Problem
When running large clusters, calling ListEntries on every reconcile is not really practical, especially when multiple controller managers are connected to a single SPIRE Server cluster.
A nested SPIRE Server setup could be one possible solution, but adding a cache mechanism to spire-controller-manager seems much simpler.
(#663 related to this maybe?)
for context, our largest Kubernetes cluster has around 30k pods in a single cluster, and roughly 300k–500k entries are registered in SPIRE Server in total.
Proposed Solution
- implement in-memory caching mechanism to avoid listing all entries when reconciling
- these features might work well if it's used together
Problem
When running large clusters, calling ListEntries on every reconcile is not really practical, especially when multiple controller managers are connected to a single SPIRE Server cluster.
A nested SPIRE Server setup could be one possible solution, but adding a cache mechanism to spire-controller-manager seems much simpler.
(#663 related to this maybe?)
for context, our largest Kubernetes cluster has around 30k pods in a single cluster, and roughly 300k–500k entries are registered in SPIRE Server in total.
Proposed Solution
hintfield based filtering (no issue/PR but spire server support this and I use this in my forked code)