SPIRE

v1.15.3Security

2026년 8월 21일

새로운 attestor와 플러그인, 설정 옵션, CLI 및 API 기능이 추가됐고 동작 변경과 의존성 업데이트, 결함 수정이 포함됐습니다. 보안 권고나 명시적인 취약점 관련 내용은 없습니다.

그 외 기록된 변경 22건 전체additions 10 · value changes 6 · fixes 5 · constraints 1

- Slurm workload attestor (#7160)
- azure_blob BundlePublisher plugin for publishing the trust bundle to Azure Blob Storage (#7030)
- trust_bundle_spiffe_workload_api agent configuration option to fetch the initial trust bundle from a Workload API endpoint, simplifying nested agent deployments (#7148)
- disable_workload_api and disable_sds_api agent options to disable the Workload API and SDS APIs on the public endpoint (#7122)
- disable_kubelet_client option for the k8s workload attestor (#7142)
- use_pod_uid_for_agent_id option in the k8s_psat node attestor to derive agent IDs from pod UIDs instead of node UIDs (#7123)
- Opt-in enable_namespace_labels option in the k8s workload attestor, producing ns-label selectors from namespace labels (#7094)
- account_list_file option in the aws_iid node attestor to source the verify_organization account list from a file instead of the AWS Organizations API (#7092)
- debug getinfo command in the spire-server and spire-agent CLIs to access the Debug APIs (#7133)
- Incremental WIT-SVID work, including support for building WIT-SVIDs in the svid.v1 API client and marshalling support for WIT-SVID keys (#7132, #7134)

- The Broker API endpoint is now included in health checks when enabled (#7141)
- Improved coordination of kubelet pod list fetching in the k8s workload attestor, reducing attestation latency and redundant kubelet requests (#7085)
- The agent now warns when the memory Key Manager is used with a node attestor that does not support re-attestation (#7139)
- Reworded the OIDC Discovery Provider allow_insecure_scheme warning to describe the actual safety condition instead of implying development-only use (#7165)
- Updated AWS CA certificates in the aws_iid node attestor (#7138)
- Updated Go to 1.26.6 (#7188, #7212)

- The events-based cache now fetches events ordered by ID, preventing spurious skipped-event tracking and unnecessary event lookups at startup (#7189)
- Agent telemetry sinks now start before node attestation, so metrics are served while the agent is still attesting (#7166)
- The agent and server no longer log a crash message and exit with a non-zero status when shut down during startup (#7154)
- The hashicorp_vault Key Manager plugin no longer triggers unrecognized parameter warnings in Vault and OpenBao audit logs (#7150)
- The example Grafana dashboard no longer includes empty query targets that caused panel query errors (#7178)

- The gcp_kms Key Manager plugin no longer requires key_identifier_value to be 36 characters long (#7140)

SPIRE 스택에 추가

조치가 필요한 변경이 나오면 주간 메일로 받아볼 수 있습니다. 이번 릴리스처럼 조치가 없는 주에는 메일을 보내지 않습니다.