spiffe / spire

The SPIFFE Runtime Environment
https://spiffe.io
Apache License 2.0
1.81k stars 478 forks source link

spire-agent: limit JWT-SVID cache size #5633

Closed sorindumitru closed 4 days ago

sorindumitru commented 2 weeks ago

Pull Request check list

Affected functionality spire-agent JWT-SVID cache

Description of change This PR makes the maximum size of the JWT-SVID cache in spire-agent configurable. This avoid the cache becoming too large and using too much memory. When the cache becomes too big, the least recently used JWT-SVID is evicted.

There's more improvements that can be made here. We could also periodically try to evict expired tokens, since tokens can have different TTLs. Opening this for now to see if that's a desired behaviour.

Which issue this PR fixes fixes #4891