You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems.{zero-trust-full} supports SPIRE version 1.12.4 running as an operand.
10
+
The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems.
11
11
12
12
These release notes track the development of {zero-trust-full}.
13
13
14
-
:FeatureName: Zero Trust Workload Identity Manager
15
-
include::snippets/technology-preview.adoc[]
14
+
[id="zero-trust-manager-release-notes-1-0-0"]
15
+
== {zero-trust-full} 1.0.0 (General Availability)
16
+
17
+
Issued: 2025-12-17
18
+
19
+
[role="_abstract"]
20
+
This release introduces capabilities for enterprise readiness, security, and operational flexibility. It includes SPIRE federation for cross-cluster identity, PostgreSQL support for production persistence, and enhanced security through stricter constraints and API validation.
21
+
22
+
The following advisories are available for the {zero-trust-full}.
The Operator now includes support for SPIRE federation, enabling workloads across distinct trust domains to securely communicate and authenticate with each other.
63
+
64
+
* Key capabilities:
65
+
66
+
** Configuration of bundle endpoints using `https_spiffe` (TLS) or `https_web` (Web PKI) profiles.
67
+
** Automatic certificate management via the ACME protocol (e.g., Let's Encrypt).
68
+
** Automatic {product-title} route creation for federation endpoints.
69
+
** Ability to configure relationships with multiple federated trust domains.
70
+
71
+
* Customer action required:
72
+
73
+
** Review the `federation` configuration within the `SpireServer` Custom Resource (CR).
74
+
** Ensure proper DNS resolution and network connectivity to federated trust domains.
75
+
76
+
PostgreSQL database support::
77
+
78
+
SPIRE Server now supports PostgreSQL as an external database backend, accommodating production deployments that necessitate enterprise-grade data persistence and high availability.
The SPIRE Agent socket path and the SPIFFE CSI Driver plugin name are now configurable, providing operational flexibility for environments with specific directory requirements or co-existence with multiple SPIFFE deployments.
90
+
91
+
* Key configuration points:
92
+
93
+
** `SpireAgent.spec.socketPath`
94
+
** `SpiffeCSIDriver.spec.agentSocketPath`
95
+
** `SpiffeCSIDriver.spec.pluginName`
96
+
97
+
* Customer action required:
98
+
99
+
** Ensure consistency between `socketPath` in the `SpireAgent` CR and `agentSocketPath` in the `SpiffeCSIDriver` CR.
100
+
101
+
Workload attestors verification API::
102
+
103
+
A new API has been introduced to configure kubelet certificate verification for workload attestation, enhancing security and supporting various OpenShift configurations.
** `skip`: Skips TLS verification (not recommended for production use).
110
+
111
+
Configurable Certificate Authority and JSON Web Token key types::
112
+
113
+
Administrators can now configure the cryptographic key types used for the SPIRE Server Certificate Authority (CA) and JSON Web Token (JWT) signing, ensuring compliance with organizational security policies.
** Review organizational security policies to determine required key types.
120
+
121
+
Custom namespace deployment::
122
+
123
+
* The Operator and all associated operands can now be deployed within a custom namespace, providing flexibility for organizations with specific namespace governance requirements.
124
+
125
+
Proxy-aware Operator and operands::
126
+
127
+
* The Operator and all managed operands are now proxy-aware and automatically inherit cluster-wide proxy settings when configured.
128
+
129
+
Enhanced Security Context Constraints::
130
+
131
+
* SPIRE Agent and SPIFFE CSI Driver now run with Security Context Constraints (SCC) that prevent root user execution, though privileged container mode remains enabled for necessary host-level operations.
132
+
133
+
* The Operator and all operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.
134
+
135
+
Enhanced API validation::
136
+
137
+
Comprehensive Common Expression Language (CEL) validation has been integrated into all Custom Resource Definitions (CRDs) to prevent configuration errors during admission control.
138
+
139
+
* Key validations:
140
+
141
+
** All Operator CRDs are enforced as singletons (must be named `cluster`).
142
+
** Immutable Fields: Fields including `trustDomain`, `clusterName`, `bundleConfigMap`, `federation`, `bundleEndpoint` profile, and all `Persistence` settings (`size`, `accessMode`, and `storageClass`) are now immutable after initial creation.
143
+
144
+
* Customer action required:
145
+
146
+
** Review existing CR configurations to ensure compliance with the new validation rules.
147
+
148
+
Common configuration consolidation::
149
+
150
+
* Standard configuration options (`labels`, `resources`, `affinity`, `tolerations`, `nodeSelector`) are now standardized across all operand CRs via a shared `CommonConfig` structure.
151
+
152
+
Configuring log level and log format for the operands::
153
+
154
+
This release introduces flexible logging controls to improve observability and debugging across the platform:
155
+
156
+
* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat`.
157
+
158
+
* Operator: The operator’s log verbosity is now configurable via the `OPERATOR_LOG_LEVEL` environment variable using klog’s `textlogger`.
159
+
160
+
Refactor for create-only mode::
161
+
162
+
By setting the `CREATE_ONLY_MODE` environment variable, users can prevent the operator from reconciling updates. This allows for manual resource modification without interference. If this mode is disabled, the Operator resumes enforcing the state and overwrites any manual changes.
163
+
164
+
=== Status and observability improvements
165
+
166
+
Enhanced status reporting::
167
+
168
+
* The main CR now aggregates status information from all operand CRs.
169
+
170
+
* New status conditions include Upgradeable (indicating a safe upgrade path) and Progressing (detailing deployment progress).
171
+
172
+
Operator metrics::
173
+
174
+
* Operator metrics are now exposed and secured with appropriate RBAC configuration.
175
+
176
+
* Integration is supported with the OpenShift monitoring stack.
Enhanced Security Context Constraints for SPIRE Agent::
182
+
+
183
+
Before this update, the SPIRE Agent and SPIFFE CSI Driver containers were running as root user, leading to potential security violations. With this release, Security Context Constraints (SCC) have been configured to ensure these components no longer run as root. While privileged container mode is still required for necessary capabilities, this change reduces potential security risks for the end user.
SpireServer updates now propagate without operator restart::
188
+
+
189
+
* Before this update, the operator failed to trigger reconciliation after updating the operand CR spec. As a consequence, user updates to SpireServer CR resources were not propagated to the StatefulSet, causing reconciliation to fail and changes to be ignored, leading to inconsistent resource allocation. With this release, the race condition between the manager and reconciler's cache to trigger reconciliation after CR updates has been fixed. As a result, day2 patch operations on SpireServer CRs will reliably trigger reconciliation, ensuring updated values are applied to the StatefulSet without manual operator restart.
Removed unnecessary security context constraint for OpenID Connect discovery provider::
194
+
+
195
+
* Before this update, the system unnecessarily created a custom security context constraint (SCC) for the OpenID Connect (OIDC) discovery provider, which increased the security footprint and configuration complexity even though the deployment did not require it. With this release, the custom SCC creation logic has been removed, resulting in a configuration where the OIDC discovery provider operates successfully without the extra security constraints.
Fixed ConfigMap Reconciliation for SPIRE Controller Manager::
200
+
+
201
+
Before this update, Spire-controller manager ConfigMap reconciliation failed due to an unhandled edge case in the previous implementation. As a consequence, users experienced configuration inconsistencies. With this release, the Spire-controller manager ConfigMap reconciliation issue has been resolved. As a result, end users now experience seamless Spire-controller manager configuration.
OIDC discovery provider now restarts automatically on configuration changes::
206
+
+
207
+
* Before this update, the SPIRE OIDC discovery provider failed to automatically restart following `configmap` changes, leading to persistent authentication failures. With this release, updates to the CR now trigger an automatic pod restart, ensuring that `configmap` changes are applied immediately, providing a seamless experience for end users.
Corrected update rollback for DaemonSets, Deployments, and StatefulSets::
212
+
+
213
+
* Before this update, `daemonset`, `deployment`, and `statefulsets` were not properly reverted to their original form in all valid scenarios due to an oversight in the update logic. As a consequence, user data loss or inconsistency occurred in valid scenarios. With this release, the update logic has been corrected, ensuring all valid scenarios revert to their original form.
==== Support for the managed OIDC Discovery Provider Route
240
+
Support for the managed OIDC Discovery Provider Route::
36
241
37
242
* The Operator exposes the `SPIREOIDCDiscoveryProvider` spec through OpenShift Routes under the domain `*.apps.<cluster_domain>` for the selected default installation.
38
243
@@ -42,8 +247,7 @@ This release of {zero-trust-full} is a Technology Preview.
42
247
43
248
* The `externalSecretRef` references an externally managed Secret that has the TLS certificate for the `oidc-discovery-provider` Route host. When provided, this populates the route's `.Spec.TLS.ExternalCertificate` field. For more information, see link:https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/ingress_and_load_balancing/index#nw-ingress-route-secret-load-external-cert_secured-routes[Creating a route with externally managed certificate]
==== Enabling the custom Certificate Authority Time-To-Live for the SPIRE bundle
250
+
Enabling the custom Certificate Authority Time-To-Live for the SPIRE bundle::
47
251
48
252
* The following Time-To-Live (TTL) fields have been added to the `SpireServer` custom resource definition (CRD) API for SPIRE Server certificate management:
49
253
@@ -55,8 +259,7 @@ This release of {zero-trust-full} is a Technology Preview.
55
259
56
260
* The default values can be replaced in the server configuration with user-configurable options that give users the flexibility to customize certificate and {svid-full} lifetimes based on their security requirements.
* The Operator controller switches to `create-only` mode once the `ztwim.openshift.io/create-only=true` annotation is present on the Operator's APIs. This allows resource creation while skipping the updates. A user can update the resources manually to test their configuration. This annotation supports APIs such as `SpireServer`, `SpireAgents`, `SpiffeCSIDriver`, `SpireOIDCDiscoveryProvider`, and `ZeroTrustWorkloadIdentityManager`.
62
265
@@ -65,13 +268,20 @@ This release of {zero-trust-full} is a Technology Preview.
65
268
* Once the annotation is removed and the pod restarts, the operator tries to come back to the required state. The annotation is applied only once during start or a restart.
* Before this update, the `JwtIssuer` field for both the `SpireServer` and the `SpireOidcDiscoveryProvider` did not need to be a URL causing an error in configurations. With this release, the user must manually enter an issuer URL in the `JwtIssuer` field in both custom resources. (link:https://issues.redhat.com/browse/SPIRE-117[SPIRE-117])
273
+
JSON Web Token Issuer field now requires a valid URL::
274
+
+
275
+
* Before this update, the `JwtIssuer` field for both the `SpireServer` and the `SpireOidcDiscoveryProvider` did not need to be a URL causing an error in configurations. With this release, the user must manually enter an issuer URL in the `JwtIssuer` field in both custom resources.
0 commit comments