x509 cache hint for registration entries

cmd/spire-server/cli/entry/create.go

@@ -74,6 +74,10 @@ type createCommand struct {
 	// storeSVID determines if the issued SVID must be stored through an SVIDStore plugin
 	storeSVID bool
 
+	// disableX509SVIDPrefetch tells the agent not to prefetch and cache X509 SVID for
+	// the given entry
+	disableX509SVIDPrefetch bool
+
 	printer cliprinter.Printer
 
 	env *commoncli.Env
@@ -103,6 +107,7 @@ func (c *createCommand) AppendFlags(f *flag.FlagSet) {
 	f.Int64Var(&c.entryExpiry, "entryExpiry", 0, "An expiry, from epoch in seconds, for the resulting registration entry to be pruned")
 	f.Var(&c.dnsNames, "dns", "A DNS name that will be included in SVIDs issued based on this entry, where appropriate. Can be used more than once")
 	f.StringVar(&c.hint, "hint", "", "The entry hint, used to disambiguate entries with the same SPIFFE ID")
+	f.BoolVar(&c.disableX509SVIDPrefetch, "disableX509SVIDPrefetch", false, "A boolean value that, when set, disables prefetching X509 SVID for this entry")
 	cliprinter.AppendFlagWithCustomPretty(&c.printer, f, c.env, prettyPrintCreate)
 }
 
@@ -209,8 +214,14 @@ func (c *createCommand) parseConfig() ([]*types.Entry, error) {
 
 		selectors = append(selectors, cs)
 	}
-
 	e.Selectors = selectors
+
+	if c.disableX509SVIDPrefetch {
+		e.AdditionalAttributes = &types.Entry_AdditionalAttributes{
+			DisableX509SvidPrefetch: c.disableX509SVIDPrefetch,
+		}
+	}
+
 	e.FederatesWith = c.federatesWith
 	e.Admin = c.admin
 	return []*types.Entry{e}, nil

cmd/spire-server/cli/entry/create_test.go

@@ -44,7 +44,10 @@ func TestCreate(t *testing.T) {
 					DnsNames:      []string{"unu1000", "ung1000"},
 					Downstream:    true,
 					StoreSvid:     true,
-					CreatedAt:     1547583197,
+					AdditionalAttributes: &types.Entry_AdditionalAttributes{
+						DisableX509SvidPrefetch: true,
+					},
+					CreatedAt: 1547583197,
 				},
 				Status: &types.Status{
 					Code:    int32(codes.OK),
@@ -93,7 +96,10 @@ func TestCreate(t *testing.T) {
 					X509SvidTtl: 200,
 					JwtSvidTtl:  30,
 					Admin:       true,
-					CreatedAt:   1547583197,
+					AdditionalAttributes: &types.Entry_AdditionalAttributes{
+						DisableX509SvidPrefetch: false,
+					},
+					CreatedAt: 1547583197,
 				},
 				Status: &types.Status{
 					Code:    int32(codes.OK),
@@ -109,7 +115,10 @@ func TestCreate(t *testing.T) {
 					X509SvidTtl: 200,
 					JwtSvidTtl:  30,
 					Hint:        "internal",
-					CreatedAt:   1547583197,
+					AdditionalAttributes: &types.Entry_AdditionalAttributes{
+						DisableX509SvidPrefetch: false,
+					},
+					CreatedAt: 1547583197,
 				},
 				Status: &types.Status{
 					Code:    int32(codes.OK),
@@ -128,7 +137,29 @@ func TestCreate(t *testing.T) {
 					StoreSvid:   true,
 					X509SvidTtl: 200,
 					JwtSvidTtl:  30,
-					CreatedAt:   1547583197,
+					AdditionalAttributes: &types.Entry_AdditionalAttributes{
+						DisableX509SvidPrefetch: false,
+					},
+					CreatedAt: 1547583197,
+				},
+				Status: &types.Status{
+					Code:    int32(codes.OK),
+					Message: "OK",
+				},
+			},
+			{
+				Entry: &types.Entry{
+					Id:          "entry-id-4",
+					SpiffeId:    &types.SPIFFEID{TrustDomain: "example.org", Path: "/additionalattr"},
+					ParentId:    &types.SPIFFEID{TrustDomain: "example.org", Path: "/spire/agent/join_token/TokenBlog"},
+					Selectors:   []*types.Selector{{Type: "unix", Value: "uid:1111"}},
+					X509SvidTtl: 200,
+					JwtSvidTtl:  30,
+					Admin:       true,
+					AdditionalAttributes: &types.Entry_AdditionalAttributes{
+						DisableX509SvidPrefetch: true,
+					},
+					CreatedAt: 1547583197,
 				},
 				Status: &types.Status{
 					Code:    int32(codes.OK),
@@ -235,6 +266,7 @@ func TestCreate(t *testing.T) {
 				"-downstream",
 				"-storeSVID",
 				"-hint", "internal",
+				"-disableX509SVIDPrefetch",
 			},
 			expReq: &entryv1.BatchCreateEntryRequest{
 				Entries: []*types.Entry{
@@ -254,27 +286,30 @@ func TestCreate(t *testing.T) {
 						Downstream:    true,
 						StoreSvid:     true,
 						Hint:          "internal",
+						AdditionalAttributes: &types.Entry_AdditionalAttributes{
+							DisableX509SvidPrefetch: true,
+						},
 					},
 				},
 			},
 			fakeResp: fakeRespOKFromCmd,
-			expOutPretty: fmt.Sprintf(`Entry ID         : entry-id
-SPIFFE ID        : spiffe://example.org/workload
-Parent ID        : spiffe://example.org/parent
-Revision         : 0
-Downstream       : true
-X509-SVID TTL    : 60
-JWT-SVID TTL     : 30
-Expiration time  : %s
-Selector         : zebra:zebra:2000
-Selector         : alpha:alpha:2000
-FederatesWith    : spiffe://domaina.test
-FederatesWith    : spiffe://domainb.test
-DNS name         : unu1000
-DNS name         : ung1000
-Admin            : true
-StoreSvid        : true
-
+			expOutPretty: fmt.Sprintf(`Entry ID                : entry-id
+SPIFFE ID               : spiffe://example.org/workload
+Parent ID               : spiffe://example.org/parent
+Revision                : 0
+Downstream              : true
+X509-SVID TTL           : 60
+JWT-SVID TTL            : 30
+Expiration time         : %s
+Selector                : zebra:zebra:2000
+Selector                : alpha:alpha:2000
+FederatesWith           : spiffe://domaina.test
+FederatesWith           : spiffe://domainb.test
+DNS name                : unu1000
+DNS name                : ung1000
+Admin                   : true
+StoreSvid               : true
+DisableX509SvidPrefetch : true
 `, time.Unix(1552410266, 0).UTC()),
 			expOutJSON: `{
   "results": [
@@ -319,7 +354,10 @@ StoreSvid        : true
         ],
         "revision_number": "0",
         "store_svid": true,
-        "jwt_svid_ttl": 30
+        "jwt_svid_ttl": 30,
+		"additional_attributes": {
+		  "disable_x509_svid_prefetch": true
+		}
       }
     }
   ]
@@ -365,22 +403,22 @@ StoreSvid        : true
 				},
 			},
 			fakeResp: fakeRespOKFromCmdWithoutJwtTtl,
-			expOutPretty: fmt.Sprintf(`Entry ID         : entry-id
-SPIFFE ID        : spiffe://example.org/workload
-Parent ID        : spiffe://example.org/parent
-Revision         : 0
-Downstream       : true
-X509-SVID TTL    : 60
-JWT-SVID TTL     : default
-Expiration time  : %s
-Selector         : zebra:zebra:2000
-Selector         : alpha:alpha:2000
-FederatesWith    : spiffe://domaina.test
-FederatesWith    : spiffe://domainb.test
-DNS name         : unu1000
-DNS name         : ung1000
-Admin            : true
-StoreSvid        : true
+			expOutPretty: fmt.Sprintf(`Entry ID                : entry-id
+SPIFFE ID               : spiffe://example.org/workload
+Parent ID               : spiffe://example.org/parent
+Revision                : 0
+Downstream              : true
+X509-SVID TTL           : 60
+JWT-SVID TTL            : default
+Expiration time         : %s
+Selector                : zebra:zebra:2000
+Selector                : alpha:alpha:2000
+FederatesWith           : spiffe://domaina.test
+FederatesWith           : spiffe://domainb.test
+DNS name                : unu1000
+DNS name                : ung1000
+Admin                   : true
+StoreSvid               : true
 
 `, time.Unix(1552410266, 0).UTC()),
 			expOutJSON: `{
@@ -466,36 +504,57 @@ StoreSvid        : true
 						JwtSvidTtl:  30,
 						StoreSvid:   true,
 					},
+					{
+						SpiffeId:    &types.SPIFFEID{TrustDomain: "example.org", Path: "/additionalattr"},
+						ParentId:    &types.SPIFFEID{TrustDomain: "example.org", Path: "/spire/agent/join_token/TokenBlog"},
+						Selectors:   []*types.Selector{{Type: "unix", Value: "uid:1111"}},
+						X509SvidTtl: 200,
+						JwtSvidTtl:  30,
+						Admin:       true,
+						AdditionalAttributes: &types.Entry_AdditionalAttributes{
+							DisableX509SvidPrefetch: true,
+						},
+					},
 				},
 			},
 			fakeResp: fakeRespOKFromFile,
-			expOutPretty: `Entry ID         : entry-id-1
-SPIFFE ID        : spiffe://example.org/Blog
-Parent ID        : spiffe://example.org/spire/agent/join_token/TokenBlog
-Revision         : 0
-X509-SVID TTL    : 200
-JWT-SVID TTL     : 30
-Selector         : unix:uid:1111
-Admin            : true
+			expOutPretty: `Entry ID                : entry-id-1
+SPIFFE ID               : spiffe://example.org/Blog
+Parent ID               : spiffe://example.org/spire/agent/join_token/TokenBlog
+Revision                : 0
+X509-SVID TTL           : 200
+JWT-SVID TTL            : 30
+Selector                : unix:uid:1111
+Admin                   : true
+
+Entry ID                : entry-id-2
+SPIFFE ID               : spiffe://example.org/Database
+Parent ID               : spiffe://example.org/spire/agent/join_token/TokenDatabase
+Revision                : 0
+X509-SVID TTL           : 200
+JWT-SVID TTL            : 30
+Selector                : unix:uid:1111
+Hint                    : internal
 
-Entry ID         : entry-id-2
-SPIFFE ID        : spiffe://example.org/Database
-Parent ID        : spiffe://example.org/spire/agent/join_token/TokenDatabase
-Revision         : 0
-X509-SVID TTL    : 200
-JWT-SVID TTL     : 30
-Selector         : unix:uid:1111
-Hint             : internal
+Entry ID                : entry-id-3
+SPIFFE ID               : spiffe://example.org/storesvid
+Parent ID               : spiffe://example.org/spire/agent/join_token/TokenDatabase
+Revision                : 0
+X509-SVID TTL           : 200
+JWT-SVID TTL            : 30
+Selector                : type:key1:value
+Selector                : type:key2:value
+StoreSvid               : true
 
-Entry ID         : entry-id-3
-SPIFFE ID        : spiffe://example.org/storesvid
-Parent ID        : spiffe://example.org/spire/agent/join_token/TokenDatabase
-Revision         : 0
-X509-SVID TTL    : 200
-JWT-SVID TTL     : 30
-Selector         : type:key1:value
-Selector         : type:key2:value
-StoreSvid        : true
+Entry ID                : entry-id-4
+SPIFFE ID               : spiffe://example.org/additionalattr
+Parent ID               : spiffe://example.org/spire/agent/join_token/TokenBlog
+Revision                : 0
+X509-SVID TTL           : 200
+JWT-SVID TTL            : 30
+Selector                : unix:uid:1111
+Admin                   : true
+DisableX509SvidPrefetch : true
 
 `,
 			expOutJSON: `{
@@ -531,7 +590,10 @@ StoreSvid        : true
         "dns_names": [],
         "revision_number": "0",
         "store_svid": false,
-        "jwt_svid_ttl": 30
+        "jwt_svid_ttl": 30,
+		"additional_attributes": {
+		  "disable_x509_svid_prefetch": false
+		}
       }
     },
     {
@@ -565,7 +627,10 @@ StoreSvid        : true
         "dns_names": [],
         "revision_number": "0",
         "store_svid": false,
-        "jwt_svid_ttl": 30
+        "jwt_svid_ttl": 30,
+		"additional_attributes": {
+		  "disable_x509_svid_prefetch": false
+		}
       }
     },
     {
@@ -603,7 +668,47 @@ StoreSvid        : true
         "dns_names": [],
         "revision_number": "0",
         "store_svid": true,
-        "jwt_svid_ttl": 30
+        "jwt_svid_ttl": 30,
+		"additional_attributes": {
+		  "disable_x509_svid_prefetch": false
+		}
+      }
+    },
+    {
+      "status": {
+        "code": 0,
+        "message": "OK"
+      },
+      "entry": {
+        "id": "entry-id-4",
+        "spiffe_id": {
+          "trust_domain": "example.org",
+          "path": "/additionalattr"
+        },
+        "parent_id": {
+          "trust_domain": "example.org",
+          "path": "/spire/agent/join_token/TokenBlog"
+        },
+        "selectors": [
+          {
+            "type": "unix",
+            "value": "uid:1111"
+          }
+        ],
+        "x509_svid_ttl": 200,
+        "federates_with": [],
+        "hint": "",
+        "admin": true,
+        "created_at": "1547583197",
+        "downstream": false,
+        "expires_at": "0",
+        "dns_names": [],
+        "revision_number": "0",
+        "store_svid": false,
+        "jwt_svid_ttl": 30,
+		"additional_attributes": {
+		  "disable_x509_svid_prefetch": true
+		}
       }
     }
   ]
@@ -621,13 +726,13 @@ StoreSvid        : true
 			}},
 			fakeResp: fakeRespErr,
 			expErrPretty: `Failed to create the following entry (code: AlreadyExists, msg: "similar entry already exists"):
-Entry ID         : (none)
-SPIFFE ID        : spiffe://example.org/already-exist
-Parent ID        : spiffe://example.org/spire/server
-Revision         : 0
-X509-SVID TTL    : default
-JWT-SVID TTL     : default
-Selector         : unix:uid:1
+Entry ID                : (none)
+SPIFFE ID               : spiffe://example.org/already-exist
+Parent ID               : spiffe://example.org/spire/server
+Revision                : 0
+X509-SVID TTL           : default
+JWT-SVID TTL            : default
+Selector                : unix:uid:1
 
 Error: failed to create one or more entries
 `,