Skip to content

TERRAFORM_OIDC_IDP_SESSION_EXPIRY extend expiry time

Hey i have a question. i am running terrareg on a Kubernetes cluster and i am using Atlantis to apply terraform code directly from pull request. But i also have allow_undefined_Access to false. Meaning i need to do terraform login public_url. and then i get a token. My question is, is it possible to create a token that is valid for atleast a year. so my Atlantis deployment can always pull from terrareg. i tried setting the TERRAFORM_OIDC_IDP_SESSION_EXPIRY to 31536000 but this don't work and after 1 hour the token is no longer valid. Is there a maximum value for the TERRAFORM_OIDC_IDP_SESSION_EXPIRY variable?

image

This seems to do something but after an hour the token till becomes unvalid result of [SELECT * FROM terraform_idp_access_token;]

image

i believe he didn't delete the entries yet because the expiry date is larger that the current date. But this doesn't mean that the token is still valid?

`

            if self.SHOULD_EXPIRE:
                # Delete any old sessions
                conn.execute(sqlalchemy.delete(self.table).where(self.table.c.expiry < datetime.now()))
                transaction.commit()`

python timedate seconds image

Let's allows values between 0-86399. so i change this line

expiry=(datetime.now() + timedelta(seconds=terrareg.config.Config().TERRAFORM_OIDC_IDP_SESSION_EXPIRY))

to

expiry=(datetime.now() + timedelta(days=terrareg.config.Config().TERRAFORM_OIDC_IDP_SESSION_EXPIRY)) and rebuilt the image now i will wait for an hour to see it this affects anything and TERRAFORM_OIDC_IDP_SESSION_EXPIRY to 365

This doesn't fix it, after 1 hour the token is no longer valid. Any idea how to make this possible?

Edited by Matt