x509 cache hint for registration entries by ValFadeev · Pull Request #6360 · spiffe/spire

ValFadeev · 2025-10-06T22:21:01Z

This is a draft PR aiming to implement some of the suggestions discussed in #6129. It adds a new field to RegisteredEntry represented by an opaque protobuf-encoded message. The message is meant to contain flags and other fields guiding the agent's behavior with respect to pre-fetching and caching of X509 SVIDs. The intention is to reduce unnecessary work performed by the agent, in case the client is unlikely to ever ask for an X509 SVID and prefers JWT instead. For now only one boolean flag JWTOnly is introduced. Other fields may be added later to fine-tune the logic and cover various edge-cases.
The bulk of this draft is to define the new field in the message definition, update the datastore and have the existing tests pass. The actual usage of the field in fetchEntries is purely indicative and requires further consideration.

Pull Request check list

Commit conforms to CONTRIBUTING.md?
Proper tests/regressions included?
Documentation updated?

Affected functionality

adds a new field to RegisteredEntry and the underlying datastore table
allows flagging registration entries as preferring JWT SVID over X509
Description of change

Which issue this PR fixes

Fixes #6129

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

proto/spire/common/common.proto

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

amartinezfayo · 2025-11-13T19:44:08Z

Hi @ValFadeev, are you planning to go back to this PR?

ValFadeev · 2025-11-16T22:42:53Z

Hi @amartinezfayo, apologies for the delay. I had a few conflicting priorities lately, but I do plan to pick this back up over the coming week.

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev · 2025-11-30T23:05:06Z

@amartinezfayo offering this for another review. I am not sure I implemented the semantics of an optional field the right way when loading from row. I also understand this change may have to be split in two, with the schema migration going first. But hopefully, this gives an outline of the functionality, as it was last described.

sorindumitru · 2025-12-16T12:56:09Z

pkg/agent/manager/sync.go

+			if !entry.CacheHintFlags.GetDisableX509SvidPrefetch() {
+				cacheEntries[entryID] = entry
+			}


This would mean that the entry is not added to the cache, which means that no workload would be able to request a SVID for it. I think the flag should end up in the lru cache where it can inform if the entry needs to prefetched or not but still allow a workload to request an x509-svid if it so desires.

I think syncSVIDsWithSubscribers might be the place to do this.

pkg/server/datastore/sqlstore/sqlstore.go

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru · 2026-01-22T19:20:33Z

I think you'll also need to make changes to the Entry type in spire-api-sdk for the agent to get and be able to use the new field.

sorindumitru · 2026-01-22T19:22:42Z

proto/spire/common/common.proto

+    /** Represents a set of flags informing the agent behaviour with respect to
+    pre-fecthing and caching SVIDs. This is meant to prevent unnecessary effort
+    spent on generating SVIDs of types, which are unlikely to be needed. */
+    message CacheHintFlags {


Since we're likely going to use this even for non-flag fields, could we call it something else? Nothing better than OptionalFields comes to me right now, let me know if you have other suggestions.

I would say something like AdditionalAttributes. This is to distinguish them from optional fields in the containing struct, such as Expiry.

sorindumitru · 2026-01-22T19:25:12Z

pkg/server/datastore/sqlstore/models.go

+
+	// CacheHintFlags contains a set of options and flags that inform the
+	// agent behaviour with respect to pre-fetching and refreshing X509 SVIDs
+	CacheHintFlags []byte `gorm:"size:255,column:cache_hint_flags"` // corresponds to TINYBLOB in MySQL


Since we may end up having other bigger fields in there, maybe we can go one size up to have some more space? I think that would be size:65535

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev · 2026-01-22T23:04:56Z

pkg/server/datastore/sqlstore/migration.go

 func migrateToV24(tx *gorm.DB) error {
-	// Add agent_version column to attested_node_entries table
-	if err := tx.AutoMigrate(&AttestedNode{}).Error; err != nil {
+	if err := tx.AutoMigrate(&AttestedNode{}, &RegisteredEntry{}).Error; err != nil {


Since there is currently no released version between my changes and #6542, I am temporarily combining migrations here to have tests pass. Once 1.14.2 is released, I will only leave my table and increment the version.

Usually we seemed to have created independent migrations for different data store changes. I think they're not strictly speaking needed, but they might be useful for the case of local development.

This still needs to be addressed.

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru

Thanks for these changes, @ValFadeev. Are you also planning on adding support for this to the CLI?

sorindumitru · 2026-02-07T14:09:01Z

pkg/server/datastore/sqlstore/migration.go

 func migrateToV24(tx *gorm.DB) error {
-	// Add agent_version column to attested_node_entries table
-	if err := tx.AutoMigrate(&AttestedNode{}).Error; err != nil {
+	if err := tx.AutoMigrate(&AttestedNode{}, &RegisteredEntry{}).Error; err != nil {


Usually we seemed to have created independent migrations for different data store changes. I think they're not strictly speaking needed, but they might be useful for the case of local development.

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru

It would be good to also add something to the intergration tests to verify that these entries are not prefetching SVIDs. Maybe that's possible in the entries test, e.g. by creating a entry at the start of that script and making sure at the end it the agent(s) didn't prefetch it?

I think you're also missing some changes to pkg/agent/client.go to specify the new field in the mask and possibly to parse it.

sorindumitru · 2026-02-14T15:59:07Z

cmd/spire-server/cli/entry/create.go

+	additionalAttributes := &types.Entry_AdditionalAttributes{}
+	additionalAttributes.DisableX509SvidPrefetch = c.disableX509SVIDPrefetch
+	e.AdditionalAttributes = additionalAttributes


Could we only create the additional attributes if one of the attributes in it is defined? Would avoid having to parse the whole field.

sorindumitru · 2026-02-14T16:11:29Z

pkg/server/api/entry.go

+func ProtoFromAdditionalAttributes(in *common.RegistrationEntry_AdditionalAttributes) *types.Entry_AdditionalAttributes {
+	if in != nil {
+		return &types.Entry_AdditionalAttributes{
+			DisableX509SvidPrefetch: in.DisableX509SvidPrefetch,
+		}
+	}
+	return nil


I think we would also need a similar item for doing the reverse, and it should be used in ProtoToRegistrationEntryWithMask.

sorindumitru · 2026-02-14T16:14:10Z

pkg/server/datastore/sqlstore/migration.go

 func migrateToV24(tx *gorm.DB) error {
-	// Add agent_version column to attested_node_entries table
-	if err := tx.AutoMigrate(&AttestedNode{}).Error; err != nil {
+	if err := tx.AutoMigrate(&AttestedNode{}, &RegisteredEntry{}).Error; err != nil {


This still needs to be addressed.

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

drafted x509 cache hint for registration entries

1dba0ae

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru reviewed Oct 7, 2025

View reviewed changes

proto/spire/common/common.proto Outdated Show resolved Hide resolved

ValFadeev added 2 commits October 11, 2025 21:10

renamed fields as per review comments

72289e3

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

fixed existing tests

3f71b9f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev added 7 commits November 25, 2025 22:41

Merge branch 'main' into jwt-preference-entry

b6b449a

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

removed unused linter directive

1c93083

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

undid drive-by formatting

660f5d1

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

removed unused linter directive

086383f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

corrected check for missing value when mapping from model

3776a45

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

increment schema version to trigger migration

8daf8d7

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

added migration test

33440fc

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev force-pushed the jwt-preference-entry branch from a3460c8 to 33440fc Compare November 27, 2025 22:51

ValFadeev added 3 commits November 27, 2025 23:10

added test data entries

2fb8b6d

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

updated test helper

ac9b01f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

conditionally populate cache hint flags from row

ab0b8e9

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev changed the title ~~[WIP] - x509 cache hint for registration entries~~ x509 cache hint for registration entries Nov 30, 2025

ValFadeev marked this pull request as ready for review November 30, 2025 21:59

ValFadeev requested review from MarcosDY, amartinezfayo, evan2645 and rturner3 as code owners November 30, 2025 21:59

ValFadeev requested a review from sorindumitru November 30, 2025 21:59

ValFadeev marked this pull request as draft November 30, 2025 22:02

amartinezfayo assigned sorindumitru Dec 11, 2025

sorindumitru reviewed Dec 16, 2025

View reviewed changes

sorindumitru mentioned this pull request Dec 30, 2025

JWT JTI Attribute #6043

Open

applied suggestion to error message

88fa1db

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev added 5 commits January 21, 2026 23:07

Merge branch 'main' into jwt-preference-entry

183e6b5

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

incremented schema version for migration

16ad462

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

corrected typo in version

921edcf

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

excluded records from cache

13e0d30

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

updated migrations and tests

19935b9

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru reviewed Jan 22, 2026

View reviewed changes

ValFadeev marked this pull request as ready for review January 22, 2026 22:31

ValFadeev added 2 commits January 22, 2026 22:52

increased size of the blob

c4508f2

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

checked if hints exist

478a81f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev commented Jan 22, 2026

View reviewed changes

ValFadeev added 4 commits January 22, 2026 23:27

added unit test for DisableX509SvidPrefetch

4caec66

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

renamed new field to additional attributes

7f1e2b4

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

Merge branch 'main' into jwt-preference-entry

bc6a28f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

updated description of the message

fac8325

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev mentioned this pull request Jan 25, 2026

Add new optional fields to Entry type spiffe/spire-api-sdk#88

Open

ValFadeev added 2 commits January 26, 2026 23:18

fixed assertion

86e81c2

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

updated model field description

fb49792

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru reviewed Feb 7, 2026

View reviewed changes

ValFadeev added 2 commits February 11, 2026 17:36

added cli support for additional attributes

cd33b7e

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

added disableX509SVIDPrefetch to server cli docs

d1db089

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

ValFadeev requested a review from sorindumitru February 11, 2026 18:09

addressed linter finding

29b19e0

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

sorindumitru reviewed Feb 14, 2026

View reviewed changes

ValFadeev added 5 commits February 17, 2026 16:39

create additional attributes conditionally

187da05

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

updated integration test to check cached svids

3ae4ecc

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

created a separate migration for registration entries

d156b8f

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

Merge branch 'main' into jwt-preference-entry

dfec897

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

fixed quoting in test fixture

6bff39a

Signed-off-by: Valentin Fadeev <vfadeev@bloomberg.net>

Conversation

ValFadeev commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

amartinezfayo commented Nov 13, 2025

Uh oh!

ValFadeev commented Nov 16, 2025

Uh oh!

ValFadeev commented Nov 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sorindumitru commented Jan 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sorindumitru left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sorindumitru left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

ValFadeev commented Oct 6, 2025 •

edited

Loading