search

spiffe / spire-api-sdk

SPIRE API Service Definitions
Apache License 2.0
14 stars 33 forks source link

Support a prune RPC in the SPIRE Server's Agent API #41

Open evan2645 opened 1 year ago

evan2645 commented 1 year ago

SPIRE PR https://github.com/spiffe/spire/pull/3982 added a spire-server CLI command for pruning old agents out of the database. That work does client-side filtering of agents to determine which need pruning. During review, this was flagged and we agreed that the prune logic is best handled server-side.

Introduce and implement a new RPC to support this server-side prune feature

nweisenauer-sap commented 9 months ago

Filtering ListAgents by X509SvidExpiresAt would already be very helpful in improving performance.

Additionally, @evan2645, if the whole prune/purge command #3982 will get its own RPC, what do you think about giving it a flag/parameter to force deletion of expired agents regardless of their CanReattest property? Maybe even a parameter to specify the limit / the maximum number of entries to be pruned in one run, just to prevent unexpected load. Please consider that there is currently no other way of deleting stale entries from TOFU-based plugins (these may be expired for months or years and eventually be cleaned up with manual, risky SQL queries on the DB).