v1.12.0-alpha.0

Note

This is an alpha pre-release, published so the changes below can be tested end to end. It is not intended for production use.

What's Changed

Conjur JWT authentication

The agent can now authenticate to CyberArk using a JWT from a projected service account token, instead of a username and password. Where both are configured, Conjur JWT takes precedence.

• Add jwtsource package for reading projected SA tokens by @roeezis in #818
• Split legacy username/password login into its own file by @roeezis in #819
• Resolve secrets_manager alongside identity_administration by @roeezis in #820
• Add Conjur JWT authentication client by @roeezis in #821
• Select Conjur JWT or legacy username/password authenticator by @roeezis in #822
• Wire Conjur JWT config into the top-level CyberArk client by @roeezis in #823
• Add Helm chart support for Conjur JWT authentication by @roeezis in #824
• Fall back cluster_name to cyberark.service_id under Conjur JWT by @roeezis in #827

Security hardening

Hosts returned by service discovery are no longer trusted verbatim. They must now resolve to a known CyberArk domain and be reached over HTTPS, which closes a path where a tampered discovery endpoint could have received the agent's credentials.

• Allowlist and require HTTPS for discovery-derived hosts by @roeezis in #829
• Validate ARK_DISCOVERY_API itself against the domain allowlist by @roeezis in #830

Other

• Add CSI information to discovery-agent by @YaaraSirkis in #816

Vulnerability fixes in the published images

Built with Go 1.27.1 and updated dependencies. The images for this release report no fixable vulnerabilities of MEDIUM severity or above, where v1.11.0 reported several. Both govulncheck and a trivy image scan are clean.

New Contributors

• @YaaraSirkis made their first contribution in #816
• @roeezis made their first contribution in #818

Full Changelog: v1.11.0...v1.12.0-alpha.0

---

OCI_PREFLIGHT_IMAGE: quay.io/jetstack/venafi-agent
OCI_PREFLIGHT_TAG: v1.12.0-alpha.0
HELM_CHART_IMAGE: quay.io/jetstack/charts/venafi-kubernetes-agent
HELM_CHART_VERSION: v1.12.0-alpha.0
ARK_IMAGE: quay.io/jetstack/disco-agent
ARK_IMAGE_TAG: v1.12.0-alpha.0
ARK_IMAGE_DIGEST: sha256:2ee75acddab269fc9fcb361f23acf35755ae8722344147a63771367351da0483
ARK_CHART: quay.io/jetstack/charts/disco-agent
ARK_CHART_TAG: v1.12.0-alpha.0
ARK_CHART_DIGEST: sha256:25b7927d395d6b09b6bfb8eaab0add42e3c10b4c0a6c55f6dca9c26f826730ee
NGTS_IMAGE: quay.io/jetstack/discovery-agent
NGTS_IMAGE_TAG: v1.12.0-alpha.0
NGTS_IMAGE_DIGEST: sha256:f1e202473a2cf1ccd82f7b0aa78e84ffec7e27ec9bceabe68a7b0fc357003e7c
NGTS_CHART: quay.io/jetstack/charts/discovery-agent
NGTS_CHART_TAG: v1.12.0-alpha.0
NGTS_CHART_DIGEST: sha256:0627c610cf2dca1b087151d78319210993d5d130ed305dbbf583eafc30a59cf4