Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support a prune RPC in the SPIRE Server's Agent API #41

Open
evan2645 opened this issue May 9, 2023 · 1 comment
Open

Support a prune RPC in the SPIRE Server's Agent API #41

evan2645 opened this issue May 9, 2023 · 1 comment

Comments

@evan2645
Copy link
Member

evan2645 commented May 9, 2023

SPIRE PR spiffe/spire#3982 added a spire-server CLI command for pruning old agents out of the database. That work does client-side filtering of agents to determine which need pruning. During review, this was flagged and we agreed that the prune logic is best handled server-side.

Introduce and implement a new RPC to support this server-side prune feature

@nweisenauer-sap
Copy link

nweisenauer-sap commented Jan 12, 2024

Filtering ListAgents by X509SvidExpiresAt would already be very helpful in improving performance.

Additionally, @evan2645, if the whole prune/purge command #3982 will get its own RPC, what do you think about giving it a flag/parameter to force deletion of expired agents regardless of their CanReattest property? Maybe even a parameter to specify the limit / the maximum number of entries to be pruned in one run, just to prevent unexpected load.
Please consider that there is currently no other way of deleting stale entries from TOFU-based plugins (these may be expired for months or years and eventually be cleaned up with manual, risky SQL queries on the DB).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants