SPIRE, the identity control plane for cloud-native workloads, just shipped v1.15.2 with eleven new features, post-quantum cryptography support, and a brand-new API surface that extends its trust model further than ever before.
If you have never heard of SPIRE, think of it as the bouncer at the door of your infrastructure. Every workload that wants to talk to another workload needs to prove who it is. SPIRE hands out cryptographically secure identity documents — called SVIDs (SPIFFE Verifiable Identity Documents) — that workloads use to authenticate each other. No shared passwords, no long-lived certificates manually rotated at 3 AM, no “just use a VPN and hope.”
It solves a specific and painful problem: how do you prove identity between services when there is no human typing a password? In a world of Kubernetes pods spinning up and dying by the hundreds, traditional identity mechanisms fall apart. SPIRE replaces all that with automated, short-lived, cryptographic identity that rotates itself.
v1.15.2 is exciting because it introduces the SPIFFE Broker endpoint, brings per-caller rate limiting to the Workload API, secures Prometheus metrics with TLS via SVIDs, and adds post-quantum cryptography support. Let us get into it.
What Is New
SPIFFE Broker Endpoint — A New API Surface for Trust Propagation
This is the headline feature. The SPIFFE Broker is a new endpoint and API that extends SPIRE’s trust propagation model beyond its traditional boundaries. It provides a standardized way for external systems and brokers to interact with SPIRE’s identity infrastructure.
Why it matters: Until now, SPIRE’s trust model was tightly coupled to its own agent-server architecture. The Broker endpoint opens a new integration path — one that lets platforms, service meshes, and custom tooling tap into SPIRE’s identity plane through a well-defined API rather than ad-hoc plugin development. For platform teams building internal developer platforms, this is the difference between “we hack around SPIRE” and “we build on SPIRE.”
# The SPIFFE Broker endpoint exposes a programmable API
# for external systems to interact with SPIRE's identity plane.
# See the documentation for configuration details.
Per-Caller Rate Limiting for the Workload API
SPIRE’s Workload API is how every workload in your cluster obtains its identity. At scale, that is a lot of calls. v1.15.2 introduces experimental per-caller rate limiting for both the agent Workload API and the Envoy SDS integration.
Why it matters: If you have ever watched a misbehaving application hammer the Workload API and take down the local SPIRE agent for everyone on that node, you know why this matters. Per-caller rate limiting means one noisy neighbor cannot starve everyone else. This is the kind of feature that makes the difference between “SPIRE works in our staging cluster” and “SPIRE works in our 500-node production cluster.”
# Enable experimental per-caller rate limiting in the agent config:
# workload_api {
# ...
# ratelimit_per_caller = true
# }
TLS for Prometheus Metrics Using a SPIRE SVID
Monitoring endpoints are a classic blind spot. You lock down your APIs, rotate your certificates, enforce mTLS everywhere — and then your Prometheus metrics endpoint sits there, unencrypted, serving up operational data to anyone who can reach it.
v1.15.2 fixes this by adding TLS support for the Prometheus metrics endpoint using a SPIRE-generated SVID. You can also configure an optional SPIFFE ID allowlist so only authorized scrapers can connect.
Why it matters: Metrics endpoints leak information — not secrets directly, but operational signals that an attacker can use to map your infrastructure. Encrypting them with SVID-based TLS means your monitoring traffic gets the same cryptographic identity treatment as your application traffic. No more “we forgot to secure the metrics port.”
# Secure your metrics endpoint with SVID-based TLS:
# server {
# ...
# prometheus {
# tls {
# svid = true
# allow_spiffe_ids = ["spiffe://example.org/prometheus/scraper"]
# }
# }
# }
Post-Quantum Cryptography Support
SPIRE v1.15.2 adds support for two additional post-quantum cryptography (PQC) curves. The PQC policy is also now applied to the bundle endpoint and Prometheus server, ensuring consistency across all cryptographic surfaces.
Why it matters: Nobody needs PQC today. But when quantum computers break current asymmetric cryptography — and they will — the infrastructure that handles identity needs to be ready before that happens, not after. SPIRE adding PQC support now means organizations with long-lived deployments can start preparing their identity infrastructure for the post-quantum transition today.
Identity infrastructure has a longer shelf life than most software. Building PQC readiness into SPIRE now is exactly the kind of boring, important decision that pays off in five years.
PR #6999 (PQC curves) and PR #6995 (PQC policy applied to bundle endpoint and Prometheus)
More Notable Additions
- JTI claim configuration for JWT-SVIDs at the entry level — gives administrators control over JWT token identification for audit and revocation workflows. PR #6514
- Tag-based key discovery in the
aws_kmsKey Manager plugin — manage your AWS KMS keys by tag instead of ARN, simplifying multi-account setups. PR #7006 - Logger service for spire-agent — a dedicated service that improves agent observability and log management. PR #7017
- Configurable batch size for pruning attested nodes — tune cleanup operations for large deployments without overwhelming the datastore. PR #7100
- Client certificate IP verification in the
x509popnode attestor — adds an extra layer of verification for node attestation. PR #6911
Security
SPIRE v1.15.2 migrates its Docker dependencies from github.com/docker/docker to their github.com/moby/moby equivalents. This migration resolves known vulnerabilities in the Docker library. This is a dependency-level security improvement — it does not affect SPIRE’s own attack surface, but it removes vulnerable transitive dependencies from the build. PR #7078
Performance and Operations
Several changes in this release improve how SPIRE performs at scale:
- Bulk node fetching — attested nodes are now fetched in bulk, reducing database load in large deployments. PR #7022
- Optimized MySQL list entries query — reduces database CPU usage under load. PR #7113
- Reduced metrics noise — agent health check loopback calls no longer emit RPC metrics. PR #6929
- Better cgroup parsing — pod and container IDs are now preferably determined from the cgroup file. PR #7060
Closing
SPIRE v1.15.2 is the release where identity infrastructure grows up — new APIs, production-grade rate limiting, quantum-ready crypto, and the kind of operational improvements that make it viable at a scale that would have broken it a year ago.
