Werk #22118: Relays only receive the passwords they actually need
| Component | Relay | ||
| Title | Relays only receive the passwords they actually need | ||
| Date | Sep 22, 2026 | ||
| Level | Prominent Change | ||
| Class | Bug Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
Previously, every relay received a copy of the site's complete password store. That included the passwords of hosts assigned to a different relay, and those of consumers a relay never runs at all, such as notifications, LDAP connections or the agent bakery.
A relay now only receives the secrets that the configuration of its own hosts actually references. This applies both to the secrets in the relay's configuration archive and to those sent along with a service discovery, a discovery preview or an active check.
Nothing changes for the site itself, or for remote sites: the password store you manage in Setup, the merged store the site resolves passwords from, and the configuration synchronization to remote sites are all untouched.
No action is required. The narrowed secrets are written on the next activation.
Technical background
The secrets shipped to a relay were taken verbatim from the site's merged password store, which by design is a superset: it holds every password of the site so that consumers can resolve one even when the configuration has moved on since the store was last written.
A relay never needs that superset. It only ever acts on the configuration archive it was shipped, and that archive is created together with its secrets, so the secrets can be narrowed to exactly the hosts it monitors. Fetching a cluster means fetching its nodes, so the nodes' secrets are included as well.