panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(spire-server): add maxAttestedNodeInfoStaleness config option (#828)

Browse Source 
* feat(spire-server): add maxAttestedNodeInfoStaleness configuration option

Wire max_attested_node_info_staleness into the spire-server ConfigMap.
When unset (default ""), the SPIRE server uses its built-in default of 0s.

Signed-off-by: Bronson Mirafuentes <[email protected]>

* docs: regenerate spire-server README via helm-docs.sh

Fixes trailing whitespace in the maxAttestedNodeInfoStaleness table row.

Signed-off-by: Bronson Mirafuentes <[email protected]>

---------

Signed-off-by: Bronson Mirafuentes <[email protected]>
This commit is contained in:
Bronson Mirafuentes
2026-05-19 08:00:53 -07:00
committed by GitHub
parent 7f4377f4b0
commit 7c532f10bb
3 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -409,6 +409,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` | | `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` | | `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` | | `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
charts/spire/charts/spire-server/templates/configmap.yaml
+3
View File
@@ -73,6 +73,9 @@ server:
{{- if .Values.pruneTOFUNodes }} {{- if .Values.pruneTOFUNodes }}
prune_tofu_nodes: {{ .Values.pruneTOFUNodes }} prune_tofu_nodes: {{ .Values.pruneTOFUNodes }}
{{- end }} {{- end }}
{{- if .Values.maxAttestedNodeInfoStaleness }}
max_attested_node_info_staleness: {{ .Values.maxAttestedNodeInfoStaleness | quote }}
{{- end }}
ca_subject: ca_subject:
- country: [{{ include "spire-server.ca-subject-country" . | quote }}] - country: [{{ include "spire-server.ca-subject-country" . | quote }}]
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -1009,6 +1009,8 @@ rateLimit:
pruneAttestedNodesExpiredFor: "" pruneAttestedNodesExpiredFor: ""
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. ## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
pruneTOFUNodes: false pruneTOFUNodes: false
## @param maxAttestedNodeInfoStaleness How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m").
maxAttestedNodeInfoStaleness: ""
nodeAttestor: nodeAttestor:
k8sPSAT: k8sPSAT: