-
Epic
-
Resolution: Done
-
Critical
-
None
-
None
-
Periodic continous refresh strategy for ignition server token
-
BU Product Work
-
False
-
False
-
Done
-
OCPSTRAT-326 - Implement HyperShift Infrastructure & Machine Management Models
-
-
0% To Do, 0% In Progress, 100% Done
-
0
-
0
-
0
https://github.com/openshift/hypershift/issues/364
The token should periodically be refreshed on an interval and ultimately old tokens revoked. This provides a secure system overtime and limits the time a exposed secret is active for.
General idea:
- Create new token after some time and use that in userdata secret
- After some time has passed (gives enough time for in flight workers to bootstrap) remove old token.