From 9bdfc10ffe3fc5db3f9d695a8fc9a2695b02aaed Mon Sep 17 00:00:00 2001 From: Bronson Mirafuentes <30124037+heybronson@users.noreply.github.com> Date: Thu, 14 May 2026 13:18:56 -0700 Subject: [PATCH] wire ratelimit configuration option in spire-server configMap (#826) * feat(spire-server): add ratelimit.attestation and ratelimit.signing values Signed-off-by: Bronson Mirafuentes * feat(spire-server): render ratelimit block in server config from values Signed-off-by: Bronson Mirafuentes * chore: bump spire-server and spire chart versions for ratelimit feature Signed-off-by: Bronson Mirafuentes * revert version bumps, use camelcase for rateLimit Signed-off-by: Bronson Mirafuentes * update readme Signed-off-by: Bronson Mirafuentes --------- Signed-off-by: Bronson Mirafuentes Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 2 ++ charts/spire/charts/spire-server/templates/configmap.yaml | 5 +++++ charts/spire/charts/spire-server/values.yaml | 6 ++++++ 3 files changed, 13 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index e8ae52c..5b76907 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -405,6 +405,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | +| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` | +| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` | | `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` | | `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 283ae7c..9fd4e76 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -120,6 +120,11 @@ server: {{- end }} {{- end }} {{- end }} + {{- with .Values.rateLimit }} + ratelimit: + attestation: {{ .attestation }} + signing: {{ .signing }} + {{- end }} plugins: {{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 1fbb497..f4677b7 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -999,6 +999,12 @@ defaultX509SvidTTL: 4h ## @param defaultJwtSvidTTL TTL for JWT Svids defaultJwtSvidTTL: 1h +## @param rateLimit.attestation Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. +## @param rateLimit.signing Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. +rateLimit: + attestation: true + signing: true + ## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. pruneAttestedNodesExpiredFor: "" ## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.