Aembit now supports more options for identifying Client Workloads and specifying Trust Provider match rules, including multiple “or” condition matches and wildcard support.
These matching improvements shipped alongside the new OAuth 2.0 Authorization Code Credential Provider; see that entry for the new-feature details.
Aembit has released two new feature updates that enhance existing Aembit functionality.
All injected Aembit containers are now run as non-root users.
Users may configure limits for the number of file descriptors Agent Proxy is allowed to open on a VM. You may configure this number when Agent Proxy is installed (using the AEMBIT_FD_LIMIT flag).
virtual machines
Default Limit - 65535, set by Agent Proxy installer
Configuration - This limit is configurable via the AEMBIT_FD_LIMIT environment variable. This value is passed directly to systemd in Agent Proxy’s service file at the time of installation.
Example - AEMBIT_FD_LIMIT=200000 [...] ./install
Kubernetes
Default Limit - This limit is inherited from container runtime.
Configuration - There is no official support without modifying the underlying runtime. For more information on configuring these limits, please see the Kubernetes limits support GitHub thread.
AWS ECS
Default Limit - 1024
Configuration - This limit is configurable via the ECS Task Definition API or ECS Dashboard. Please refer to the AWS ECS Developer Guide for more detailed information on how to configure these limits.
AWS Lambda
Default Limit - 1024
Configuration - This limit is not configurable. For more information, please refer to the AWS Lambda Developer Guide.
In some cases, you may find it necessary to manually shut down Agent Proxy when the main container exits, but a sidecar is still running. Since you may not want to kill the whole job, since it will look like a cancelled job, Aembit now provides a solution that enables you to gracefully terminate the job while allowing the sidecar to still run.
For more detailed information on this feature, please refer to the Agent Proxy Shutdown page.
Aembit has released two new features on Aembit Cloud:
You may now configure and add Aembit GeoIP conditions in your Aembit Tenant. This new Access Condition type enables you to explicitly designate which countries/regions will have access to Server Workloads from policy-enabled Client Workloads.
For more information on this feature, please refer to the Access Conditions for GeoIP Restriction page.
Aembit now supports Log Streams that target Google Cloud Storage (GCS) Buckets. You may add or configure this new Log Stream destination type in the Administration tab of your Aembit Tenant.
For more information on this feature, please refer to the Google Cloud Storage Bucket Log Streams page.
Aembit Edge Components now support virtual machine deployments to virtual machines running Red Hat 8.9.
An issue was identified in the Agent Controller component due to the non-rotation of the public/private key pair used for Kerberos attestation. This issue has been resolved by implementing a process by which these private/public key pairs will be automatically rotated when the certificate reaches 80% of its lifespan.
Aembit now supports secure communication between Agent Proxy and Agent Controller using Transport Layer Security (TLS) for both Kubernetes and virtual machine deployments.
For more information on how to configure TLS for Agent Controller, please refer to the Configuring TLS for Agent Controller documentation.
Aembit has now enabled support for Access Authorization Events. Access Authorization Events enable customers to observe credential requests.
Aembit supports Google CloudRun Jobs as Client Workloads. With this support, you can now:
authenticate to the Aembit IdP using Attestation with the GCP Cloud Run Job Identity
request and retrieve a secret from GCP Secret Manager
Several new feature updates and additions have been made to improve Aembit user experience. These updates include:
Aembit now supports Multi-Factor Authentication (MFA) so users can provide different authentication methods. Users can:
Users may now deploy Aembit Edge Components to VMs (non-Kubernetes). This feature enables users to have options on how they want to deploy these components.
For more detailed information about this feature, please see the virtual machine Installation page.