search

spiffe / spire

The SPIFFE Runtime Environment
https://spiffe.io
Apache License 2.0
1.76k stars 466 forks source link

Consider supporting rotation of database credentials in the datastore #5113

Open amartinezfayo opened 3 months ago

amartinezfayo commented 3 months ago

Currently, we don't really support rotation of credentials in the datastore for database types that don't support IAM authentication. This issue is to scope the work and consider supporting of rotating the credentials in case that:

The scope of the work will depend on the database types and the authentication types that would support credentials rotation. Different database types may present different challenges, depending also on the authentication type. Support rotation of certificate authentication is probably a more clear use case than username and password, but it's worth consider all the different authentication types while looking at this.

amartinezfayo commented 3 months ago

Although it has been disabled for the specific case of the DataStore due to its particular considerations, SPIRE has now built-in support for plugin recofinguration, which means that the plumbing to support this through the update of the DataStore config is now implemented. The scope is now reduced to the implementation needed in the "sql" DataStore plugin itself.

azdagron commented 3 months ago

Just a quick note that we didn't implement DataStore reloadability, since the DataStore is handled outside of the catalog. However, it wouldn't be a hard change.