From 7c532f10bb53c8a35152fcc6c5405f81c0bfc455 Mon Sep 17 00:00:00 2001 From: Bronson Mirafuentes <30124037+heybronson@users.noreply.github.com> Date: Tue, 19 May 2026 08:00:53 -0700 Subject: [PATCH] feat(spire-server): add maxAttestedNodeInfoStaleness config option (#828) * feat(spire-server): add maxAttestedNodeInfoStaleness configuration option Wire max_attested_node_info_staleness into the spire-server ConfigMap. When unset (default ""), the SPIRE server uses its built-in default of 0s. Signed-off-by: Bronson Mirafuentes * docs: regenerate spire-server README via helm-docs.sh Fixes trailing whitespace in the maxAttestedNodeInfoStaleness table row. Signed-off-by: Bronson Mirafuentes --------- Signed-off-by: Bronson Mirafuentes --- charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 5b76907..c1b6133 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -409,6 +409,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` | | `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` | | `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` | +| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | | `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 9fd4e76..eb5f784 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -73,6 +73,9 @@ server: {{- if .Values.pruneTOFUNodes }} prune_tofu_nodes: {{ .Values.pruneTOFUNodes }} {{- end }} + {{- if .Values.maxAttestedNodeInfoStaleness }} + max_attested_node_info_staleness: {{ .Values.maxAttestedNodeInfoStaleness | quote }} + {{- end }} ca_subject: - country: [{{ include "spire-server.ca-subject-country" . | quote }}] diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f4677b7..a26a598 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1009,6 +1009,8 @@ rateLimit: pruneAttestedNodesExpiredFor: "" ## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. pruneTOFUNodes: false +## @param maxAttestedNodeInfoStaleness How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). +maxAttestedNodeInfoStaleness: "" nodeAttestor: k8sPSAT: