Token expiry

chart/epinio/README.md

@@ -58,6 +58,15 @@ Epinio configures the ingress with settings that are important for application d
 
 These settings can be adjusted in the `ingress` section of your `values.yaml` file to match your specific deployment requirements and cluster capabilities.
 
+#### Server Configuration
+
+- **`server.defaultTokenExpiry`**: Controls the default expiry time for auth tokens (e.g. `"30s"`, `"60s"`, `"2m"`). Use this to mitigate clock drift in environments where short-lived tokens may expire before use—for example, in staging workloads or when Kubernetes hosts have time synchronization issues. The value is capped at 5 minutes for security. Default is `"30s"`.
+
+  ```yaml
+  server:
+    defaultTokenExpiry: "60s"  # Example: increase to 1 minute for clock drift
+  ```
+
 ### Cert Manager
 
 Epinio needs [cert-manager](https://cert-manager.io/) in order to create TLS

chart/epinio/templates/server.yaml

@@ -313,6 +313,8 @@ spec:
               value: "{{ default .Values.global.tlsIssuer .Values.global.customTlsIssuer }}"
             - name: TRACE_LEVEL
               value: "{{ .Values.server.traceLevel }}"
+            - name: AUTH_TOKEN_DEFAULT_EXPIRY
+              value: "{{ .Values.server.defaultTokenExpiry }}"
             - name: CHART_VERSION
               value: "{{ .Chart.Version }}"
             - name: DEFAULT_BUILDER_IMAGE

chart/epinio/values.schema.json

@@ -65,6 +65,10 @@
         "traceLevel": {
           "type": "integer"
         },
+        "defaultTokenExpiry": {
+          "type": "string",
+          "description": "Default expiry time for auth tokens (e.g. 30s, 60s, 2m). Use to mitigate clock drift."
+        },
         "disableTracking": {
           "type": "boolean"
         },

chart/epinio/values.yaml

@@ -55,6 +55,9 @@ server:
   timeoutMultiplier: 1
   # Increase this value to instruct the API server to produce more debug output
   traceLevel: 0
+  # Default expiry time for auth tokens (e.g. "30s", "60s", "2m"). Use to mitigate clock drift
+  # in environments where short-lived tokens may expire before use. Capped at 5 minutes.
+  defaultTokenExpiry: "30s"
   # The ingressClassName is used to select the ingress controller for apps.
   # If empty ingress.ingressClassName (see below) is used
   ingressClassName: ""