28 posts tagged with "vertex"

Fixed

• After 24 hours, Workload Identities on Azure would incorrectly refresh their tokens. This affected both database connections and KeyVault / ManagedHSM requests.
• Removed sensitive tokens from logs when using Workload Identities on Azure.

Fixed

• Fixed incomplete parameter list being shown in the OpenAPI docs for the /admin/keys/grant-usage-permission and /admin/keys/revoke-usage-permission routes.

Added

• Filters to several list endpoints.
• Groups to the Vertex, allowing for better organization of users and keys.

Changed

• Bug fix for Freeze keys by name.

Added

• Return 503 errors for new connections when the Vertex reaches MAX_CONNECTIONS.

Changed

• UserAlreadyHasKeyPermission errors will now be treated internally, ignoring duplicate assignments for the same key.
• Changed Vertex dockerfile from Alpine Linux to Distroless

Added

• Allow users to pass the backup and import PEM certificates encoded as base64 strings. To learn more about how to backup and import your shares from the Vertex, please look at our dedicated docs.

Added

• Enable accessing the configured PostgreSQL DB through Azure workload identities by passing the --pg-az-use-identities flag on startup.

Changed

• Use Azure workload identities as the default identification method on newer deployment versions. Note: this doesn't affect users who will not use newer versions of Sodot's Azure deployment TF and Helm.

Changed

• Changed delete keyshare API endpoints for HMAC-SHA256 and HMAC-SHA512 to use query parameters with /delete-key-share instead of path parameters (previously /delete-key-share/:key_id); the old path-based endpoints are deprecated, providing more flexible key management.
• Added UserIdent support to allow identification by both user_name and user_id, improving API flexibility.

Improved

• Improved handling of incoming connection bursts.
• Enable the Vertex to handle more concurrent connections.

Added

• Use CA certificates when running on GKE confidential compute.

Added

• Support using native certs when accessing PostgreSQL DBs.