sabsari and Claude Opus 4.8
203183f73c
Add externalSecret support to spire-server kubeConfigs ( #889 )
...
Allow each kubeConfigs entry to reference an externally-managed Secret
(externalSecret{name,key}) instead of embedding the kubeconfig in values.
Entries may reference different Secrets and mix inline with external ones.
The kubeconfigs volume becomes a projected volume; consumer mount paths are
unchanged. Each entry must set exactly one of kubeConfig, kubeConfigBase64,
or externalSecret.
Signed-off-by: sabsari <[email protected] [email protected]
2026-07-29 08:07:39 -07:00
kfox1111
952cbedbff
Broker updates ( #882 )
...
* Broker updates
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-07-21 18:28:14 -07:00
kfox1111 and Faisal Memon
f548e05899
Automatically label clusterspiffeids with their class name ( #877 )
...
* Automatically label clusterspiffeids with their class name
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected]
2026-07-14 14:57:46 -07:00
kfox1111 and Matheus Pimenta
bf6b36c807
SPIRE Agent support for Broker API ( #876 )
...
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-07-14 13:46:19 -07:00
sabsari and Claude Opus 4.8
cc164bad6b
Add EJBCA UpstreamAuthority plugin support to spire-server chart ( #873 )
...
Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE
server to use an EJBCA instance as its upstream CA over mTLS.
- Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName,
certificateProfileName, optional endEntityName and accountBindingId).
- Render the ejbca UpstreamAuthority block in the server config and count it
toward the single-upstream-authority guard.
- Mount the mTLS client credentials (and optional CA cert) from a secret,
either chart-created (secret.create) or externally provided.
- Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle
handling for deterministic rendering.
- Regenerate the chart README and add a unit render test.
Signed-off-by: sabsari <[email protected] [email protected]
2026-07-13 01:14:37 +00:00
kfox1111
0d6894037c
Bump spire to 1.15.2 ( #875 )
...
Signed-off-by: Kevin Fox <[email protected]
2026-07-12 16:44:15 -07:00
kfox1111
af6533d764
We havent released 0.30.0 yet. Merge notes. ( #869 )
2026-07-05 14:13:45 -07:00
kfox1111
e44f006dde
Experimental support for spire-identity-exchange ( #860 )
...
* Experimental support for spire-identity-exchange
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-07-05 07:49:12 -07:00
Daniel Schlatter and kfox1111
21bcece2ac
add config to allow disabling jwt svids ( #864 )
...
Signed-off-by: Daniel Schlatter <[email protected] [email protected]
2026-07-02 14:57:29 -07:00
kfox1111
7687339420
Enable easy plugin loading ( #859 )
...
* Enable easy plugin loading
customPluings have to be loaded into the main container somehow. Extend
the existing cel plugin loader to allow users to easily specify an image
to load it from.
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-06-25 22:49:42 -07:00
Guillermo Gaston and kfox1111
4f8ac5af06
Configure jwt_issuer in SPIRE OIDC Provider ( #829 )
...
The SPIRE OIDC Discovery Provider binary supports a top-level
`jwt_issuer` configuration key. When set, the provider returns that
exact string as the `issuer` field in the OIDC discovery document
(`.well-known/openid-configuration`) regardless of how the request was
routed. When unset, it derives `issuer` from the inbound HTTP Host
header. This chart did not render that key into the OIDC provider
config, leaving the discovery document Host-derived even when the
operator had a fixed issuer in mind.
Why this matters
OpenID Connect Discovery requires the discovery doc's `issuer` to be
byte-equal to the JWT `iss` claim. Conformant verifiers reject the chain
when the two differ. Production OIDC consumers routinely reach the
discovery endpoint at a URL different from the canonical issuer:
- a load balancer, ingress, or NodePort exposes the provider on an
IP or host different from the canonical issuer name;
- TLS terminates at a hostname different from the one advertised to
clients;
- the discovery URL is fetched by an internal service (e.g. the API
server in a private cluster) over a different DNS view than
external clients use;
- a pinned issuer URL is contractually required and must survive
infrastructure changes that move the actual service endpoint.
In all of these the JWT's `iss` claim is a logical, stable URL; the
discovery doc must report that same value, or downstream verifiers
reject the tokens.
Current chart behavior
The chart already has `global.spire.jwtIssuer` (and a subchart-local
`jwtIssuer`), resolved by the `spire-lib.jwt-issuer` helper to
`global.spire.jwtIssuer` -> subchart-local `jwtIssuer` ->
`https://oidc-discovery .<trustDomain>`. The spire-server subchart writes
that helper's result unconditionally as `jwt_issuer:` into the server's
config -- this controls the `iss` claim of every JWT-SVID the server
mints. In the OIDC subchart, however, the same helper was only used for
two things:
1. as the strict-mode assertion gate (fails the render when the
resolved value is the `example.org` default);
2. as the default source for `config.jwtDomain` (the Host
allow-list).
It was never written into the rendered OIDC provider configuration file.
The asymmetry means the chart shipped a structurally invalid OIDC setup
by default: the spire-server signs JWTs with `iss = <resolved issuer>`,
while the OIDC discovery endpoint advertises whatever Host header was
used to reach it. The only way to correct that today is to patch the
rendered ConfigMap out of band (`kubectl patch`, a CMP, a kustomize
post-renderer), which defeats the purpose of the chart.
Backward compatibility and behavior changes
Operators who set `global.spire.jwtIssuer` will see one additional
`jwt_issuer:` line in the rendered OIDC ConfigMap. The discovery doc's
`issuer` will start returning that pinned value instead of being
Host-derived, bringing the chain into spec compliance; this is a fix for
any spec-compliant verifier that previously rejected tokens. Operators
who only set the OIDC subchart-local `jwtIssuer` see the same fix
applied via the helper's fallback chain. Operators with nothing set will
see the new line default to `https://oidc-discovery .<trustDomain>`,
matching what the spire-server config already emits today.
Signed-off-by: Guillermo Gaston <[email protected] [email protected]
2026-06-14 01:25:43 +00:00
Bronson Mirafuentes and dependabot[bot]
86c60b186f
feat(spire-server): add terminationGracePeriodSeconds ( #835 )
...
* feat(spire-server): add terminationGracePeriodSeconds and lifecycle support
Adds two new top-level values to the spire-server chart:
- `terminationGracePeriodSeconds` (nullable, pod-spec level): overrides the
default 30s termination grace period. Useful when the server is behind a
load balancer that needs time to deregister the target (e.g. AWS NLB with
a deregistration delay > 30s).
- `lifecycle` (object, container level): lifecycle hooks for the spire-server
container. The primary use case is a preStop hook to hold the pod alive
while the load balancer deregisters the target before SIGTERM is sent:
lifecycle:
preStop:
sleep:
seconds: 60
Both fields default to their absent/empty equivalents (null and {}) so
existing deployments are unaffected.
Signed-off-by: Bronson Mirafuentes <[email protected] #836 )
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-06-11 12:12:33 -07:00
Faisal Memon and Kevin Fox
98ec4e680b
Bump spire-lib Helm Chart version from 0.1.0 to 0.2.0 ( #822 )
...
* Bump spire-lib and dependent Helm Chart versions (minor)
* 3c1dec30#787 )
Signed-off-by: Faisal Memon <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-06-06 10:33:41 -07:00
kfox1111
1afb4626f1
Update spire-controller-manager ( #840 )
...
Signed-off-by: Kevin Fox <[email protected]
2026-06-04 18:11:03 +00:00
kfox1111
1031167b84
Implement easy Bottom Turtle HA support in the charts ( #816 )
...
* Implement easy Bottom Turtle HA support in the charts
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-06-03 12:15:28 -07:00
Bronson Mirafuentes
7c532f10bb
feat(spire-server): add maxAttestedNodeInfoStaleness config option ( #828 )
...
* feat(spire-server): add maxAttestedNodeInfoStaleness configuration option
Wire max_attested_node_info_staleness into the spire-server ConfigMap.
When unset (default ""), the SPIRE server uses its built-in default of 0s.
Signed-off-by: Bronson Mirafuentes <[email protected] [email protected] [email protected]
2026-05-19 08:00:53 -07:00
Bronson Mirafuentes and kfox1111
9bdfc10ffe
wire ratelimit configuration option in spire-server configMap ( #826 )
...
* feat(spire-server): add ratelimit.attestation and ratelimit.signing values
Signed-off-by: Bronson Mirafuentes <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-05-14 13:18:56 -07:00
Pratik Lotia
806c6ae59e
aws node attester: add org verification support ( #825 )
...
* add verify org support for aws node attester
Signed-off-by: pratik-lotia <[email protected] [email protected] [email protected]
2026-05-12 12:25:07 -07:00
Faisal Memon and kfox1111
574fa87d57
Bump spire Helm Chart version from 0.28.4 to 0.28.5 ( #817 )
...
* c489dfc4#815 )
* f537f770#798 )
* c5ba8213#797 )
* dfe80891#796 )
* 21969d20#795 )
Signed-off-by: Faisal Memon <[email protected] [email protected]
2026-05-07 05:04:38 -07:00
Daniel Schlatter
c489dfc4db
Update helper images in spiffe-csi-driver ( #815 )
...
csi-node-driver-registrar -> 2.15.0
ubi9 -> ubi10/ubi-minimal:10.1-1776834797
Signed-off-by: Daniel Schlatter <[email protected]
2026-05-02 00:25:29 -07:00
Daniel Schlatter
f537f7702f
allow unsupported built-in key manager plugins to be used ( #798 )
...
Signed-off-by: Daniel Schlatter <[email protected]
2026-04-23 05:31:17 -07:00
spire-helm-version-checker[bot] and marcofranssen
c5ba8213df
Bump test chart dependencies ( #797 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-04-20 04:27:18 -07:00
Jesper Engberg and kfox1111
dfe8089160
feat: add gcp_iit node attestor configuration options ( #796 )
...
* feat: add gcp_iit node attestor configuration options
Signed-off-by: Jesper Engberg <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-04-15 16:33:53 +00:00
spire-helm-version-checker[bot] and marcofranssen
21969d20f3
Bump test chart dependencies ( #795 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-04-14 11:34:08 +02:00
Faisal Memon
a062e49c91
Bump spire Helm Chart version from 0.28.3 to 0.28.4
...
* 01342172#788 )
* 040ccf90#789 )
* 9273f11f#785 )
* 145f3a36#784 )
* a27acbcb#786 )
* 838a3535#783 )
* 59de7aa3#779 )
* 96773a31#777 )
* aad7527c#774 )
* de59147f#775 )
* bf4bd819#772 )
* f78c1d42#773 )
* 7afffd75#771 )
* 60899fc9#769 )
* 2de363a4#767 )
* 6631349b#766 )
Signed-off-by: Faisal Memon <[email protected]
2026-04-10 15:48:58 -07:00
013421724f
Fix typos in error messages ( #788 )
...
* nit: fix typos
Signed-off-by: Dávid Szakállas <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-04-10 16:56:50 +00:00
kfox1111
040ccf905b
Bump versions to 1.14.5 ( #789 )
...
Signed-off-by: Kevin Fox <[email protected]
2026-04-09 10:07:37 -07:00
Faisal Memon
9273f11f0a
Support root-level spire-lib chart reuse ( #785 )
...
* Add root-level spire-lib chart
Signed-off-by: Faisal Memon <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-04-09 05:14:05 -07:00
Shubham Hibare and kfox1111
145f3a36b5
chore: Add configurable probes for controller-manager ( #784 )
...
Signed-off-by: Shubham Hibare <[email protected] [email protected]
2026-04-06 18:30:43 +00:00
spire-helm-version-checker[bot] and marcofranssen
a27acbcbca
Bump test chart dependencies ( #786 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-04-06 07:12:47 -07:00
kfox1111
838a353567
Label chart ( #783 )
...
Signed-off-by: Kevin Fox <[email protected]
2026-04-05 08:47:27 -07:00
spire-helm-version-checker[bot] and marcofranssen
59de7aa314
Bump test chart dependencies ( #779 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-03-30 12:03:11 +02:00
kfox1111
96773a310f
Bump versions ( #777 )
...
* Bump versions
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-03-29 12:13:59 -07:00
Alan Cha and Kevin Fox
aad7527c0c
Add set_key_use configuration option ( #774 )
...
* Add set_key_use configuration option
Add a setKeyUse boolean configuration option to control the set_key_use
field in the SPIFFE OIDC Discovery Provider configuration.
When enabled, this adds the 'use': 'sig' field to JWKS keys, which is
required for compatibility with Keycloak's SPIFFE identity provider.
Defaults to false to maintain backward compatibility.
Signed-off-by: Alan Cha <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-03-29 09:34:30 -07:00
Daniel Schlatter
de59147fc5
fix gather hostcert edge case issues ( #775 )
...
* Check each conditional of gather host cert in case a command to create the host cert fails
Signed-off-by: Daniel Schlatter <[email protected] [email protected] [email protected]
2026-03-29 16:13:20 +00:00
bf4bd8199e
feature: add awsSecretsManager upstreamAuthority ( #772 )
...
* feature: add awsSecretsManager upstreamAuthority
Signed-off-by: gcavalcante8808 <[email protected] #773 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected] [email protected] #1 )
Signed-off-by: Kevin Fox <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-03-26 11:43:19 -07:00
spire-helm-version-checker[bot] and marcofranssen
f78c1d4246
Bump test chart dependencies ( #773 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-03-23 06:59:16 -07:00
spire-helm-version-checker[bot] and marcofranssen
7afffd75ca
Bump test chart dependencies ( #771 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-03-16 11:36:52 +01:00
anhpatel
60899fc9d2
Add configurable hostNetwork support to spiffe-csi-driver ( #769 )
...
Signed-off-by: aniket patel <[email protected]
2026-03-10 14:09:31 -07:00
spire-helm-version-checker[bot] and marcofranssen
2de363a4a6
Bump test chart dependencies ( #767 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-03-09 09:01:33 -07:00
Shubham Hibare
6631349bbb
feat(spire-server): add logEncoding parameter for controller-manager ( #766 )
...
Signed-off-by: Shubham Hibare <[email protected]
2026-03-05 09:57:44 -08:00
Faisal Memon
8afe8cf6e7
Bump spire Helm Chart version from 0.28.2 to 0.28.3
...
* 2385c2d7#763 )
Signed-off-by: Faisal Memon <[email protected]
2026-03-04 07:58:57 -08:00
kfox1111
2385c2d7a2
Bump spire to 1.14.2 ( #763 )
2026-03-04 00:57:14 +00:00
Faisal Memon
85989b45eb
Bump spire Helm Chart version from 0.28.1 to 0.28.2
...
* 24b3a173#758 )
* 0133d4a5#755 )
* 0a841c76#759 )
* a9bee70c#757 )
* bb4c0f33#756 )
* 3e8f3f18#753 )
* b0aa3e42#751 )
* 3daadc64#752 )
* 730b76bb#750 )
* e849a1fb#749 )
* 982d53c2#746 )
* 8abac78a#740 )
* 75ffbd06#741 )
* 141c8865#744 )
* 6b5d01b7#743 )
* ba2b6a5a#748 )
* 86a806f3#742 )
* 7d266454#715 )
* 666d304c#738 )
* a7ac6a49#735 )
Signed-off-by: Faisal Memon <[email protected]
2026-03-03 15:21:39 -08:00
Faisal Memon
24b3a1730e
Change hostNetwork to auto ( #758 )
2026-03-03 21:56:48 +00:00
Daniel Schlatter and kfox1111
0133d4a5a7
add key experimental.requirePQKEM for spire-server and spire-agent ( #755 )
...
Signed-off-by: Daniel Schlatter <[email protected] [email protected]
2026-03-03 06:31:44 -08:00
spire-helm-version-checker[bot] and marcofranssen
0a841c76a2
Bump test chart dependencies ( #759 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]
2026-03-02 10:03:57 +01:00
Shubham Hibare
a9bee70c0b
feat(spiffe-oidc-discovery-provider): Add configurable log format option. ( #757 )
...
Signed-off-by: Shubham Hibare <[email protected]
2026-02-25 14:20:59 -08:00
Shubham Hibare
bb4c0f33ce
chore: Bump controller manager image tag to 0.6.3 in README and values.yaml ( #756 )
...
* chore: Bump controller manager image tag to 0.6.3 in README and values.yaml
Signed-off-by: Shubham Hibare <[email protected] [email protected] [email protected]
2026-02-25 06:55:42 -08:00
3e8f3f1893
Bump test chart dependencies ( #753 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected] [email protected]
2026-02-23 16:15:40 +00:00
