Increase resilience to very low/high TTLs

pkg/agent/manager/config.go

@@ -48,7 +48,7 @@ func New(c *Config) (*manager, error) {
 	}
 
 	if c.RotationInterval == 0 {
-		c.RotationInterval = 60 * time.Second
+		c.RotationInterval = svid.DefaultRotatorInterval
 	}
 
 	if c.Clk == nil {

pkg/agent/svid/rotator.go

@@ -81,7 +81,6 @@ func (r *rotator) shouldRotate() bool {
 
 	ttl := s.SVID[0].NotAfter.Sub(r.clk.Now())
 	watermark := s.SVID[0].NotAfter.Sub(s.SVID[0].NotBefore) / 2
-
 	return ttl <= watermark
 }
 

pkg/agent/svid/rotator_config.go

@@ -17,7 +17,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-const defaultInterval = 60 * time.Second
+const DefaultRotatorInterval = 5 * time.Second
 
 type RotatorConfig struct {
 	Catalog     catalog.Catalog
@@ -42,7 +42,7 @@ type RotatorConfig struct {
 
 func NewRotator(c *RotatorConfig) (*rotator, client.Client) {
 	if c.Interval == 0 {
-		c.Interval = defaultInterval
+		c.Interval = DefaultRotatorInterval
 	}
 
 	state := observer.NewProperty(State{

pkg/server/ca/manager.go

@@ -32,9 +32,15 @@ import (
 const (
 	DefaultCATTL    = 24 * time.Hour
 	backdate        = time.Second * 10
-	rotateInterval  = time.Minute
+	rotateInterval  = time.Second * 10
 	pruneInterval   = 6 * time.Hour
 	safetyThreshold = 24 * time.Hour
+
+	thirtyDays              = 30 * 24 * time.Hour
+	preparationThresholdCap = thirtyDays
+
+	sevenDays              = 7 * 24 * time.Hour
+	activationThresholdCap = sevenDays
 )
 
 type CASetter interface {
@@ -168,7 +174,7 @@ func (m *Manager) rotateX509CA(ctx context.Context) error {
 	telemetry_server.SetX509CARotateGauge(m.c.Metrics, m.c.TrustDomain.String(), float32(ttl.Seconds()))
 	m.c.Log.WithFields(logrus.Fields{
 		telemetry.TrustDomainID: m.c.TrustDomain.String(),
-		telemetry.TTL: ttl.Seconds(),
+		telemetry.TTL:           ttl.Seconds(),
 	}).Debug("Successfully rotated X.509 CA")
 
 	return nil
@@ -980,12 +986,20 @@ func parseUpstreamCACSRResponse(resp *upstreamca.SubmitCSRResponse) ([]*x509.Cer
 
 func preparationThreshold(issuedAt, notAfter time.Time) time.Time {
 	lifetime := notAfter.Sub(issuedAt)
-	return notAfter.Add(-lifetime / 2)
+	threshold := lifetime / 2
+	if threshold > preparationThresholdCap {
+		threshold = preparationThresholdCap
+	}
+	return notAfter.Add(-threshold)
 }
 
 func activationThreshold(issuedAt, notAfter time.Time) time.Time {
 	lifetime := notAfter.Sub(issuedAt)
-	return notAfter.Add(-lifetime / 6)
+	threshold := lifetime / 6
+	if threshold > activationThresholdCap {
+		threshold = activationThresholdCap
+	}
+	return notAfter.Add(-threshold)
 }
 
 func newJWTKey(signer crypto.Signer, expiresAt time.Time) (*JWTKey, error) {

pkg/server/ca/manager_test.go

@@ -506,6 +506,26 @@ func (s *ManagerSuite) TestRunFailsIfNotifierFails() {
 	s.Equal("Notifier failed to handle event", entry.Message)
 }
 
+func (s *ManagerSuite) TestPreparationThresholdCap() {
+	issuedAt := time.Now()
+	notAfter := issuedAt.Add(365 * 24 * time.Hour)
+
+	// Expect the preparation threshold to get capped since 1/2 of the lifetime
+	// exceeds the thirty day cap.
+	threshold := preparationThreshold(issuedAt, notAfter)
+	s.Require().Equal(thirtyDays, notAfter.Sub(threshold))
+}
+
+func (s *ManagerSuite) TestActivationThreshholdCap() {
+	issuedAt := time.Now()
+	notAfter := issuedAt.Add(365 * 24 * time.Hour)
+
+	// Expect the activation threshold to get capped since 1/6 of the lifetime
+	// exceeds the seven day cap.
+	threshold := activationThreshold(issuedAt, notAfter)
+	s.Require().Equal(sevenDays, notAfter.Sub(threshold))
+}
+
 func (s *ManagerSuite) initSelfSignedManager() {
 	s.cat.SetUpstreamCA(nil)
 	s.m = NewManager(s.selfSignedConfig())

pkg/server/svid/rotator_config.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	DefaultRotatorInterval = 30 * time.Second
+	DefaultRotatorInterval = 5 * time.Second
 )
 
 type RotatorConfig struct {