Skip to content

Releases: vmware-tanzu/secrets-manager

v0.28.0

16 Oct 06:49
@v0lkan v0lkan
v0.28.0
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
17bcc0a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.0 Latest
Latest

VSecM Logo

Added

  • Added PostgreSQL support as a backing store to VSecM Safe.
  • Fixed a bug that affected the polling interval to be faster than normal
    in VSecM Sidecar.
  • Added use case examples on SPIFFE federation and Web Crypto API.
  • Initiated a PoC VSecM Relay Client and VSecM Relay Server to enable
    cross-cluster secret sharing.

Security

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.27.3...v0.28.0

Contributors

v0lkan and dependabot
Assets 2
Loading
0 Join discussion

v0.27.3

04 Oct 06:14
@v0lkan v0lkan
v0.27.3
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
06df118
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.3

VSecM Logo

This is a quick patch release to add Helm chart options.

Added

  • Added helm charts the ability to optionally disable custom namespace generation.

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.27.2...v0.27.3

Contributors

v0lkan
Assets 2
Loading

v0.27.2

01 Oct 02:56
@v0lkan v0lkan
v0.27.2
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
2d0256a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.2

VSecM Logo

Added

  • Documented all undocumented public methods in the source code.
  • Other documentation updates.
  • Updated some of the Asciinema screen recordings of the use cases.
  • Minor code fixes and enhancements.
  • Added missing imagePullSecrets to SPIFFE CSI Driver helm template of the
    VSecM Helm charts.

Below are the generated release notes of every commit since the last release cut:

What's Changed

  • minor typo by @v0lkan in #1082
  • Introducing initial helm-chart for version 0.27.1 by @v0lkan in #1084
  • doc changes by @v0lkan in #1085
  • 🧹 chore(vsecm): Release next version's manifests by @v0lkan in #1087
  • 📚 docs(vsecm): add version snapshot by @v0lkan in #1088
  • 🐛 fix(VSecM Keygen): regression: keygen was not decrypting secrets by @v0lkan in #1092
  • 🌟 enhancement(VSecM): pointed example images to upstream by @v0lkan in #1093
  • Added a new use case by @v0lkan in #1094
  • Use case: Using Init container with k8s secrets by @v0lkan in #1095
  • 🐛 fix(VSecM): fix logic error in example workload by @v0lkan in #1096
  • Create scorecard.yml by @v0lkan in #1098
  • 🌟 enhancement(VSecM Web): Add a new landing page by @v0lkan in #1112
  • 📚 docs(VSecM Web): add screen recordings to some use cases by @v0lkan in #1114
  • Test/app sentinel coverage by @gurkanguray in #1117
  • 💄 cosmetic(VSecM Web): landing page mobile fixes by @v0lkan in #1118
  • 🌟 enhancement(VSecM): Isolate VSecM SDK by @v0lkan in #1120
  • (chore) Version Update for the New SDK Approach to work by @v0lkan in #1121
  • 🐛 fix(VSecM Helm Charts): SPIRE Server was crashing if not persistent by @v0lkan in #1122
  • Refactor: fix potential panic & refactor some code by @canack in #1123
  • 🚨 test(VSecM): unit tests added for core/audit and core/constants by @gurkanguray in #1099
  • 📚 docs(VSecM Web): added new contributor hours video recording by @v0lkan in #1125
  • update roadmap by @v0lkan in #1126
  • Finalized pending ADRs + security enhancements by @v0lkan in #1127
  • Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /sdk by @dependabot in #1128
  • 🚨 test(VSecM Sentinel): 1100 add unit test and refactor app/sentinel by @gurkanguray in #1129
  • Release v0.27.1 by @v0lkan in #1130
  • Introducing initial helm-chart for version 0.27.2 by @v0lkan in #1132
  • 🌟 enhancement(VSecM): next helm charts and docs by @v0lkan in #1133
  • 0.27.2 (future version) by @v0lkan in #1136
  • documentation update and minor code fixes by @v0lkan in #1137
  • doc update by @v0lkan in #1138
  • 🐛 increased go version in test-coverage.yml by @marikann in #1139
  • documentation update + spiffe workshop files by @v0lkan in #1140
  • add helper scripts to workshop by @v0lkan in #1141
  • Update CODEOWNERS by @v0lkan in #1142
  • v0.27.2 by @v0lkan in #1143

New Contributors

Full Changelog: v0.27.0...v0.27.2

Contributors

v0lkan, canack, and 3 other contributors
Assets 2
Loading
0 Join discussion

v0.27.1

13 Sep 12:25
@v0lkan v0lkan
v0.27.1
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
43505e8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.1

VSecM Logo

This is a security and stability release. We have fixed several vulnerabilities
and made the components more robust.

Added

  • Increased test coverage.
  • Minor bug fixes and performance improvements.
  • Documentation updates.

Changed

  • Updated Go to version 1.23.1 on major components. vSecM SDK remains at Go
    version 1.21.0 to offer compatibility with older systems. This is the smallest
    version that we can support with the SDK without exposing vulnerabilities.

Fixed

  • Fixed a bug where SPIRE Server was crashing when using Helm charts and not
    enabling persistent volumes.

Security

Below are the generated release notes of every commit since the last release cut:

What's Changed

  • minor typo by @v0lkan in #1082
  • Introducing initial helm-chart for version 0.27.1 by @v0lkan in #1084
  • doc changes by @v0lkan in #1085
  • 🧹 chore(vsecm): Release next version's manifests by @v0lkan in #1087
  • 📚 docs(vsecm): add version snapshot by @v0lkan in #1088
  • 🐛 fix(VSecM Keygen): regression: keygen was not decrypting secrets by @v0lkan in #1092
  • 🌟 enhancement(VSecM): pointed example images to upstream by @v0lkan in #1093
  • Added a new use case by @v0lkan in #1094
  • Use case: Using Init container with k8s secrets by @v0lkan in #1095
  • 🐛 fix(VSecM): fix logic error in example workload by @v0lkan in #1096
  • Create scorecard.yml by @v0lkan in #1098
  • 🌟 enhancement(VSecM Web): Add a new landing page by @v0lkan in #1112
  • 📚 docs(VSecM Web): add screen recordings to some use cases by @v0lkan in #1114
  • Test/app sentinel coverage by @gurkanguray in #1117
  • 💄 cosmetic(VSecM Web): landing page mobile fixes by @v0lkan in #1118
  • 🌟 enhancement(VSecM): Isolate VSecM SDK by @v0lkan in #1120
  • (chore) Version Update for the New SDK Approach to work by @v0lkan in #1121
  • 🐛 fix(VSecM Helm Charts): SPIRE Server was crashing if not persistent by @v0lkan in #1122
  • Refactor: fix potential panic & refactor some code by @canack in #1123
  • 🚨 test(VSecM): unit tests added for core/audit and core/constants by @gurkanguray in #1099
  • 📚 docs(VSecM Web): added new contributor hours video recording by @v0lkan in #1125
  • update roadmap by @v0lkan in #1126
  • Finalized pending ADRs + security enhancements by @v0lkan in #1127
  • Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /sdk by @dependabot in #1128
  • 🚨 test(VSecM Sentinel): 1100 add unit test and refactor app/sentinel by @gurkanguray in #1129
  • Release v0.27.1 by @v0lkan in #1130

New Contributors

Full Changelog: v0.27.0...v0.27.1

Contributors

v0lkan, canack, and 2 other contributors
Assets 2
Loading

v0.27.0

28 Jul 18:26
@v0lkan v0lkan
v0.27.0
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
36c67f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.0

VSecM Logo

Changed

  • Removed useClusterSpiffeIds and useSpireControllerManager from helm charts
    options. SPIRE helm charts use SPIRE Controller Manager, and disabling it
    is nontrivial. Also, ClusterSPIFFEIDs are the best way to manage SPIFFEIDs
    in a Kubernetes cluster. — If we find a use case where these options are
    necessary, or if there is a need from the community, we can modify the
    code to let SPIRE install without SPIRE Controller Manager and bring those
    flags back.
  • Optimized the build pipeline, reducing the build time by 60%.
  • Removed bundle endpoints from SPIRE manifests. We don't use them anywhere.
    If there is a need, we can bring them back. Note that this also impacts
    the experimental "federation" feature. Federation can still be enabled
    by manually editing the SPIRE Server and SPIRE Agent configmaps. Later, we'll
    have a cross-cluster replication feature where we will introduce these
    bundle endpoints using a hub-spoke topology in a more controlled manner.

Added

  • Introduced new Architecture Decision Records (ADRs) as drafts. These ADRs
    will be reviewed and finalized in the upcoming releases.
  • Namespaces of vsecm-system, spire-server, and spire-system can now
    be dynamically configurable via Helm charts.
  • Various documentation and README updates.

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.26.1...v0.27.0

Contributors

v0lkan and omergk28
Assets 2
Loading

v0.26.1

09 Jul 04:38
@v0lkan v0lkan
v0.26.1
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: E598DA434F7E7CAF
Learn about vigilant mode.
f2d958b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.26.1

VSecM Logo

Added

  • VMware Secrets Manager Helm charts now have the ability to generate
    RedHat OpenShift compatible manifests. You’ll need to set global.enableOpenShift
    to true to use this feature. It is false by default because it introduced
    OpenShift-specific security rules that other clusters will not interpret
    properly.
  • Introduced new images spireHelperBash, spireHelperKubectl,
    openShiftHelperUbi9 to help and streamline SPIRE deployment and harden
    its security by mutating webhook configurations and other security attributes
    post-install.
  • Increased unit tests coverage. Our first target is 50%, and we are aiming to
    reach there one unit test at a time.
  • Documentation updates.

Changed

  • BREAKING: We have made significant updates in the VSecM SPIRE helm charts
    to align them with the official upstream SPIFFE helm-charts-hardened
    project. This means, VSecM users will need to add className: "vsecm" to
    their workload SPIFFEID for the workloads to get their SVIDs.
  • BREAKING: The default SPIRE Agent socket is renamed to spire-agent.sock
    instead of agent.sock. If you are using VSecM SDK or VSecM Sidecar
    this change is transparent; however if you are manually consuming the SPIRE
    Agent socket, you’d need to change your code to listen to the new socket.
  • SPIRE Server and SPIRE Agent configuration values in the ConfigMaps are now
    in JSON form to align with helm-charts-hardened.
  • SPIRE Server Service is now serving from the standard TLS port 443.
  • Updated SPIRE-related dependencies to their recent stable versions.
  • Updates in the exponential backoff algorithm to make it more robust.
  • Certain environment variables changed, the changes have not reflected to the
    documentation by the time of this release note. We will update the documentation
    shortly. In the meantime, when in doubt, take source code as the authoritative
    reference for variable naming. Helm charts will also contain the correct
    environment variable names and default values.
  • Other refactorings in the codebase to improve performance. The changes do
    not change the behavior or introduce any new behavior.

Security

  • SPIRE Server is now in its own namespace (to benefit from the security of
    namespace isolation    ) and also has a restricted pod security audit with
    a read-only file system and an unprivileged non-root account.
  • Other security enhancements especially focused around SPIRE.

Fixed

  • Several minor bugfixes and regressions.

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.26.0...v0.26.1

Contributors

v0lkan
Assets 2
Loading

v0.26.0

29 Jun 20:12
@v0lkan v0lkan
v0.26.0
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
49ae83f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.26.0

VSecM Logo

Added

  • Added the ability to have regex-based SPIFFE ID matchers.
  • Enabled stricter validation on SPIFFE IDs to reduce configuration errors.
  • Added ability to optionally use multiple worker nodes for the development
    clusters.
  • Introduced helm-docs to automatically augment the documentation with the
    Helm chart's values.yaml.
  • Added the ability to deploy VSecM without SPIRE Controller Manager. In this
    mode, the operator will need to manually create SPIRE Server registration
    entries.
  • Added the ability to not create ClusterSPIFFEIDs for the VSecM components
    automatically. In this mode, the operator will need to manually create those
    required ClusterSPIFFEIDs.
  • Ability to use regexes for SPIFFEID prefix matching.
  • Ability to use a custom trust domain.
  • Ability to Use Regex-Based Validation for Sentinel, Safe, and Workload
    SPIFFE IDs.
  • Code cleanup and refactoring.
  • Random secret generator can now generate symbols too, along with numbers and
    letters.
  • Created a ./lib folder to hold common code that can be shared across
    different components, or even be imported by external applications.
  • Stability: Enhancements in liveness and readiness probes for VSecM components.
    This change ensures that the components are more resilient and reliable.
  • Enable Istio-style SPIFFE IDs; custom namespaces, and custom trust domains.

Changed

  • Lots of documentation updates to reflect the recent changes in the project.
  • Replaced github.com/pkg/errors with the native errors package
    to reduce the number of dependencies and the codebase more
    secure and maintainable.
  • Updates to the exponential backoff algorithm.
  • Enhancements to speed up build time.
  • Rephrased the "Problem reading secret" error message to be more informative.
    The message ought to have been a notification, not an error because it
    regularly happens during cache misses. Fixed the wording to indicate
    there is no need to panic.
  • We started using zola for the documentation
    website. This change makes the documentation website faster, more accessible,
    and easier to navigate and follow.

Security

  • Stricter workload validation: Workload validation now panics if the SPIFFE ID
    does not have the proper trust domain or is badly formatted.

Check out the changelog for a human-readable summary of what has happened so far.

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.25.3...v0.26.0

Contributors

v0lkan, muratmirgun, and 2 other contributors
Assets 2
Loading
0 Join discussion

v0.25.3

20 May 00:46
@v0lkan v0lkan
v0.25.3
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
1bfdbb6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.25.3

VSecM Logo

  • Removed some configuration options including VSECM_MANUAL_ROOT_KEY_UPDATES_K8S_SECRET because how the root key will
    be updated will be depending on backing store implementation. And it does
    not make sense for an operator updating the root key in memory but not
    updating the backing Kubernetes secret. That could bring inconsistencies
    to the system.
  • Removed VSECM_SAFE_REMOVE_LINKED_K8S_SECRETS since we have long
    deprecated and removed the -k flag that was dealing with the linked
    Kubernetes secrets. Again, future behavior will be contingent upon the
    backing store plugins that will be implemented.
  • Removed Kubernetes secrets deletion queue because we do not link Kubernetes
    secrets to workloads anymore. Deletion of ad-hoc VSecM-generated Kubernetes
    Secrets will be handled by upcoming configuration options. Right now,
    VSecM Safe can only create and update, but not delete Kubernetes Secrets.
  • Stability improvements, including adding "exponential backoff"s to places
    where requests can be retried before giving up; also letting the apps
    crash (and be re-crated by the scheduler) if certain critical requests fail
    even after a fair amount exponentially-backed-off of retries (10 by default).
  • An entire overhaul of the documentation website: It is now faster, more
    accessible, more usable, easier to navigate and follow.
  • Added an experimental Java SDK. The keyword here is: experimental; we
    do know that it does not work out-of-the box, so we are not providing any
    documentation yet: Feel free to join our Slack channel to learn more about
    how best you can use it.
  • Refactorings and improvements across the entire codebase.
  • Introduced Architectural Decision Records

Check out the changelog for a human-readable summary of what has happened so far.

Below are the generated release notes of every commit since the last release cut:

What's Changed

Full Changelog: v0.25.2...v0.25.3

Contributors

v0lkan and sahinakyol
Assets 2
Loading

v0.25.2

07 May 05:49
@v0lkan v0lkan
v0.25.2
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
0f84f81
This commit was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.25.2

VSecM Logo

This release introduced many structural changes. The functionality remains
the same, but the codebase is more organized and easier to maintain.
We had to temporarily disable some of the unit tests to make the release
happen on time. We will re-enable them before the next release.

Changed

  • Simplified audit journaling
  • Refactoring and code organization
  • Now helm-chart can deploy VSecM and SPIRE to any namespace, before it had
    to be vsecm-system and spire-system respectively.
  • removed "backing store" from secret meta info; backing store will be set
    at a global level.
  • removed -b (backing store) flag from VSecM Sentinel's CLI too.
  • Added certain useful methods from internal packages to the core package
    to make it more reusable. These functionalities may be part of the SDK too,
    later.
  • Organized imports and functions according to the project standards.
  • Renamed certain modules and functions for clarity.
  • Introduced certain environment variables whose functionalities will be
    implemented later.
  • updated helm charts, removed hard coded namespace references from service URLs.

Check out the changelog for a human-readable summary of what has happened so far.

Below are the generated release notes of every commit since the last release cut:

What's Changed

  • Introducing initial helm-chart for version 0.25.2 by @v0lkan in #948
  • add serviceName for conformance by @v0lkan in #952
  • 0.25.2 - intermediate release cut by @v0lkan in #953
  • Enable Namespace Change in Helm Charts by @v0lkan in #955
  • Add helm hooks for ordering spire-agent and spire-server deployment by @BulldromeQ in #954
  • cleanup by @v0lkan in #956

Full Changelog: v0.25.1...v0.25.2

Contributors

v0lkan and BulldromeQ
Assets 2
Loading

v0.25.1

27 Apr 05:50
@v0lkan v0lkan
v0.25.1
This tag was signed with the committer’s verified signature.
v0lkan Volkan Özçelik
GPG key ID: 9A59F3D946BFD021
Learn about vigilant mode.
8238a7e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.25.1

VSecM Logo

This was a stability and reliability release. We have made several improvements
to VSecM Sentinel, helm charts, and Kubernetes manifests to make the system
more reliable and resilient.

Changed

  • Converted VSecM Safe and SPIRE Server to StatefulSets (because they are stateful).
  • VSecM Sentinel "init command" loop now exits the container if it cannot execute
    commands after exponential backoff. The former behavior was to retry forever,
    and that was not a cloud-native way of handling the situation. Panicking
    early and thus killing the pod fixed issues with things like persistent volumes
    and CSI drivers.

Fixed

  • Minor bug fixes in the VSecM Sentinel init command workflow.

Check out the changelog for a human-readable summary of what has happened so far.

Below are the generated release notes of every commit since the last release cut:

What's Changed

  • Introducing initial helm-chart for version 0.25.1 by @v0lkan in #938
  • v0.25.0 release notes by @v0lkan in #940
  • 🌟 enhancement(VSecM Sentinel): refactored forever loops by @v0lkan in #946
  • PV Support for VSecM Safe by @v0lkan in #947

Full Changelog: v0.25.0...v0.25.1

Contributors

v0lkan
Assets 2
Loading