Added

• Support staticManifestPath: watch a directory for CRs instead of using Kubernetes API (#411)

Added

• Support for configuring the log level (#388, #464)
• New metrics to track ClusterStaticEntry failures (#387)

Fixed

• Failed controller upgrade when webhook certificate is expired (#450)

Updated

• Minor documentation changes (#435, #443)
• Version used in migration guide (#465)

🚨 PLEASE READ BEFORE UPGRADING 🚨

This version contains changes in the ClusterSPIFFEID CRD. Before upgrading you MUST do the following:

• Update the CRD in your cluster (see here).

Added

• Hint field to the ClusterSPIFFEID CRD that controls the hint on resulting entries (#416)
• Fallback field to the ClusterSPIFFEID CRD which causes the CR to only apply if no other non-fallback CRs have been applied to a given pod (#415)
• Missing documentation for the className on the ClusterFederatedTrustDomain CRD (#413)

🚨 PLEASE READ BEFORE UPGRADING 🚨

This version contains changes in the ClusterStaticEntry CRD. Before upgrading you MUST do the following:

• Update the CRD in your cluster (see here).

Added

• Support for storeSVID on ClusterStaticEntry (#304)
• Support for more than one spire-controller-manager managing entries against a single SPIRE server cluster via entry prefixes (#325)

Security

• Updated Golang to 1.21.9 to address CVE-2023-45288 (#338)

Added

• Ability to selectively choose which CRDs to reconcile (#297)

Changed

• Join token novelty entries are ignored during entry reconciliation (#306)

Added

• Process-wide support for customizing the parent ID template for workload registration (#289)

Fixed

• Failed controller startup when webhook was disabled via ENABLE_WEBHOOKS=false (#294)

Added

• Support for caching multiple namespaces instead of one or all (#271,#286)
• Support for expanding environment variables in the controller configuration (#256)
• Support for disabling webhooks by setting the environment variable ENABLE_WEBHOOKS=false (#234)

🚨 PLEASE READ BEFORE UPGRADING 🚨

This version contains changes in the ClusterSPIFFEID CRD, ClusterFederatedTrustDomain CRD and ClusterStaticEntry CRD. Before upgrading you MUST do the following, in order:

• Update those CRDs into your cluster (see here, here and here).
• Update the manager-role ClusterRole, which includes additional permissions for endpoints CRD (see here)

Security

• Updated to google.golang.org/grpc v1.59.0 to address CVE-2023-44487 (#231)

Added

• ClusterSPIFFEID CRD support for DNS name auto-population (#122)
• Support for multiple SPIRE clusters running in the same K8S cluster using ClassName's (#230)

Fixed

• Missing status subresource definitions (#223)