SPIRE, the CNCF-graduated identity framework for cloud-native workloads, just shipped version 1.15.0 with a stack of features that make zero-trust identity a lot more practical in production.
Think of SPIRE as the bouncer at the door of every microservice in your cluster. Before any workload gets to talk to another workload, SPIRE checks its ID, verifies it is who it claims to be, and hands it a cryptographically signed identity document (called an SVID). No shared passwords, no static credentials rotting in config files, no hoping nobody finds that one service account token you forgot to rotate six months ago.
The problem SPIRE solves is deceptively simple but painfully real: how do you know who is talking to whom? In a world of ephemeral containers, auto-scaling nodes, and services spinning up and down by the hundreds, traditional identity models fall apart. SPIRE gives every workload a verifiable, cryptographically backed identity tied to what it is and where it runs, not where it sits on a network.
Platform engineers running multi-cluster Kubernetes environments, SREs responsible for service mesh security, and security teams building zero-trust architectures are the primary users. If you have ever lost sleep over service-to-service authentication at scale, SPIRE was built for you.
Version 1.15.0 is worth your attention because it brings HashiCorp Vault integration for key management, PROXY protocol support for production rate limiting, TLS-secured Prometheus metrics, and a handful of other features that remove real friction from running SPIRE in production. Let us get into it.
HashiCorp Vault Key Manager Plugin
The headline feature. SPIRE needs to store and manage private keys for the SVIDs it issues. Up until now, your options for where those keys lived were limited. This release adds a dedicated HashiCorp Vault Key Manager plugin (#6889), which means SPIRE can now store its signing keys directly in Vault.
This matters because Vault is already the de facto standard for secrets management in most cloud-native shops. Instead of introducing yet another key storage mechanism, SPIRE plugs into the infrastructure you already have. Your audit trail, access policies, and rotation workflows all stay in one place.
KeyManager "hashicorp_vault" {
plugin_data = {
vault_addr = "https://vault.example.com:8200"
namespace = "spire"
}
}The plugin uses Vault’s Transit secrets engine to create, store, and rotate SPIRE server keys. Authentication methods include Token, Client Certificate, AppRole, and Kubernetes auth, matching the existing upstream authority plugin’s feature set. Keys are named using a <UUID>-<SPIRE-key-id> scheme to support high-availability deployments where multiple server instances must keep their keys distinct. PR #6889
PROXY Protocol for Rate Limiting Behind Load Balancers
If you run SPIRE behind a load balancer (and most production deployments do), you have probably run into a frustrating problem: the rate limiter sees every request as coming from the load balancer’s IP, not the actual client. This makes rate limiting effectively useless.
SPIRE 1.15.0 adds PROXY protocol support (#6819), which means the SPIRE Server can now read the original client IP from the PROXY protocol header. Your rate limiting rules actually work the way you expect them to.
server {
bind_address = "0.0.0.0"
bind_port = "8081"
proxy_protocol = true
ratelimits = [
{
endpoint_selector = "type:SERVER"
max_operations = 2000
period = "1s"
}
]
}Flip one boolean, and your rate limiter goes from “why is everything coming from 10.0.1.5” to actually working. PR #6819
TLS for Prometheus Metrics
SPIRE’s Prometheus metrics endpoint has been plaintext-only since forever. In a zero-trust environment, having an unencrypted metrics endpoint is a bit ironic. Version 1.15.0 adds native TLS support for the Prometheus metrics sink (#6718), so your observability pipeline can be as secure as the identity framework it is monitoring.
Metrics {
prometheus {
host = "0.0.0.0"
port = 9988
tls {
cert_file = "/etc/spire/tls/server.crt"
key_file = "/etc/spire/tls/server.key"
}
}
}No more excuses for running plaintext metrics in production. PR #6718
Sigstore Support Graduates to Stable
The experimental Sigstore integration in the Kubernetes and Docker attestors has been promoted out of experimental (#6901, #6906). This means you can now verify container image signatures using Sigstore’s Cosign and Fulcio as a stable, supported feature of SPIRE’s workload attestation.
In practical terms: SPIRE can now verify that a workload is running a container image that was signed by the right team, built from the right pipeline, and hasn’t been tampered with. That verification feeds directly into the trust decisions SPIRE makes when issuing identities. PR #6901, PR #6906
More Features Worth Knowing About
- Rootless Podman support in the Docker workload attestor (#6798) — SPIRE can now attest workloads running under rootless Podman, not just Docker and Podman running as root. If your security posture requires rootless containers, this removes a real gap.
- WIT-SVID
issclaim support (#6857) — The Web Identity Token SVID format now supports theiss(issuer) claim, advancing the SPIFFE Federation story and making cross-trust-domain identity verification more complete. - AWS IID
account_idselector (#6697) — Node attestation on AWS can now select on the AWS account ID, giving you finer-grained control over which EC2 instances get which identities in multi-account setups. - X509-SVID prefetch opt-out (#6360) — You can now mark registration entries so their X509-SVIDs are not prefetched by the agent. Useful for entries that are rarely used or where you want to minimize unnecessary key material on agents.
- Instance flag for CLI (#6789) — The
spire-serverandspire-agentCLIs now support an instance flag, making it easier to target specific server or agent instances in multi-instance setups.
Bug Fixes
- Potential nil panic in the upstream authority plugin (#6773) — A crash bug in the core upstream authority plugin has been fixed. If you are running a nested SPIRE topology, this one is worth upgrading for.
- Nil panic in the
azure_imdsplugin (#6795) — Azure instances without a Network Security Group attached could trigger a nil panic. Fixed. - Azure Key Vault key manager now supports Managed HSM (#6751) — The Azure Key Vault plugin was previously limited to standard Key Vault. It now works with Azure Managed HSM as well.
- Agent Debug service errors (#6878) — Connections to the agent debug service were producing “unrecognized service” log entries. Cleaned up.
- AWS KMS rotated alias revert (#6805) — The
aws_kmsplugin could revert rotated key aliases under certain conditions. Fixed.
Upgrade Notes
There is one potentially breaking change to be aware of: the JSON output of CLI commands no longer wraps objects in extra slices (#6655). If you have scripts that parse the JSON output of spire-server or spire-agent commands, verify they still work after upgrading. The old behavior was technically a bug, but it is a bug you might have built automation around.
The Cosign dependency has been updated to the v3 major release (#6493). If you are using Sigstore verification, test your verification pipelines after upgrading to make sure the new Cosign version behaves the same way in your setup.
SPIRE 1.15.0 is the kind of release that quietly makes your zero-trust infrastructure significantly less annoying to operate, and that is exactly the point.
