v1.7.9

Changelog

Changed

• Use latest version of conjur-authn-k8s-client which supports JWT loging and tracing.
  cyberark/secretless-broker#1446

v1.7.8

1.7.8 - 2021-11-09

Fixed

• Version bump to resolve flakey test on tagged master.
  cyberark/secretless-broker#1438

v1.7.7 - 2021-11-03

Fixed

• Request-signing on the AWS connector was updated to address a bug that was
  causing failed integrity checks, where the request-signing by Secretless was
  incorporating more headers than were used on the original request-signing. The
  fix limits the headers used by Secretless to those used in the original
  request. cyberark/secretless-broker#1432

Security

• Updated containerd to v1.4.11 to close CVE-2020-15257 (Not vulnerable)
  cyberark/secretless-broker#1431

v1.7.6

Added

• Secretless and secretless-redhat containers now use Alpine 3.14 as their base
  image. PR cyberark/secretless-broker#1423

v1.7.5

Changelog

Security

• Updated addressable to 2.8.0 in docs/Gemfile.lock to resolve GHSA-jxhc-q857-3j6g
  cyberark/secretless-broker#1418
• Updated github.com/gogo/protobuf to 1.3.2 to resolve CVE-2021-3121
  cyberark/secretless-broker#1418

v1.7.4

Changed

• Update RH base image to ubi8/ubi instead of rhel7/rhel.
  PR cyberark/secretless-broker#1411

v1.7.3

Changelog

Changed

• Update k8s authenticator client version to 0.19.1, which streamlines the parsing of authentication responses, updates the project Golang version to v1.15, and improves error messaging.

Fixed

• Secretless now sends a valid "SSL is not supported" response per the PostgreSQL protocol standard when a client attempts to open an SSL connection (i.e. when configured with SSL mode require or prefer) via the PostgreSQL connector. When the client is configured with SSL mode prefer, the updated response enables the client to downgrade to an insecure connection and continue. Previously, clients sending requests using either require or prefer SSL mode would receive a generic error from Secretless, which made it harder to determine the root cause of the problem and broke how prefer is expected to work.
  cyberark/secretless-broker#1377

v1.7.2

Changelog

Added

• Support for OpenShift 4.3 and 4.5.
  conjurdemos/kubernetes-conjur-demo#122

Deprecated

• Support for OpenShift 3.9 and 3.10 is removed in this release.
  conjurdemos/kubernetes-conjur-demo#122

Fixed

• Automatic endpoint discovery for the AWS connector was updated to address two
  bugs where (1) the request host header was not being updated to the discovered
  endpoint, and (2) the request modification was being done after signing the
  request which would result in a failing integrity check.
  cyberark/secretless-broker#1369

v1.7.1

Change log

Added

• The vault provider now supports loading secrets from the KV Version 2 secret engine. Reference a secret in Vault using the right path and a field navigation in the Secretless configuration. cyberark/secretless-broker#1331

Changed

• Update k8s authenticator client version to 0.19.0, which adds some fixes around cert injection failure (see also changes in 0.18.1). cyberark/secretless-broker#1352

v1.7.0

Change log

Added

• Secretless and secretless-redhat containers now use Alpine 3.12 as their base image.
  PR cyberark/secretless-broker#1296
• MySQL and PostgreSQL connectors support SSL host name verification with verify-full SSL mode. Also adds optional sslhost configuration parameter that is compared to the server's certificate SAN.
  cyberark/secretless-broker#548
• Generic HTTP connector now supports queryParam as a configurable section in the Secretless configuration file, under config. This allows the construction of a query string which can have credentials injected as needed.
  cyberark/secretless-broker#1290
• Generic HTTP connector now supports oauth1 as a configurable section in the Secretless configuration file, under config. This allows the construction of a header for an OAuth 1.0 request. The OAuth 1.0 feature currently only supports HMAC-SHA1, but there is an issue logged to support other hashing methods.
  cyberark/secretless-broker#1297
• Many (20+) example generic connector configurations were added to the project, to demonstrate support for a broad set of popular APIs and to serve as an example for other APIs users may need to use Secretless with their apps. See here for the full list of examples.
  cyberark/secretless-broker#1248

v1.6.0

Change log

Added

• Support for a SECRETLESS_HTTP_CA_BUNDLE environment variable that specifies the path to a CA cert bundle and enables users to configure Secretless with additional CA certificates for server cert verification when using HTTP connectors. (PR #1180)
• TLS support for the Secretless-to-server connections of the MSSQL connector. This is the recommended way to secure this connection and achieves feature parity with other TLS connectors. (#1163, #1164, #1165)
• MSSQL connector supports SSL host name verification with verify-full SSL mode. Also adds optional sslhost configuration parameter that is compared to the server's certificate SAN. (#1199)

Fixed

• PostgreSQL connector log messages were updated to improve formatting, fixing a previous issue where the log messages were improperly formatted and were garbled in the logs. (PR #1192)

Security

• TCP connectors all automatically zeroize the connection credentials in memory after successfully opening a connection; previously, credentials were only zeroized in memory on error. (#1188)