Skip to content

Commit 495feef

Browse files
wgabor0427wgabor0427
committed
OSDOCS-17626 updated zero-trust release notes for GA
1 parent 56c5a21 commit 495feef

File tree

1 file changed

+184
-2
lines changed

1 file changed

+184
-2
lines changed

‎security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc‎

Lines changed: 184 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,190 @@ The {zero-trust-full} leverages Secure Production Identity Framework for Everyon
1111

1212
These release notes track the development of {zero-trust-full}.
1313

14-
:FeatureName: Zero Trust Workload Identity Manager
15-
include::snippets/technology-preview.adoc[]
14+
[id="zero-trust-manager-release-notes-1-0-0"]
15+
== {zero-trust-full} 1.0.0 (General Availability)
16+
17+
Issued: 2025-12-17
18+
19+
This release of the {zero-trust-full} introduces new capabilities focused on enterprise readiness, security, and operational flexibility. Key features include SPIRE federation support for cross-cluster identity, PostgreSQL database support for production persistence, and enhanced security controls implemented through stricter Security Context Constraints (SCCs) and comprehensive API validation.
20+
21+
{zero-trust-full} supports the following components and versions:
22+
23+
[cols="1,1",options="header"]
24+
|===
25+
| Component
26+
| Version
27+
28+
| SPIRE Server
29+
| 1.13.3
30+
31+
| SPIRE Agent
32+
| 1.13.3
33+
34+
| SPIRE Controller Manager
35+
| 0.6.3
36+
37+
| SPIRE OIDC Discovery Provider
38+
| 1.13.3
39+
40+
| SPIFFE CSI Driver
41+
| 0.2.8
42+
|===
43+
44+
[id="zero-trust-manager-1-0-0-features-enhancements_{context}"]
45+
=== New features and enhancements
46+
47+
[id="zero-trust-manager-1-0-0-federation-support_{context}"]
48+
==== SPIRE federation support
49+
50+
The Operator now includes support for SPIRE federation, enabling workloads across distinct trust domains to securely communicate and authenticate with each other.
51+
52+
* Key capabilities:
53+
54+
** Configuration of bundle endpoints using `https_spiffe` (mTLS) or `https_web` (Web PKI) profiles.
55+
** Automatic certificate management via the ACME protocol (e.g., Let's Encrypt).
56+
** Automatic {product-title} route creation for federation endpoints.
57+
** Ability to configure relationships with multiple federated trust domains.
58+
59+
* Customer Action Required:
60+
61+
** Review the `federation` configuration within the `SpireServer Custom Resource (CR).
62+
** Ensure proper DNS resolution and network connectivity to federated trust domains.
63+
64+
[id="zero-trust-manager-1-0-0-configurable-socketpath-plugin-name_{context}"]
65+
==== Configurable agent socket path and Container Storage Interface (CSI) plugin name
66+
67+
The SPIRE Agent socket path and the SPIFFE CSI Driver plugin name are now configurable, providing operational flexibility for environments with specific directory requirements or co-existence with multiple SPIFFE deployments.
68+
69+
* Key configuration points:
70+
71+
** `SpireAgent.spec.socketPath`
72+
** `SpiffeCSIDriver.spec.agentSocketPath`
73+
** `ApiffeCSIDriver.spec.pluginName`
74+
75+
* Customer action required:
76+
77+
** Ensure consistency between `socketPath` in the `SpireAgent` CR and `agentSocketPath` in the `SpiffeCSIDriver` CR.
78+
79+
[id="zero-trust-manager-1-0-0-workload-attestors_{context}"]
80+
==== Workload attestors verification API
81+
82+
A new API has been introduced to configure kubelet certificate verification for workload attestation, enhancing security and supporting various OpenShift configurations.
83+
84+
* Verification types:
85+
86+
** `auto` (default): Verification utilizes OpenShift defaults (`/etc/kubernetes/kubelet-ca.crt`).
87+
** `hostCert': Uses a custom CA certificate path.
88+
** `skip``: Skips TLS verification (not recommended for production use).
89+
90+
[id="zero-trust-manager-1-0-0-configurable-CA-JWT_{context}"]
91+
==== Configurable Certificate Authority and JSON Web Token key types
92+
93+
Administrators can now configure the cryptographic key types used for the SPIRE Server Certificate Authority (CA) and JSON Web Token (JWT) signing, ensuring compliance with organizational security policies.
94+
95+
* Supported Key Types: `rsa-2048` (default), `rsa-4096`, `ec-p256`, `ec-p384`.
96+
97+
* Customer action required:
98+
99+
** Review organizational security policies to determine required key types.
100+
101+
[id="zero-trust-manager-1-0-0-custom-namespace-deployment_{context}"]
102+
==== Custom namespace deployment
103+
104+
* The Operator and all associated operands can now be deployed within a custom namespace, providing flexibility for organizations with specific namespace governance requirements.
105+
106+
[id="zero-trust-manager-1-0-0-postgres-database-support_{context}"]
107+
==== PostgreSQL database support
108+
109+
SPIRE Server now supports PostgreSQL as an external database backend, accommodating production deployments that necessitate enterprise-grade data persistence and high availability.
110+
111+
* Supported Types: sqlite3 (default), postgres, mysql.
112+
113+
* Customer action required:
114+
115+
** For production, evaluation of migration from SQLite to PostgreSQL is recommended.
116+
** Creation and configuration of Kubernetes Secrets for database TLS certificates and credentials are required.
117+
118+
[id="zero-trust-manager-1-0-0-proxy-aware-operator-operands_{context}"]
119+
==== Proxy-awared Operator and operands
120+
121+
* The operator and all managed operands are now proxy-aware and automatically inherit cluster-wide proxy settings when configured.
122+
123+
[id="zero-trust-manager-1-0-0-enhanced-security-context_{context}"]
124+
==== Enhanced Security Context Constraints
125+
126+
* SPIRE Agent and SPIFFE CSI Driver now operate under the restricted Security Context Constraints (SCC).
127+
128+
* All operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.
129+
130+
[id="zero-trust-manager-1-0-0-enhanced-api-validation_{context}"]
131+
==== Enhanced API validation
132+
133+
Comprehensive Common Expression Language (CEL) validation has been integrated into all Custom Resource Definitions (CRDs) to prevent configuration errors during admission control.
134+
135+
* Key validations:
136+
137+
** All Operator CRDs are enforced as singletons (must be named `cluster`).
138+
** Immutable Fields: Fields including `trustDomain`, `clusterName`, `bundleConfigMap`, federation `bundleEndpoint`, and all `Persistence` settings (`size`, `accessMode`, and `storageClass`) are now immutable after initial creation.
139+
140+
* Customer action required:
141+
142+
** Review existing CR configurations to ensure compliance with the new validation rules.
143+
144+
[id="zero-trust-manager-1-0-0-common-configuration_{context}"]
145+
==== Common configuration consolidation
146+
147+
* Standard configuration options (`labels`, `resources`, `affinity`, `tolerations`, `nodeSelector`) are now standardized across all operand CRs via a shared `CommonConfig` structure.
148+
149+
[id="zero-trust-manager-1-0-0-immutable-fields_{context}"]
150+
==== Immutable fields
151+
152+
The following fields are now strictly enforced as *immutable* after initial creation:
153+
154+
[cols="1,1,1",options="header"]
155+
|===
156+
| Custom resource
157+
| Field
158+
| Notes
159+
160+
| ZeroTrustWorkloadIdentityManager
161+
| `trustDomain`, `clusterName`, `bundleConfigMap`
162+
| Cannot be modified post-creation.
163+
164+
| SpireServer
165+
| `persistence.size`, `persistence.accessMode`, `persistence.storageClass`
166+
| Cannot be modified post-creation.
167+
168+
| SpireServer
169+
| `federation.bundleEndpoint`
170+
| Cannot be removed once configured.
171+
|===
172+
173+
[id="zero-trust-manager-1-0-0-status-observability-improvements_{context}"]
174+
=== Status and observability improvements
175+
176+
[id="zero-trust-manager-1-0-0-enhanced-status-reporting_{context}"]
177+
==== Enhanced status reporting
178+
179+
* The main CR now aggregates status information from all operand CRs.
180+
181+
* New status conditions include Upgradeable (indicating a safe upgrade path) and Progressing (detailing deployment progress).
182+
183+
[id="zero-trust-manager-1-0-0-operator-metrics_{context}"]
184+
==== Operator metrics
185+
186+
* Operator metrics are now exposed and secured with appropriate RBAC configuration.
187+
188+
* Integration is supported with the OpenShift monitoring stack.
189+
190+
[id="zero-trust-manager-1-0-0-bug-fixes_{context}"]
191+
=== Bug fixes
192+
193+
* Before this update, daemonset, deployment, and `statefulsets`` were not properly reverted to their original form in all valid scenarios due to an oversight in the update logic. As a consequence, user data loss or inconsistency occurred in valid scenarios. With this release, the update logic has been corrected, ensuring all valid scenarios revert to their original form. (link:https://issues.redhat.com/browse/SPIRE-248[SPIRE-248])
194+
195+
* Before this update, the SPIRE OpenID Connect (OIDC) discovery provider pod did not restart after a configuration change due to the lack of an automatic restart. As a consequence, end users experienced persistent authentication issues with the SPIRE OIDC. With this release, the SPIRE OIDC discovery provider restarts automatically after `configmap` changes via the custom resource (CR), improving seamless service updates for end users. (link:https://issues.redhat.com/browse/SPIRE-225[SPIRE-225])
196+
197+
* Before this update, the Spire-controller manager 'ConfigMap' reconciliation failed due to an unhandled edge case in the previous implementation. As a consequence, users experienced configuration inconsistencies. With this release, the Spire-controller manager `ConfigMap` reconciliation issue has been resolved. (link:https://issues.redhat.com/browse/SPIRE-195[SPIRE-195])
16198

17199
[id="zero-trust-manager-release-notes-0-2-0"]
18200
== {zero-trust-full} 0.2.0 (Technology Preview)

0 commit comments

Comments
 (0)