You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems.{zero-trust-full} supports SPIRE version 1.12.4 running as an operand.
10
+
The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems.
11
11
12
12
These release notes track the development of {zero-trust-full}.
13
13
14
-
:FeatureName: Zero Trust Workload Identity Manager
15
-
include::snippets/technology-preview.adoc[]
14
+
[id="zero-trust-manager-release-notes-1-0-0"]
15
+
== {zero-trust-full} 1.0.0 (General Availability)
16
+
17
+
Issued: 2025-12-17
18
+
19
+
This release of the {zero-trust-full} introduces new capabilities focused on enterprise readiness, security, and operational flexibility. Key features include SPIRE federation support for cross-cluster identity, PostgreSQL database support for production persistence, and enhanced security controls implemented through stricter Security Context Constraints (SCCs) and comprehensive API validation.
20
+
21
+
{zero-trust-full} supports the following components and versions:
The Operator now includes support for SPIRE federation, enabling workloads across distinct trust domains to securely communicate and authenticate with each other.
51
+
52
+
* Key capabilities:
53
+
54
+
** Configuration of bundle endpoints using `https_spiffe` (mTLS) or `https_web` (Web PKI) profiles.
55
+
** Automatic certificate management via the ACME protocol (e.g., Let's Encrypt).
56
+
** Automatic {product-title} route creation for federation endpoints.
57
+
** Ability to configure relationships with multiple federated trust domains.
58
+
59
+
* Customer Action Required:
60
+
61
+
** Review the `federation` configuration within the `SpireServer` Custom Resource (CR).
62
+
** Ensure proper DNS resolution and network connectivity to federated trust domains.
SPIRE Server now supports PostgreSQL as an external database backend, accommodating production deployments that necessitate enterprise-grade data persistence and high availability.
==== Configurable agent socket path and Container Storage Interface (CSI) plugin name
78
+
79
+
The SPIRE Agent socket path and the SPIFFE CSI Driver plugin name are now configurable, providing operational flexibility for environments with specific directory requirements or co-existence with multiple SPIFFE deployments.
80
+
81
+
* Key configuration points:
82
+
83
+
** `SpireAgent.spec.socketPath`
84
+
** `SpiffeCSIDriver.spec.agentSocketPath`
85
+
** `SpiffeCSIDriver.spec.pluginName`
86
+
87
+
* Customer action required:
88
+
89
+
** Ensure consistency between `socketPath` in the `SpireAgent` CR and `agentSocketPath` in the `SpiffeCSIDriver` CR.
A new API has been introduced to configure kubelet certificate verification for workload attestation, enhancing security and supporting various OpenShift configurations.
==== Configurable Certificate Authority and JSON Web Token key types
104
+
105
+
Administrators can now configure the cryptographic key types used for the SPIRE Server Certificate Authority (CA) and JSON Web Token (JWT) signing, ensuring compliance with organizational security policies.
* The Operator and all associated operands can now be deployed within a custom namespace, providing flexibility for organizations with specific namespace governance requirements.
Comprehensive Common Expression Language (CEL) validation has been integrated into all Custom Resource Definitions (CRDs) to prevent configuration errors during admission control.
134
+
135
+
* Key validations:
136
+
137
+
** All Operator CRDs are enforced as singletons (must be named `cluster`).
138
+
** Immutable Fields: Fields including `trustDomain`, `clusterName`, `bundleConfigMap`, federation `bundleEndpoint`, and all `Persistence` settings (`size`, `accessMode`, and `storageClass`) are now immutable after initial creation.
139
+
140
+
* Customer action required:
141
+
142
+
** Review existing CR configurations to ensure compliance with the new validation rules.
* Standard configuration options (`labels`, `resources`, `affinity`, `tolerations`, `nodeSelector`) are now standardized across all operand CRs via a shared `CommonConfig` structure.
==== Configuring log level and log format for the operands
151
+
152
+
This release introduces flexible logging controls to improve observability and debugging across the platform:
153
+
154
+
* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat.
155
+
156
+
* Operator: The operator’s log verbosity is now configurable via the `OPERATOR_LOG_LEVEL` environment variable using klog’s `textlogger`.
By setting the `CREATE_ONLY_MODE` environment variable, users can prevent the operator from reconciling updates. This allows for manual resource modification without interference. If this mode is disabled, the Operator resumes enforcing the state and overwrites any manual changes.
0 commit comments