RFD191: Rework Workload Identity Configuration and RBAC UX #49133
Conversation
|
Ready for first pass opinions on this. |
Co-authored-by: Tim Buckley <[email protected]>
…nal/teleport into rfd/191-workload-id-config-ux
|
I think largely, we need to ask design partners about the types of rules they would write, and understand how they'd prefer to express these. Generally, it seems like option 1 and option 3 are the most sensible to move forward with. Option 2 seems to push the complexity of what's reasonable in YAML and causes problems for generation of IaC due to recursion. |
|
@thedevelopnik / @timothyb89 please take another look. |
strideynet
added
the
no-changelog
| TTL will be capped at this value. This provides the ability to enforce a | ||
| maximum permissible TTL regardless of the configuration of the `tbot` agent. | ||
|
|
||
| If this field is not set, a default maximum value of 24 hours will be used. |
There was a problem hiding this comment.
Do we / the SPIFFE spec define an upper limit to the TTL, or is it arbitrary?
There was a problem hiding this comment.
SPIFFE doesn't specify anything. Across the rest of Teleport we do have some limits, but, I'm leaning towards that we may want to relax these for Workload Identity in order to support some more niche use-cases.
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
Related to #44006