OSDOCS-17626 updated zero-trust release notes for GA #103679

wgabor0427 · 2025-12-09T16:48:49Z

Version(s):
4.20+

Issue:
https://issues.redhat.com/browse/OSDOCS-17626

Link to docs preview:
https://103679--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.html

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-12-09T16:55:44Z

🤖 Wed Dec 10 15:06:00 - Prow CI generated the docs preview:

https://103679--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.html

anirudhAgniRedhat · 2025-12-10T10:26:29Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+* Integration is supported with the OpenShift monitoring stack.
+
+[id="zero-trust-manager-1-0-0-bug-fixes_{context}"]
+=== Bug fixes


few bugs which were resolved
SPIRE-68: Updating the operands CR spec sometimes does not trigger reconciliation
SPIRE-60: Agent runs as non-root user
SPIRE-190: Remove the SCC for the OIDC Discovery Provider

@lunarwhite please check if I had missed any??

Yes. This list is complete.

lunarwhite · 2025-12-10T10:07:51Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

 toc::[]

 The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems. {zero-trust-full} supports SPIRE version 1.12.4 running as an operand.



We could remove this sentence: https://github.com/openshift/openshift-docs/blob/9eaec7a7c25eb2558d4ca9ddaf2070ae9dc43d63/security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc?plain=1#L10C216-L10C286, as the versions are explicitly mentioned in the chart:

openshift-docs/security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

Line 21 in 9eaec7a

{zero-trust-full} supports the following components and versions:

. There is no need to maintain it in two places, which would only increase the maintainance burden for each release.

lunarwhite · 2025-12-10T10:57:10Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+* Customer Action Required:
+
+** Review the `federation` configuration within the `SpireServer Custom Resource (CR).


Suggested change

** Review the `federation` configuration within the `SpireServer Custom Resource (CR).

** Review the `federation` configuration within the `SpireServer` Custom Resource (CR).

lunarwhite · 2025-12-10T10:57:34Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+** `SpireAgent.spec.socketPath`
+** `SpiffeCSIDriver.spec.agentSocketPath`
+** `ApiffeCSIDriver.spec.pluginName`


Suggested change

** `ApiffeCSIDriver.spec.pluginName`

** `SpiffeCSIDriver.spec.pluginName`

lunarwhite · 2025-12-10T10:58:13Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+* Verification types:
+
+** `auto` (default): Verification utilizes OpenShift defaults (`/etc/kubernetes/kubelet-ca.crt`).
+** `hostCert': Uses a custom CA certificate path.


Suggested change

** `hostCert': Uses a custom CA certificate path.

** `hostCert`: Uses a custom CA certificate path.

lunarwhite · 2025-12-10T10:58:32Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+** `auto` (default): Verification utilizes OpenShift defaults (`/etc/kubernetes/kubelet-ca.crt`).
+** `hostCert': Uses a custom CA certificate path.
+** `skip``: Skips TLS verification (not recommended for production use).


Suggested change

** `skip``: Skips TLS verification (not recommended for production use).

** `skip`: Skips TLS verification (not recommended for production use).

lunarwhite · 2025-12-10T11:01:00Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+* The Operator and all associated operands can now be deployed within a custom namespace, providing flexibility for organizations with specific namespace governance requirements.
+
+[id="zero-trust-manager-1-0-0-postgres-database-support_{context}"]


It's better to move this item (PostgreSQL database support) to the position right after SPIRE federation support.

lunarwhite · 2025-12-10T11:02:16Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+* SPIRE Agent and SPIFFE CSI Driver now operate under the restricted Security Context Constraints (SCC).
+
+* All operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.


Suggested change

* All operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.

* Operator and all operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.

lunarwhite · 2025-12-10T11:04:36Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+[id="zero-trust-manager-1-0-0-immutable-fields_{context}"]
+==== Immutable fields
+
+The following fields are now strictly enforced as *immutable* after initial creation:
+
+[cols="1,1,1",options="header"]
+|===
+| Custom resource
+| Field
+| Notes
+
+| ZeroTrustWorkloadIdentityManager
+| `trustDomain`, `clusterName`, `bundleConfigMap`
+| Cannot be modified post-creation.
+
+| SpireServer
+| `persistence.size`, `persistence.accessMode`, `persistence.storageClass`
+| Cannot be modified post-creation.
+
+| SpireServer
+| `federation.bundleEndpoint`
+| Cannot be removed once configured.
+|===
+


consider removing this table as they has been mentioned at this line already: https://github.com/openshift/openshift-docs/pull/103679/files#diff-cae3550cca1c8918c4da09faef482503a73e4be67ba89e4e2b5259044e9de140R138

openshift-ci · 2025-12-10T15:06:53Z

@wgabor0427: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

lunarwhite

/lgtm
expect for minor nitpicks

lunarwhite · 2025-12-11T04:47:01Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+| Updating the operands CR spec sometimes does not trigger reconciliation.
+
+| SPIRE-190
+| Updating the operands CR spec sometimes does not trigger reconciliation.


Suggested change

| Updating the operands CR spec sometimes does not trigger reconciliation.

| Remove redundant SCC for the OIDC Discovery Provider.

lunarwhite · 2025-12-11T04:51:23Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+SPIRE Server now supports PostgreSQL as an external database backend, accommodating production deployments that necessitate enterprise-grade data persistence and high availability.
+
+* Supported Types: sqlite3 (default), postgres, mysql.


Suggested change

* Supported Types: sqlite3 (default), postgres, mysql.

* Supported Types: `sqlite3` (default), `postgres`, `mysql`.

lunarwhite · 2025-12-11T04:52:25Z

security/zero_trust_workload_identity_manager/zero-trust-manager-release-notes.adoc

+
+This release introduces flexible logging controls to improve observability and debugging across the platform:
+
+* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat.


Suggested change

* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat.

* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat`.

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Dec 9, 2025

wgabor0427 force-pushed the OSDOCS-17626 branch from 495feef to 9eaec7a Compare December 9, 2025 17:06

anirudhAgniRedhat reviewed Dec 10, 2025

View reviewed changes

lunarwhite reviewed Dec 10, 2025

View reviewed changes

OSDOCS-17626 updated RNs

7963ff0

wgabor0427 force-pushed the OSDOCS-17626 branch from 9eaec7a to 7963ff0 Compare December 10, 2025 14:59

lunarwhite reviewed Dec 11, 2025

View reviewed changes

openshift-ci bot assigned lunarwhite Dec 11, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 11, 2025

		toc::[]

		The {zero-trust-full} leverages Secure Production Identity Framework for Everyone (SPIFFE) and the SPIFFE Runtime Environment (SPIRE) to provide a comprehensive identity management solution for distributed systems. {zero-trust-full} supports SPIRE version 1.12.4 running as an operand.


		* Customer Action Required:

		** Review the `federation` configuration within the `SpireServer Custom Resource (CR).

	** `ApiffeCSIDriver.spec.pluginName`
	** `SpiffeCSIDriver.spec.pluginName`

	** `hostCert': Uses a custom CA certificate path.
	** `hostCert`: Uses a custom CA certificate path.

	** `skip``: Skips TLS verification (not recommended for production use).
	** `skip`: Skips TLS verification (not recommended for production use).


		* The Operator and all associated operands can now be deployed within a custom namespace, providing flexibility for organizations with specific namespace governance requirements.

		[id="zero-trust-manager-1-0-0-postgres-database-support_{context}"]


		* SPIRE Agent and SPIFFE CSI Driver now operate under the restricted Security Context Constraints (SCC).

		* All operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.

	* All operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.
	* Operator and all operand containers are configured with the `ReadOnlyRootFilesystem` set to `true`.

	\| Updating the operands CR spec sometimes does not trigger reconciliation.
	\| Remove redundant SCC for the OIDC Discovery Provider.


		SPIRE Server now supports PostgreSQL as an external database backend, accommodating production deployments that necessitate enterprise-grade data persistence and high availability.

		* Supported Types: sqlite3 (default), postgres, mysql.

	* Supported Types: sqlite3 (default), postgres, mysql.
	* Supported Types: `sqlite3` (default), `postgres`, `mysql`.


		This release introduces flexible logging controls to improve observability and debugging across the platform:

		* SPIRE Components: Users can now configure the `logLevel` (debug, info, warn, error) and `logFormat` (text, JSON) independently for `SpireServer`, `SpireAgent`, and `SpireOIDCDiscoveryProvider` directly within their CR specifications. The defaults are set to "info" for the `logLevel` and "text" for the `logFormat.

OSDOCS-17626 updated zero-trust release notes for GA #103679

Are you sure you want to change the base?

OSDOCS-17626 updated zero-trust release notes for GA #103679

Conversation

wgabor0427 commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 10, 2025

Uh oh!

lunarwhite left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wgabor0427 commented Dec 9, 2025 •

edited

Loading

ocpdocs-previewbot commented Dec 9, 2025 •

edited

Loading