RATATOSKRATATOSK
Sign in

SPIRE

v1.16.0Security
Nov 5, 2026

CHECK 6PLAN 2OTHER 40

A substantial feature and behavior release with experimental capabilities, new integrations, and broad correctness and performance fixes. It also changes behavior in ways that affect some existing attestors, plugins, and configuration setups, including security-related removals and breaking defaults.

Check if affected (6)

  • securityThe mountinfo fallback, removed from the container locator

    Applies if you use the docker or k8s workload attestor.

    The mountinfo fallback has been removed from the container locator used by the docker and k8s workload attestors because it could be forged.

  • breakingAgent SPIFFE IDs under /spire/agent

    Applies if you use external plugins or configure agent_path_template.

    Agent SPIFFE IDs must now reside under /spire/agent; attestations that produce other IDs fail unless the experimental allow_nonconforming_agent_ids configuration is set.

  • breakingRootless Podman attestation requirement

    Applies if you use rootless Podman with the docker workload attestor and do not configure use_rootless_podman.

    Rootless Podman workload attestation now requires the use_rootless_podman option in the docker workload attestor.

  • breakingBroker API JWT-SVID service for admin and downstream entries

    Applies if you use the Broker API for admin or downstream entries.

    The Broker API no longer serves JWT-SVIDs for admin or downstream entries.

  • breakingThe journal_id column in ca_journals

    Applies if you configure disable_migration.

    The ca_journals table in the sql datastore gains a journal_id column reserved for future use. Deployments with disable_migration set are affected by this schema migration.

  • breakingThe use_sync_authorized_entries agent option, removed

    Applies if you configure use_sync_authorized_entries.

    The use_sync_authorized_entries agent option has been removed.

Plan ahead (2)

  • deprecatedNotifier plugins, deprecated in favor of BundlePublisher plugins

    Applies if you use Notifier plugins.

    Notifier plugins are deprecated in favor of BundlePublisher plugins.

  • deprecatedOIDC Discovery Provider certificate sections, deprecated

    Applies if you configure acme or serving_cert_file.

    The acme and serving_cert_file sections in the OIDC Discovery Provider are deprecated in favor of serving_cert_source.

All 40 other recorded changesadditions 18 · fixes 13 · value changes 6 · constraints 2 · defaults 1

additions (18)

  • Experimental WIT-SVID support, enabled with the enable_wit_svids server and agent options, including Workload API methods, a spire-agent api fetch wit CLI command, an agent-side WIT-SVID cache, per-entry and default (default_wit_svid_ttl) WIT-SVID TTLs, and publishing of WIT signing keys through the spire UpstreamAuthority plugin (#7243, #7244, #7273, #7282, #7302, #7306, #7354)
  • kmip KeyManager plugin for storing keys in KMIP-compliant servers (#7235)
  • Microsoft Entra ID authentication for Azure PostgreSQL and MySQL in the sql datastore (#7279)
  • In-process log file rotation via the log_file_rotation agent and server option (#7229)
  • Support for triggering a log file reopen on Windows, and external tools can now move or delete the log file on Windows (#7248, #7269)
  • Experimental use_xds agent option to resolve the SPIRE server via xDS (#7256)
  • Experimental server_load_balancing_config agent option to configure the load balancing policy used for connections to the server (#7241)
  • Experimental agent options to configure the sync retry backoff (sync_retry_backoff), rpc_timeout and max_bundle_workers (#7093, #7286)
  • bootstrap_bundle_path option on federates_with to bootstrap https_spiffe federation trust from a file (#7260)
  • serving_cert_source section in the OIDC Discovery Provider, including a workload_api variant that serves HTTPS using an X509-SVID from the Workload API (#7285)
  • audit_log_exclude_agent_sync server option to omit successful bundle and authorized-entry read audit records (#7328)
  • group_template and allowed_groups options in the x509pop node attestor to produce group selectors (#7002)
  • extension_oids option in the x509pop node attestor to expose certificate extensions as selectors (#7327)
  • Subject attribute selectors by OID in the tpm_devid node attestor (#7312)
  • Optional verify_client_ip in the sshpop and http_challenge node attestors (#7191, #7240)
  • trust_bundle_path option in the azure_imds node attestor for additional root CAs (#7143)
  • exclude_completed_pods option in the k8s workload attestor to drop completed pods from the kubelet cache (#7177)
  • CA rotation horizon metrics (#7325)

fixes (13)

  • The agent retries NewJWTSVID with backoff on transient errors (#7169)
  • Cached SVIDs are invalidated when their registration entry changes substantially, preventing workloads from receiving SVIDs issued for a different entry (#7310)
  • LRU cache subscribers now match on complete selector sets (#7257)
  • aws_secretsmanager and gcp_secretmanager SVIDStore plugins now handle federated bundles with multiple or no roots (#7309)
  • The server keeps processing bundle updates after a single failure (#7319)
  • Bundle subscribers are notified when a bundle is removed (#7331)
  • The OIDC Discovery Provider now allows CORS (#7224)
  • The rotator failure count is reset after a successful rotation (#7254)
  • log_file is no longer opened when validating configuration (#7247)
  • The agent and server no longer exit as crashed on gRPC context canceled errors during startup (#7274)
  • No more spurious warning on profiling server shutdown (#7211)
  • The server CA now honors upstream X.509 chain expiry during rotation (#7303)
  • The agent no longer panics during workload attestation when sigstore verification meets a signature that has a Rekor entry but no Rekor bundle (#7363)

value changes (6)

  • The cache_manager/expiring_svids and cache_manager/outdated_svids samples now carry an svid_type label (X509 or WIT), so counts are reported per SVID type (#7244)
  • DNS names are case-folded before IDNA validation (#7255)
  • Reduced database load for entry writes, attested node cache rebuilds and agent authorization (#7182, #7218, #7304)
  • Reduced memory usage when fetching kubelet pod lists (#7320)
  • Fulcio roots are now loaded through sigstore-go TUF APIs, honoring TUF_ROOT and SIGSTORE_NO_CACHE (#7263)
  • Updated Go to 1.27.3 (#7252, #7267, #7346, #7353)

constraints (2)

  • The k8s_psat node attestor now rejects attestations when the fetched pod UID does not match the token's pod UID (#7117)
  • Pagination tokens larger than 32 bits are now accepted by the datastore (#7201)

defaults (1)

  • The k8s workload attestor broker configuration now applies sensible defaults, so brokers no longer need to be specified twice (#7187)
Add SPIRE to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All SPIRE releases →