SPIFFE/SPIRE v1.15.2

This release focuses on scaling SPIRE for larger deployments through significant database optimizations and Introducing the SPIFFE Broker. It also advances the project's security posture with expanded post-quantum cryptography support and native TLS for metrics, alongside critical fixes for cloud-provider attestation plugins.

Introduction of the SPIFFE Broker — Introduces a new Broker endpoint and API, simplifying identity federation and exchange between different SPIFFE trust domains.

Database Performance Optimizations for Large Deployments — Significantly reduces database CPU load and contention in large-scale environments by optimizing MySQL queries and implementing bulk processing for node management.

Expanded Post-Quantum Cryptography (PQC) Support — Ensures SPIRE remains resilient against future cryptographic threats by expanding PQC support to additional curves and applying PQC policies to the bundle and Prometheus endpoints.

Configurable JTI Claim Support for JWT-SVIDs — Provides more granular control over JWT-SVID generation, allowing security architects to enforce unique token identifiers at the individual entry level.

SPIFFE-native TLS support for Prometheus Metrics — Secures observability data by allowing the Prometheus endpoint to use SPIFFE-native TLS, ensuring that only authorized entities in the mesh can scrape metrics.