Open amartinezfayo opened 3 months ago
Although it has been disabled for the specific case of the DataStore due to its particular considerations, SPIRE has now built-in support for plugin recofinguration, which means that the plumbing to support this through the update of the DataStore config is now implemented. The scope is now reduced to the implementation needed in the "sql" DataStore plugin itself.
Just a quick note that we didn't implement DataStore reloadability, since the DataStore is handled outside of the catalog. However, it wouldn't be a hard change.
Currently, we don't really support rotation of credentials in the datastore for database types that don't support IAM authentication. This issue is to scope the work and consider supporting of rotating the credentials in case that:
The scope of the work will depend on the database types and the authentication types that would support credentials rotation. Different database types may present different challenges, depending also on the authentication type. Support rotation of certificate authentication is probably a more clear use case than username and password, but it's worth consider all the different authentication types while looking at this.