support setting a custom cert ttl via SECRET_TTL env var

Cargo.toml

@@ -84,6 +84,7 @@ trust-dns-client = "0.22.0"
 trust-dns-proto = "0.22.0"
 trust-dns-resolver = "0.22.0"
 trust-dns-server = { version = "0.22.1", features = [ "trust-dns-resolver" ] }
+duration-str = "0.7.0"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 netns-rs = "0.1.0"

src/config.rs

@@ -40,6 +40,7 @@ const LOCAL_XDS_PATH: &str = "LOCAL_XDS_PATH";
 const XDS_ON_DEMAND: &str = "XDS_ON_DEMAND";
 const XDS_ADDRESS: &str = "XDS_ADDRESS";
 const CA_ADDRESS: &str = "CA_ADDRESS";
+const SECRET_TTL: &str = "SECRET_TTL";
 const FAKE_CA: &str = "FAKE_CA";
 const ZTUNNEL_WORKER_THREADS: &str = "ZTUNNEL_WORKER_THREADS";
 const ENABLE_ORIG_SRC: &str = "ENABLE_ORIG_SRC";
@@ -53,6 +54,7 @@ const DEFAULT_DNS_PORT: u16 = 15053;
 const DEFAULT_SELFTERM_DEADLINE: Duration = Duration::from_secs(5);
 const DEFAULT_CLUSTER_ID: &str = "Kubernetes";
 const DEFAULT_CLUSTER_DOMAIN: &str = "cluster.local";
+const DEFAULT_TTL: Duration = Duration::from_secs(60 * 60 * 24); // 24 hours
 
 const ISTIO_META_PREFIX: &str = "ISTIO_META_";
 const DNS_CAPTURE_METADATA: &str = "DNS_CAPTURE";
@@ -139,6 +141,8 @@ pub struct Config {
     pub xds_address: Option<String>,
     /// Root cert for XDS TLS verification.
     pub xds_root_cert: RootCert,
+    /// TTL for CSR requests
+    pub secret_ttl: Duration,
     /// YAML config for local XDS workloads
     #[serde(skip_serializing)]
     pub local_xds_config: Option<ConfigSource>,
@@ -335,6 +339,10 @@ pub fn construct_config(pc: ProxyConfig) -> Result<Config, Error> {
         xds_root_cert,
         ca_address,
         ca_root_cert,
+        secret_ttl: match parse::<String>(SECRET_TTL)? {
+            Some(ttl) => duration_str::parse(&ttl).unwrap_or(DEFAULT_TTL),
+            None => DEFAULT_TTL,
+        },
         local_xds_config: parse::<PathBuf>(LOCAL_XDS_PATH)?.map(ConfigSource::File),
         xds_on_demand: parse_default(XDS_ON_DEMAND, false)?,
         proxy_metadata: pc.proxy_metadata,

src/identity/caclient.rs

@@ -31,6 +31,7 @@ use crate::xds::istio::ca::IstioCertificateRequest;
 pub struct CaClient {
     pub client: IstioCertificateServiceClient<InterceptedService<TlsGrpcChannel, AuthSource>>,
     pub enable_impersonated_identity: bool,
+    pub secret_ttl: i64,
 }
 
 impl CaClient {
@@ -39,6 +40,7 @@ impl CaClient {
         cert_provider: Box<dyn tls::ClientCertProvider>,
         auth: AuthSource,
         enable_impersonated_identity: bool,
+        secret_ttl: i64,
     ) -> Result<CaClient, Error> {
         let svc = tls::grpc_connector(address, cert_provider.fetch_cert().await?)?;
         // let client = IstioCertificateServiceClient::new(svc);
@@ -48,6 +50,7 @@ impl CaClient {
         Ok(CaClient {
             client,
             enable_impersonated_identity,
+            secret_ttl,
         })
     }
 }
@@ -65,7 +68,7 @@ impl CaClient {
         let csr = std::str::from_utf8(&csr).map_err(Error::Utf8)?.to_string();
         let req = IstioCertificateRequest {
             csr,
-            validity_duration: 60 * 60 * 24, // 24 hours
+            validity_duration: self.secret_ttl,
             metadata: {
                 if self.enable_impersonated_identity {
                     Some(Struct {

src/identity/manager.rs

@@ -393,6 +393,7 @@ impl SecretManager {
             )),
             cfg.auth,
             cfg.proxy_mode == ProxyMode::Shared,
+            cfg.secret_ttl.as_secs().try_into().unwrap_or(60 * 60 * 24),
         )
         .await?;
         Ok(Self::new_with_client(caclient))

src/test_helpers/ca.rs

@@ -82,6 +82,7 @@ impl CaServer {
                 "Kubernetes".to_string(),
             ),
             true,
+            60 * 60 * 24,
         )
         .await
         .unwrap();