Prepare the v0.12 release branch for v0.12.2 #2183
Merged
azdagron merged 77 commits intospiffe:v0.12from Mar 31, 2021
Merged
Conversation
The server API endpoint already enforces TLS 1.2 as the minimum TLS version. However, the bundle endpoint and k8s registrar endpoints still accept TLS 1.0/1.1 clients. This change updates those servers to also enforce at least TLS 1.2. Fixes: spiffe#2024 Signed-off-by: Andrew Harding <aharding@vmware.com>
This fixes spiffe#1230 Signed-off-by: Jonathan Oddy <jonathan.oddy@transferwise.com>
Signed-off-by: Jonathan Oddy <jonathan.oddy@transferwise.com>
Co-authored-by: Andrew Harding <azdagron@gmail.com> Signed-off-by: Jonathan Oddy <jonathan.oddy@transferwise.com>
Signed-off-by: Ryan Turner <turner@uber.com>
Signed-off-by: Ryan Turner <turner@uber.com>
Signed-off-by: Ryan Turner <turner@uber.com>
Signed-off-by: Ryuma Yoshida <ryuma.y1117@gmail.com>
Signed-off-by: Ryuma Yoshida <ryumyosh@zlab.co.jp>
Signed-off-by: Ryuma Yoshida <ryumyosh@zlab.co.jp>
Signed-off-by: Ryuma Yoshida <ryumyosh@zlab.co.jp>
Signed-off-by: Ryuma Yoshida <ryumyosh@zlab.co.jp>
Signed-off-by: Ryuma Yoshida <ryumyosh@zlab.co.jp>
Signed-off-by: Mariano Kunzi <kunzi.mariano@gmail.com>
…fe#2032) * Report update time as metrics for spire server and agent Signed-off-by: CHEN XI <cxi@uber.com>
…VID (spiffe#2065) Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
The lack of a named error variable (and an accidental capture) was preventing the deferred call counter done method from picking up the error returned from building the cache. This change fixes the bug by naming the error variable in the closure. Signed-off-by: Andrew Harding <aharding@vmware.com>
Signed-off-by: Tomoya Usami <tousami@zlab.co.jp>
Signed-off-by: Ben Leggett <bleggett@virtru.com>
Signed-off-by: Ben Leggett <bleggett@virtru.com>
Signed-off-by: Ben Leggett <bleggett@virtru.com>
Signed-off-by: Ben Leggett <bleggett@virtru.com>
Signed-off-by: Ben Leggett <bleggett@virtru.com>
Signed-off-by: inajob <kinadu@zlab.co.jp>
Signed-off-by: inajob <kinadu@zlab.co.jp>
…09 signing (spiffe#2142) * Expose a single config to disable rate limiting on JWT signing and X509 signing Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Co-authored-by: Andrew Harding <azdagron@gmail.com> Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Faisal Memon <f.memon@f5.com>
Signed-off-by: Andrew Harding <aharding@vmware.com>
Signed-off-by: Andrew Harding <aharding@vmware.com>
Signed-off-by: SirNexus <ai.carson@f5.com>
…file_selectors'. This is needed when spire-server is running in a secure area with no public internet access. If an attesting node has an iam instance profile policy attached and there is no public internet access, spire-server fails to attest the nodes because it cannot reach the aws iam endpoint - iam.amazonaws.com. Setting use_instance_profile_selectors = false, disables the api call to the iam endpoint allowing nodes to attest. Signed-off-by: Kris Gambirazzi <kris.gambirazzi@transferwise.com>
…kwards functionality. Signed-off-by: Kris Gambirazzi <kris.gambirazzi@transferwise.com>
…onfig option Signed-off-by: Kris Gambirazzi <kris.gambirazzi@transferwise.com>
…tance_profile_selectors configuration option Signed-off-by: Kris Gambirazzi <kris.gambirazzi@transferwise.com>
Signed-off-by: Kris Gambirazzi <kris.gambirazzi@transferwise.com>
…he node attestor type Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
evan2645
approved these changes
Mar 31, 2021
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry picks in the following PRs in preparation for the 0.12.2 release.
#2015
#2020
#2022
#2025
#2032
#2044
#2048
#2065
#2091
#2110
#2116
#2119
#2133
#2142
#2150
#2155
#2159