wire ratelimit configuration option in spire-server configMap (#826)
* feat(spire-server): add ratelimit.attestation and ratelimit.signing values Signed-off-by: Bronson Mirafuentes <[email protected]> * feat(spire-server): render ratelimit block in server config from values Signed-off-by: Bronson Mirafuentes <[email protected]> * chore: bump spire-server and spire chart versions for ratelimit feature Signed-off-by: Bronson Mirafuentes <[email protected]> * revert version bumps, use camelcase for rateLimit Signed-off-by: Bronson Mirafuentes <[email protected]> * update readme Signed-off-by: Bronson Mirafuentes <[email protected]> --------- Signed-off-by: Bronson Mirafuentes <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Bronson Mirafuentes
co-authored by
kfox1111
kfox1111
parent
806c6ae59e
commit
9bdfc10ffe
@@ -405,6 +405,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
||||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||||
|
| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` |
|
||||||
|
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
|
||||||
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
||||||
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
||||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
||||||
|
|||||||
@@ -120,6 +120,11 @@ server:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.rateLimit }}
|
||||||
|
ratelimit:
|
||||||
|
attestation: {{ .attestation }}
|
||||||
|
signing: {{ .signing }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
plugins:
|
plugins:
|
||||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
||||||
|
|||||||
@@ -999,6 +999,12 @@ defaultX509SvidTTL: 4h
|
|||||||
## @param defaultJwtSvidTTL TTL for JWT Svids
|
## @param defaultJwtSvidTTL TTL for JWT Svids
|
||||||
defaultJwtSvidTTL: 1h
|
defaultJwtSvidTTL: 1h
|
||||||
|
|
||||||
|
## @param rateLimit.attestation Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable.
|
||||||
|
## @param rateLimit.signing Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery.
|
||||||
|
rateLimit:
|
||||||
|
attestation: true
|
||||||
|
signing: true
|
||||||
|
|
||||||
## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
|
## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
|
||||||
pruneAttestedNodesExpiredFor: ""
|
pruneAttestedNodesExpiredFor: ""
|
||||||
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
|
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
|
||||||
|
|||||||
Reference in New Issue
Block a user