Secrets Management Agent Release Notes
8 min
1.8.5 Release Notes
These release notes give an overview of the enhancements, new features, and improvements included in Kron PAM Secrets Management Agent (AAPM) 1.8.5.
Agent
- Just-in-time account support has been added. Applications can request temporary, time-limited accounts that are created on demand and can extend the lifetime of these accounts.
- The agent now automatically detects the features supported by the Kron PAM server it connects to and remains compatible with earlier Kron PAM versions.
- The agent identity is now included in password requests. On Kron PAM versions that do not support this feature, the agent automatically falls back to the previous method.
- The response timeout for the Kron PAM server has been increased to 30 seconds, which reduces timeout errors in high-load environments.
- An error that occurred when no failover server address was defined has been fixed.
- More accurate error codes are now returned in error conditions.
SDKs
- Just-in-time account requests and lifetime extensions are now supported in all SDKs (Java, .NET, C++, PHP, Python).
- The SDKs now provide improved error handling and stability.
- Connection security and input validation have been strengthened in the SDKs.
- The applicationId and signature parameters have been removed. Applications that use these parameters must remove the related lines before upgrading.
- The PHP SDK now requires PHP 8.0 or later.
- The Windows C++ SDK now supports encrypted (SSL/TLS) connections only.
- The .NET SDK now uses TLS 1.2 for HTTP connections.
Installation & Deployment
- A unique certificate is now generated automatically for each installation.
- Information used during installation is now stored so that only authorized accounts can access it.
- The service configuration in the Linux installation has been fixed.
- Service startup and the transfer of installation parameters in the Windows installation have been fixed.
- Sample applications have been removed from the installation package.
Security
- On Linux, the agent service now runs with restricted privileges, in line with the principle of least privilege.
- Third-party components have been upgraded to their current versions, including security updates.
1.8.4 Release Notes
These release notes give an overview of the enhancements, new features, and improvements included in Kron PAM Secrets Management Agent (AAPM) 1.8.4.
Agent
- Failover to the secondary server when the primary Kron PAM server is unreachable has been improved.
- When the Kron PAM server is temporarily unreachable, the service now continues without interruption for the configured grace period (graceInMinutes).
- The agent name is now included in the status information sent to Kron PAM, which makes agents easier to tell apart.
- Incorrect detection of the machine IP address on hosts with Docker installed has been fixed.
- Hostname detection has been improved, and IP detection no longer requires a connection to an external address.
- Stability issues related to cache refresh and concurrent requests have been fixed.
- Compatibility with Java 8 environments has been improved.
SDKs
- All SDKs (Java, .NET, C++, PHP, Python) now return standardized error codes, so applications can distinguish and handle errors more easily.
- Logging support has been added to the SDKs. Sensitive information such as passwords is automatically masked in the logs.
- Kron PAM now shows which SDK a request originated from.
Installation & Deployment
- An installation package for macOS has been added.
- Uninstall scripts for Windows and Linux have been added.
- Silent installation, which requires no user interaction, is now supported, and an installation guide has been added.
- On Linux, the configuration file (.env) has been moved to the /etc/kron-agent directory. Custom scripts that access this file must be updated with the new path.
Security
- Third-party components (gRPC, Netty, Protobuf, Tomcat, Spring Boot, Log4j2) have been upgraded, including security updates.
- Rate limiting and timeout protections have been added against excessive request load.
- Authentication is now enabled by default in the agent management tool.
- On Linux, configuration and credentials are now stored in the /etc/kron-agent directory with permissions that restrict access to the authorized user.