Skip to main content

SPIRL System Releases

Latest Assets​

AssetTypeLatest Release VersionLocation
SPIRL System Helm ChartHelm Chart0.48.2oci://ghcr.io/spirl/charts/spirl-system:0.48.2
SPIRL AgentContainer Imagev0.48.2ghcr.io/spirl/spirl-agent:v0.48.2
SPIRL ControllerContainer Imagev0.48.2ghcr.io/spirl/spirl-controller:v0.48.2
SPIRL BridgeContainer Imagev0.48.2ghcr.io/spirl/spirl-bridge:v0.48.2
SPIRL AgentAMD64 Debian Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-agent/0.48.2/spirl-agent_0.48.2_linux_amd64.deb
SPIRL AgentARM64 Debian Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-agent/0.48.2/spirl-agent_0.48.2_linux_arm64.deb
SPIRL AgentAMD64 RPM Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-agent/0.48.2/spirl-agent_0.48.2_linux_amd64.rpm
SPIRL AgentARM64 RPM Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-agent/0.48.2/spirl-agent_0.48.2_linux_arm64.rpm
SPIRL BridgeAMD64 Debian Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-bridge/0.48.2/spirl-bridge_0.48.2_linux_amd64.deb
SPIRL BridgeARM64 Debian Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-bridge/0.48.2/spirl-bridge_0.48.2_linux_arm64.deb
SPIRL BridgeAMD64 RPM Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-bridge/0.48.2/spirl-bridge_0.48.2_linux_amd64.rpm
SPIRL BridgeARM64 RPM Package0.48.2https://spirl-releases.s3.us-west-2.amazonaws.com/spirl-bridge/0.48.2/spirl-bridge_0.48.2_linux_arm64.rpm
ReflectorContainer Imagev0.48.2ghcr.io/spirl/reflector:v0.48.2

Additionally, the SPIRL Agent uses the SPIFFE CSI Driver and CSI Node Driver Registrar at the following pinned versions:

AssetTypeLatest Release VersionLocation
SPIFFE CSI DriverContainer Imagev0.2.11ghcr.io/spiffe/spiffe-csi-driver:0.2.11
CSI Node Driver RegistrarContainer Imagev2.15.0registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0

Release Notes​

spirl-system 0.48.2​

October 23, 2026

Bug Fixes​

  • Fixed an issue where a Ledger Kubernetes scan could hang indefinitely instead of failing when uploading scan results failed, the scan timed out, or the scan was stopped.
  • Fixed an issue where the spirl-system Helm chart ignored the k8s values block when platform was not set. Settings such as k8s.includeContainerAttributes, k8s.includeAnnotations, k8s.skipKubeletVerification, and k8s.updateStrategy apply again. This issue affected spirl-system 0.47.0 through 0.48.1. Clusters created with spirlctl cluster add had platform set automatically and were not affected.
    • A values file that set k8s.skipKubeletVerification: false without platform had kubelet certificate verification silently turned off. Upgrading to 0.48.2 turns verification back on.

Enhancements​

  • The new Helm values node.workloadSocketVolumeName and node.workloadSocketVolumeMountPath set the default name and mount path of the socket volume the controller injects into workload pods. The defaults are spirl-agent-socket and /spirl-agent-socket in spirl-system, and defakto-agent-socket and /defakto-agent-socket in defakto-system. A socket.* value, socketLayout, or a platform block's socket settings take precedence over these keys.
  • The defakto-system chart now injects the Agent socket into workload pods as the defakto-agent-socket volume at /defakto-agent-socket, and sets SPIFFE_ENDPOINT_SOCKET to match. Earlier defakto-system releases and all spirl-system releases use spirl-agent-socket at /spirl-agent-socket. The new path applies to pods admitted after you upgrade a defakto-system release or switch a release from spirl-system. A release that sets socket.* values or uses the Istio socket layout keeps its current names.
    • When upgrading defakto-system, update anything that references /spirl-agent-socket directly, such as a SPIFFE_ENDPOINT_SOCKET value set in the pod spec or a config file that points at the socket. To keep the SPIRL names instead, set node.workloadSocketVolumeName: spirl-agent-socket and node.workloadSocketVolumeMountPath: /spirl-agent-socket.
  • The defakto-controller binary now defaults --socket-volume-name and --socket-volume-mount-path to defakto-agent-socket and /defakto-agent-socket. Both charts set these flags explicitly.
  • The controller now reuses a socket volume that a pod already declares from the configured CSI driver instead of injecting a second one.
  • The controller now rejects a pod that already mounts a different volume at the socket mount path, with an error that names the container and volume. Previously the API server returned a generic duplicate mount path error.

spirl-system 0.48.1​

October 21, 2026

Security Fixes​

  • Rebuilt with Go 1.27.3, which includes the fix for CVE-2026-111943 published on 2026-10-19. The fix makes crypto/x509 reject certificate chains that pass through known-compromised intermediate certificates.

Enhancements​

  • The new Helm value node.spirlAgentSocketMountDirectory sets the path where the Agent container mounts the socket directory. The default is /run/spirl/sockets. The host path is still set by node.spirlAgentSocketDirectory.
  • spirl-controller accepts DEFAKTO_-prefixed environment variables for every flag, alongside the existing SPIRL_ names. When both are set, the DEFAKTO_ value is used.
  • The Reflector's encryption-key settings and the Ledger scanner's credentials file can also be set with DEFAKTO_-prefixed environment variables, alongside the existing SPIRL_ names. When both are set, the DEFAKTO_ value is used.
  • Every spirl_* metric is now exposed as defakto_*, and defakto_* labels have been added alongside the spirl_* labels on grpc_* metrics.

spirl-system 0.48.0​

October 16, 2026

Security Fixes​

  • Rebuilt with Go 1.26.9. The Go security team published 15 CVE fixes on 2026-10-08. None of them affect spirl-system.
  • Updated the golang.org/x/net dependency to pick up the same upstream HTTP/2 fixes.

Bug Fixes​

  • Fixed an issue where the Agent could run out of memory on nodes with many completed pods. The Agent's Kubernetes workload attestor now ignores pods in the Succeeded or Failed phase. A Broker API reference to a finished pod now returns WORKLOAD_NOT_FOUND, the same as a reference to a deleted pod.
  • Fixed an issue where the Agent's Broker API socket could become unreachable after a rolling update of the Agent DaemonSet with maxSurge (the chart default), requiring an extra restart to recover.
  • Fixed an issue where the controller's mutating webhook injected the default csi.spiffe.io driver name into workload pods even when csiDriver.pluginName set a different name. The chart now passes csiDriver.pluginName to the controller. This issue affected spirl-system 0.44.0 through 0.47.0.

Enhancements​

  • The Agent now accepts unbranded flags and config keys and DEFAKTO_-prefixed environment variables. Existing spirl-* and SPIRL_ names keep working in the SPIRL Agent.
  • When the Agent can't log in because its private key doesn't match its cluster version ID, the Agent now logs a warning to check that the ID and private key come from the same Cluster Version Key.
  • The Helm chart has new options for labeling the resources it creates:
    • The new commonLabels value applies custom labels to every resource the chart creates, including the Agent, controller, CSI driver, Reflector, and Ledger scanner workloads and their pods. Keys the chart owns or selects on, such as app.kubernetes.io/name, are rejected. See Common Labels.
    • The additionalLabels values for the Agent, controller, CSI driver, and Reflector now also label their DaemonSet or Deployment, not just its pods.

spirl-system 0.47.0​

September 28, 2026

Bug​

  • Ledger now evaluates a static AWS/Azure credential injected into a Kubernetes workload via env[].valueFrom.secretKeyRef and generates the same remediation recommendation it already gives for the equivalent envFrom.secretRef/volume-mount patterns.

Enhancements​

  • The spirl-system Helm chart accepts agent settings at the top level of values.yaml, without a platform. The top-level keys socketLayout (or socket), skipKubeletVerification, kubeletHost, includeAnnotations, includeContainerAttributes and updateStrategy each override the matching key in the k8s, istio, eks and eksIstio blocks.
  • Add the ability to configure the spirl-system chart reflector HPA settings to auto-scale based on memory usage with reflector.deployment.hpa.targetMemoryUtilizationPercentage.

spirl-system 0.46.0​

September 21, 2026

Bug Fixes​

  • FetchJWTSVID on the Broker API now returns a PermissionDenied/WORKLOAD_NOT_ENTITLED instead of an empty SVID list when the requested spiffe_id does not match the caller's minted identity.
  • The JWT workload attestor no longer rejects tokens whose JWKS key alg field doesn't exactly match the JWT header's alg; that check was out of spec (a JWK's alg is informational, not a signature-verification input). The attestor now also requires the exp claim to be present on JWT tokens; tokens missing exp are rejected.
  • Fixed an issue where reflector pods that restarted or scaled out while every trust domain server was unreachable remained unready even though they had already loaded bundles and cached SVIDs from the persisted store. The readiness check now reads the API bundle cache that agents are served from, so a reflector with persisted state becomes ready and serves cached credentials without requiring a reachable trust domain server.

Enhancements​

  • The SPIRL agent now attests the workload pod's Kubernetes Namespace object, emitting kubernetes.namespace.name, kubernetes.namespace.uid, kubernetes.namespace.label.*, and (for allow-listed prefixes) kubernetes.namespace.annotation.* workload attributes. These attributes are usable in SPIFFE ID path, certificate, and JWT templates; namespace name, UID, and labels are also eligible in issuance policy overrides. Added workloadAttestation.kubernetes.includeNamespaceAnnotationPrefixes to Central Config to control which namespace annotation prefixes attestation may emit — when empty, no namespace annotations are included. The agent's ClusterRole now grants get/list/watch on namespaces (Helm value agent.namespaceRBAC, default true); set it to false to withhold the grant, in which case no kubernetes.namespace.* attributes are emitted.
  • Webhooks can now reject SVID issuance non-retryably by returning a reject key in the response body; the SPIRL server and agent will not retry a rejected request. Returning an error key continues to indicate a retryable error. Workloads receive a PermissionDenied error instead of FailedPrecondition when issuance is rejected this way. The reflector no longer serves a cached SVID when the server has rejected the request.
  • The reflector can now be configured to cache only specific SVID types via reflector.cache.enabled, accepting a list of SVID types (jwt, x509). Both types are cached by default; set to a single type (e.g., ["x509"]) to disable caching for the other.

spirl-system 0.45.0​

September 14, 2026

Bug Fixes​

  • Fixes an issue where the Reflector would send the wrong status code to the agent when an attribute was missing in an SVID signing request. The agent then failed to re-trigger attestation earlier than the default of 30 minutes. The agent now attempts to recover the missing attribute on the next attempt, handling the case where the attribute was missing due to a temporary condition.

spirl-system 0.44.0​

August 28, 2026

Enhancements​

  • spirl-agent now serves the SPIFFE Broker API, letting a broker such as ztunnel (Istio Ambient mode) obtain X.509 SVIDs, JWT SVIDs, and trust bundles on a workload's behalf. The endpoint is a separate mTLS Unix domain socket and is disabled by default. Enable it with the Helm value agent.brokerEndpoint.socketPath, or --broker-socket-path on Linux and Docker, and add a BrokerPolicy section through Managed Config to control which brokers may connect.
    • A broker can identify a workload by Kubernetes pod or by process ID. Process ID references are attested with the full workload attestor set (Linux, Kubernetes, Docker, and systemd), so host processes are issuable through a broker, not only pods.
    • The endpoint is not limited to Kubernetes. On a host with no pod identity, such as a packaged systemd deployment, the agent establishes its own serving identity by attesting its own process.
    • New metrics report endpoint activity: spirl_agent_broker_endpoint_enabled, spirl_agent_broker_requests_total, spirl_agent_broker_policy_denials_total, spirl_agent_broker_reference_resolution_total, spirl_agent_broker_subscriptions, and spirl_agent_broker_subscription_first_update_total.
  • The agent can now validate a server's TLS certificate against a name other than the address it dialed. This supports private link deployments where the dial address differs from the name on the certificate. Configure the mapping with the Helm value agent.endpoint.serverNameOverrides, or --spirl-endpoint-server-name-override <dial-address>=<tls-server-name> on Linux and Docker.
  • A new optional Helm value csiDriver.pluginName sets the name the SPIFFE CSI driver registers with kubelet, defaulting to csi.spiffe.io. Override it when running more than one agent in the same Kubernetes cluster so that each driver registers under a unique name and points at its own agent socket.
  • The agent's namespace is now part of the generated ClusterRole and ClusterRoleBinding names, which makes it possible to install the spirl-system chart more than once in a cluster, in different namespaces. Use helm upgrade on existing deployments. Because the resource names change, helm upgrade creates the new ClusterRole and ClusterRoleBinding before deleting the old ones, which should prevent disruption.
  • The Reflector now supports opt-in, scheduled rotation of the key encryption key (KEK) that protects its Kubernetes Secret-backed encryption keys. Set a schedule with the Helm value reflector.kekRotation.interval. Supported values are whole hours from 24h through 8760h. Rotation stays off when no interval is set.
    • After a rotation the Reflector rewraps its stored data encryption keys under the new KEK generation. The encrypted payloads themselves are left unchanged.
    • Once nothing references them any more, superseded KEK generations are retired. The current and immediately preceding generations are always retained, so fully purging a specific key takes two rotations.
    • A rotation can also be requested on demand by writing a newer RFC3339 timestamp to the defakto.security/kek-rotation-requested-at annotation on the Reflector's KEK Secret (spirl-reflector-enc-keys). On-demand rotation does not require a configured interval. Cloud KMS-backed deployments do not support annotation-triggered rotation, since key material rotates through the provider.
  • The Ledger Kubernetes integration now detects OpenAI API keys and Microsoft Entra client secrets in Secrets, ConfigMaps, and Pod environment variables, in addition to the credential types it already recognized. Detections carry a redacted hint, never the raw secret.

Bug Fixes​

  • Reduced non-actionable ERROR logging from spirl-agent and the Reflector. Transient and per-attempt conditions such as expected stream shutdowns, retried SVID rotations, single-workload attestation failures, and transient kubelet lookups now log at WARN. ERROR is reserved for conditions that need an operator's attention.

spirl-system 0.43.0​

July 24, 2026

Bug​

  • Fixed an issue where the spiffe-csi-driver would not accept Helm values for the container security context.

Enhancement​

  • Updates the default maxUnavailable on CSI driver upgrades to 10% of the cluster. CSI driver update strategy can now be tuned by changing the Helm value csiDriver.updateStrategy to a custom update strategy.
  • Fixes an issue in the Helm chart where the updateStrategy was always read from the Kubernetes platform configuration, not the selected platform.
  • Ledger Kubernetes integration now detects and flags Anthropic API keys.

Internal​

  • Add destroyScheduledDuration under the gcpKMS extension in Managed Configuration to allow for control over how long destroyed keys stay in GCP after they are no longer in use.

spirl-system 0.42.0​

July 10, 2026

Bug Fixes​

  • When the JWT WorkloadAttestor is used, spirl-agent will flatten objects in JWT claim values when mapping them to attestation attributes
  • SPIRL agents now drain in-flight Workload API/SDS streams gracefully on shutdown, so workloads no longer see a transport error when an agent restarts.
  • The spirl-system Helm chart no longer sets namespaceSelector: {} or objectSelector: {} on the MutatingWebhookConfiguration when these fields are not configured. This prevents a server-side apply field-ownership conflict with admissionsenforcer on AKS clusters with Azure Policy enabled that caused helm upgrade to fail.

Enhancements​

  • The key type for x509 SVIDs can be configured using the SVIDIssuancePolicy. This will configure which key type (algorithm) spirl-agent uses when generating a key for an x509 SVID.
  • Added additionalLabels values to the Helm chart for csiDriver and controller
  • Agents can now identify their cluster by name instead of cluster ID when configuring agent attestation, via the new cluster-name agent setting (agent.auth.clusterName in Helm). A cluster can be referenced using a naming convention you control, rather than passing a Defakto-generated ID between your provisioning and deployment pipelines. The existing clusterId setting continues to work unchanged.
  • Add GCP Certificate Authority Service upstream authority extension
  • A new Helm chart parameter reflector.deployment.topologySpreadConstraints lets operators set pod topology spread constraints on the reflector Deployment.
  • A new Helm chart parameter controller.replicas allows spirl-controller deployment to be scaled.

spirl-system 0.41.0​

June 11, 2026

Ledger Generally Available​

Ledger, Defakto's solution for non-human identity (NHI) visibility, risk management, and secret eradication is Generally Available. You can read more about Ledger in our documentation.

spirl-system installs the Kubernetes runtime integration. Read more about the setup of this integration.

spirl-system 0.40.0​

June 1, 2026

Enhancements​

  • Helm Chart now supports setting nodeSelector on Agent, Controller, CSI Driver, and Reflector pods.
  • Helm Chart now supports setting tolerations on Reflector pods.
  • Added a new metric spirl_agent_workload_attestation_configured that reports whether each workload attestation type is enabled.
  • Added a new jwt WorkloadAttestation type. A JWT token can be passed to the spirl-agent via gRPC metadata, where it is validated and its claims are included in the workload's attested attributes. This follows the same behavior as CI/CD Profiles and Links.

spirl-system 0.39.0​

May 22, 2026

Security Fixes​

  • Updated golang.org/x/crypto, golang.org/x/net, and go-git/v5 dependencies to pick up upstream CVE fixes.

Bug Fixes​

  • Fixed a chart upgrade bug in the Reflector: The spirl-system chart no longer sets spec.replicas on the Reflector Deployment when reflector.deployment.hpa.enabled=true, resolving a field ownership conflict that caused helm upgrade to fail when the Reflector HPA is enabled. On initial install with HPA enabled, the deployment briefly starts with the Kubernetes default of 1 replica before the HPA scales to minReplicas.

spirl-system 0.38.0​

May 13, 2026

Security Fixes​

  • Rebuilt with Go 1.26.3. The Go security team published 11 CVE fixes on 2026-05-07; of these, CVE-2026-33814 was reachable in the agent's Sigstore image-signature verification and the customer-configured webhook extension code paths. The other 10 fixed CVEs do not affect spirl-system in our deployment context.
  • Updated go-git/v5 and in-toto-golang dependencies to pick up their respective security fixes.

Enhancements​

  • Added a new TPM Device ID agent attestor for hardware-based attestation.
  • Added Sigstore support to the Kubernetes workload attestor.
  • Added Sigstore attributes to the Docker workload attestor.
  • The Reflector now exposes liveness and readiness health probes, allowing Kubernetes to automatically detect and recover from unhealthy instances and withhold traffic until the Reflector is fully initialized.
  • Upgraded the bundled SPIFFE CSI Driver to v0.2.11 and the CSI Node Driver Registrar to v2.15.0.

spirl-system 0.37.0​

May 1, 2026

Bug Fixes​

  • Changed log level of RST_STREAM events originating from the bundleRefresher and the sessionClient to be logged as WARN instead of ERROR. These events are expected when a load balancer sitting in front of the servers closes the connection.
  • Corrected a bug in the Reflector garbage collection process that was loading full data backed by a Kubernetes custom resource (data.spirl.com) when only the metadata was needed. This bug caused the Reflector to use significantly more memory than expected.

Enhancements​

  • Added Podman support to the Docker Workload Attestor.
  • Added two new attributes to the Docker Workload Attestor: docker.container.env.<key> and docker.container.image_config_digest.
  • Added a new Custom JWT Agent Attestor, enabling agents to use additional JWTs to authenticate to the Trust Domain Server.
  • Added proactive renewal of X.509 SVIDs previously signed by tainted keysets.

spirl-system 0.36.0​

April 15, 2026

Enhancements​

  • General availability of
    • 11 new agent attestation options, including custom extensions.
    • 1 new workload attestation option (Linux systemd) plus new k8 attributes: kubernetes.pod.image_count, kubernetes.pod.init_image_count, kubernetes.pod.owner, and kubernetes.pod.owner_uid.
  • New metric spirl_agent_workload_svid_expiry_timestamp to track SVID expire times for local workloads.
  • Easier migration of Istio workloads by allowing an Istio CA to be added as a supplemental root in the spirl-agent trust store.

spirl-system 0.35.0​

April 2, 2026

Enhancements​

  • Adds a feature that on startup will read the local Istio trust domain certificate authority from Kubernetes and add it as a supplemental root. This supports multi-root configuration in Istio where workloads can be issued credentials from either the Istio or Defakto trust domain. Istio also needs to be separately configured with the Defakto certificate authority to fully complete the bi-directional trust.
    • This feature is disabled by default. Enable with:
      • Helm: experimental.useIstioSupplementalRoot: true

spirl-system 0.34.0​

March 26, 2026

Bug Fixes​

  • Fixes miscalculations in the following metrics leading to inaccurate results:
    • spirl_agent_svid_expiring
    • spirl_agent_svid_outdated
    • spirl_agent_svid_cache_size
  • Adds a grace period of 2 minutes before a credential is considered expiring when calculating the spirl_agent_svid_expiring metric.
    • If the agent is healthy, all SVIDs will be rotated within 2 minutes of being considered for renewal, allowing any non-zero value in this metric to indicate the SVIDs are not rotating on schedule.
  • Fixes a rare issue when dialing the server through an HTTP proxy that would cause a connection to timeout and need to be retried.
  • Improves error messages to provide more context when using the JWT Workload Attestor.

Enhancements​

  • Adds a new metric spirl_agent_workload_svid_expiry_timestamp that reports for each workload connection to the agent the expiry time of the SVID issued to the workload. This metric only includes workloads that maintain a connection to the agent and monitor the agent for rotations.
    • This metric is disabled by default. Enable with:
      • Helm: telemetry.collectors.workload.emitSVIDExpiry: true
      • Linux: --telemetry-enable-workload-svid-expiry-metrics

spirl-system 0.33.0​

March 11th, 2026

Bug Fixes​

  • Fix a spelling mistake in the Helm chart values file emmitLatencyMetrics becomes emitLatencyMetrics. emmitLatencyMetrics may still be used for backwards compatibility.
  • spirl-agent: Previously, when setting the value of runWithoutPrivileged, the agent would both run as an unprivileged process and also configure the agent pod to run in the host network namespace . This has been split into two independent settings. There is now a new parameter enableHostNetwork to configure the pod to run in the host network namespace. The setting runWithoutPrivileged will no longer cause the process to run in the host network namespace.
    • Please be aware: if running an agent in the host network namespace via the new parameter enableHostNetwork, the workload API will be unavailable during agent restarts. This setting should only be used under advice of Defakto customer support.

Enhancements​

  • Adds the following parameters to the agent Helm chart for enabling attestation of Kubernetes container (k8s.container.*) attributes: k8s.includeContainerAttributes: <bool>, istio.includeContainerAttributes: <bool>, eks.includeContainerAttributes: <bool>, eksIstio.includeContainerAttributes: <bool>.
  • Enables spirl-agent deployments via ArgoCD by adding the following parameter:
    • Adds argocd.enabled: <bool> Helm value which annotates Kubernetes resource for use by ArgoCD application specifications. When enabled each resource will be annotated with a default set of annotations that govern the lifecycle of each resource.

spirl-system 0.32.0​

February 12th, 2026

Bug Fixes​

  • Fixes an issue introduced in release 0.31.0 where an agent may leave additional TCP connections open to servers, leading to slightly higher memory utilization.

Enhancements​

  • Additional metrics added to the /metrics endpoint (See documentation at https://d.defakto.security/configuration/telemetry/spirl-telemetry-metrics#spirl-agent-metrics)
    • spirl_agent_workload_attestation_total
    • spirl_agent_workload_attestation_duration_seconds
    • spirl_agent_workload_api_connections_total
    • spirl_agent_workload_api_connections
    • spirl_agent_svid_rotation_total
    • spirl_agent_svid_rotation_duration_seconds
    • spirl_agent_svid_cache_size
    • spirl_agent_svid_expiring
    • spirl_agent_svid_outdated
  • General availability of the Workload Attestation Extension. Removes the experimental prefix "-x" from configuration parameters.
  • Additional telemetry added to the backend health event stream, providing enhanced visibility into system health for better operational support.

spirl-system 0.31.0​

January 21st, 2026

Bug Fixes​

  • In multiple services, "RST_STREAM" errors were logged at a high rate when streams routinely disconnected and reconnected; now those logs are at the "warn" level
  • Remove a log about an ignored health check from error to warn since it's ignored
  • In the agent and reflector, "waiting for next source change" errors were logged at a high rate when streams ended; they now end transparently without logging errors
  • In the agent, "context canceled" errors were logged at a high rate during gRPC connection swaps when connections reached maximum age or during failover; connection swaps now happen transparently without logging errors
  • Fix an issue where agents/reflectors/servers emit invalid spirl_application_info metrics with empty values, out of date values, or the invalid value spirl.public.

Enhancements​

  • Adds a helm chart parameter image.pullCredentials to specify a raw username and password to login to a registry. The username and password must be provided in the form base64("<username>:<password>").
  • Adds a parameter runWithoutPrivileged to the spirl-system helm chart to run the spirl-agent without privileged: true
  • Workload attestation now fails immediately when extension attestation fails
  • Added agent-side metrics for X.509 and JWT SVID minting operations
  • SVID minting success/failure rates now exported via Prometheus
  • SVID minting duration metrics available for performance monitoring
  • Added dedicated health server on port 8086 (configurable via --health-listen-addr)
  • Health check endpoints moved to /live (liveness) and /ready (readiness) on the new health server
  • Deprecated health endpoints on metrics server (port 9090) remain for backwards compatibility
  • Updated Kubernetes readiness and liveness probes to use the new health server

spirl-system 0.30.0​

December 8th, 2025

Enhancements​

  • Agent passes attesting workload PID to extensions.

spirl-system 0.29.0​

December 8th, 2025

Enhancements​

  • Add POC support to custom workload attribute attestation through two complementary extension mechanisms: centralized webhook-based extensions in the Server, and distributed executable-based extensions in the Agent.
  • Validates that the SPIRL endpoint is not an http endpoint.
  • When available, adds x-forwarded-for header to span tags.
  • Add a logger in the agent that outputs current memory and CPU usage.

Security Fix​

  • Updates Golang to 1.25.5 to address CVE-2025-61729 and CVE-2025-61727

spirl-system 0.28.0​

December 1st, 2025

Bug Fixes​

  • gRPC logger now logs "finished call" messages at INFO level when the request completes with OK status.

Documentation​

  • The region field in agent and server logs has been renamed to deploymentName to better reflect its meaning.

Enhancements​

  • spirlctl and SPIRL Go SDK now support filtering clusters by realm when listing
  • Add ability to configure Agent Attestation for new and existing clusters

Security Fix​

spirl-system 0.27.0​

November 5th, 2025

Enhancements​

  • Logs related to the same request can be correlated across components using trace_id.
  • Agent: Adds a flag ---linux-attestation-discover-workload-path which will include the attribute linux.binary.path in the attested attributes. It should only be set when the agent is running on bare metal Linux nodes as root or with CAP_SYS_PTRACE capability.
  • gRPC client errors (NotFound, AlreadyExists, InvalidArgument, Unauthenticated) are now logged at Warn level instead of Info.
  • Fixed silent failures in the Linux attestor for blank usernames and group names - now returns proper errors instead of continuing without validation.
  • Enhanced logging across all attestors with PID and container context for better debugging visibility.
  • The spirl-agent binaries in Linux packages have CGO_ENABLED which makes it possible to attest Linux user names for LDAP users.

spirl-system 0.26.0​

November 3rd, 2025

Enhancements​

  • Add spirl-bridge sidecar
  • spirl-controller can inject spirl-bridge using annotations

spirl-system 0.25.0​

October 8th, 2025

Security Fixes​

Enhancements​

  • td-server: Adds a flag --events-service-server-name to override the server name when connecting to the events service. This is useful when connecting via PrivateLink.
  • SVIDIssuedEvents requests support filtering by issuer type, issuer ID, agent ID, SVID type, and spiffe ID.

spirl-system 0.24.0​

September 23rd, 2025

Enhancements​

  • Adds new --realm flag to spirlctl cluster add to add a cluster within a realm.
  • Updated AWS EC2 instance certificates (added "ap-southeast-6" region)
  • Allow CSI driver and SPIRL Controller to be disabled when installing SPIRL System Helm chart.

spirl-system 0.23.0​

August 26th, 2025

Breaking Changes​

  • Removes flags jwt-attestation-issuer,jwt-attestation-jwks-url, and supplemental-attestation. CI/CD Profiles can now be configured by linking a CI/CD Profile to a cluster using the LinkCICDProfile method.

Bug Fixes​

  • Fix version reporting in health events.
  • Agent heartbeats generated by the Reflector correctly include the agent version

Enhancements​

  • Add support for custom JWT claims in JWT-SVIDs via a JWT customization template.
  • Reduced Reflector error log noise
  • No longer log expected resource storage conflicts during sync as errors.
  • Adds x-forwarded-for and x-request-id to the logs when present in a gRPC connection
  • Reflectors now send their own heartbeats, at a low rate, in addition to agent heartbeats
  • No longer emit a misleading error log related to reloading metadata during normal shutdown
  • Added "cache_hit" to the spirl_reflector_mint_svid_total metric, allowing tracking of % of requests that could be served from cache
  • Added affinity to the Reflector chart (reflector.deployment.affinity)

spirl-system 0.22.3​

July 24th, 2025

Enhancements​

  • Adds supplemental roots file for JWT Attestation to spirl-system helm chart

spirl-system 0.22.2​

July 22nd, 2025

Bug Fixes​

  • Fix reflector metrics port exposure when telemetry is enabled

Enhancements​

  • Improved error messages on invalid cluster key secret
  • Signers will now distinguish Reflectors and Agents if both use distinct authentication keys

spirl-system 0.22.1​

July 15th, 2025

Enhancements​

  • Reflector credentials can now be be optionally omitted while enabling the Reflector which will use the Agent credentials if omitted

spirl-system 0.22.0​

July 11th, 2025

Enhancements​

  • Improves service configuration change reactivity
  • TD Servers can now authenticate Reflectors separately from Agents
  • Added the spirl_reflector_mint_svid_total prometheus counter to the Reflector
  • Updated EC2 instance identity certificates
  • Install data CRD on Helm chart upgrades.
  • Added HPA support for the Reflector
  • Reflector returns better error codes when the upstream trust domain server rejects the login attempt
  • Reflectors now use their own credentials when connecting to the TD server instead of using the Agent credentials

spirl-system 0.21.0​

June 27th, 2025

Bug Fixes​

  • Reflector now accepts startup arguments for ConnectionMaxAge and UseGRPCFastRedial and includes those when initializing its TD server client
  • spirl-system Helm chart configuration values for ConnectionMaxAge and UseGRPCFastRedial are copied from the agent.endpoint section when deploying the Reflector

Enhancements​

  • Reflector enabled clusters don't count reflectors as agents
  • Reflector enabled clusters correctly issue agent heartbeats
  • Reflector can now be configured with a Pod Distribution Budget to ensure health during maintenance activities

spirl-system 0.20.0​

June 24th, 2025

Enhancements​

  • spirldbg: Adds identity-exchange-token flag to svid-jwt and svid-x509 commands to support OIDC JWT attestation for CI/CD clusters
  • Updated EC2 instance identity certificates
  • Reflector support multiple upstream endpoints in priority order
  • Reflector logs serving from cache at Info level

spirl-system 0.19.0​

June 17th, 2025

Enhancements​

  • Azure Key Vault: a validation check during key wrapping initialization is now performed to verify that keys support the required 256-bit AES-GCM algorithm, failing fast when an incompatible keys is encountered.
  • Reflector replica count and resource requests/limits can now be customized in Helm chart

spirl-system 0.18.0​

June 10th, 2025

Breaking Changes​

  • Removed deprecated GetTrustBundle API from trust domain server. SPIRL agent v0.3.0 (released Jul 19, 2023) and newer use a different API and therefore are unaffected by this change.

spirl-system 0.17.1​

May 23rd, 2025

All changes in this release are internal only

spirl-system 0.17.0​

May 20th, 2025

Enhancements​

  • Attribute allow lists can now be configured through the chart.
  • Use the RSA-2048 instance verification method to attest AWS EC2 instances.
  • Reflector supports managing a self-signed CA
  • Make it possible to set additional labels for the agent pod in the spirl-system chart.

spirl-controller 0.6.1​

May 20th, 2025

All changes in this release are internal only

spirl-system-helm-chart 0.9.0​

May 20th, 2025

Enhancements​

  • SPIRL server now emits latency gRPC metrics by default if telemetry is enabled.
  • Prometheus scraping annotations are added as pod annotations if telemetry is enabled
  • Upgrades SPIFFE CSI driver to version 0.2.7.
  • Improves the spirl-agent daemonset update strategy to replace agent pods with less impact to the workload API

spirl-agent 0.16.0​

May 20th, 2025

  • SPIRL agents will now generate app info prometheus metrics including trust domain and trust domain deployment as labels.
  • SPIRL server and agent now include three labels in the generated Prometheus metrics that can be used for filtering and dashboard building. gRPC metrics include spirl_component (agent | server), spirl_trust_domain (trust domain name), and spirl_trust_domain_deployment (trust domain deployment name) as labels. Besides that, a new metric (spirl_application_info) is generated during initialization, it also includes the aforementioned labels and the binary version as well.
  • Add a flag to have the agent test and wait for the kubelet pod list API to become available during startup

spirl-system-helm-chart 0.8.0​

May 20th, 2025

Enhancements​

  • You can specify imagePullSecrets now for all pods in the helm chart.
  • Introduces a useGRPCFastRedial endpoint configuration option to spirl-agent that will trigger faster redialing of the endpoint when using DNS based load balancers.
  • Improves the spirl-agent daemonset update strategy to replace agent pods with less impact to the workload API
  • Annotation collection on Kubernetes collections is now supported using the includeAnnotations option

spirl-agent v0.15.1​

May 20th, 2025

Enhancements​

  • Introduces a useGRPCFastRedial endpoint configuration option to spirl-agent that will trigger faster redialing of the endpoint when using DNS based load balancers.
  • Improves the spirl-agent daemonset update strategy to replace agent pods with less impact to the workload API
  • Annotation collection on Kubernetes collections is now supported using the includeAnnotations option