panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

set refresh hint to 1/3 of default CA TTL value fixes #335 (#343)

Browse Source 
Signed-off-by: Drew Wells <[email protected]>
This commit is contained in:
Drew Wells
2024-05-02 13:24:51 -07:00
committed by GitHub
parent f8fd46a28d
commit ee124042c2
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -147,6 +147,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.enabled` | Flag to enable federation | `false` | | `federation.enabled` | Flag to enable federation | `false` |
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | | `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
| `federation.bundleEndpoint.refresh_hint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` | | `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` | | `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -210,6 +210,8 @@ federation:
port: 8443 port: 8443
## @param federation.bundleEndpoint.address Address for trust bundle federation ## @param federation.bundleEndpoint.address Address for trust bundle federation
address: "0.0.0.0" address: "0.0.0.0"
## @param federation.bundleEndpoint.refresh_hint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.
refresh_hint: "5m"
tls: tls:
spire: spire: