spire

No entries match these filters. Clear filters

1. v1.15.4 Oct 15, 2026 · issue 110

   SPIRE v1.15.4 adds configurable TLS policies for TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.4 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.15.4

   • Supports configuring TLS policies to be applied to TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. v1.15.3 Aug 21, 2026 · issue 053

   SPIRE v1.15.3 adds a Slurm workload attestor, Azure Blob bundle publisher, and several new agent configuration options.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.3 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.15.3

   └──▷ USE IT
   Disable the Workload API and SDS API on a public-facing agent endpoint to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. in environments where those APIs are not needed.
   /etc/spire/agent/agent.conf copy

   disable_workload_api = true
   disable_sds_api = true

   Inspect live agent state via the Debug API without needing to query the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. endpoint directly.
   copy

   $ spire-agent debug getinfo

   Enable namespace label selectors in the Kubernetes workload attestor to write SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. policies based on namespace-level labels.
   /etc/spire/agent/agent.conf copy

   enable_namespace_labels = true

   • Adds trust_bundle_spiffe_workload_api agent configuration option to fetch the initial trust bundle from a Workload API endpoint, simplifying nested agent deployments.
   • Adds disable_workload_api and disable_sds_api agent options to disable the Workload API and SDS APIs on the public endpoint.
   • Adds disable_kubelet_client option for the k8s workload attestor.
   • Adds use_pod_uid_for_agent_id option in the k8s_psat node attestor to derive agent IDs from pod UIDs instead of node UIDs.
   • Adds opt-in enable_namespace_labels option in the k8s workload attestor, producing ns-label selectors from namespace labels.

   +6 more show less

   • Adds account_list_file option in the aws_iid node attestor to source the verify_organization account list from a file instead of the AWS Organizations API.
   • Adds debug getinfo subcommand in the spire-server and spire-agent CLIs to access the Debug APIs.
   • New azure_blob BundlePublisher plugin for publishing the trust bundle to Azure Blob Storage.
   • New Slurm workload attestor.
   • Adds WIT-SVID building support in the svid.v1 API client and marshalling support for WIT-SVID keys.
   • The Broker API endpoint is now included in health checks when enabled.

   11 details in Everything

3. v1.15.2 Jul 9, 2026 · issue 011

   SPIRE v1.15.2 adds SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. Broker, PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. curve support, per-caller rate limiting, and TLS-secured Prometheus metrics.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.2 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.15.2

   • Adds configurable JTI claim inclusion in JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-SVIDs at the entry level.
   • Introduces experimental per-caller rate limiting for the agent Workload API and Envoy SDS.
   • Adds TLS support for the Prometheus metrics endpoint using a SPIRE SVID, with an optional SPIFFE ID allowlist.
   • Adds optional verification of client certificate IPs in the x509pop node attestor.
   • Introduces the SPIFFE Broker endpoint and API.

   +10 more show less

   • Adds disable_group_name_selectors option for the Windows workload attestor.
   • Adds log_selectors configuration item for the agent.
   • Supports two additional post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQC) curves.
   • Adds tag-based key discovery support in the aws_kms Key Manager plugin.
   • Introduces a Logger service for spire-agent.
   • Adds configurable batch size for pruning attested nodes.
   • Deprecation warnings now use dedicated log markers for easier detection.
   • Post-quantumPost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. cryptography policy is now applied to the bundle endpoint and Prometheus server.
   • Attested nodes are now fetched in bulk, reducing database load in large deployments.
   • Optimizes MySQL list entries query to reduce database CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage under load.

   15 details in Everything

4. v1.15.0 May 19, 2026 · release notes

   SPIRE v1.15.0 adds HashiCorp Vault Key Manager, rootless Podman attestation, PROXY protocol support, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.0 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.15.0

   └──▷ TRY IT
   Restrict node attestation to a specific AWS account ID using the new account_id selector.
   copy

   $ spire-server entry create \
     -spiffeID spiffe://example.org/workload \
     -selector aws_iid:account_id:123456789012 \
     -parentID spiffe://example.org/agent

   • New account_id selector for the aws_iid node attestor enables scoping attestation to specific AWS accounts.
   • TLS support added to the Prometheus metrics sink for encrypted metric scraping.
   • Supports marking registration entry X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVIDs as non-prefetchable to control caching behavior.
   • Docker workload attestor now supports rootless Podman environments.
   • PROXY protocol support added for correct rate limiting when SPIRE sits behind load balancers.

   +7 more show less

   • Agents can now fetch the X509-SVID for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. attestation mode directly from the Workload API socket.
   • iss claim support added for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-SVIDs (WIT-SVIDs).
   • Instance flag support added to spire-server and spire-agent CLIs for multi-instance deployments.
   • Experimental optional spiffe_id node selector added to enable aliasing individual nodes.
   • New HashiCorp Vault Key Manager plugin for storing SPIRE signing keys in Vault.
   • sigstore support in Kubernetes and Docker workload attestors promoted out of experimental.
   • gcp_iit node attestor now derives service account email from the identity token, removing dependency on use_instance_metadata.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The JSON output of the CLI no longer wraps objects in slices when printing; any tooling that parses CLI JSON output may break.
   • !A metric label is renamed from bootstraped to bootstrapped; any dashboards or alerts keyed on the old label name will stop matching.
5. v1.14.3 Mar 18, 2026 · release notes

   SPIRE v1.14.3 adds agent version visibility, standardizes post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. KEM, and doubles OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. policy evaluation performance.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.3 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.14.3

   • Adds spire-agent version reporting to spire-server via the PostStatus API, now visible in GetAgent/ListAgents CLI output.
   • The RequirePQKEM TLS policy now uses the standardized X25519MLKEM768 algorithm instead of the draft x25519Kyber768Draft00.
   • OPA policy evaluation performance improved by approximately 2× through use of partial evaluation.
   • Selectors are no longer logged at the agent level, preventing potential leakage of sensitive information.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The RequirePQKEM TLS policy switches from x25519Kyber768Draft00 to X25519MLKEM768; any peer or configuration that negotiated the draft KEM will no longer be compatible.
6. v1.14.1 Jan 15, 2026 · release notes

   SPIRE Server on Windows now supports persistent arguments in the service binPath for automatic startup.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.1 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.14.1

   • Supports persistent arguments in the Windows service binPath for automatic SPIRE Server startup.
   • The uptime_in_ms gauge metric now reports float64 precision instead of integer.

   2 details in Everything

7. v1.14.0 Dec 11, 2025 · release notes

   SPIRE v1.14.0 adds Azure IMDS node attestation, AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. key tagging, ec-p384 curve support, and expanded docker/GCP capabilities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.0 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.14.0

   └──▷ USE IT
   Disable JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. issuance on a server that only needs X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. SVIDs, reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   hcl copy

   server {
     disable_jwt_svids = true
   }

   Validate plugin configuration before deploying changes to a live SPIRE server.
   copy

   $ spire-server validate -config /etc/spire/server.conf

   • New azure_imds node attestor plugin attests nodes running in Microsoft Azure using the Azure Instance Metadata Service (IMDS).
   • AWS KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key manager plugin now supports key tagging.
   • JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-SVID profile on spire-server can now be disabled via the disable_jwt_svids config option.
   • spire-server validate now supports validating plugin configuration.
   • Adds support for the ec-p384 curve in the workload_x509_svid_key_type configuration option in spire-agent.

   +4 more show less

   • Docker workload attestor now supports the docker:image_config_digest selector.
   • GCP CAs now specify a certificate_id in CreateCertificateRequest for Enterprise tier compatibility.
   • GCP cloudsql-proxy can now be used with PostgreSQL.
   • KeyManager directory is now validated to exist and be writeable on agent startup.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The deprecated retry_rebootstrap agent config option has been removed; any working configuration using it will break on upgrade.
8. v1.13.3 Oct 23, 2025 · release notes

   SPIRE v1.13.3 adds file-based join tokens, caller-path Rego filtering, and absolute X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. CA expiry metrics.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.13.3 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.13.3

   • New X.509 CA metric exposes absolute expiration time, complementing the existing TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.-based metric.
   • New spire-agent configuration option sources join tokens from files, enabling integration with third-party credential providers.
   • New capability to filter on caller path in spire-server Rego authorization policies.
   • spire-server now uses SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. for X.509-SVIDX.509-SVIDAn X.509 certificate formatted to carry a SPIFFE Verifiable Identity Document, binding a cryptographic identity to a workload so cyber tools can authenticate services without passwords or static secrets. Subject Key Identifiers when GODEBUG contains fips140=only.
   • oidc-discovery-provider now fails to initialize when started with unrecognized arguments, surfacing misconfigurations at startup.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !oidc-discovery-provider now refuses to start when passed unrecognized arguments; previously unrecognized arguments were silently ignored, so any deployment passing extra flags will fail on upgrade.
9. v1.13.1 Sep 18, 2025 · release notes

   SPIRE v1.13.1 adds EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. cluster verification for aws_iid, configurable node-info caching, and refresh hints for bundle publishers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.13.1 https://github.com/spiffe/spire.git
   # already have the repo? check out this version:
   $ git checkout v1.13.1

   • Enables aws_iid NodeAttestor to verify that attesting nodes belong to specified EKS clusters.
   • Adds server-side configuration for how long attested node information is cached, reducing node fetch dependency for RPCs.
   • Adds refresh hint support to aws_s3, gcp_cloudstorage, and k8s_configmap BundlePublisher plugins for published bundles.

   3 details in Everything

10. v1.13.0 Aug 15, 2025 · release notes

    SPIRE v1.13.0 adds periodic expired-agent purging, automatic agent rebootstrap, and full events-based cache reload.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.13.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.13.0

    • New server configuration to periodically purge expired agents, reducing stale entry accumulation.
    • Automatic agent rebootstrap support when the server CA goes invalid, improving resilience without manual intervention.
    • Events-based cache now implements a full cache reload, completing its feature parity path.
    • Server configuration validation now checks agent_ttl compatibility with the current ca_ttl at startup.
    • No identities issued error log now includes the attested selectors for faster diagnosis.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated use_legacy_downstream_x509_ca_ttl server configurable has been removed; any config referencing it will break on upgrade.
    • !The deprecated use_rego_v1 server configurable has been removed; any config referencing it will break on upgrade.
    • !Default values for rebootstrapMode and rebootstrapDelay in SPIRE Agent have changed; existing agent behavior that relied on previous defaults may differ after upgrade.
11. v1.12.4 Jul 1, 2025 · release notes

    SPIRE v1.12.4 adds a Kubernetes ConfigMap bundle publisher, a new streaming bundle RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets., and file-based trust bundle support for the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.12.4

    • New k8s_configmap BundlePublisher plugin lets SPIRE Server publish trust bundles directly to a Kubernetes ConfigMap.
    • New UpstreamAuthority.SubscribeToLocalBundle RPC enables streaming updates of the local trust bundle to upstream authority plugins.
    • OIDC Discovery Provider can now read the trust bundle from a file, removing the dependency on a live SPIRE Server endpoint.
    • Integration tests now run on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., broadening validated platform coverage.
    • Improved entry lookup performance in the SPIRE Server.

    5 details in Everything

12. v1.12.1 May 7, 2025 · release notes

    SPIRE v1.12.1 adds Unix socket support for trust bundle URLs and renames the SQL transaction timeout config key.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.12.1

    • Supports Unix sockets in trust bundle URLs, enabling local socket-based bundle federation.
    • Improves events-based cache performance via batch fetching of updated entries (experimental).

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sql_transaction_timeout config key is replaced by event_timeout and its default value is reduced to 15 minutes — existing configurations using sql_transaction_timeout will break on upgrade.
13. v1.12.0 Mar 21, 2025 · release notes

    SPIRE v1.12.0 adds S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage support, Rego V1 policy engine, and SAN-based node attestation selectors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    └──▷ USE IT
    Publish SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. bundles to a self-hosted MinIO cluster instead of AWS S3 by pointing the aws_s3 BundlePublisher at a custom endpoint.
    hcl copy

    BundlePublisher "aws_s3" {
      region = "us-east-1"
      bucket = "spire-bundles"
      object_key = "bundle.jwks"
      endpoint = "https://minio.internal:9000"
      force_path_style = true
    }

    • Supports any S3-compatible object storage (e.g., MinIO) in the aws_s3 BundlePublisher plugin, not just AWS S3.
    • Supports Rego V1 syntax in the authorization policy engine.
    • Adds SAN-based selectors in the x509pop NodeAttestor plugin for finer-grained node attestation.
    • Agents now use the SyncAuthorizedEntries API for periodic entry synchronization by default.
    • Log timestamps now include nanosecond precision.

    +1 more show less

    • Experimental events-based cache now supports reading from read-only database replicas when data staleness is tolerated, improving read performance.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The use_legacy_downstream_x509_ca_ttl server setting now defaults to false; deployments relying on legacy downstream X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. CA TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. behavior must explicitly set it to true or migrate.
    • !The deprecated k8s_sat NodeAttestor plugin has been removed; deployments using it must migrate to an alternative node attestor before upgrading.
14. v1.11.2 Feb 13, 2025 · release notes

    SPIRE v1.11.2 adds multi-region GCP Secret Manager support, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider config flexibility, and optional trust_domain metrics labeling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.11.2

    • Adds multi-region support to the gcp_secretmanager SVIDStore plugin, letting operators specify which regions secrets are created in.
    • Supports environment variable expansion in the OIDC Discovery Provider configuration.
    • Enables an optional trust_domain label on all metrics for finer-grained observability.
    • Allows the JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. URI returned in the OIDC Discovery Provider discovery document to be explicitly configured.
    • Adds support for specifying a server path prefix in the OIDC Discovery Provider.

    5 details in Everything

15. v1.11.1 Dec 12, 2024 · release notes

    SPIRE v1.11.1 adds SPRIG template functions, configurable JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. cache, and a configurable JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. issuer in the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.11.1

    └──▷ USE IT
    Override the JWT issuer in the OIDC Discovery Provider to match your organisation's public domain instead of the default.
    hcl copy

    jwt_issuer = "https://oidc.example.com"

    • Adds SPRIG library functions to the Go text/template engine available in SPIRE plugins, expanding templating power for plugin authors.
    • Makes the JWT-SVID cache in the SPIRE agent configurable, giving operators control over cache sizing and behaviour.
    • Enables a configurable JWT issuer (jwt_issuer) in the OIDC Discovery Provider, allowing operators to override the default issuer claim.

    3 details in Everything

16. v1.11.0 Oct 24, 2024 · release notes

    SPIRE v1.11.0 adds forced rotation/revocation, a new EJBCA UpstreamAuthority plugin, and config-file variable support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    └──▷ USE IT
    Control the size of the now-always-on SPIRE Agent LRU identity cache to tune memory usage for your workload density.
    hcl copy

    # In the SPIRE Agent config file
    agent {
      x509_svid_cache_max_size = 1000
    }

    • Adds forced rotation and revocation support for SVIDs.
    • New EJBCA UpstreamAuthority plugin for SPIRE Server enables issuing SVIDs via an EJBCA CA.
    • Supports variables in templates within the SPIRE config file.
    • Supports configuration validation RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. on all built-in plugins.
    • Improves CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory usage for concurrent Kubernetes Workload attestation.

    +2 more show less

    • Enables CGroups v2 support in Kubernetes and Docker workload attestors by default.
    • SPIRE Agent LRU identity cache is now always enabled, with size controllable via x509_svid_cache_max_size.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated -ttl flag has been removed from the SPIRE Server entry create and entry update commands; commands using -ttl will break.
    • !Official support for MySQL 5.X has been dropped; no explicit testing will be performed against this version.
    • !The SPIRE Agent LRU identity cache is now unconditionally enabled; any configuration that previously disabled it will no longer have that effect.
17. v1.10.2 Sep 3, 2024 · release notes

    SPIRE v1.10.2 adds HTTP challenge node attestation, Sigstore container image validation, and event-cache metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.10.2

    • New http_challenge NodeAttestor plugin enables node attestation via HTTP challenge.
    • Experimental Sigstore selector support in the Docker Workload Attestor allows validation of container image signatures.
    • New metrics for monitoring the event-based cache.
    • Delegated Identity API now supports subscription by process ID.
    • Agent Debug endpoint now counts SVIDs broken down by type.

    +1 more show less

    • Agent health check now reports unhealthy status until the Agent SVID is fully attested.

    6 details in Everything

18. v1.10.1 Aug 1, 2024 · release notes

    SPIRE v1.10.1 adds AWS RolesAnywhere bundle publishing, Grafana dashboards, and federation endpoint custom certs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.10.1

    • New aws_rolesanywhere_trustanchor BundlePublisher plugin for publishing SPIRE bundles to AWS RolesAnywhere trust anchors.
    • New Grafana dashboard template for monitoring SPIRE deployments.
    • SPIRE UpstreamAuthority now optionally uses Preferred TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. on intermediate authorities.
    • Federation endpoint now supports custom bundles and certificates for authorization.

    4 details in Everything

19. v1.10.0 Jun 24, 2024 · release notes

    SPIRE v1.10.0 adds plugin reconfiguration via plugin_data_file and removes deprecated configs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    • Evicted agents that support reattestation can now reattest without being restarted.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Agents no longer clean up deprecated bundle and SVID files manually; existing deprecated files remain on disk.
20. v1.9.6 May 14, 2024 · release notes

    SPIRE v1.9.6 adds gcp_cloudstorage BundlePublisher, CGroups v2 support, and AWS Org checks for aws_iid attestor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.6 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.9.6

    • Adds gcp_cloudstorage BundlePublisher plugin to export the SPIRE bundle to Google Cloud Storage.
    • Enables opt-in support for CGroups v2 in K8s and Docker workload attestors via the cgroups_v2 config key.
    • Extends the aws_iid node attestor to verify if the AWS account ID is part of an AWS Organization using the aws_org_id config field.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Credential composer no longer converts timestamp-related claims (exp, iat) to floating point values.
21. v1.9.2 Mar 25, 2024 · release notes

    SPIRE v1.9.2 adds AWS RDS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth, runtime log level changes, and retry_bootstrap config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.9.2

    • Adds retry_bootstrap option to SPIRE Agent configuration to retry failed bootstrapping with backoff instead of failing startup
    • Adds support for adjusting the SPIRE Server log level at runtime without restart
    • Adds support for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege.-based authentication with AWS RDS backed databases

    3 details in Everything

22. v1.9.0 Feb 22, 2024 · release notes

    SPIRE v1.9 adds uniqueid CredentialComposer for x509UniqueIdentifier and wildcards in X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVID DNS names

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    └──▷ USE IT
    Inject the x509UniqueIdentifier attribute into issued workload X509-SVIDs using the new Composer plugin.
    yaml copy

    # Add `uniqueid` to your SPIRE Agent's credential_composer section in server_entries.yaml
    # (or equivalent config file path for your deployment)
    credential_composer {
      plugins [
        "uniqueid"
      ]
    }

    Configure SPIRE to issue X509-SVIDs with wildcard DNS names for broader service discovery.
    📍# Set the allow_wildcards_in_dns_names flag to true in your agent configuration entry { dns_name: *.example.com } # Ensure server config allows wildcards if supported by version
    Access the Agent's Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. via its new default location instead of specifying a custom socket path.
    shell copy

    # Use the new default Unix domain socket for Admin API calls
    sudo curl --unix-socket /run/spire/server/api.sock https://localhost/v1/agent/health

    • uniqueid CredentialComposer plugin that adds the x509UniqueIdentifier attribute to workload X509-SVIDs
    • X509-SVIDs minted by SPIRE can now include wildcards in the DNS names
    • Agent's Admin API has now a default location defined

    3 details in Everything

23. v1.8.7 Dec 21, 2023 · release notes

    SPIRE v1.8.7 adds configurable agent availability targets, new SyncAuthorizedEntries RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets., and experimental events-based entry cache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.7 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.8.7

    • Adds availability_target configuration to agents for controlling X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVID rotation aggressiveness based on downtime tolerance
    • Adds use_sync_authorized_entries experimental setting to enable the new SyncAuthorizedEntries RPC for incremental entry synchronization
    • Adds experimental events-based entry cache to reduce database overhead

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Agents no longer maintain agent SVID and bundle information in the legacy paths in the data directory
24. v1.8.5 Nov 22, 2023 · release notes

    spire v1.8.5 adds Azure managed identity support and telemetry hostname labels

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.5 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.8.5

    • Expands azure_msi NodeAttestor plugin to support all credential types supported by Azure
    • Adds EnableHostnameLabel field in Server and Agent telemetry configuration section to add hostname label to metrics

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The use_msi configuration fields in azure_msi NodeAttestor plugin and azure_key_vault KeyManager plugin are deprecated in favor of the chained Azure SDK credential loading strategy
25. v1.8.3 Oct 25, 2023 · release notes

    SPIRE v1.8.3 adds configurable metrics prefix support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.8.3

    • Allow configuring prefixes for all metrics
    • SPIRE Agent distributes sync requests to mitigate thundering herd situations

    2 details in Everything

26. v1.8.0 Sep 20, 2023 · release notes

    spire v1.8.0 adds Azure Key Vault KeyManager, batch entry deletion CLI, and AWS Gov/China support for aws_iid

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • Adds azure_key_vault KeyManager plugin for key storage
    • Enables aws_iid NodeAttestor in AWS Gov Cloud and China regions
    • Adds optional client-controlled Entry IDs for BatchCreateEntry requests
    • Groups Bundle server configuration by endpoint profiles

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed support for Envoy SDS v2 API; ensure proxies use SDS v3 or later
    • !Server no longer cleans up stale data in the database on startup; stale entries must be managed externally
    • !Server no longer deletes entries with invalid SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. IDs on startup; invalid entries will remain until manually removed
27. v1.7.2 Aug 16, 2023 · release notes

    SPIRE v1.7.2 adds AWS S3 BundlePublisher plugin and exposes bundle sequence number in the server endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.7.2

    └──▷ TRY IT
    Fetch the current trust bundle and inspect the sequence number to determine if new registrations exist without full comparison
    copy

    $ curl -s http://localhost:8080/v1/bundle | jq '.bundle_sequence_number'

    • Adds aws_s3 BundlePublisher plugin to push SPIRE trust bundles directly to an Amazon S3 bucket
    • SPIRE Server bundle endpoint now includes the bundle_sequence_number field to track trust anchor rotation

    2 details in Everything

28. v1.7.1 Jul 27, 2023 · release notes

    Adds leaf cert serial selector in x509pop, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cert support for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider, and log source info.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

    • x509pop node attestor emits a new selector with the leaf certificate serial number
    • HTTPS server in the OIDC Discovery Provider can now be configured to use a certificate file
    • Option to log source information in server and agent logs

    3 details in Everything

29. v1.7.0 Jun 14, 2023 · release notes

    SPIRE v1.7.0 adds AWS GovCloud/China support to IID Node Attestor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    • Removes Envoy SDSv2 API (now disabled by default) (#4228)

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Envoy SDSv2 API is now disabled by default; clients relying on SDSv2 must reconfigure or migrate to v3.
30. v1.6.4 May 17, 2023 · release notes

    v1.6.4 adds agent purge command, Systemd Workload Attestor plugin, and BundlePublisher plugin type

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    └──▷ TRY IT
    Remove stale agent records from the datastore using the new subcommand.
    copy

    $ spire-server agent purge

    • Adds new agent purge subcommand for removing stale agent records from the datastore.
    • Introduces the Systemd Workload Attestor plugin for attesting workloads via systemd units.
    • New BundlePublisher plugin type allows publishing SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. bundles to external stores.

    3 details in Everything

31. v1.6.3 Apr 13, 2023 · release notes

    v1.6.3 adds by_can_reattest agent filtering and hint support to Entry API/CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.6.3

    └──▷ TRY IT
    Filter agents by re-attestation capability via the Agent API.
    copy

    $ curl -s http://localhost:8081/v1/agent/by_can_reattest/true

    Create an entry with hint information to indicate intended use.
    copy

    $ spire-server entry create -parentID spiffe://example.org/ns/default/sa/workload -spiffeID spiffe://example.org/ns/default/sa/target --hint "env:prod"

    • spire-server agent CLI commands now display whether agents can be re-attested.
    • Agent APIs support by_can_reattest filtering for querying agent re-attestation status.
    • Entry API and spire-server entry create, spire-server entry show, spire-server entry update CLI commands now accept hint information.

    3 details in Everything

32. v1.6.0 Feb 28, 2023 · release notes

    SPIRE v1.6.0 adds CredentialComposer plugins, sigstore validation, and -output flags to CLI commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Adds CredentialComposer plugin interface for customizing SVID and CA attributes
    • Adds experimental sigstore selectors for validating container image signatures
    • Adds -output flag to spire-server mint, spire-server token generate, and spire-agent api CLI commands
    • Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. architecture support to published scratch images
    • Adds non-root user and default folders to release images

    +1 more show less

    • Adds support for bootstrap bundles in SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. format in the agent

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Non-scratch images are no longer published
    • !k8s-workload-registar is no longer released and maintained
    • !Unused database column x509_svid_ttl from registered_entries table is removed
    • !The deprecated enabled flag from InMem telemetry config is removed
    • !The deprecated default_svid_ttl configurable is removed
    • !The deprecated omit_x509svid_uid configurable is removed
33. v1.5.4 Jan 13, 2023 · release notes

    SPIRE v1.5.4 adds Windows service support and AWS IID selectors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.5.4

    └──▷ TRY IT
    Export federation configuration in JSON format for automated ingestion by orchestration tools.
    copy

    $ spire-server federation show -output json

    • spire-server federation CLI commands now accept the -output flag for structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed..
    • The aws_iid NodeAttestor plugin gains new selectors.

    2 details in Everything

34. v1.5.3 Dec 14, 2022 · release notes

    SPIRE v1.5.3 adds a gcp_kms KeyManager plugin and -output flag to key CLI commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.5.3

    └──▷ TRY IT
    Export server bundle data in a parseable format for automation.
    copy

    $ spire-server bundle -format spiff -output json

    Register a new workload entry and capture the result programmatically.
    copy

    $ spire-server entry create -parentID spiffe://example.org/ns/dev/sa/web -spiffeID spiffe://example.org/ns/prod/sa/api -selector unix:uid:1001 -output yaml

    • gcp_kms KeyManager plugin is now available for encryption at rest
    • -output flag added to spire-server agent, spire-server bundle, and spire-server entry CLI commands

    2 details in Everything

35. v1.5.0 Nov 2, 2022 · release notes

    SPIRE v1.5.0 introduces separate TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. configuration for X.509-SVIDX.509-SVIDAn X.509 certificate formatted to carry a SPIFFE Verifiable Identity Document, binding a cryptographic identity to a workload so cyber tools can authenticate services without passwords or static secrets. and JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. across entries and server defaults.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ TRY IT
    Create an SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. entry with a specific JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token lifetime distinct from the X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate lifetime.
    copy

    $ spire-server entry create -parentID spiffe://example.org/ns/workload/sa/agent -spiffeID spiffe://example.org/app -jwtSVIDTTL 1h -x509SVIDTTL 24h

    Update an existing entry to set the JWT token TTL using the new API field directly.
    shell copy

    curl -X PATCH http://localhost:8081/v1/entry/entry-id-123 -d '{"jwt_svid_ttl": "3600s", "x509_ttl": "86400s"}'

    • Adds jwt_svid_ttl field to the entry protobuf type in the /v1/entry API, allowing separate control of JWT token lifetime from X.509 certificates
    • Allows configuring X.509-SVID and JWT-SVID TTLs independently at both the server default level and per-entry level using new configuration fields

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ttl protobuf field in /v1/entry API is renamed to x509_ttl
    • !The -ttl flag in spire-server entry create and spire-server entry update commands is replaced by -x509SVIDTTL and -jwtSVIDTTL
36. v1.4.4 Oct 5, 2022 · release notes

    SPIRE v1.4.4 adds experimental SVID cache limit and Envoy holdApplicationUntilProxyStarts support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.4.4

    • Adds experimental_svid_cache_max config option to control the maximum number of SVIDs cached by the agent
    • Adds attestation support for Envoy proxy workloads when Istio is configured with holdApplicationUntilProxyStarts: true

    2 details in Everything

37. v1.4.2 Sep 7, 2022 · release notes

    SPIRE v1.4.2 adds unique IDs to X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVID Subject fields and bans agents.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • Agents shut down when banned

    1 detail in Everything

38. v1.4.0 Aug 8, 2022 · release notes

    SPIRE v1.4.0 adds Windows workload attestation on Kubernetes, RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key support for X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVIDs, and anonymous Kubelet auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds windows workload attestation support on Kubernetes to allow workloads running on Windows nodes to be attested via the Kubelet secure port
    • Enables the use of RSA keys for Workload X509-SVIDs via a new config option in the agent configuration
    • Supports anonymous authentication to the Kubelet secure port for workload attestation on Kubernetes via a new flag/option in the node attestor

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The webhook mode has been removed from the k8s-workload-registrar, requiring migration to an alternative registration method
    • !Support for the configmap leader election lock type has been removed from the k8s-workload-registrar, requiring users to switch to a different leader election mechanism
39. v1.3.2 Jul 8, 2022 · release notes

    SPIRE v1.3.2 adds K8s workload attestation for standalone Kubelet and pagination to entry show

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.3.2

    • Adds kubernetes workload attestation support when the Kubelet is run as a standalone component
    • Adds optional health check endpoints to the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider service
    • Adds pagination support to the server entry show command

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SPIRE on Windows no longer automatically creates directories for UDS endpoints.
40. v1.3.1 Jun 9, 2022 · release notes

    SPIRE v1.3.1 adds SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. selector to the Windows workload attestor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

41. v1.3.0 May 12, 2022 · release notes

    v1.3.0 adds Envoy cert validation toggle, Delegated Identity JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. fetch, K8s registrar leader lock config, and Windows support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ USE IT
    Retrieve a JWT SVID and bundle for a specific workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. via the new Delegated Identity API.
    shell copy

    curl -sk -H "Host: spire-agent" https://localhost:14053/v1/delegatedidentity/svid
    
    # To fetch the JWT Bundle:
    curl -sk -H "Host: spire-agent" https://localhost:14053/v1/delegatedidentity/bundle

    • leaderElection resourceLockType in the K8s Workload Registrar configuration to change the Kubernetes resource lock mechanism used for leader election
    • Delegated Identity API endpoints /v1/delegatedidentity/svid (JWT SVID) and /v1/delegatedidentity/bundle (JWT Bundle) allowing workloads to fetch credentials on behalf of other identities
    • Envoy xDS validate_x509 field (default true) in the SPIRE plugin config to revert cert validation to standard X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. when set to false
    • Pre-compiled Windows binaries for the SPIRE Agent

    4 details in Everything

42. v1.2.2 Apr 7, 2022 · release notes

    SPIRE v1.2.2 adds log rotation via SIGUSR2 and downstream workload registration in CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    └──▷ TRY IT
    Rotate SPIRE log files without restarting the process by sending a signal to the PID
    copy

    $ kill -SIGUSR2 <spire-server-pid>

    • Adds SIGUSR2 signal support to SPIRE Server and Agent for log file rotation
    • K8s Workload Registrar CRD mode now supports registering downstream workloads

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SPIRE Server no longer sets the DigitalSignature KeyUsage bit in its CA certificate
43. v1.2.1 Mar 16, 2022 · release notes

    SPIRE Agent fetch jwt command adds JSON output support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    └──▷ TRY IT
    Get a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. in JSON format for automated parsing or integration with other tools.
    copy

    $ spire-agent fetch jwt -format json

44. v1.2.0 Jan 28, 2022 · release notes

    SPIRE v1.2.0 adds admin SVID TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. configuration and fixed admin SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. IDs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Adds agent_svid_ttl config key to SPIRE Server to control minted agent SVID lifetimes

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated domain configurable is removed from the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider
    • !The deprecated allow_unsafe_ids configurable is removed from SPIRE Server
45. advisory CVE-2021-44716 Jan 7, 2022 · issue 128
    • CVE-2021-44716: Unbounded memory usage on exposed HTTP/2 (non-gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.) endpoints (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Before 1.0.3 and 1.1.x before 1.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
46. v1.1.2 Dec 15, 2021 · release notes

    SPIRE v1.1.2 adds Delegated Identity API support, K8s registrar DNS templates, and JWK use property configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.1.2

    • use property now configurable on JWKs served by OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider
    • SPIRE Agent implements the Delegated Identity API endpoint for SVID delegation

    2 details in Everything

47. v1.1.1 Nov 17, 2021 · release notes

    SPIRE Agent v1.1.1 gains native Google Cloud Secrets Manager integration for storing SVIDs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

48. v1.1.0 Oct 10, 2021 · release notes

    SPIRE v1.1.0 adds SVIDStore plugin, TrustDomain API, and multi-cluster K8s Bundle Notifier support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds SVIDStore plugin type to enable agentless workload scenarios with new built-in AWS Secrets Manager integration
    • Implements the TrustDomain API with related CLI commands for managing trust domains via SPIRE Server
    • Enables the K8s Bundle Notifier plugin to push certificates to resources across multiple Kubernetes clusters
    • Introduces issuer:cn selector in TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. DevID Node Attestor emitting the issuing certificate's common name
    • Adds configurable ca_pool setting to the GCP CAS UpstreamAuthority plugin to specify the CA pool location

    +1 more show less

    • Extends CLI agent and entry list commands with new filtering capabilities

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for the deprecated Registration API has been removed
    • !Legacy (v0) plugin support has been removed; all plugins must now be authored using the plugin SDK
    • !The deprecated service_account_whitelist configurables have been removed from the SAT and PSAT Node Attestor plugins
    • !The deprecated projectid_whitelist configurable has been removed from the GCP IIT Node Attestor plugin
    • !The deprecated bundle_endpoint and registration_uds_path configurables have been removed from SPIRE Server
49. v1.0.2 Sep 2, 2021 · release notes

    SPIRE v1.0.2 adds experimental OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. policy support, audit logging, and k8s identity templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.0.2

    • Adds allow_insecure_scheme config option to SPIRE OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider to serve over HTTP
    • Adds new metrics configuration options to filter out specific metrics and labels
    • Enables experimental custom authorization policies based on Open Policy Agent (OPA)
    • Allows SPIRE Server to emit audit logs via configuration
    • Adds identity template support for workload registration in k8s-workload-registrar

    +1 more show less

    • Improves filtering support across server APIs

    6 details in Everything

50. v1.0.1 Aug 5, 2021 · release notes

    SPIRE v1.0.1 adds LDevID TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. attestation, multi-account AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role assumption, and API call logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.0.1

    • Adds the tpm_devid NodeAttestor plugin for LDevID-based TPM attestation
    • Enables aws_iid NodeAttestor to assume AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles for multi-account node attestation
    • Logs caller details for unauthorized Server API calls

    3 details in Everything

51. v1.0.0 Jul 8, 2021 · release notes

    SPIRE v1.0.0 adds cert-manager UpstreamAuthority, SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. federation config, and new Server CLI agents/count/ban commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Ban a specific agent in the SPIRE cluster using the new CLI command.
    copy

    $ spire-server agent ban <agent_id>

    Query the number of registered entries via the new count subcommand.
    copy

    $ spire-server entries count

    • vault UpstreamAuthority plugin now supports Kubernetes service account authentication
    • New cert-manager UpstreamAuthority plugin is available
    • SPIRE Server CLI can now ban agents via new subcommands
    • SPIRE Server CLI adds agents, entries, and bundles count subcommands for listing quantities
    • SPIRE Server federation configured via standard spec fields in the federates_with config block

    +5 more show less

    • SPIFFE bundle endpoint URL is configurable within the federates_with config block
    • SPIRE Agent optionally provides unregistered callers with a bundle via allow_unauthenticated_verifiers configurable
    • SPIRE Server JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. key type independently configurable via jwt_key_type
    • Registration entries can be queried/filtered by federates_with in the entry API
    • SPIRE Server and Agent expose standard gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. health service

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SPIFFE IDs with UTF-8 are no longer supported by SPIRE Server
    • !The legacy Node API is removed from SPIRE Server
    • !The deprecated enable_sds configurable is removed from SPIRE Server
    • !The aws_iid NodeResolver plugin is removed
    • !The noop NodeResolver plugin is removed
52. v0.12.3 May 17, 2021 · release notes

    SPIRE v0.12.3 adds federation support in k8s-workload-registrar and API service CA bundle updates via k8s_bundle notifier.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.12.3

    • k8s-workload-registrar gains federation capability (experimental)
    • k8s_bundle notifier plugin keeps API service CA bundles up to date
    • SPIRE Server internal cache reload timing is now tunable (experimental)

    3 details in Everything

53. v0.12.2 Apr 14, 2021 · release notes

    SPIRE v0.12.2 adds AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. and GCP CAS plugins, disables rate limiting, and improves k8s selectors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.12.2

    • Adds the aws_kms server KeyManager plugin to use AWS Key Management ServiceKey Management ServiceA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
    • Adds the gcp_cas UpstreamAuthority plugin using Google Cloud Platform's Certificate Authority Service
    • Allows disabling rate limiting on X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. signing and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. signing

    3 details in Everything

54. advisory CVE-2021-27099 Mar 4, 2021 · issue 128
    • CVE-2021-27099: Path Normalization issue in aws_iid Node Attestor (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects <0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
55. advisory CVE-2021-27098 Mar 4, 2021 · issue 128
    • CVE-2021-27098: Legacy Node API Allows Impersonation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects 0.8.1-0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
56. v0.12.0 Dec 18, 2020 · release notes

    SPIRE v0.12.0 adds SDS v3, Vault config knobs, CLI stdin JSON, and more

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    └──▷ TRY IT
    Pipe JSON entry definition directly into the CLI to create a workload registration without intermediate files.
    copy

    $ echo '{"entry": {"parent_id": "spiffe://example.org/ns/home/sa/node-agent", "spiffe_id": "spiffe://example.org/app/api", "ttl": 30}}' | spire-server entry create -stdin

    • GET /debug/* debug endpoints added to the server for operational diagnostics.
    • Agent now supports the SDS v3 API (github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3) allowing direct Envoy integration without legacy adapters.
    • vault UpstreamAuthority plugin gains roles, namespaces, and re-authentication configuration keys in its config block for better KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. lifecycle control.
    • vault UpstreamAuthority plugin supports non-renewable tokens via the new non_renewable boolean flag in its configuration.
    • bundle delete subcommand added to the SPIRE Server API for programmatic removal of federated bundles.

    +3 more show less

    • CLI entry commands (entry create, entry update) now accept JSON payloads from STDIN when piped, enabling automation without temp files.
    • x509pop trust bundle plugin supports multiple CA files via the new bundle_files list config key.
    • entry show CLI output includes the ExpiresAt field for verifying certificate lifetime.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The registration_api config section in k8s-workload-registrar is removed; use server_api instead.
    • !Registration and Node APIs are deprecated and will be removed in a future release; existing setups should migrate to the Server API.
57. v0.11.1 Sep 30, 2020 · release notes

    SPIRE v0.11.1 adds AWS PCA configurable CA support and server-side rate limit control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.11.1

    • Adds aws_pca configurable field for specifying additional CA certificates to include in the SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. Trust Bundle
    • Adds server configuration option to disable rate limiting on node attestation requests

    2 details in Everything

58. v0.11.0 Aug 31, 2020 · release notes

    Spire v0.11.0 adds group-based Unix attestation and new CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it./Reconcile modes for K8s Workload Registrar

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Adds crd registration mode to the Kubernetes Workload Registrar for CRD-based entry management
    • Adds reconcile registration mode to the Kubernetes Workload Registrar for controller-based reconciliation
    • Enables Unix workload attestation via auxiliary group membership

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated UpstreamCA plugin is removed; use UpstreamAuthority instead
    • !The deprecated upstream_bundle server config key is removed; the upstream bundle is always used as the trust bundle
    • !The node resolver plugin is deprecated and its functionality is subsumed by the server's AWS node attestor
    • !The DataStore interface pluggability is removed, restricting use to the built-in sql plugin
    • !Unknown config options now cause the server and agent to fail to start instead of being ignored
59. v0.10.1 Jun 23, 2020 · release notes

    SPIRE v0.10.1 adds built-in Vault upstream authority plugin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.10.1

60. v0.10.0 Apr 22, 2020 · release notes

    v0.10.0 adds JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. for nested topologies, a validate CLI subcommand, and the UpstreamAuthority plugin type.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • Adds support for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-SVID in nested SPIRE topologies
    • Adds validate subcommand to the SPIRE Server and SPIRE Agent CLIs to validate the configuration file
    • Introduces new plugin type UpstreamAuthority, which supports both X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-SVID and JWT-SVID as well as the ability to push upstream changes into SPIRE Server
    • Adds environment variable config templating support
    • Adds CreateEntryIfNotExists RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. to Registration API

    +2 more show less

    • Introduces a new RPC PushJWTKeyUpstream in the Node API for publishing JWT-SVID signing keys from downstream servers
    • Introduces a new RPC FetchBundle in the Node API for fetching an up-to-date bundle

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated ttl configurable from upstreamauthority plugins is removed
    • !The upstream_bundle configurable defaults to true and is marked as deprecated
61. v0.9.3 Mar 5, 2020 · release notes

    Spire v0.9.3 adds AWS IID node attestor v2 support, SQL datastore read-only replicas, and paged listing in Registration API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout v0.9.3

    • Adds v2 metadata service support to the AWS IID node attestor
    • Enables SQL datastore plugin usage of read-only replicas via a new configuration option
    • Adds a paginated ListEntries RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. to the Registration API

    3 details in Everything

62. 0.9.2 Jan 14, 2020 · release notes

    SPIRE 0.9.2 adds Web-PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. support for bundle endpoint clients and CA TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. warnings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.9.2

    • Adds Web-PKI authentication support to the bundle endpoint client
    • Adds a warning in SPIRE configuration if the CA TTL results in shorter-than-expected SVID lifetimes

    2 details in Everything

63. 0.9.1 Dec 19, 2019 · release notes

    Spire 0.9.1 adds GCS bundle notifier plugin, unknown config detection, and atomic cache writes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.9.1

    • Adds googlecloudstorage bundle notifier plugin for Server to push trust bundles to Google Cloud Storage
    • Enables detection of unknown configuration options in supported blocks for both Server and Agent

    2 details in Everything

64. 0.9.0 Nov 14, 2019 · release notes

    SPIRE v0.9.0 adds workload executable hash opt-out, SQL migration disable, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery provider, Upstream CA plugin, and custom JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. issuer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.9.0

    • Add disable_hash option to workload selectors to skip executable hashing
    • Add disable_auto_migrate config key to disable SQL auto-migration
    • Add issuer claim configuration for JWT-SVIDs
    • Add new OIDC discovery provider plugin serving JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. from trust domain signing keys
    • Add Upstream CA plugin for AWS Certificate Manager integration

    +1 more show less

    • Add node_id and other details to agent CLI output for attested nodes

    6 details in Everything

65. 0.8.4 Oct 28, 2019 · release notes

    SPIRE 0.8.4 adds Kind support for Kubernetes Workload Attestor and ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. v2 to the bundle endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.8.4

    • Adds Kind cluster support to the Kubernetes Workload Attestor via config key kind_support.
    • Enables ACME v2 protocol support in the bundle endpoint configuration.

    2 details in Everything

66. 0.8.2 Oct 10, 2019 · release notes

    ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. for Web PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. bundle serving, mint subcommand for direct SVID creation, and Kubernetes annotation-based SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. ID assignment.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.8.2

    • sql_datastore_plugin.connection_pool_details config keys allow tuning connection pool settings in the SQL DataStore plugin
    • spire_server.bundle.acme config section allows serving Web PKI bundles via ACME protocol
    • k8s_psat_node_attestor now emits node and pod label selectors for registration entries
    • kubernetes_workload_registrar supports SPIFFE ID assignment based on Kubernetes annotations
    • Registration entries with an expiry are automatically pruned from the datastore

    5 details in Everything

67. 0.8.1 Jul 19, 2019 · release notes

    SPIRE 0.8.1 adds GCP CloudSQL support, experimental federation, K8s Workload Registrar, and JSON logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.8.1

    • Added gcp_iit node attestor that produces selectors for project, zone, instance name, tags, service accounts, metadata and labels
    • Added experimental_federation support for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. federation
    • Added New Kubernetes Workload Registrar that automatically registers Kubernetes workloads
    • Added cloudsql_gcp upstream CA plugin for GCP CloudSQL support
    • Logs can now be emitted in JSON format via the log_format json configuration option

    +1 more show less

    • Plugins can now emit metrics by implementing the new metrics interface

    6 details in Everything

68. 0.8.0 May 20, 2019 · release notes

    SPIRE v0.8.0 introduces Nested SPIRE, Notifier/NodeAttestor plugins, X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. SANs, Prometheus telemetry, and MySQL support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.8.0

    • Adds KubernetesSAT NodeAttestor supporting the TokenReview API
    • Adds SSH NodeAttestor based on SSH certificates
    • Adds Nested SPIRE allowing server clusters to be chained together
    • Adds PSAT Kubernetes NodeAttestor for node specificity
    • Adds AWSSecretManager UpstreamCA plugin

    +8 more show less

    • Adds support for TLS-protected connections to MySQL in the DataStore
    • Adds MySQL support to the SQL DataStore plugin
    • Adds Prometheus, Statsd, and DogStatsd telemetry export for Agent and Server
    • Enables optional CN/DNS SAN inclusion in X.509-SVIDs
    • Enables configurable expiry and automatic pruning for Registration entries
    • Exposes healthcheck commands in both server and agent components
    • Allows plugins to expose auxiliary services and consume host-based services
    • Introduces the v2 client library for Workload API interaction

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Back-compat bundle management code is removed; bundle handling is now performed by the new core logic.
69. 0.7.3 Feb 12, 2019 · release notes

    SPIRE 0.7.3 adds Docker workload attestor, SDS API for cert rotation, and node-entry CLI distinction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.3 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.7.3

    • Agent can now expose Envoy SDS API (Secret Discovery Service) for TLS certificate installation rotation
    • Server gains ability to evict previously-attested agents, allowing immediate removal of stale nodes

    2 details in Everything

70. 0.7.2 Jan 23, 2019 · release notes

    SPIRE 0.7.2 introduces authenticated remote Registration API and multi-node resolver support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.7.2

    └──▷ TRY IT
    Authenticate remote workloads by creating registration entries via the secured API
    copy

    $ curl -X POST https://spire-server:8443/v1/agent/svid/register -H 'Authorization: Bearer <token>' -d '{"entry": {}}'

    • Adds authentication to the Registration API, enabling remote registration of workloads
    • Enables Server to use multiple node resolvers for heterogeneous infrastructure

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Agent can no longer specify the X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. Subject value; values must be defined via Registration Entries
71. 0.7.1 Dec 20, 2018 · release notes

    SPIRE 0.7.1 adds telemetry to server, prevents trust domain changes, and improves CLI TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. display

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.7.1

    • Introduces new telemetry points in the SPIRE server for operational monitoring (#640)
    • CLI utilities print default instead of 0 for TTL values when not explicitly set, improving visibility (#645)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Attestation now fails if NodeResolver encounters an error, potentially breaking setups where resolver errors were previously ignored or handled differently (#634)
72. 0.7.0 Nov 9, 2018 · release notes

    SPIRE 0.7.0 adds basic federation, Kubernetes/Azure/UNIX node attestors, and a KeyManager plugin interface.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    • basic federation support for distributing trust across SPIRE clusters
    • Kubernetes node attestor (nodeattestor.k8s/sa) enabling workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. via Service Accounts
    • Azure node attestor and resolver plugins for Azure VM workloads
    • UNIX attestor enhancements: returns effective user/group name, binary path, and sha256 hash
    • Workload API now returns intermediate X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. chains in the SVID bundle

    +3 more show less

    • KeyManager plugin interface (server.keymanager.*) allowing custom key storage backends
    • Disk KeyManager server plugin (keymanager.disk) for local key management
    • nodeattestor.k8s/sa selector support for node attestors to return selectors

    8 details in Everything

73. 0.6.2 Sep 12, 2018 · release notes

    Adds Azure node attestation/resolution, HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy support, and Node API ratelimiting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.2 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.6.2

    • Added azure as a supported provider for node attestation
    • Added azure as a supported provider for node resolution
    • Added support for http and https CONNECT proxies for SPIRE communication
    • Added configurable ratelimiting to the Node API

    4 details in Everything

74. 0.6.1 Jul 27, 2018 · release notes

    SPIRE 0.6.1 adds supplemental selectors for node attestors and disk persistence for ServerCA keys

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.1 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.6.1

    • Introduces the persist_to_disk config option under server.ca_type.server "memory" to optionally write Server CA private keys to disk instead of keeping them in RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. only

    1 detail in Everything

75. 0.6.0 Jun 26, 2018 · release notes

    SPIRE 0.6.0 adds GCP IIT and X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. Proof-of-Possession attestation, challenge/response API support, and PostgresSQL datastore plugin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds GCP Instance Identity Token (IIT) node attestation.

    1 detail in Everything

76. 0.5 Apr 5, 2018 · release notes

    SPIRE v0.5 adds PrintBundlePEM to the server CLI and configurable bundle distribution for workload federation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.5

    └──▷ TRY IT
    Export the SPIRE server's CA bundle for manual federation with external trust domains.
    copy

    $ spire-server print-bundle > spiffe-ca-bundle.pem

    • spire-server print-bundle outputs the server's CA bundle in PEM format to standard output.
    • Adds a configuration option (previously implicit or default behavior) to distribute the full certificate chain instead of just the leaf certificate.

    2 details in Everything

77. 0.4 Feb 2, 2018 · release notes

    spire-server CLI gains CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for registration entries; unified config format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4 https://github.com/spiffe/spire.git
    # already have the repo? check out this version:
    $ git checkout 0.4

    └──▷ TRY IT
    Inspect existing registration entries via the new unified CLI interface
    copy

    $ spire-server register list

    • Adds register subcommand(s) to spire-server CLI for creating, reading, updating and deleting registration entries

    1 detail in Everything