WIP: Pluggable datastore design doc and proof of concept implementation

.gitignore

@@ -28,7 +28,9 @@ tools/spire-plugingen/spire-plugingen
 
 # Editor specific configuration
 .idea
-.vscode
+.vscode/*
+!.vscode/launch.json
+!.vscode/tasks.json
 
 # Runtime version manager specific configuration
 # asdf config file
@@ -41,3 +43,12 @@ oci/
 # Go workspace files
 go.work
 go.work.sum
+
+# VSCode debug artifacts
+__debug_bin*
+
+.agent-data/
+.loadtest-data/*
+cmd/cassandraplugin/cassandraplugin
+
+import

.vscode/launch.json

@@ -0,0 +1,72 @@
+{
+    "configurations": [
+        {
+            "name": "Run migrations",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/pkg/server/datastore/cassandra/migrationhelper/main.go",
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Run SPIRE server - cassandra",
+            "type": "go",
+            "request": "launch",
+            "mode": "debug",
+            "program": "${workspaceFolder}/cmd/spire-server/main.go",
+            "args": [
+                "run",
+                "-config",
+                "./dev/server/server_cass.conf"
+            ],
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Run SPIRE server - cassandra external",
+            "type": "go",
+            "request": "launch",
+            "mode": "debug",
+            "program": "${workspaceFolder}/cmd/spire-server/main.go",
+            "args": [
+                "run",
+                "-config",
+                "./dev/server/server_cass_external.conf"
+            ],
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Run SPIRE server - postgres",
+            "type": "go",
+            "request": "launch",
+            "mode": "debug",
+            "program": "${workspaceFolder}/cmd/spire-server/main.go",
+            "args": [
+                "run",
+                "-config",
+                "./dev/server/server_pg.conf"
+            ],
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Debug Cassandra integration tests",
+            "type": "go",
+            "request": "launch",
+            "mode": "test",
+            "program": "${workspaceFolder}/pkg/server/datastore",
+            "buildFlags": [
+                "-ldflags",
+                "-X github.com/spiffe/spire/pkg/server/datastore_test.TestDialect=cassandra -X github.com/spiffe/spire/pkg/server/datastore_test.TestConnString=[\"localhost:9053\"];spire_test"
+            ],
+            "cwd": "${workspaceFolder}/pkg/server/datastore",
+            "args": [
+                "-test.parallel",
+                "1",
+                "-test.v",
+                "-testify.m",
+                "^(TestCreateOrReturnRegistrationEntry)$"
+            ],
+            "preLaunchTask":"start cassandra",
+            "postDebugTask": "stop cassandra",
+        },
+    ]   
+}

.vscode/tasks.json

@@ -0,0 +1,20 @@
+{
+    "tasks": [
+        {
+            "label": "start cassandra",
+            "type": "shell",
+            "command": "bash",
+            "args": [
+                "${workspaceFolder}/test/integration/cassandra-suites/datastore-cassandra-focus/extras/debug-setup.sh"
+            ]
+        },
+        {
+            "label": "stop cassandra",
+            "type": "shell",
+            "command": "bash",
+            "args": [
+                "${workspaceFolder}/test/integration/cassandra-suites/datastore-cassandra-focus/extras/debug-teardown.sh"
+            ]
+        }
+    ]
+}

cmd/cassandraplugin/Makefile

@@ -0,0 +1,2 @@
+build:
+	go build -o cassandraplugin main.go

cmd/cassandraplugin/main.go

@@ -0,0 +1,20 @@
+package main
+
+import (
+	"github.com/spiffe/spire-plugin-sdk/pluginmain"
+	datastorev1 "github.com/spiffe/spire-plugin-sdk/proto/spire/plugin/server/datastore/v1alpha1"
+	configv1 "github.com/spiffe/spire-plugin-sdk/proto/spire/service/common/config/v1"
+	"github.com/spiffe/spire/pkg/server/datastore/cassandra"
+)
+
+type Plugin struct {
+	cassandra.Plugin
+}
+
+func main() {
+	plugin := cassandra.NewPlugin()
+	pluginmain.Serve(
+		datastorev1.DataStorePluginServer(plugin),
+		configv1.ConfigServiceServer(plugin),
+	)
+}

cmd/spire-server/cli/run/run.go

@@ -116,6 +116,7 @@ type experimentalConfig struct {
 	SQLTransactionTimeout   string                      `hcl:"sql_transaction_timeout"`
 	RequirePQKEM            bool                        `hcl:"require_pq_kem"`
 	WITKeyType              string                      `hcl:"wit_key_type"`
+	AllowPluggableDatastore bool                        `hcl:"allow_pluggable_datastore"`
 
 	Flags fflag.RawConfig `hcl:"feature_flags"`
 
@@ -775,6 +776,8 @@ func NewServerConfig(c *Config, logOptions []log.Option, allowUnknownConfig bool
 	sc.EventsBasedCache = c.Server.Experimental.EventsBasedCache
 	sc.AuthOpaPolicyEngineConfig = c.Server.Experimental.AuthOpaPolicyEngine
 
+	sc.ExperimentalAllowPluggableDatastore = c.Server.Experimental.AllowPluggableDatastore
+
 	for _, f := range c.Server.Experimental.Flags {
 		sc.Log.Warnf("Developer feature flag %q has been enabled", f)
 	}

doc/plugin_server_datastore_cassandra.md

@@ -0,0 +1,17 @@
+# Server plugin: DataStore "cassandra"
+
+The `cassandra` plugin is an experimental datastore plugin being prototyped to support allowing SPIRE servers to use [Apache Cassandra](https://cassandra.apache.org/) as a highly-available distributed database backend. This plugin is not officially supported and requires enabling an experimental flag in the `server` stanza of the SPIRE Server configuration file:
+```hcl
+server {
+    ...
+    experimental {
+        allow_pluggable_datastore = true
+    }
+}
+```
+
+Adventurous users wanting to explore this plugin should be aware that it should be expected to be unstable and potentially lose data until it has been hardened. This plugin should not be run in production. This plugin has been developed and tested against Cassandra 5.0.6, and will not support versions of Cassandra prior to v5.0. 
+
+When the Cassandra datastore is used, the 
+
+## Cassandra configuration

go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129
+	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
 	github.com/aws/aws-sdk-go-v2 v1.41.5
 	github.com/aws/aws-sdk-go-v2/config v1.32.12
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.12
@@ -40,7 +41,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/docker/docker v28.5.2+incompatible
-	github.com/envoyproxy/go-control-plane/envoy v1.37.0
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0
 	github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa
 	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/go-sql-driver/mysql v1.9.3
@@ -80,6 +81,7 @@ require (
 	github.com/spiffe/spire-api-sdk v1.2.5-0.20260320104153-99d433165a01
 	github.com/spiffe/spire-plugin-sdk v1.4.4-0.20251120194148-791bbd274dc7
 	github.com/stretchr/testify v1.11.1
+	github.com/tjons/cassandra-toolbox v0.0.0-20260314211553-cdb30cc01b34
 	github.com/uber-go/tally/v4 v4.1.17
 	github.com/valyala/fastjson v1.6.10
 	golang.org/x/crypto v0.50.0
@@ -145,6 +147,7 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
+	github.com/creack/pty v1.1.24 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
@@ -330,3 +333,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/spiffe/spire-plugin-sdk => github.com/geico/spire-plugin-sdk v0.0.0-20260418165235-b38c1edf5e75

go.sum

@@ -111,6 +111,8 @@ github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129/go.mod h1:rFgp
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/apache/cassandra-gocql-driver/v2 v2.0.0 h1:Omnzb1Z/P90Dr2TbVNu54ICQL7TKVIIsJO231w484HU=
+github.com/apache/cassandra-gocql-driver/v2 v2.0.0/go.mod h1:QH/asJjB3mHvY6Dot6ZKMMpTcOrWJ8i9GhsvG1g0PK4=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
@@ -223,8 +225,8 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpk
 github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
 github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
-github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
@@ -268,8 +270,8 @@ github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bF
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
@@ -299,6 +301,8 @@ github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvD
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/geico/spire-plugin-sdk v0.0.0-20260418165235-b38c1edf5e75 h1:i6YaPFYPd2WLuJvkAwj7HS2YoP1JneRLoc0Wvp5BdLg=
+github.com/geico/spire-plugin-sdk v0.0.0-20260418165235-b38c1edf5e75/go.mod h1:QvrRDiBlXiJ7kNd176ZHsF5eklxxeTRgJSu2CXe0MKw=
 github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
@@ -707,6 +711,9 @@ github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgr
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
+github.com/pierrec/lz4/v4 v4.1.8 h1:ieHkV+i2BRzngO4Wd/3HGowuZStgq6QkPsD1eolNAO4=
+github.com/pierrec/lz4/v4 v4.1.8/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pires/go-proxyproto v0.12.0 h1:TTCxD66dU898tahivkqc3hoceZp7P44FnorWyo9d5vM=
 github.com/pires/go-proxyproto v0.12.0/go.mod h1:qUvfqUMEoX7T8g0q7TQLDnhMjdTrxnG0hvpMn+7ePNI=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
@@ -754,6 +761,8 @@ github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8A
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
@@ -815,8 +824,6 @@ github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMps
 github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
 github.com/spiffe/spire-api-sdk v1.2.5-0.20260320104153-99d433165a01 h1:FA0UhZ5fOca/d/ogmVHif1eDARpMo4FLWUnav8JzEts=
 github.com/spiffe/spire-api-sdk v1.2.5-0.20260320104153-99d433165a01/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y=
-github.com/spiffe/spire-plugin-sdk v1.4.4-0.20251120194148-791bbd274dc7 h1:OAvr7TNirmBpXnAp82cTosuB+JAus5cyFCRqXHE0WHs=
-github.com/spiffe/spire-plugin-sdk v1.4.4-0.20251120194148-791bbd274dc7/go.mod h1:QvrRDiBlXiJ7kNd176ZHsF5eklxxeTRgJSu2CXe0MKw=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -849,6 +856,8 @@ github.com/tink-crypto/tink-go/v2 v2.6.0 h1:+KHNBHhWH33Vn+igZWcsgdEPUxKwBMEe0QC6
 github.com/tink-crypto/tink-go/v2 v2.6.0/go.mod h1:2WbBA6pfNsAfBwDCggboaHeB2X29wkU8XHtGwh2YIk8=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
+github.com/tjons/cassandra-toolbox v0.0.0-20260314211553-cdb30cc01b34 h1:ymRJ3UeFD5u+I7HxbiBXX65NXzJ/H6DRRsJSX4LVFDE=
+github.com/tjons/cassandra-toolbox v0.0.0-20260314211553-cdb30cc01b34/go.mod h1:r7A2k5T3lg+7FRTLah8mAeUaephHObjiihDz6COTBSM=
 github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
 github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
 github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=

pkg/common/catalog/builtin.go

@@ -35,6 +35,10 @@ type BuiltInConfig struct {
 
 	// HostServices are the host service servers provided to the plugin.
 	HostServices []pluginsdk.ServiceServer
+
+	// MaxGrpcMessageSize is the maximum gRPC message size that the plugin should be configured to send.
+	// Defaults to 4 MB if not set.
+	MaxGrpcMessageSize int
 }
 
 func LoadBuiltIn(ctx context.Context, builtIn BuiltIn, config BuiltInConfig) (_ Plugin, err error) {
@@ -51,6 +55,7 @@ func loadBuiltIn(ctx context.Context, builtIn BuiltIn, config BuiltInConfig) (_
 		pluginName:   builtIn.Name,
 		log:          config.Log,
 		hostServices: config.HostServices,
+		maxGrpcMessageSize: config.MaxGrpcMessageSize,
 	}
 
 	var closers closerGroup
@@ -61,14 +66,14 @@ func loadBuiltIn(ctx context.Context, builtIn BuiltIn, config BuiltInConfig) (_
 	}()
 	closers = append(closers, dialer)
 
-	builtinServer, serverCloser := newBuiltInServer(config.Log)
+	builtinServer, serverCloser := newBuiltInServer(config.Log, config.MaxGrpcMessageSize)
 	closers = append(closers, serverCloser)
 
 	pluginServers := append([]pluginsdk.ServiceServer{builtIn.Plugin}, builtIn.Services...)
 
 	private.Register(builtinServer, pluginServers, logger, dialer)
 
-	builtinConn, err := startPipeServer(builtinServer, config.Log)
+	builtinConn, err := startPipeServer(builtinServer, config.Log, config.MaxGrpcMessageSize)
 	if err != nil {
 		return nil, err
 	}
@@ -82,27 +87,30 @@ func loadBuiltIn(ctx context.Context, builtIn BuiltIn, config BuiltInConfig) (_
 	return newPlugin(ctx, builtinConn, info, config.Log, closers, config.HostServices)
 }
 
-func newBuiltInServer(log logrus.FieldLogger) (*grpc.Server, io.Closer) {
+func newBuiltInServer(log logrus.FieldLogger, maxGrpcMessageSize int) (*grpc.Server, io.Closer) {
 	drain := &drainHandlers{}
 	return grpc.NewServer(
 		grpc.ChainStreamInterceptor(drain.StreamServerInterceptor, streamPanicInterceptor(log)),
 		grpc.ChainUnaryInterceptor(drain.UnaryServerInterceptor, unaryPanicInterceptor(log)),
+		grpc.MaxSendMsgSize(maxGrpcMessageSize),
+		grpc.MaxRecvMsgSize(maxGrpcMessageSize),
 	), closerFunc(drain.Wait)
 }
 
 type builtinDialer struct {
-	pluginName   string
-	log          logrus.FieldLogger
-	hostServices []pluginsdk.ServiceServer
-	conn         *pipeConn
+	pluginName         string
+	log                logrus.FieldLogger
+	hostServices       []pluginsdk.ServiceServer
+	conn               *pipeConn
+	maxGrpcMessageSize int
 }
 
 func (d *builtinDialer) DialHost(context.Context) (grpc.ClientConnInterface, error) {
 	if d.conn != nil {
 		return d.conn, nil
 	}
 	server := newHostServer(d.log, d.pluginName, d.hostServices)
-	conn, err := startPipeServer(server, d.log)
+	conn, err := startPipeServer(server, d.log, d.maxGrpcMessageSize)
 	if err != nil {
 		return nil, err
 	}
@@ -122,7 +130,7 @@ type pipeConn struct {
 	io.Closer
 }
 
-func startPipeServer(server *grpc.Server, log logrus.FieldLogger) (_ *pipeConn, err error) {
+func startPipeServer(server *grpc.Server, log logrus.FieldLogger, maxGrpcMessageSize int) (_ *pipeConn, err error) {
 	var closers closerGroup
 
 	pipeNet := newPipeNet()
@@ -146,6 +154,10 @@ func startPipeServer(server *grpc.Server, log logrus.FieldLogger) (_ *pipeConn,
 		"passthrough:IGNORED",
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 		grpc.WithContextDialer(pipeNet.DialContext),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallSendMsgSize(maxGrpcMessageSize),
+			grpc.MaxCallRecvMsgSize(maxGrpcMessageSize),
+		),
 	)
 	if err != nil {
 		return nil, err