set refresh hint to 1/3 of default CA TTL value fixes #335 (#343)

Signed-off-by: Drew Wells <[email protected]>
2024-05-02 13:24:51 -07:00
parent f8fd46a28d
commit ee124042c2
2 changed files with 4 additions and 1 deletions
@@ -210,6 +210,8 @@ federation:
    port: 8443
    ## @param federation.bundleEndpoint.address Address for trust bundle federation
    address: "0.0.0.0"
+    ## @param federation.bundleEndpoint.refresh_hint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.
+    refresh_hint: "5m"

  tls:
    spire:
@@ -877,7 +879,7 @@ tornjak:
      issuer: ""
      ## @param tornjak.config.userManagement.audience UserManagement audience check
      audience: ""
-      
+
    # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
    # The connections are determined based on provided configuration
    # When `tlsSecret` is created in this chart namespace, the TLS connection is started