Add preferred_ttl field to SVID.NewDownstreamX509CA (#60)

This field will facilitate using the downstream CA TTL configuration as a sane default for the downstream intermediate CA cert lifetime. See SPIRE issue #5236. Also removed an unused import. Signed-off-by: Andrew Harding <[email protected]>
spiffe · Aug 1, 2024 · 4cd2aac · 4cd2aac
1 parent 3fa5737
commit 4cd2aac
Show file tree

Hide file tree

Showing 4 changed files with 71 additions and 57 deletions.
diff --git a/proto/spire/api/server/svid/v1/svid.pb.go b/proto/spire/api/server/svid/v1/svid.pb.go
diff --git a/proto/spire/api/server/svid/v1/svid.proto b/proto/spire/api/server/svid/v1/svid.proto
@@ -115,6 +115,11 @@ message NewDownstreamX509CARequest {
     // CSR is only used to convey the public key; other fields in the CSR are
     // ignored. The X509-SVID attributes are determined by the downstream entry.
     bytes csr = 1;
+
+    // Optional. The TTL preferred by the downstream SPIRE Server for the
+    // signed intermediate CA. If zero, the upstream SPIRE Server will use its
+    // own default.
+    int32 preferred_ttl = 2;
 }
 
 message NewDownstreamX509CAResponse {

diff --git a/proto/spire/api/types/logger.pb.go b/proto/spire/api/types/logger.pb.go
diff --git a/proto/spire/api/types/logger.proto b/proto/spire/api/types/logger.proto
@@ -2,8 +2,6 @@ syntax = "proto3";
 package spire.api.types;
 option go_package = "github.com/spiffe/spire-api-sdk/proto/spire/api/types";
 
-import "google/protobuf/wrappers.proto";
-
 // The logger log levels.
 enum LogLevel {
 	UNSPECIFIED = 0;