spire 0.12.2 Helm chart
philips-labsVerified publisherScored 14 Sept 2026
A Helm chart for deploying the full Spire stack into your k8s cluster. Components: - spire-server - spire-controller-manager (optional) - spire-k8s-workload-registrar (deprecated, optional) - spire-agent - spiffe-csi-driver - spiffe-oidc-discovery-provider (optional) > **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. > **Note**: Minimum Spire version is `v1.5.3` *(This requires a nodeSelector to limit to `amd64` nodes on multi-node clusters)*. > The recommended minimum version for multi-architecture clusters is `v1.6.0` which ships with `arm64` support. To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. ```bash docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` ```yaml spec: containers: - command: - kube-apiserver - --api-audiences=api,spire-server - --service-account-issuer=api,spire-agent - --service-account-key-file=/run/config/pki/sa.pub - --service-account-signing-key-file=/run/config/pki/sa.key ```
Version 0.12.2 3 years agoapp version 1.6.0 1Artifact Hub
spire 0.12.2 deploys 6 container images: ghcr.io/spiffe/spiffe-csi-driver, registry.k8s.io/sig-storage/csi-node-driver-registrar, cgr.dev/chainguard/wait-for-it, ghcr.io/spiffe/spire-agent and 2 more. Across the 5 measured, 726 findings — 0 critical, 15 high — 6 on CISA KEV. The highest contribution is GHSA-45x7-px36-x8w8 in golang.org/x/crypto v0.6.0, fixed in 0.17.0. Chart.yaml declares kubeVersion >=1.21.0-0; rendered for Kubernetes 1.21.0.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Container images
| Image | Tag | Vulnerabilities | Radar Score |
|---|---|---|---|
| ghcr.io/ | 0.2.3 | 024106 | 1,010 |
| registry.k8s.io/ | v2.6.2 | 0210122 | 1,273 |
| cgr.dev/ | latest-20230113 | — | unmeasured |
| ghcr.io/ | 1.6.0 | 0418161 | 1,859 |
| ghcr.io/ | 1.6.0 | 0313129 | 1,468 |
| ghcr.io/ | 0.2.2 | 0416132 | 1,626 |
Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.
Vulnerabilities
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Low | GO-2026-5029 | golang.org/ | 0.55.0 |
| Low | GO-2026-5030 | golang.org/ | 0.55.0 |
| Low | GO-2026-4316 | github.com/ | no fix listed |
| Low | GO-2026-4602 | stdlib | 1.25.8 |
| Low | GHSA-wfqv-66vq-46rm | github.com/ | 3.0.5 |
| Low | GO-2026-5024 | golang.org/ | 0.44.0 |
| Low | GHSA-pmwq-pjrm-6p5r | github.com/ | 0.11.0 |
| Low | DLA-3972-1 | tzdata | 2024b-0+deb11u1 |
| Low | DLA-4085-1 | tzdata | 2025a-0+deb11u1 |
| Low | DLA-4105-1 | tzdata | 2025b-0+deb11u1 |
| Low | DLA-4403-1 | tzdata | 2025b-0+deb11u2 |
| Low | GO-2023-2153 | google.golang.org/ | 1.56.3 |
| Low | GO-2023-2334 | github.com/ | 3.0.1 |
| Low | GO-2026-5547 | github.com/ | 0.11.0 |
| Low | GO-2026-5932 | golang.org/ | no fix listed |
| Low | GO-2026-6061 | google.golang.org/ | 1.82.1 |
| Low | GO-2026-6225 | github.com/ | no fix listed |
| Low | GO-2026-4309 | github.com/ | no fix listed |
| Low | GHSA-4vq8-7jfc-9cvp | github.com/ | 25.0.13 |
Indexed versions
The latest version and the previous major, as selected nightly from the repository’s index.
README badge
Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.