https://cybertoolchain.io/tools/spire New releases and features in spire, tracked by The Cyber Toolchain. en Thu, 15 Oct 2026 21:20:04 GMT https://github.com/spiffe/spire/releases/tag/v1.15.4 https://github.com/spiffe/spire/releases/tag/v1.15.4 Thu, 15 Oct 2026 21:20:04 GMT SPIRE v1.15.4 adds configurable TLS policies for TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports configuring TLS policies to be applied to TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.15.3 https://github.com/spiffe/spire/releases/tag/v1.15.3 Fri, 21 Aug 2026 14:26:18 GMT SPIRE v1.15.3 adds a Slurm workload attestor, Azure Blob bundle publisher, and several new agent configuration options. • Adds `trust_bundle_spiffe_workload_api` agent configuration option to fetch the initial trust bundle from a Workload API endpoint, simplifying nested agent deployments. • Adds `disable_workload_api` and `disable_sds_api` agent options to disable the Workload API and SDS APIs on the public endpoint. • Adds `disable_kubelet_client` option for the `k8s` workload attestor. • Adds `use_pod_uid_for_agent_id` option in the `k8s_psat` node attestor to derive agent IDs from pod UIDs instead of node UIDs. • Adds opt-in `enable_namespace_labels` option in the `k8s` workload attestor, producing `ns-label` selectors from namespace labels. • Adds `account_list_file` option in the `aws_iid` node attestor to source the `verify_organization` account list from a file instead of the AWS Organizations API. • Adds `debug getinfo` subcommand in the `spire-server` and `spire-agent` CLIs to access the Debug APIs. • New `azure_blob` BundlePublisher plugin for publishing the trust bundle to Azure Blob Storage. • New Slurm workload attestor. • Adds WIT-SVID building support in the `svid.v1` API client and marshalling support for WIT-SVID keys. • The Broker API endpoint is now included in health checks when enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.15.2 https://github.com/spiffe/spire/releases/tag/v1.15.2 Thu, 09 Jul 2026 20:07:55 GMT SPIRE v1.15.2 adds SPIFFE Broker, PQC curve support, per-caller rate limiting, and TLS-secured Prometheus metrics. • Adds configurable JTI claim inclusion in JWT-SVIDs at the entry level. • Introduces experimental per-caller rate limiting for the agent Workload API and Envoy SDS. • Adds TLS support for the Prometheus metrics endpoint using a SPIRE SVID, with an optional SPIFFE ID allowlist. • Adds optional verification of client certificate IPs in the `x509pop` node attestor. • Introduces the SPIFFE Broker endpoint and API. • Adds `disable_group_name_selectors` option for the Windows workload attestor. • Adds `log_selectors` configuration item for the agent. • Supports two additional post-quantum cryptography (PQC) curves. • Adds tag-based key discovery support in the `aws_kms` Key Manager plugin. • Introduces a Logger service for `spire-agent`. • Adds configurable batch size for pruning attested nodes. • Deprecation warnings now use dedicated log markers for easier detection. • Post-quantum cryptography policy is now applied to the bundle endpoint and Prometheus server. • Attested nodes are now fetched in bulk, reducing database load in large deployments. • Optimizes MySQL list entries query to reduce database CPU usage under load. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.15.0 https://github.com/spiffe/spire/releases/tag/v1.15.0 Tue, 19 May 2026 17:24:58 GMT SPIRE v1.15.0 adds HashiCorp Vault Key Manager, rootless Podman attestation, PROXY protocol support, and more. • New `account_id` selector for the `aws_iid` node attestor enables scoping attestation to specific AWS accounts. • TLS support added to the Prometheus metrics sink for encrypted metric scraping. • Supports marking registration entry X509-SVIDs as non-prefetchable to control caching behavior. • Docker workload attestor now supports rootless Podman environments. • PROXY protocol support added for correct rate limiting when SPIRE sits behind load balancers. • Agents can now fetch the X509-SVID for SPIFFE attestation mode directly from the Workload API socket. • `iss` claim support added for JWT-SVIDs (WIT-SVIDs). • Instance flag support added to `spire-server` and `spire-agent` CLIs for multi-instance deployments. • Experimental optional `spiffe_id` node selector added to enable aliasing individual nodes. • New HashiCorp Vault Key Manager plugin for storing SPIRE signing keys in Vault. • `sigstore` support in Kubernetes and Docker workload attestors promoted out of experimental. • `gcp_iit` node attestor now derives service account email from the identity token, removing dependency on `use_instance_metadata`. Breaking changes: • The JSON output of the CLI no longer wraps objects in slices when printing; any tooling that parses CLI JSON output may break. • A metric label is renamed from `bootstraped` to `bootstrapped`; any dashboards or alerts keyed on the old label name will stop matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.14.3 https://github.com/spiffe/spire/releases/tag/v1.14.3 Wed, 18 Mar 2026 13:38:16 GMT SPIRE v1.14.3 adds agent version visibility, standardizes post-quantum KEM, and doubles OPA policy evaluation performance. • Adds `spire-agent` version reporting to `spire-server` via the PostStatus API, now visible in `GetAgent`/`ListAgents` CLI output. • The `RequirePQKEM` TLS policy now uses the standardized `X25519MLKEM768` algorithm instead of the draft `x25519Kyber768Draft00`. • OPA policy evaluation performance improved by approximately 2× through use of partial evaluation. • Selectors are no longer logged at the agent level, preventing potential leakage of sensitive information. Breaking changes: • The `RequirePQKEM` TLS policy switches from `x25519Kyber768Draft00` to `X25519MLKEM768`; any peer or configuration that negotiated the draft KEM will no longer be compatible. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.14.1 https://github.com/spiffe/spire/releases/tag/v1.14.1 Thu, 15 Jan 2026 18:54:44 GMT SPIRE Server on Windows now supports persistent arguments in the service binPath for automatic startup. • Supports persistent arguments in the Windows service binPath for automatic SPIRE Server startup. • The `uptime_in_ms` gauge metric now reports float64 precision instead of integer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.14.0 https://github.com/spiffe/spire/releases/tag/v1.14.0 Thu, 11 Dec 2025 22:27:36 GMT SPIRE v1.14.0 adds Azure IMDS node attestation, AWS KMS key tagging, ec-p384 curve support, and expanded docker/GCP capabilities. • New `azure_imds` node attestor plugin attests nodes running in Microsoft Azure using the Azure Instance Metadata Service (IMDS). • AWS KMS key manager plugin now supports key tagging. • JWT-SVID profile on spire-server can now be disabled via the `disable_jwt_svids` config option. • `spire-server validate` now supports validating plugin configuration. • Adds support for the `ec-p384` curve in the `workload_x509_svid_key_type` configuration option in spire-agent. • Docker workload attestor now supports the `docker:image_config_digest` selector. • GCP CAs now specify a `certificate_id` in `CreateCertificateRequest` for Enterprise tier compatibility. • GCP cloudsql-proxy can now be used with PostgreSQL. • KeyManager directory is now validated to exist and be writeable on agent startup. Breaking changes: • The deprecated `retry_rebootstrap` agent config option has been removed; any working configuration using it will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.13.3 https://github.com/spiffe/spire/releases/tag/v1.13.3 Thu, 23 Oct 2025 13:05:05 GMT SPIRE v1.13.3 adds file-based join tokens, caller-path Rego filtering, and absolute X.509 CA expiry metrics. • New X.509 CA metric exposes absolute expiration time, complementing the existing TTL-based metric. • New `spire-agent` configuration option sources join tokens from files, enabling integration with third-party credential providers. • New capability to filter on caller path in `spire-server` Rego authorization policies. • `spire-server` now uses SHA-256 for X.509-SVID Subject Key Identifiers when `GODEBUG` contains `fips140=only`. • `oidc-discovery-provider` now fails to initialize when started with unrecognized arguments, surfacing misconfigurations at startup. Breaking changes: • `oidc-discovery-provider` now refuses to start when passed unrecognized arguments; previously unrecognized arguments were silently ignored, so any deployment passing extra flags will fail on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.13.1 https://github.com/spiffe/spire/releases/tag/v1.13.1 Thu, 18 Sep 2025 18:36:52 GMT SPIRE v1.13.1 adds EKS cluster verification for aws_iid, configurable node-info caching, and refresh hints for bundle publishers. • Enables `aws_iid` NodeAttestor to verify that attesting nodes belong to specified EKS clusters. • Adds server-side configuration for how long attested node information is cached, reducing node fetch dependency for RPCs. • Adds refresh hint support to `aws_s3`, `gcp_cloudstorage`, and `k8s_configmap` BundlePublisher plugins for published bundles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.12.4 https://github.com/spiffe/spire/releases/tag/v1.12.4 Tue, 01 Jul 2025 21:39:47 GMT SPIRE v1.12.4 adds a Kubernetes ConfigMap bundle publisher, a new streaming bundle RPC, and file-based trust bundle support for the OIDC Discovery Provider. • New `k8s_configmap` BundlePublisher plugin lets SPIRE Server publish trust bundles directly to a Kubernetes ConfigMap. • New `UpstreamAuthority.SubscribeToLocalBundle` RPC enables streaming updates of the local trust bundle to upstream authority plugins. • OIDC Discovery Provider can now read the trust bundle from a file, removing the dependency on a live SPIRE Server endpoint. • Integration tests now run on ARM64, broadening validated platform coverage. • Improved entry lookup performance in the SPIRE Server. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.12.1 https://github.com/spiffe/spire/releases/tag/v1.12.1 Wed, 07 May 2025 15:40:24 GMT SPIRE v1.12.1 adds Unix socket support for trust bundle URLs and renames the SQL transaction timeout config key. • Supports Unix sockets in trust bundle URLs, enabling local socket-based bundle federation. • Improves events-based cache performance via batch fetching of updated entries (experimental). Breaking changes: • The `sql_transaction_timeout` config key is replaced by `event_timeout` and its default value is reduced to 15 minutes — existing configurations using `sql_transaction_timeout` will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.12.0 https://github.com/spiffe/spire/releases/tag/v1.12.0 Fri, 21 Mar 2025 19:39:35 GMT SPIRE v1.12.0 adds S3-compatible storage support, Rego V1 policy engine, and SAN-based node attestation selectors. • Supports any S3-compatible object storage (e.g., MinIO) in the `aws_s3` BundlePublisher plugin, not just AWS S3. • Supports Rego V1 syntax in the authorization policy engine. • Adds SAN-based selectors in the `x509pop` NodeAttestor plugin for finer-grained node attestation. • Agents now use the SyncAuthorizedEntries API for periodic entry synchronization by default. • Log timestamps now include nanosecond precision. • Experimental events-based cache now supports reading from read-only database replicas when data staleness is tolerated, improving read performance. Breaking changes: • The `use_legacy_downstream_x509_ca_ttl` server setting now defaults to `false`; deployments relying on legacy downstream X.509 CA TTL behavior must explicitly set it to `true` or migrate. • The deprecated `k8s_sat` NodeAttestor plugin has been removed; deployments using it must migrate to an alternative node attestor before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.11.2 https://github.com/spiffe/spire/releases/tag/v1.11.2 Thu, 13 Feb 2025 21:08:41 GMT SPIRE v1.11.2 adds multi-region GCP Secret Manager support, OIDC Discovery Provider config flexibility, and optional trust_domain metrics labeling. • Adds multi-region support to the `gcp_secretmanager` SVIDStore plugin, letting operators specify which regions secrets are created in. • Supports environment variable expansion in the OIDC Discovery Provider configuration. • Enables an optional `trust_domain` label on all metrics for finer-grained observability. • Allows the JWKS URI returned in the OIDC Discovery Provider discovery document to be explicitly configured. • Adds support for specifying a server path prefix in the OIDC Discovery Provider. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.11.1 https://github.com/spiffe/spire/releases/tag/v1.11.1 Thu, 12 Dec 2024 19:48:53 GMT SPIRE v1.11.1 adds SPRIG template functions, configurable JWT-SVID cache, and a configurable JWT issuer in the OIDC Discovery Provider. • Adds SPRIG library functions to the Go text/template engine available in SPIRE plugins, expanding templating power for plugin authors. • Makes the JWT-SVID cache in the SPIRE agent configurable, giving operators control over cache sizing and behaviour. • Enables a configurable JWT issuer (`jwt_issuer`) in the OIDC Discovery Provider, allowing operators to override the default issuer claim. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.11.0 https://github.com/spiffe/spire/releases/tag/v1.11.0 Thu, 24 Oct 2024 20:08:59 GMT SPIRE v1.11.0 adds forced rotation/revocation, a new EJBCA UpstreamAuthority plugin, and config-file variable support. • Adds forced rotation and revocation support for SVIDs. • New EJBCA UpstreamAuthority plugin for SPIRE Server enables issuing SVIDs via an EJBCA CA. • Supports variables in templates within the SPIRE config file. • Supports configuration validation RPC on all built-in plugins. • Improves CPU and memory usage for concurrent Kubernetes Workload attestation. • Enables CGroups v2 support in Kubernetes and Docker workload attestors by default. • SPIRE Agent LRU identity cache is now always enabled, with size controllable via `x509_svid_cache_max_size`. Breaking changes: • The deprecated `-ttl` flag has been removed from the SPIRE Server `entry create` and `entry update` commands; commands using `-ttl` will break. • Official support for MySQL 5.X has been dropped; no explicit testing will be performed against this version. • The SPIRE Agent LRU identity cache is now unconditionally enabled; any configuration that previously disabled it will no longer have that effect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.10.2 https://github.com/spiffe/spire/releases/tag/v1.10.2 Tue, 03 Sep 2024 13:48:07 GMT SPIRE v1.10.2 adds HTTP challenge node attestation, Sigstore container image validation, and event-cache metrics. • New `http_challenge` NodeAttestor plugin enables node attestation via HTTP challenge. • Experimental Sigstore selector support in the Docker Workload Attestor allows validation of container image signatures. • New metrics for monitoring the event-based cache. • Delegated Identity API now supports subscription by process ID. • Agent Debug endpoint now counts SVIDs broken down by type. • Agent health check now reports unhealthy status until the Agent SVID is fully attested. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.10.1 https://github.com/spiffe/spire/releases/tag/v1.10.1 Thu, 01 Aug 2024 20:02:16 GMT SPIRE v1.10.1 adds AWS RolesAnywhere bundle publishing, Grafana dashboards, and federation endpoint custom certs • New `aws_rolesanywhere_trustanchor` BundlePublisher plugin for publishing SPIRE bundles to AWS RolesAnywhere trust anchors. • New Grafana dashboard template for monitoring SPIRE deployments. • SPIRE UpstreamAuthority now optionally uses Preferred TTL on intermediate authorities. • Federation endpoint now supports custom bundles and certificates for authorization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.10.0 https://github.com/spiffe/spire/releases/tag/v1.10.0 Mon, 24 Jun 2024 14:13:22 GMT SPIRE v1.10.0 adds plugin reconfiguration via `plugin_data_file` and removes deprecated configs • Evicted agents that support reattestation can now reattest without being restarted. Breaking changes: • Agents no longer clean up deprecated bundle and SVID files manually; existing deprecated files remain on disk. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.9.6 https://github.com/spiffe/spire/releases/tag/v1.9.6 Tue, 14 May 2024 21:46:51 GMT SPIRE v1.9.6 adds `gcp_cloudstorage` BundlePublisher, CGroups v2 support, and AWS Org checks for `aws_iid` attestor • Adds `gcp_cloudstorage` BundlePublisher plugin to export the SPIRE bundle to Google Cloud Storage. • Enables opt-in support for CGroups v2 in K8s and Docker workload attestors via the `cgroups_v2` config key. • Extends the `aws_iid` node attestor to verify if the AWS account ID is part of an AWS Organization using the `aws_org_id` config field. Breaking changes: • Credential composer no longer converts timestamp-related claims (`exp`, `iat`) to floating point values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.9.2 https://github.com/spiffe/spire/releases/tag/v1.9.2 Mon, 25 Mar 2024 21:14:22 GMT SPIRE v1.9.2 adds AWS RDS IAM auth, runtime log level changes, and `retry_bootstrap` config. • Adds `retry_bootstrap` option to SPIRE Agent configuration to retry failed bootstrapping with backoff instead of failing startup • Adds support for adjusting the SPIRE Server log level at runtime without restart • Adds support for AWS IAM-based authentication with AWS RDS backed databases Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.9.0 https://github.com/spiffe/spire/releases/tag/v1.9.0 Thu, 22 Feb 2024 22:40:28 GMT SPIRE v1.9 adds `uniqueid` CredentialComposer for x509UniqueIdentifier and wildcards in X509-SVID DNS names • `uniqueid` CredentialComposer plugin that adds the x509UniqueIdentifier attribute to workload X509-SVIDs • X509-SVIDs minted by SPIRE can now include wildcards in the DNS names • Agent's Admin API has now a default location defined Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.8.7 https://github.com/spiffe/spire/releases/tag/v1.8.7 Thu, 21 Dec 2023 19:45:00 GMT SPIRE v1.8.7 adds configurable agent availability targets, new SyncAuthorizedEntries RPC, and experimental events-based entry cache. • Adds `availability_target` configuration to agents for controlling X509-SVID rotation aggressiveness based on downtime tolerance • Adds `use_sync_authorized_entries` experimental setting to enable the new SyncAuthorizedEntries RPC for incremental entry synchronization • Adds experimental events-based entry cache to reduce database overhead Breaking changes: • Agents no longer maintain agent SVID and bundle information in the legacy paths in the data directory Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.8.5 https://github.com/spiffe/spire/releases/tag/v1.8.5 Wed, 22 Nov 2023 22:09:56 GMT spire v1.8.5 adds Azure managed identity support and telemetry hostname labels • Expands `azure_msi` NodeAttestor plugin to support all credential types supported by Azure • Adds `EnableHostnameLabel` field in Server and Agent `telemetry` configuration section to add hostname label to metrics Breaking changes: • The `use_msi` configuration fields in `azure_msi` NodeAttestor plugin and `azure_key_vault` KeyManager plugin are deprecated in favor of the chained Azure SDK credential loading strategy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.8.3 https://github.com/spiffe/spire/releases/tag/v1.8.3 Wed, 25 Oct 2023 21:26:30 GMT SPIRE v1.8.3 adds configurable metrics prefix support • Allow configuring prefixes for all metrics • SPIRE Agent distributes sync requests to mitigate thundering herd situations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.8.0 https://github.com/spiffe/spire/releases/tag/v1.8.0 Wed, 20 Sep 2023 17:39:09 GMT spire v1.8.0 adds Azure Key Vault KeyManager, batch entry deletion CLI, and AWS Gov/China support for aws_iid • Adds `azure_key_vault` KeyManager plugin for key storage • Enables `aws_iid` NodeAttestor in AWS Gov Cloud and China regions • Adds optional client-controlled Entry IDs for BatchCreateEntry requests • Groups Bundle server configuration by endpoint profiles Breaking changes: • Removed support for Envoy SDS v2 API; ensure proxies use SDS v3 or later • Server no longer cleans up stale data in the database on startup; stale entries must be managed externally • Server no longer deletes entries with invalid SPIFFE IDs on startup; invalid entries will remain until manually removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.7.2 https://github.com/spiffe/spire/releases/tag/v1.7.2 Wed, 16 Aug 2023 22:31:30 GMT SPIRE v1.7.2 adds AWS S3 BundlePublisher plugin and exposes bundle sequence number in the server endpoint • Adds `aws_s3` `BundlePublisher` plugin to push SPIRE trust bundles directly to an Amazon S3 bucket • SPIRE Server bundle endpoint now includes the `bundle_sequence_number` field to track trust anchor rotation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.7.1 https://github.com/spiffe/spire/releases/tag/v1.7.1 Thu, 27 Jul 2023 23:06:32 GMT Adds leaf cert serial selector in x509pop, HTTPS cert support for OIDC Discovery Provider, and log source info. • x509pop node attestor emits a new selector with the leaf certificate serial number • HTTPS server in the OIDC Discovery Provider can now be configured to use a certificate file • Option to log source information in server and agent logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.7.0 https://github.com/spiffe/spire/releases/tag/v1.7.0 Wed, 14 Jun 2023 21:09:11 GMT SPIRE v1.7.0 adds AWS GovCloud/China support to IID Node Attestor • Removes Envoy SDSv2 API (now disabled by default) (#4228) Breaking changes: • Envoy SDSv2 API is now disabled by default; clients relying on SDSv2 must reconfigure or migrate to v3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.6.4 https://github.com/spiffe/spire/releases/tag/v1.6.4 Wed, 17 May 2023 21:56:54 GMT v1.6.4 adds `agent purge` command, Systemd Workload Attestor plugin, and BundlePublisher plugin type • Adds new `agent purge` subcommand for removing stale agent records from the datastore. • Introduces the Systemd Workload Attestor plugin for attesting workloads via systemd units. • New `BundlePublisher` plugin type allows publishing SPIFFE bundles to external stores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.6.0 https://github.com/spiffe/spire/releases/tag/v1.6.0 Tue, 28 Feb 2023 21:24:31 GMT SPIRE v1.6.0 adds CredentialComposer plugins, sigstore validation, and -output flags to CLI commands • Adds `CredentialComposer` plugin interface for customizing SVID and CA attributes • Adds experimental `sigstore` selectors for validating container image signatures • Adds `-output` flag to `spire-server mint`, `spire-server token generate`, and `spire-agent api` CLI commands • Adds ARM64 architecture support to published scratch images • Adds non-root user and default folders to release images • Adds support for bootstrap bundles in SPIFFE format in the agent Breaking changes: • Non-scratch images are no longer published • `k8s-workload-registar` is no longer released and maintained • Unused database column `x509_svid_ttl` from `registered_entries` table is removed • The deprecated `enabled` flag from InMem telemetry config is removed • The deprecated `default_svid_ttl` configurable is removed • The deprecated `omit_x509svid_uid` configurable is removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.5.4 https://github.com/spiffe/spire/releases/tag/v1.5.4 Fri, 13 Jan 2023 01:15:54 GMT SPIRE v1.5.4 adds Windows service support and AWS IID selectors • `spire-server federation` CLI commands now accept the `-output` flag for structured output. • The `aws_iid` NodeAttestor plugin gains new selectors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.5.3 https://github.com/spiffe/spire/releases/tag/v1.5.3 Wed, 14 Dec 2022 21:52:18 GMT SPIRE v1.5.3 adds a gcp_kms KeyManager plugin and `-output` flag to key CLI commands • `gcp_kms` KeyManager plugin is now available for encryption at rest • `-output` flag added to `spire-server agent`, `spire-server bundle`, and `spire-server entry` CLI commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.5.0 https://github.com/spiffe/spire/releases/tag/v1.5.0 Wed, 02 Nov 2022 22:39:27 GMT SPIRE v1.5.0 introduces separate TTL configuration for X.509-SVID and JWT-SVID across entries and server defaults. • Adds `jwt_svid_ttl` field to the entry protobuf type in the `/v1/entry` API, allowing separate control of JWT token lifetime from X.509 certificates • Allows configuring X.509-SVID and JWT-SVID TTLs independently at both the server default level and per-entry level using new configuration fields Breaking changes: • The `ttl` protobuf field in `/v1/entry` API is renamed to `x509_ttl` • The `-ttl` flag in `spire-server entry create` and `spire-server entry update` commands is replaced by `-x509SVIDTTL` and `-jwtSVIDTTL` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.4.4 https://github.com/spiffe/spire/releases/tag/v1.4.4 Wed, 05 Oct 2022 19:23:04 GMT SPIRE v1.4.4 adds experimental SVID cache limit and Envoy holdApplicationUntilProxyStarts support • Adds `experimental_svid_cache_max` config option to control the maximum number of SVIDs cached by the agent • Adds attestation support for Envoy proxy workloads when Istio is configured with `holdApplicationUntilProxyStarts: true` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.4.2 https://github.com/spiffe/spire/releases/tag/v1.4.2 Wed, 07 Sep 2022 19:41:49 GMT SPIRE v1.4.2 adds unique IDs to X509-SVID Subject fields and bans agents. • Agents shut down when banned Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.3.2 https://github.com/spiffe/spire/releases/tag/v1.3.2 Fri, 08 Jul 2022 19:12:04 GMT SPIRE v1.3.2 adds K8s workload attestation for standalone Kubelet and pagination to entry show • Adds `kubernetes` workload attestation support when the Kubelet is run as a standalone component • Adds optional health check endpoints to the OIDC Discovery Provider service • Adds pagination support to the server `entry show` command Breaking changes: • SPIRE on Windows no longer automatically creates directories for UDS endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.3.0 https://github.com/spiffe/spire/releases/tag/v1.3.0 Thu, 12 May 2022 15:52:00 GMT v1.3.0 adds Envoy cert validation toggle, Delegated Identity JWT fetch, K8s registrar leader lock config, and Windows support • `leaderElection` `resourceLockType` in the K8s Workload Registrar configuration to change the Kubernetes resource lock mechanism used for leader election • Delegated Identity API endpoints `/v1/delegatedidentity/svid` (JWT SVID) and `/v1/delegatedidentity/bundle` (JWT Bundle) allowing workloads to fetch credentials on behalf of other identities • Envoy xDS `validate_x509` field (default `true`) in the SPIRE plugin config to revert cert validation to standard X.509 when set to `false` • Pre-compiled Windows binaries for the SPIRE Agent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.2.2 https://github.com/spiffe/spire/releases/tag/v1.2.2 Thu, 07 Apr 2022 20:39:47 GMT SPIRE v1.2.2 adds log rotation via SIGUSR2 and downstream workload registration in CRD mode • Adds `SIGUSR2` signal support to SPIRE Server and Agent for log file rotation • K8s Workload Registrar CRD mode now supports registering "downstream" workloads Breaking changes: • SPIRE Server no longer sets the `DigitalSignature` KeyUsage bit in its CA certificate Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.2.1 https://github.com/spiffe/spire/releases/tag/v1.2.1 Wed, 16 Mar 2022 22:07:49 GMT SPIRE Agent `fetch jwt` command adds JSON output support • Adds `json` format to SPIRE Agent's `fetch jwt` CLI command for structured JWT responses Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.2.0 https://github.com/spiffe/spire/releases/tag/v1.2.0 Fri, 28 Jan 2022 19:58:16 GMT SPIRE v1.2.0 adds admin SVID TTL configuration and fixed admin SPIFFE IDs. • Adds `agent_svid_ttl` config key to SPIRE Server to control minted agent SVID lifetimes Breaking changes: • The deprecated `domain` configurable is removed from the OIDC Discovery Provider • The deprecated `allow_unsafe_ids` configurable is removed from SPIRE Server Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.1.2 https://github.com/spiffe/spire/releases/tag/v1.1.2 Wed, 15 Dec 2021 21:10:25 GMT SPIRE v1.1.2 adds Delegated Identity API support, K8s registrar DNS templates, and JWK use property configuration. • `use` property now configurable on JWKs served by OIDC Discovery Provider • SPIRE Agent implements the Delegated Identity API endpoint for SVID delegation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire https://github.com/spiffe/spire/releases/tag/v1.1.1 https://github.com/spiffe/spire/releases/tag/v1.1.1 Wed, 17 Nov 2021 20:18:51 GMT SPIRE Agent v1.1.1 gains native Google Cloud Secrets Manager integration for storing SVIDs • SPIRE Agent can now store SVIDs with Google Cloud Secrets Manager Full history on Cyber Toolchain: https://cybertoolchain.io/tools/spire