yes that s what rotated this time Any
# spicedbm
mgagliardo
07/18/2023, 6:04 PMyes, that's what rotated this time. Any reason why it wouldn't pick up that change?
e
ecordell
07/18/2023, 6:12 PMIt's just not implemented; the the go grpc / tls toolchain provides a nice callback for updating the certs but not the CAs, so it's a little bit more work that we just haven't done yet
What we do is sign (internal only) CAs for that are valid for 2 years but rotate every year. Then spicedb just needs to be restarted once a year, which happens anyway for updates / maintenance.
if something like that wouldn't work for you we can file an issue to support watching the CA as well?
ecordell
07/18/2023, 6:15 PM> The remainder of our services watch the mounted cert file for changes and pick them up in real-time to avoid any lapse in cert expiry
are any of these services in go? if there's some nice middleware that we could drop in and get CA watching for free we would definitely consider it
m
mgagliardo
07/18/2023, 6:26 PMI can talk to our ops team about extending the expiry on the CA for now, but yea I think the best bet would be just supporting rotating CAs as well if thats something I can get into an issue.
Most of our services are in node and we are just using a directory watcher for the mounted certs, and re-initializing clients as necessary
mgagliardo
07/18/2023, 6:42 PM@ecordell would this be an issue for the operator or spicedb directly?
e
ecordell
07/18/2023, 6:42 PMspicedb directly
m
mgagliardo
07/18/2023, 6:47 PMthanks 🙏
mgagliardo
07/18/2023, 6:51 PM8 Views