keeganwitt · Oct 22, 2026 · Nov 8, 2026
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
@@ -6,7 +6,7 @@ on:
   pull_request: {}
   workflow_dispatch: {}
 env:
-  GO_VERSION: 1.24.0
+  GO_VERSION: 1.26.10
   CHANGE_MINIKUBE_NONE_USER: true
   TERM: xterm
 jobs:

diff --git a/docker-compose/federation/README.md b/docker-compose/federation/README.md
@@ -16,8 +16,8 @@ In this tutorial you will learn how to:
 
 The baseline components for SPIFFE federation are:
 
-* Two SPIRE Server instances running version 1.11.2.
-* Two SPIRE Agents running version 1.11.2. One connected to one SPIRE Server, and the second connected to the other SPIRE Server.
+* Two SPIRE Server instances running version 1.15.5.
+* Two SPIRE Agents running version 1.15.5. One connected to one SPIRE Server, and the second connected to the other SPIRE Server.
 * Two workloads that need to communicate each other via mTLS, and use the Workload API to get SVIDs and trust bundles.
 
 # Scenario

diff --git a/docker-compose/federation/docker/broker-webapp/Dockerfile b/docker-compose/federation/docker/broker-webapp/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/spiffe/spire-agent:1.5.1
+FROM ghcr.io/spiffe/spire-agent:1.15.5
 
 COPY conf/agent.conf /opt/spire/conf/agent/agent.conf
 COPY conf/agent.key.pem /opt/spire/conf/agent/agent.key.pem

diff --git a/docker-compose/federation/docker/spire-server-broker.example/Dockerfile b/docker-compose/federation/docker/spire-server-broker.example/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/spiffe/spire-server:1.11.2
+FROM ghcr.io/spiffe/spire-server:1.15.5
 
 # Override spire configurations
 COPY conf/server.conf /opt/spire/conf/server/server.conf

diff --git a/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile b/docker-compose/federation/docker/spire-server-stockmarket.example/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/spiffe/spire-server:1.11.2
+FROM ghcr.io/spiffe/spire-server:1.15.5
 
 # Override spire configurations
 COPY conf/server.conf /opt/spire/conf/server/server.conf

diff --git a/docker-compose/federation/docker/stock-quotes-service/Dockerfile b/docker-compose/federation/docker/stock-quotes-service/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/spiffe/spire-agent:1.5.1 as spire
+FROM ghcr.io/spiffe/spire-agent:1.15.5 as spire
 
 COPY conf/agent.conf /opt/spire/conf/agent/agent.conf
 COPY conf/agent.key.pem /opt/spire/conf/agent/agent.key.pem

diff --git a/docker-compose/metrics/docker-compose.yaml b/docker-compose/metrics/docker-compose.yaml
@@ -17,13 +17,13 @@ services:
     ports:
       - "9090:9090"
   spire-server:
-    image: ghcr.io/spiffe/spire-server:1.11.2
+    image: ghcr.io/spiffe/spire-server:1.15.5
     hostname: spire-server
     volumes:
         - ./spire/server:/opt/spire/conf/server
     command: ["-config", "/opt/spire/conf/server/server.conf"]
   spire-agent:
-    image: ghcr.io/spiffe/spire-agent:1.11.2
+    image: ghcr.io/spiffe/spire-agent:1.15.5
     depends_on: ["spire-server"]
     hostname: spire-agent
     volumes:

diff --git a/docker-compose/nested-spire/.go-version b/docker-compose/nested-spire/.go-version
@@ -1 +1 @@
-1.14.4
+1.26.10
diff --git a/docker-compose/nested-spire/README.md b/docker-compose/nested-spire/README.md
@@ -48,15 +48,15 @@ We define all the services for the tutorial in the [docker-compose.yaml](docker-
    services:
      # Root
      root-server:
-       image: ghcr.io/spiffe/spire-server:1.11.2
+       image: ghcr.io/spiffe/spire-server:1.15.5
        hostname: root-server
        volumes:
          - ./root/server:/opt/spire/conf/server
        command: ["-config", "/opt/spire/conf/server/server.conf"]
      root-agent:
        # Share the host pid namespace so this agent can attest the nested servers
        pid: "host"
-       image: ghcr.io/spiffe/spire-agent:1.11.2
+       image: ghcr.io/spiffe/spire-agent:1.15.5
        depends_on: ["root-server"]
        hostname: root-agent
        volumes:
@@ -91,7 +91,7 @@ The Docker Compose definition for the `nestedA-server` service in the [docker-co
    nestedA-server:
      # Share the host pid namespace so this server can be attested by the root agent
      pid: "host"
-     image: ghcr.io/spiffe/spire-server:1.11.2
+     image: ghcr.io/spiffe/spire-server:1.15.5
      hostname: nestedA-server
      labels:
        # label to attest nestedA-server against root-agent

diff --git a/docker-compose/nested-spire/docker-compose.yaml b/docker-compose/nested-spire/docker-compose.yaml
@@ -1,15 +1,15 @@
 services:
   # Root
   root-server:
-    image: ghcr.io/spiffe/spire-server:1.11.2
+    image: ghcr.io/spiffe/spire-server:1.15.5
     hostname: root-server
     volumes:
       - ./root/server:/opt/spire/conf/server
     command: ["-config", "/opt/spire/conf/server/server.conf"]
   root-agent:
     # Share the host pid namespace so this agent can attest the nested servers
     pid: "host"
-    image: ghcr.io/spiffe/spire-agent:1.11.2
+    image: ghcr.io/spiffe/spire-agent:1.15.5
     depends_on: ["root-server"]
     hostname: root-agent
     volumes:
@@ -22,7 +22,7 @@ services:
   nestedA-server:
     # Share the host pid namespace so this server can be attested by the root agent
     pid: "host"
-    image: ghcr.io/spiffe/spire-server:1.11.2
+    image: ghcr.io/spiffe/spire-server:1.15.5
     hostname: nestedA-server
     labels:
       # label to attest server against root-agent
@@ -34,7 +34,7 @@ services:
       - ./nestedA/server:/opt/spire/conf/server
     command: ["-config", "/opt/spire/conf/server/server.conf"]
   nestedA-agent:
-    image: ghcr.io/spiffe/spire-agent:1.11.2
+    image: ghcr.io/spiffe/spire-agent:1.15.5
     hostname: nestedA-agent
     depends_on: ["nestedA-server"]
     volumes:
@@ -44,7 +44,7 @@ services:
   nestedB-server:
     # Share the host pid namespace so this server can be attested by the root agent
     pid: "host"
-    image: ghcr.io/spiffe/spire-server:1.11.2
+    image: ghcr.io/spiffe/spire-server:1.15.5
     hostname: nestedB-server
     depends_on: ["root-server","root-agent"]
     labels:
@@ -56,7 +56,7 @@ services:
       - ./nestedB/server:/opt/spire/conf/server
     command: ["-config", "/opt/spire/conf/server/server.conf"]
   nestedB-agent:
-    image: ghcr.io/spiffe/spire-agent:1.11.2
+    image: ghcr.io/spiffe/spire-agent:1.15.5
     hostname: nestedB-agent
     depends_on: ["nestedB-server"]
     volumes:

diff --git a/k8s/envoy-jwt/scripts/set-env.sh b/k8s/envoy-jwt/scripts/set-env.sh
@@ -70,7 +70,7 @@ wait_for_envoy() {
 }
 
 echo "${bb}Creating Envoy-x509 scenario...${nn}"
-bash "${EXAMPLEDIR}"/scripts/pre-set-env.sh > /dev/null
+bash "${EXAMPLEDIR}"/scripts/pre-set-env.sh
 
 echo "${bb}Applying SPIRE Envoy JWT configuration...${nn}"
 kubectl apply -k "${EXAMPLEDIR}"/k8s/. > /dev/null

diff --git a/k8s/envoy-x509/scripts/pre-set-env.sh b/k8s/envoy-x509/scripts/pre-set-env.sh
@@ -12,17 +12,23 @@ red=$(tput setaf 1) || true
 green=$(tput setaf 2) || true
 
 LOGLINE="Agent attestation request completed"
+show_spire_diagnostics() {
+    kubectl -nspire --request-timeout=10s describe pods >&2 || true
+    kubectl -nspire --request-timeout=10s logs statefulset/spire-server -c spire-server --tail=100 --pod-running-timeout=10s >&2 || true
+    kubectl -nspire --request-timeout=10s logs daemonset/spire-agent -c spire-agent --tail=100 --pod-running-timeout=10s >&2 || true
+}
+
 wait_for_agent() {
+    if ! kubectl -nspire rollout status statefulset/spire-server --timeout=120s; then
+        show_spire_diagnostics
+        return 1
+    fi
+    if ! kubectl -nspire rollout status daemonset/spire-agent --timeout=120s; then
+        show_spire_diagnostics
+        return 1
+    fi
     for ((i=0;i<120;i++)); do
-        if ! kubectl -nspire rollout status statefulset/spire-server; then
-            sleep 1
-            continue
-        fi
-        if ! kubectl -nspire rollout status daemonset/spire-agent; then
-            sleep 1
-            continue
-        fi
-        if ! kubectl -nspire logs statefulset/spire-server -c spire-server | grep -e "$LOGLINE" ; then
+        if ! kubectl -nspire --request-timeout=10s logs statefulset/spire-server -c spire-server --pod-running-timeout=10s | grep -e "$LOGLINE" ; then
             sleep 1
             continue
         fi
@@ -32,7 +38,8 @@ wait_for_agent() {
     done
     if [ ! -n "${RUNNING}" ]; then
         echo "${red}Timed out waiting for SPIRE Agent to be running.${nn}"
-        exit 1
+        show_spire_diagnostics
+        return 1
     fi
 }
 

diff --git a/k8s/envoy-x509/scripts/set-env.sh b/k8s/envoy-x509/scripts/set-env.sh
@@ -54,7 +54,7 @@ wait_for_envoy() {
 }
 
 #Creates Envoy-x509 scenario
-bash "${EXAMPLEDIR}"/scripts/pre-set-env.sh > /dev/null
+bash "${EXAMPLEDIR}"/scripts/pre-set-env.sh
 
 echo "${bb}Applying SPIRE Envoy X509 configuration...${nn}"
 # Updates resources for the backend and frontend

diff --git a/k8s/oidc-aws/agent-daemonset.yaml b/k8s/oidc-aws/agent-daemonset.yaml
@@ -28,7 +28,7 @@ spec:
           args: ["-t", "30", "spire-server:8081"]
       containers:
         - name: spire-agent
-          image: ghcr.io/spiffe/spire-agent:1.5.1
+          image: ghcr.io/spiffe/spire-agent:1.15.5
           args: ["-config", "/run/spire/config/agent.conf"]
           volumeMounts:
             - name: spire-config

diff --git a/k8s/oidc-aws/server-statefulset.yaml b/k8s/oidc-aws/server-statefulset.yaml
@@ -21,7 +21,7 @@ spec:
       shareProcessNamespace: true
       containers:
         - name: spire-server
-          image: ghcr.io/spiffe/spire-server:1.5.1
+          image: ghcr.io/spiffe/spire-server:1.15.5
           args:
             - -config
             - /run/spire/config/server.conf
@@ -52,7 +52,7 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 5
         - name: spire-oidc
-          image: ghcr.io/spiffe/oidc-discovery-provider:1.5.1
+          image: ghcr.io/spiffe/oidc-discovery-provider:1.15.5
           args:
           - -config
           - /run/spire/oidc/config/oidc-discovery-provider.conf

diff --git a/k8s/oidc-vault/k8s/server-statefulset.yaml b/k8s/oidc-vault/k8s/server-statefulset.yaml
@@ -21,7 +21,7 @@ spec:
       shareProcessNamespace: true
       containers:
         - name: spire-server
-          image: ghcr.io/spiffe/spire-server:1.5.1
+          image: ghcr.io/spiffe/spire-server:1.15.5
           args:
             - -config
             - /run/spire/config/server.conf
@@ -52,7 +52,7 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 5
         - name: spire-oidc
-          image: ghcr.io/spiffe/oidc-discovery-provider:1.5.1
+          image: ghcr.io/spiffe/oidc-discovery-provider:1.15.5
           args:
           - -config
           - /run/spire/oidc/config/oidc-discovery-provider.conf

diff --git a/k8s/quickstart/agent-daemonset.yaml b/k8s/quickstart/agent-daemonset.yaml
@@ -28,7 +28,7 @@ spec:
           args: ["-t", "30", "spire-server:8081"]
       containers:
         - name: spire-agent
-          image: ghcr.io/spiffe/spire-agent:1.11.2
+          image: ghcr.io/spiffe/spire-agent:1.15.5
           args: ["-config", "/run/spire/config/agent.conf"]
           env:
           - name: MY_NODE_NAME

diff --git a/k8s/quickstart/client-deployment.yaml b/k8s/quickstart/client-deployment.yaml
@@ -18,7 +18,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: client
-          image: ghcr.io/spiffe/spire-agent:1.5.1
+          image: ghcr.io/spiffe/spire-agent:1.15.5
           command: ["/opt/spire/bin/spire-agent"]
           args: [ "api", "watch",  "-socketPath", "/run/spire/sockets/agent.sock" ]
           volumeMounts:

diff --git a/k8s/quickstart/server-statefulset.yaml b/k8s/quickstart/server-statefulset.yaml
@@ -22,7 +22,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: spire-server
-          image: ghcr.io/spiffe/spire-server:1.11.2
+          image: ghcr.io/spiffe/spire-server:1.15.5
           args:
             - -config
             - /run/spire/config/server.conf