Werk #20032: Preserve explicit-password identifier across rule edits
| Component | Setup | ||
| Title | Preserve explicit-password identifier across rule edits | ||
| Date | Jun 3, 2026 | ||
| Level | Trivial Change | ||
| Class | Bug Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
Saving a rule that contains an inline ("explicit") password used to assign a
new internal identifier to the password on every save, even when the rule
field being edited was unrelated to the password. Because this identifier is
also embedded in the active-check command lines generated at configuration
activation, the brief window between writing a new stored_passwords file
and the monitoring core picking up the new command lines could surface as
intermittent check failures of the form:
Password 'uuid...' not found in
/omd/sites/<site>/var/check_mk/core/helper_config/latest/stored_passwords
The internal identifier of an explicit password is now preserved across rule edits. It is also preserved when the password value itself is changed, since the identifier is a slot reference and not derived from the value; keeping it stable avoids the same window during a password rotation. A fresh identifier is still assigned when a new rule is created or when an existing rule is cloned.
This applies to rules edited through the user interface as well as through the REST API.