Skip to content

Fix Workload API handling of SVID renewal interval #56626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strideynet merged 1 commit into from
Jul 10, 2025
Merged

Fix Workload API handling of SVID renewal interval #56626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions lib/tbot/service_workload_identity_api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,8 +309,13 @@ func (s *WorkloadIdentityAPIService) FetchX509SVID(
if err != nil {
return trace.Wrap(err, "fetching CRL set from cache")
}
renewalInterval := cmp.Or(
s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime,
).RenewalInterval

var svids []*workloadpb.X509SVID
renewalTimer := time.NewTimer(renewalInterval)
defer renewalTimer.Stop()
for {
log.InfoContext(ctx, "Starting to issue X509 SVIDs to workload")

Expand All @@ -320,6 +325,10 @@ func (s *WorkloadIdentityAPIService) FetchX509SVID(
if err != nil {
return trace.Wrap(err)
}
// Reset our renewal timer to renew these freshly fetched SVIDs
// renewal_interval from now.
renewalTimer.Reset(renewalInterval)

// The SPIFFE Workload API (5.2.1):
//
// If the client is not entitled to receive any X509-SVIDs, then the
Expand All @@ -334,7 +343,6 @@ func (s *WorkloadIdentityAPIService) FetchX509SVID(
"workload did not pass attestation for any SVIDs",
)
}

}

resp := &workloadpb.X509SVIDResponse{
Expand Down Expand Up @@ -378,7 +386,7 @@ func (s *WorkloadIdentityAPIService) FetchX509SVID(
log.DebugContext(ctx, "CRL set has been updated, distributing to client")
crlSet = newCRLSet
continue
case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
case <-renewalTimer.C:
log.DebugContext(ctx, "Renewal interval reached, renewing SVIDs")
svids = nil
continue
Expand Down
9 changes: 8 additions & 1 deletion lib/tbot/service_workload_identity_x509.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,9 @@ func (s *WorkloadIdentityX509Service) Run(ctx context.Context) error {
if err != nil {
return trace.Wrap(err, "getting CRL set from cache")
}
renewalInterval := cmp.Or(
s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime,
).RenewalInterval

if s.statusReporter == nil {
s.statusReporter = readyz.NoopReporter()
Expand All @@ -116,6 +119,8 @@ func (s *WorkloadIdentityX509Service) Run(ctx context.Context) error {
var failures int
firstRun := make(chan struct{}, 1)
firstRun <- struct{}{}
renewalTimer := time.NewTimer(renewalInterval)
defer renewalTimer.Stop()
for {
var retryAfter <-chan time.Time
if failures > 0 {
Expand Down Expand Up @@ -155,7 +160,7 @@ func (s *WorkloadIdentityX509Service) Run(ctx context.Context) error {
}
crlSet = newCRLSet
s.log.DebugContext(ctx, "CRL set has been updated, will regenerate output")
case <-time.After(cmp.Or(s.cfg.CredentialLifetime, s.botCfg.CredentialLifetime).RenewalInterval):
case <-renewalTimer.C:
s.log.InfoContext(ctx, "Renewal interval reached, renewing SVIDs")
x509Cred = nil
privateKey = nil
Expand All @@ -170,6 +175,8 @@ func (s *WorkloadIdentityX509Service) Run(ctx context.Context) error {
failures++
continue
}
// Reset the renewal timer to the configured interval.
renewalTimer.Reset(renewalInterval)
}
if err := s.render(
ctx, bundleSet, x509Cred, privateKey, crlSet,
Expand Down
Loading