The spire-agent k8s workload attestor wont refresh kubelet ca if it changes on disk

[kfox1111]

There is no way to notify the agent or have the agent notice itself, if kubelet's server cert is updated.

[azdagron]

Seems reasonable to periodically reload that file.

[kfox1111]

Hmm.... Its not a very costly operation I would think, would it make sense to either:

• reload before each call back to the spire server (assuming its not very frequent?)
• Reload after a failure to connect to the spire server. Then the next retry would get the update

[SpectralHiss]

Why not use fsnotify to actually watch the file system instead?

[github-actions[bot]]

This issue is stale because it has been open for 365 days with no activity.

[sorindumitru]

I'm not sure this is a problem, we reload the CA certs every time we create a new kubelet client, which is once every minute or so. See here where we reload the CA and the default interval.

@kfox1111 was this reload every minute not working for you? Did you configure the reload interval to be higher? If the CA changes in a live system (don't know if that's possible) you'll have some downtime for up to 1 minute, but I'm sure the agent won't be the only thing having that issue.

[kfox1111]

hmm. I think I looked at the code, but didnt realize it would refresh it. If you think its refreshing ok, I think we can close it.

[sorindumitru]

Good to close based on the, we reload the file every minute.