Secrets Management Agent
The Secrets Management Agent (also called the AAPM Agent) is a deployable service that removes hardcoded credentials from applications. Instead of storing a password in source code or a configuration file, an application asks the agent for it at runtime. The agent acts as a layer between the application and the Kron PAM Password Vault: it retrieves the credential from the vault, caches it locally, and serves it to the application through a Kron PAM SDK.
You can install the agent directly on Linux and Windows application servers, or deploy it as a container in Kubernetes and OpenShift environments. Agents require a license. Kron PAM lists them under Secrets > Application Management on the Agent screen.
The Application TokenApplication Token mechanism is also the authentication layer the Secrets Management Agent uses to reach the Password Vault. You don't need to configure anything extra for token authentication beyond what's described in that section, the agent handles it automatically during registration.
How the Agent Caches and Validates Passwords
To avoid sending every application request to Kron PAM, the agent caches each password after its first retrieval:
- An application requests a password through the SDK.
- If no valid cached value exists, the agent fetches the password from the Password Vault and stores it in its local cache.
- The agent calculates the cache entry's expiration from the account's next scheduled password change in Kron PAM, and schedules a validation task for it.
- Subsequent requests for the same account are served from the cache, without contacting Kron PAM again, until the entry is refreshed or expires.
The agent validates cached passwords in two modes:
Mode | Behavior |
|---|---|
Regular | Periodically checks whether the cached password is still valid and whether the vault's nextChange time has moved, at a fixed interval. |
Intensive | Checks more frequently as the scheduled password change approaches, to detect and pick up a rotation quickly. |
The switch from Regular to Intensive mode is controlled by the bufferInSeconds parameter: when the time remaining before the next change drops to this value, the agent switches modes. You can tune all three intervals in application.properties after installation:
Parameter | Description |
|---|---|
password.statusCheck.period.regular | How often the agent checks a cached password's status in Regular mode. |
password.statusCheck.period.intensive | How often the agent checks a cached password's status in Intensive mode. |
password.statusCheck.period.bufferInSeconds | How long before the scheduled password change the agent switches from Regular to Intensive mode. |
password.statusCheck.period.graceInMinutes | How long the agent keeps serving a cached password from its local cache if it can't reach either the primary or secondary Kron PAM node. Kron PAM discards the cached password for that account once a request arrives after this period elapses. |
password.statusCheck.period.regular 60
password.statusCheck.period.intensive 5
password.statusCheck.period.bufferInSeconds 60
Note: Changing any application.properties parameter, including the cache and status-check parameters above, requires restarting the Secrets Management Agent service to take effect.
Secrets Management Agent Screen
To view and manage agents, navigate to Secrets > Application Management > Agent. The screen lists every registered agent — installed on Linux, on Windows, or deployed on a Container Orchestration Platform — with the following columns:
Column | Description |
|---|---|
OS Type | The operating system or platform the agent runs on. |
Hostname | The hostname of the server or pod the agent is installed on. |
Host IP | The IP address of the server or pod the agent is installed on. |
Registration Time | The date and time the agent registered with Kron PAM. |
Version | The installed agent's version number. |
Status | Whether the agent is currently Online or Offline. |
Actions | Per-agent actions: Heartbeat and Delete. |
Click Heartbeat in the Actions column to view the heartbeat logs an agent sends once every minute, shown as a graphical chart with an underlying data table. Click Delete in the Actions column to remove an agent that's no longer in use.
To install the agent in a new environment, click the Add button on the Agent screen to generate a new Register Key. The agent installation is then performed on the respective server or pod using the Register Key.
