From b6c2712483fe3465280f9ce1011ec8e8763f6c37 Mon Sep 17 00:00:00 2001 From: Keegan Witt Date: Thu, 22 Oct 2026 16:34:04 -0400 Subject: [PATCH] Update pinned toolchains and SPIRE security releases Signed-off-by: Keegan Witt --- .github/workflows/pr_build.yml | 2 +- docker-compose/federation/README.md | 4 ++-- .../federation/docker/broker-webapp/Dockerfile | 2 +- .../docker/spire-server-broker.example/Dockerfile | 2 +- .../spire-server-stockmarket.example/Dockerfile | 2 +- .../docker/stock-quotes-service/Dockerfile | 2 +- docker-compose/metrics/docker-compose.yaml | 4 ++-- docker-compose/nested-spire/.go-version | 2 +- docker-compose/nested-spire/README.md | 6 +++--- docker-compose/nested-spire/docker-compose.yaml | 12 ++++++------ k8s/oidc-aws/agent-daemonset.yaml | 2 +- k8s/oidc-aws/server-statefulset.yaml | 4 ++-- k8s/oidc-vault/k8s/server-statefulset.yaml | 4 ++-- k8s/quickstart/agent-daemonset.yaml | 2 +- k8s/quickstart/client-deployment.yaml | 2 +- k8s/quickstart/server-statefulset.yaml | 2 +- 16 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml index 6db39275..b1c8174f 100644 --- a/.github/workflows/pr_build.yml +++ b/.github/workflows/pr_build.yml @@ -6,7 +6,7 @@ on: pull_request: {} workflow_dispatch: {} env: - GO_VERSION: 1.24.0 + GO_VERSION: 1.26.10 CHANGE_MINIKUBE_NONE_USER: true TERM: xterm jobs: diff --git a/docker-compose/federation/README.md b/docker-compose/federation/README.md index a4a69317..93133225 100644 --- a/docker-compose/federation/README.md +++ b/docker-compose/federation/README.md @@ -16,8 +16,8 @@ In this tutorial you will learn how to: The baseline components for SPIFFE federation are: -* Two SPIRE Server instances running version 1.11.2. -* Two SPIRE Agents running version 1.11.2. One connected to one SPIRE Server, and the second connected to the other SPIRE Server. +* Two SPIRE Server instances running version 1.15.5. +* Two SPIRE Agents running version 1.15.5. One connected to one SPIRE Server, and the second connected to the other SPIRE Server. * Two workloads that need to communicate each other via mTLS, and use the Workload API to get SVIDs and trust bundles. # Scenario diff --git a/docker-compose/federation/docker/broker-webapp/Dockerfile b/docker-compose/federation/docker/broker-webapp/Dockerfile index 9a6954ff..46b1758b 100644 --- a/docker-compose/federation/docker/broker-webapp/Dockerfile +++ b/docker-compose/federation/docker/broker-webapp/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/spiffe/spire-agent:1.5.1 +FROM ghcr.io/spiffe/spire-agent:1.15.5 COPY conf/agent.conf /opt/spire/conf/agent/agent.conf COPY conf/agent.key.pem /opt/spire/conf/agent/agent.key.pem diff --git a/docker-compose/federation/docker/spire-server-broker.example/Dockerfile b/docker-compose/federation/docker/spire-server-broker.example/Dockerfile index 85541398..20203c6e 100644 --- a/docker-compose/federation/docker/spire-server-broker.example/Dockerfile +++ b/docker-compose/federation/docker/spire-server-broker.example/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/spiffe/spire-server:1.11.2 +FROM ghcr.io/spiffe/spire-server:1.15.5 # Override spire configurations COPY conf/server.conf /opt/spire/conf/server/server.conf diff --git a/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile b/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile index bbaf606b..24beaca0 100644 --- a/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile +++ b/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/spiffe/spire-server:1.11.2 +FROM ghcr.io/spiffe/spire-server:1.15.5 # Override spire configurations COPY conf/server.conf /opt/spire/conf/server/server.conf diff --git a/docker-compose/federation/docker/stock-quotes-service/Dockerfile b/docker-compose/federation/docker/stock-quotes-service/Dockerfile index 111a4b4f..346ebd32 100644 --- a/docker-compose/federation/docker/stock-quotes-service/Dockerfile +++ b/docker-compose/federation/docker/stock-quotes-service/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/spiffe/spire-agent:1.5.1 as spire +FROM ghcr.io/spiffe/spire-agent:1.15.5 as spire COPY conf/agent.conf /opt/spire/conf/agent/agent.conf COPY conf/agent.key.pem /opt/spire/conf/agent/agent.key.pem diff --git a/docker-compose/metrics/docker-compose.yaml b/docker-compose/metrics/docker-compose.yaml index df6417f2..6d9f4f82 100644 --- a/docker-compose/metrics/docker-compose.yaml +++ b/docker-compose/metrics/docker-compose.yaml @@ -17,13 +17,13 @@ services: ports: - "9090:9090" spire-server: - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: spire-server volumes: - ./spire/server:/opt/spire/conf/server command: ["-config", "/opt/spire/conf/server/server.conf"] spire-agent: - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 depends_on: ["spire-server"] hostname: spire-agent volumes: diff --git a/docker-compose/nested-spire/.go-version b/docker-compose/nested-spire/.go-version index 4e00d0ac..63d92c7f 100644 --- a/docker-compose/nested-spire/.go-version +++ b/docker-compose/nested-spire/.go-version @@ -1 +1 @@ -1.14.4 +1.26.10 diff --git a/docker-compose/nested-spire/README.md b/docker-compose/nested-spire/README.md index 86b67851..f998243b 100644 --- a/docker-compose/nested-spire/README.md +++ b/docker-compose/nested-spire/README.md @@ -48,7 +48,7 @@ We define all the services for the tutorial in the [docker-compose.yaml](docker- services: # Root root-server: - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: root-server volumes: - ./root/server:/opt/spire/conf/server @@ -56,7 +56,7 @@ We define all the services for the tutorial in the [docker-compose.yaml](docker- root-agent: # Share the host pid namespace so this agent can attest the nested servers pid: "host" - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 depends_on: ["root-server"] hostname: root-agent volumes: @@ -91,7 +91,7 @@ The Docker Compose definition for the `nestedA-server` service in the [docker-co nestedA-server: # Share the host pid namespace so this server can be attested by the root agent pid: "host" - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: nestedA-server labels: # label to attest nestedA-server against root-agent diff --git a/docker-compose/nested-spire/docker-compose.yaml b/docker-compose/nested-spire/docker-compose.yaml index f8b79581..81378893 100644 --- a/docker-compose/nested-spire/docker-compose.yaml +++ b/docker-compose/nested-spire/docker-compose.yaml @@ -1,7 +1,7 @@ services: # Root root-server: - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: root-server volumes: - ./root/server:/opt/spire/conf/server @@ -9,7 +9,7 @@ services: root-agent: # Share the host pid namespace so this agent can attest the nested servers pid: "host" - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 depends_on: ["root-server"] hostname: root-agent volumes: @@ -22,7 +22,7 @@ services: nestedA-server: # Share the host pid namespace so this server can be attested by the root agent pid: "host" - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: nestedA-server labels: # label to attest server against root-agent @@ -34,7 +34,7 @@ services: - ./nestedA/server:/opt/spire/conf/server command: ["-config", "/opt/spire/conf/server/server.conf"] nestedA-agent: - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 hostname: nestedA-agent depends_on: ["nestedA-server"] volumes: @@ -44,7 +44,7 @@ services: nestedB-server: # Share the host pid namespace so this server can be attested by the root agent pid: "host" - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 hostname: nestedB-server depends_on: ["root-server","root-agent"] labels: @@ -56,7 +56,7 @@ services: - ./nestedB/server:/opt/spire/conf/server command: ["-config", "/opt/spire/conf/server/server.conf"] nestedB-agent: - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 hostname: nestedB-agent depends_on: ["nestedB-server"] volumes: diff --git a/k8s/oidc-aws/agent-daemonset.yaml b/k8s/oidc-aws/agent-daemonset.yaml index 41cca9f1..6263c6ee 100644 --- a/k8s/oidc-aws/agent-daemonset.yaml +++ b/k8s/oidc-aws/agent-daemonset.yaml @@ -28,7 +28,7 @@ spec: args: ["-t", "30", "spire-server:8081"] containers: - name: spire-agent - image: ghcr.io/spiffe/spire-agent:1.5.1 + image: ghcr.io/spiffe/spire-agent:1.15.5 args: ["-config", "/run/spire/config/agent.conf"] volumeMounts: - name: spire-config diff --git a/k8s/oidc-aws/server-statefulset.yaml b/k8s/oidc-aws/server-statefulset.yaml index d9b11eec..ddb8e5b3 100644 --- a/k8s/oidc-aws/server-statefulset.yaml +++ b/k8s/oidc-aws/server-statefulset.yaml @@ -21,7 +21,7 @@ spec: shareProcessNamespace: true containers: - name: spire-server - image: ghcr.io/spiffe/spire-server:1.5.1 + image: ghcr.io/spiffe/spire-server:1.15.5 args: - -config - /run/spire/config/server.conf @@ -52,7 +52,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 - name: spire-oidc - image: ghcr.io/spiffe/oidc-discovery-provider:1.5.1 + image: ghcr.io/spiffe/oidc-discovery-provider:1.15.5 args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf diff --git a/k8s/oidc-vault/k8s/server-statefulset.yaml b/k8s/oidc-vault/k8s/server-statefulset.yaml index d9b11eec..ddb8e5b3 100644 --- a/k8s/oidc-vault/k8s/server-statefulset.yaml +++ b/k8s/oidc-vault/k8s/server-statefulset.yaml @@ -21,7 +21,7 @@ spec: shareProcessNamespace: true containers: - name: spire-server - image: ghcr.io/spiffe/spire-server:1.5.1 + image: ghcr.io/spiffe/spire-server:1.15.5 args: - -config - /run/spire/config/server.conf @@ -52,7 +52,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 - name: spire-oidc - image: ghcr.io/spiffe/oidc-discovery-provider:1.5.1 + image: ghcr.io/spiffe/oidc-discovery-provider:1.15.5 args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf diff --git a/k8s/quickstart/agent-daemonset.yaml b/k8s/quickstart/agent-daemonset.yaml index 520fff5a..79bdfb7f 100644 --- a/k8s/quickstart/agent-daemonset.yaml +++ b/k8s/quickstart/agent-daemonset.yaml @@ -28,7 +28,7 @@ spec: args: ["-t", "30", "spire-server:8081"] containers: - name: spire-agent - image: ghcr.io/spiffe/spire-agent:1.11.2 + image: ghcr.io/spiffe/spire-agent:1.15.5 args: ["-config", "/run/spire/config/agent.conf"] env: - name: MY_NODE_NAME diff --git a/k8s/quickstart/client-deployment.yaml b/k8s/quickstart/client-deployment.yaml index b22bdc40..1cc8b4a3 100644 --- a/k8s/quickstart/client-deployment.yaml +++ b/k8s/quickstart/client-deployment.yaml @@ -18,7 +18,7 @@ spec: dnsPolicy: ClusterFirstWithHostNet containers: - name: client - image: ghcr.io/spiffe/spire-agent:1.5.1 + image: ghcr.io/spiffe/spire-agent:1.15.5 command: ["/opt/spire/bin/spire-agent"] args: [ "api", "watch", "-socketPath", "/run/spire/sockets/agent.sock" ] volumeMounts: diff --git a/k8s/quickstart/server-statefulset.yaml b/k8s/quickstart/server-statefulset.yaml index d45d997c..c9546809 100644 --- a/k8s/quickstart/server-statefulset.yaml +++ b/k8s/quickstart/server-statefulset.yaml @@ -22,7 +22,7 @@ spec: fsGroup: 1000 containers: - name: spire-server - image: ghcr.io/spiffe/spire-server:1.11.2 + image: ghcr.io/spiffe/spire-server:1.15.5 args: - -config - /run/spire/config/server.conf