Repository navigation
Full version: 0.30.0-2026102301.vbc65cc5
Changes
- trident-acl-agent has been modified to read the COSI metadata SHA-384 checksum from the Nebraska package label
cosi.metadata.sha384by default. Labels must contain a 96-character hexadecimal digest. (microsoft/trident#833, microsoft/trident#864, microsoft/trident#871) - trident-acl-agent logs its effective startup configuration, and adds Nebraska request status, timing, and checksum diagnostics. (microsoft/trident#865)
New Features
trident-acl-agent can derive Kubernetes node name from the kubelet certificate
Set TRIDENT_ACL_AGENT_KUBERNETES_NODE_NAME_SOURCE=kubelet-cert to derive the Kubernetes Node name from the kubelet client certificate. Hostname remains the default, and an explicit NODE_NAME takes precedence. Certificate resolution retries without falling back to the hostname. (microsoft/trident#839)
trident-acl-agent can optionally verify Kubernetes Node hardware
Set TRIDENT_ACL_AGENT_KUBERNETES_VALIDATE_NODE_UUID=true to compare the Node's system UUID with the local hardware UUID, helping prevent updates against a stale or recycled Node identity. Disabled by default; an unavailable UUID is logged and verification is skipped. (microsoft/trident#837)
trident-acl-agent can utilize Nebraska affinity cookies
Set TRIDENT_ACL_AGENT_ORCHESTRATION_COOKIE_ENABLED=true to preserve Nebraska server affinity throughout an update, including agent restarts and reboots. Cookies are disabled by default. The supported per-update mode starts each new update check without a cookie and reuses that response's cookie for the remaining update lifecycle. (microsoft/trident#854)
Bug Fixes
- Update TLS dependencies used by trident-acl-agent, including rustls 0.23.46, to address security advisories. (microsoft/trident#847, microsoft/trident#855)
- Update quick-xml and h2 to versions containing security fixes. (microsoft/trident#857)
- Prevent service shutdown during reboot from causing trident-acl-agent to report a false update failure to Nebraska. (microsoft/trident#866)
- Prevent crafted log line numbers from injecting HTML or scripts when a log file is opened in the web log viewer. (microsoft/trident#860)