Trinity 4.11.0 Release Notes
Overview
Trinity 4.11.0 makes secrets easier to manage and your apps safer to run. You can now sync many vault keys in one secret, move secrets between environments with import and export, and take tighter control of the traffic going in and out of your apps. Under the hood, this release also closes the findings from our latest security review.
New features
Sync secrets
- Many keys, one sync secret: add several secret key and vault key pairs to a single sync secret, instead of creating one secret per key. Works for both project and asset secrets.
- Pick vault keys from a list: search your vault’s keys and select one, several or all of them. Works with Azure Key Vault (including managed identity), Google Secret Manager, OCI Vault and AWS Secrets Manager.
- Sync on demand: refresh one secret with Sync now, or a whole table with Sync all. The new Last synced column shows when each secret was last updated.
- Decoding options: choose Auto or None for how secret values are decoded.
One sync secret with several secret key and vault key pairs:
Pick vault keys from a searchable list, or select all:
The sync secret table, with Sync now, Sync all and Last synced:
A sync in progress:
Secrets import and export
- Move secrets between environments: use the new Import and Export buttons on the project and asset Secrets pages.
- Export saves all your secrets (new, mapped and synced) to one JSON file. Secret values aren’t included.
- Import checks each secret first, then creates, updates or skips it. You see the result for every secret and can retry any that failed.
Export: pick the secret types to include, then copy or download the JSON:
Import: paste or upload the JSON, and choose whether to skip or overwrite secrets that already have a value:
Deployments
- Better control of ingress and egress: decide who can reach your API apps and what they are allowed to call. Turn it on under Configurations when you deploy.
- Edit variables as JSON: switch the variables table to a JSON view to see and edit all your environment variables at once.
Ingress and egress: turn on the policy, then choose which namespaces can call your app, what it can call, and which outgoing ports are open to public addresses:
Vault configuration
- Azure managed identity: AKS vault configurations can now use managed identity, so you no longer need a tenant ID and client secret.
Tenant ID is optional, and leaving the client secret empty uses the managed identity:
Improvements
- Faster asset details page: it makes fewer requests, and its storage and access sections load on their own.
- Clearer error messages: if a mapped variable, storage or secret is missing in the target environment, the deployment tells you exactly what is missing.
- Complete secret table: every key of a sync secret is listed, and new rows appear at the top.
Bug fixes
- Asset sync secrets that use the same vault no longer overwrite each other.
- The vault key dropdown now shows every key in the vault.
- Choosing a private URL no longer stops you from continuing to the next step.
Security
This release fixes the findings from our latest penetration test. Most of the work happens behind the scenes. These are the changes you may notice:
- Admin-only access: managing Trinity now requires the ORG_ADMIN role.
- Stricter sign-in checks: only tokens issued for Trinity are accepted.
- Audit trail: changes, pod actions and secret access are recorded in the audit log. Secret values are never logged.
- Secrets encrypted in your browser: secrets you enter are encrypted before they leave your browser, and only the server can decrypt them.
- Less exposure: certificate keys and other sensitive settings are no longer returned by the APIs, and secret values no longer appear in logs.
- Patched vulnerabilities: high and critical CVEs fixed across our images and dependencies.
Upgrade notes
For administrators upgrading an existing installation:
- In the trinity-db-operations service, run
backend/trinity-db-operations/SQL_SCRIPTS/console-db/release-4.11.0.sql. It addssecret_project_environment.key_value_pairsand backfills existing sync secrets. - Deploy together with the matching console-helm-charts release. It mounts service settings at
/etc/trinity/configand supplies the credentials removed from the env files. - Provide
PAYLOAD_DECRYPTION_KEY(RSA private key, PEM) to trinity-orchestrator and trinity-assets-orchestrator through trinity-secrets. - Make sure Trinity users have the ORG_ADMIN role; other users lose access.
- Deploy API apps with the
n-apps-api-with-security-fixversion of then-apps-apichart to get the security fixes and the new ingress and egress controls. - Deploy UI apps with the
n-apps-ui-with-security-fixversion of then-apps-uichart to get its security fixes and ingress and egress controls.
Docker images
| Service | Image |
|---|---|
| Orchestrator | neutrinos.azurecr.io/trinity/trinity-orchestrator:26.10.4.11.0 |
| Deployments | neutrinos.azurecr.io/trinity/trinity-deployments:26.10.4.11.0 |
| DB operations | neutrinos.azurecr.io/trinity/trinity-db-operations:26.10.4.11.0 |
| Frontend API | neutrinos.azurecr.io/trinity/trinity-frontend/api:26.10.4.11.0 |
| Frontend UI | neutrinos.azurecr.io/trinity/trinity-frontend/ui:26.10.4.11.0 |
| App logs | neutrinos.azurecr.io/trinity/trinity-app-logs:26.10.4.11.0 |
| Promscale connector | neutrinos.azurecr.io/trinity/trinity-promscale-connector:26.10.4.11.0 |