What would you like to be added?
The TTL for registry token while using ORAS with k8Secrets is hard coded to 12 hours. This is a bit problematic, since it is possible that the secret expires well before the 12h timeout in code. This leads to a 403, which then leads to a cache miss, and then does a force reload of the secret, causing things to run.
The 403 is a problem for us, because we use Ratify with Gatekeeper to deny pods.. The occasional 403 sends us false alerts, so we propose that this 12h limit be configurable. We have async processes in the background and refresh the registry token, so we can get minimize the 403s and just deal with cache misses and secret-reloads without pod admission getting denied.
Anything else you would like to add?
No response
Are you willing to submit PRs to contribute to this feature?
What would you like to be added?
The TTL for registry token while using ORAS with k8Secrets is hard coded to 12 hours. This is a bit problematic, since it is possible that the secret expires well before the 12h timeout in code. This leads to a 403, which then leads to a cache miss, and then does a force reload of the secret, causing things to run.
The 403 is a problem for us, because we use Ratify with Gatekeeper to deny pods.. The occasional 403 sends us false alerts, so we propose that this 12h limit be configurable. We have async processes in the background and refresh the registry token, so we can get minimize the 403s and just deal with cache misses and secret-reloads without pod admission getting denied.
Anything else you would like to add?
No response
Are you willing to submit PRs to contribute to this feature?