Werk #22554: Agent rule sets: new value format
| Component | Setup | ||
| Title | Agent rule sets: new value format | ||
| Date | Oct 27, 2026 | ||
| Level | Trivial Change | ||
| Class | New Feature | ||
| Compatibility | Incompatible - Manual interaction might be required | ||
| Checkmk versions & editions |
|
The following rule sets now store their rule values in a new format:
- TCP port for connection to Checkmk agent
- Symmetric encryption (Linux, Solaris, Windows)
- Allowed agent access via IP address (Linux, Windows)
- Agent Controller auto-registration (Checkmk Ultimate)
Users who configure these rules using the REST API need to adapt their scripts.
Your existing rules are converted automatically during the update, and they keep working as before.
What you need to do
If you create or edit rules of these rule sets via the REST API, adapt your scripts: the REST API only accepts rule values in the new format. The value is now a dictionary with a single key that holds the previous value:
- TCP port for connection to Checkmk agent:
6556becomes{"port": 6556} - Symmetric encryption (Linux, Solaris, Windows):
"my-secret"becomes{"passphrase": "my-secret"},nullbecomes{"passphrase": null} - Allowed agent access via IP address (Linux, Windows):
["10.1.0.0/16"]becomes{"allowed_addresses": ["10.1.0.0/16"]} - Agent Controller auto-registration:
[true, {...}]becomes{"auto_registration": [true, {...}]}
Why this change
The agent bakery evaluates its rule sets by merging the values of all matching rules into one dictionary. These rule sets were among the last that needed special treatment. The new value has a single mandatory key, so merging gives exactly the first matching rule, and the result doesn't change.
While at it, we fixed a crash when renaming a site that had an Agent Controller auto-registration rule set to "Do not manage the controllers auto-registration".