github.com/spiffe/spire

What's New

• Introduced refactored server APIs (#1533, #1548, #1563, #1567, #1568, #1571, #1575, #1576, #1577, #1578, #1582, #1585, #1586, #1587, #1588, #1589, #1590, #1591, #1592, #1593, #1594, #1595, #1597, #1604, #1606, #1607, #1613, #1615, #1617, #1622, #1623, #1628, #1630, #1633, #1641, #1643, #1646, #1647, #1654, #1659, #1667, #1673, #1674, #1683, #1684, #1689, #1690, #1692, #1693, #1694, #1701, #1708, #1727, #1728, #1730, #1733, #1734, #1739, #1749, #1753, #1768, #1772, #1779, #1783, #1787, #1788, #1789, #1790, #1791)
• Unix workloads can now be attested using auxiliary group membership (#1771)
• The Kubernetes Workload Registrar now supports two new registration modes (crd and reconcile)

What's Changed

• Federation is now a stable feature (#1656, #1737, #1777)
• Removed support for the UpstreamCA plugin, which was deprecated in favor of the UpstreamAuthority plugin in v0.10.0 (#1699)
• Removed deprecated upstream_bundle server configurable. The server now always use the upstream bundle as the trust bundle (#1702)
• The server's AWS node attestor subsumed all the functionality of the node resolver, which has been deprecated (#1705)
• Removed pluggability of the DataStore interface, restricting use to the current built-in sql plugin (#1707)
• Unknown config options now make the server and agent fail to start (#1714)
• Improved registration entry change detection on agent (#1720)
• /tmp/agent.sock is now the default socket path for the agent (#1738)

Security

• Fixed CVE-2021-27098
• Fixed file descriptor leak in peertracker

What's New

• vault as Upstream Authority built-in plugin (#1611, #1632)
• Improved configuration file docs to list all possible configuration settings (#1608, #1618)

What's Changed

• Improved container ID parsing from cgroup path in the docker workload attestor plugin (#1605)
• Improved container ID parsing from cgroup path in the k8s workload attestor plugin (#1649)
• Envoy SDS support is now always on (#1579)
• Errors on agent SVID rotation are now fatal if the agent's current SVID has expired, forcing an agent restart (#1584)