canonical / microcluster

dqlite cluster management using go-dqlite
GNU Affero General Public License v3.0
22 stars 26 forks source link

Add join token expiration #199

Closed masnax closed 1 month ago

masnax commented 1 month ago

Join tokens exist forever after creation. Instead, we should have some mechanism to expire tokens after a user-specified period of time.

This means updating the join token configuration here to take a timeout.

There are a few nuances here like changing the schema to expect an initial creation date for tokens.

masnax commented 1 month ago

I'm not sure how LXD handles image expiry, but I'm thinking in microcluster a good place to handle this would be when issuing a heartbeat.

masnax commented 1 month ago

There's also the matter of deciding if we want a sensible default expiration, like 10 minutes per token by default.

MggMuggins commented 1 month ago

https://documentation.ubuntu.com/lxd/en/latest/server/#server-core:core.remote_token_expiry https://documentation.ubuntu.com/lxd/en/latest/server/#server-cluster:cluster.join_token_expiry