Agent Control release notesRSS

New features

• Added AWS Secrets Manager value provider (nr-awssm), supporting access key credentials and EC2 instance profiles.
• Linux and Windows: Agent Control and its sub-agents now report os.version and host.arch as OpAMP attributes. Linux also reports os.name (the distro id, e.g. "debian").

Bug fixes

• On-host: sub-agents without a health check defined no longer log errors from executables publishing health into a closed channel.
• HTTP clients no longer pick up proxy settings outside the Agent Control proxy configuration and ignore_system_proxy: true is fully honored.
• On-host: sub-agent output containing non-UTF-8 bytes no longer stops log forwarding and terminates the sub-agent. Such lines are now logged with the invalid bytes replaced.
• Windows: a self-update that fails while staging the new binary no longer leaves Agent Control without an executable, which prevented the service from starting after the next restart.

Security updates

• Updated rust crate opamp-client to v0.3.0
• Updated rust crate toml to 1.1.8
• Updated rust crate nr-auth to v0.7.0
• Updated opentelemetry-rust monorepo to 0.33.1
• Updated rust crate syn to 3.0.9
• Updated rust crate zip to 9.0.5
• Updated rust crate serde_json to 1.0.154
• Updated rust crate aws-lc-rs to 1.18.2
• Updated rust crate schemars to 1.2.3
• Updated rust crate actix-web to 4.17.0
• Updated rust crate tokio to 1.54.0
• Updated rust crate serde-saphyr to v2
• Updated alpine/helm to v4.3.1
• Updated rust to v1.99.1
• Updated rust crate rstest to 0.28.0
• Updated rust crate httpmock to 0.9.0
• Updated aws-sdk-rust monorepo

For a detailed description of changes, see the release notes.

New features

• Added Azure Key Vault value provider, supporting both Managed Identity and Service Principal authentication.
• Self instrumentation now gets the injected license key as header if none is set in all systems.

Bug fixes

• Windows: install.ps1 now detects and removes a standalone New Relic Infrastructure Agent installation to avoid duplicate host reporting; it must be reconfigured as an Agent Control managed sub-agent afterwards if still needed.
• On-host: fixed integration restarts caused by redundant filesystem sync and full directory recreation when writing OHI config files to the shared filesystem.
• Make health-check threads initial delay cancellable, to reduce graceful shutdown idle waiting periods.
• Fixed minor logging issues: a redundant field, a duplicated log, wrong log levels, and inconsistent message casing.
• Agent Control now always re-reports its remote config status on startup, fixing a missed resend after restart when the server requests a full-state sync.
• Windows: system shutdown/reboot goes through the same service graceful stop path as a manual service stop instead of ctrl signal handling.

Security updates

• Updated rust crate encoding_rs to 0.8.42
• Updated alpine/kubectl to v1.37.1
• Updated rust crate oci-client to 0.18.0
• Updated opentelemetry-rust monorepo to 0.33.0
• Updated rust crate config to 0.15.27
• Updated rust to v1.99.0
• Updated rust crate tokio to 1.53.2
• Updated amazon-eks to v1.37
• Updated rust crate either to 1.19.0
• Updated rust crate toml to 1.1.7

For a detailed description of changes, see the release notes.

Bug fixes

• On-host: the OpAMP compression for the verify client is disabled so that the server can read the execution.mode attribute

Security updates

• Updated rust crate nr-auth to v0.6.0
• Updated rust crate config to 0.15.26
• Updated rust crate thiserror to 2.0.21

For a detailed description of changes, see the release notes.

New features

• Linux: added Debian 13 (trixie) as a supported/published platform.
• Linux: removed the legacy on-host folder migration pre-v1.2.0 from newrelic-agent-control-cli
• Variants support has been removed in favor of the "governance" flow server side
• Regex-based remote config validation has been removed in favor of the "governance" flow server side.

Bug fixes

• On-host: fixed a spurious error-level log "cannot forward agent control event" emitted on every clean shutdown; the status server bridge now exits only via an explicit stop signal, closed channels are silently disabled rather than causing an exit, and publisher lifetimes are extended to keep channels open until the stop signal fires.
• Linux: uninstall.sh now uses apt-get purge instead of apt-get remove, preventing a dpkg state inconsistency that caused reinstallation to fail, the service could not start because the systemd-env.conf conffile was not recreated by the package manager.
• Windows: the uninstall script now warns instead of silently succeeding when the install or runtime-data directory cannot be removed (e.g. Windows Explorer has it open), and preserves the script itself so it can be re-run once the lock is released.
• On-host: filesystem entries under filesystem:/shared_filesystem: are now written to disk in alphabetical order and fsynced after each write, making the write order deterministic.
• On-host: self-update no longer deletes the downloaded package's binary when replacing the running binary, fixing rollback and same-version reinstall after a self-update.
• On-host: fixed a spurious Error reading the log directory/files: No such file or directory message printed to stderr the first time Agent Control's or a sub-agent's log directory is created.
• On-host: executable output and lifecycle logs are no longer misleadingly tagged with the start_agent span for the entire lifetime of agent processes and supervisors, they carry the explicit fields instead.
• On exit, the process-terminated log line (success or error) is no longer dropped from the log file: it used to be emitted after the file logger had already shut down, so it only ever reached journalctl/stderr.

Security updates

• Update rustls
• Updated rust crate reqwest to 0.13.5
• Updated rust crate encoding_rs to 0.8.41
• Updated alpine/helm to v4.3.0
• Updated rust crate toml to 1.1.6
• Updated rust crate clap to 4.6.7
• Updated rust crate jsonwebtoken to 11.1.0
• Updated rust crate opamp-client to v0.1.0
• Updated rust crate cfg-if to 1.0.5
• Updated rust crate syn to 3.0.6
• Updated rust crate serde-saphyr to 1.3.0
• Updated rust crate nr-auth to v0.5.3

For a detailed description of changes, see the release notes.

New features

• Renamed the secrets_providers config key to value_providers, the old key is kept for backwards compatibility.
• OnHost: added support for RedHat 10
• K8s: add a new nr-kubecm value provider to resolve variables from Kubernetes ConfigMaps.
• chart_values.global is still supported in agentTypes, but deprecated. You can still configure globals via chart_values.[chart-name].global
• Linux: added uninstall.sh script bundled in the package that auto-detects the package manager (apt, yum, zypper) and removes newrelic-agent-control.

Bug fixes

• On-host: the eBPF agent now writes its status log under the AC managed filesystem directory instead of /etc/newrelic-ebpf-agent.
• On-host: fix false "already running" startup error when a stale PID file held a PID reused by an unrelated process.
• Suppress Health reporting (OpAMP and status server) for sub-agents whose agent type defines no health: block, including on initial supervisor start failure.
• On-host: when an agent type is upgraded to a new version, stale filesystem entries declared by the old version are now removed via a diff instead of a full agent directory wipe; the sub-agent's OpAMP instance ID is preserved across version bumps.
• K8s: when a sub-agent type is upgraded to a new version, the OpAMP instance ID is now preserved across the upgrade; previously the fleet-data ConfigMap was deleted on every type change regardless of whether the agent name changed, causing a new instance ID to be generated on the next start.
• Linux: postremove script now correctly removes newrelic-agent-control directories on any uninstall (not only on apt purge), and targets the right paths (/etc/newrelic-agent-control, /var/lib/newrelic-agent-control, /var/run/newrelic-infra) instead of the old infra-agent ones.
• On-host: the service now retries indefinitely on failure (20 s delay) instead of stopping after 5 rapid restarts; applies to both the Linux systemd unit and the Windows SCM failure actions.

Security updates

• Updated rust crate nr-auth to v0.5.2
• Updated rust crate opamp-client to v0.0.42
• Updated rust crate flate2 to 1.1.10
• Updated rust crate rcgen to 0.14.10
• Updated rust crate serde-saphyr to 1.2.0
• Updated alpine/kubectl to v1.37.0
• Updated rust crate aws-lc-rs to 1.18.1
• Updated rust crate toml to 1.1.5
• Updated rust to v1.98.1
• Updated rust crate windows-link to 0.100.0
• Updated rust crate windows-registry to 0.100.0
• Updated rust crate syn to 3.0.5
• Updated rust crate crossbeam to 0.8.5
• Updated rust crate rstest to 0.27.0
• Updated rust crate encoding_rs to 0.8.40

For a detailed description of changes, see the release notes.

New features

• Add support for variables override through variable.agentConfig syntax in Remote Configuration keys.
• Add support for a single entry of a string_map variable override through variable.agentConfig.<variable>:<map-key> syntax in Remote Configuration keys.
• On-host infrastructure agent type (linux): expose the nri-docker integration configuration through a new config_docker variable.
• Agent type: enforce variable name format to [A-Za-z0-9_-] starting with a letter and maximum length of 64 characters.
• On-Host: enable self-update capability by default. Self updates are only executed when commanded by Fleet Control.

Bug fixes

• K8s supervisor: force a Flux reconciliation on stalled HelmReleases (e.g. after exhausting install/upgrade retries) when a new remote config arrives and restarts the sub-agent supervisor.
• On-host: report the actual last failure (launch error or non-zero exit) in the lastErrorMessage of the unhealthy status once the restart policy is exceeded, instead of the generic "Restart policy exceeded" message.
• On-host: persist fluent-bit's home directory (fb.db) across infra-agent package updates instead of storing it in the replaced package directory

Security updates

• Updated rust crate either to 1.18.0
• Updated rust to v1.98.0
• Updated rust crate actix-web to 4.15.0
• Updated alpine/kubectl to v1.36.4
• Updated rust crate syn to 3.0.4

For a detailed description of changes, see the release notes.

New features

• On-host: enforce a 2400 MiB hard memory limit on the Agent Control process tree (AC + all child agents) via systemd MemoryMax on Linux.

Bug fixes

• Linux: prevent systemd service disable after RPM package update

Security updates

• Updated rust crate futures to 0.3.34
• Updated alpine/helm to v4.2.4
• Updated rust crate serde-saphyr to 1.1.0

For a detailed description of changes, see the release notes.

New features

• Windows filesystem: Removed unused code and use higher-level APIs for Windows interaction.
• Reports the com.newrelic.remoteAgentTypeRepoReachable OpAMP custom capability when the configured Agent Type OCI repository is reachable at startup.
• On-host: added nri-flex agentType.

Bug fixes

• Windows: fixed files under Agent Control's managed directories being left with permissions it could not use. Managed directories now use an inheritable Administrators ACE, and Agent Control tries to repair ACEs on startup.

Security updates

• Updated rust crate http to 1.5.0
• Updated rust crate clap to 4.6.6
• Updated rust crate serde-saphyr to 1.0.1
• Updated rust crate base64 to 0.23.1
• Updated rust crate aws-lc-rs to 1.18.0
• Updated rust crate thiserror to 2.0.20
• Updated rust crate async-trait to 0.1.92
• Updated rust crate actix-web to 4.14.1
• Updated rust crate rcgen to 0.14.9

For a detailed description of changes, see the release notes.

New features

• Kubernetes: --release-name is now optional on uninstall-agent-control; omitting it skips deleting the release's own HelmRelease/HelmRepository CRs.
• On-host: added nri-apache and nri-nginx agentTypes.
• On-host: added nri-postgresql agentType.
• On-host: added nri-mysql agentType.
• On-host: added nri-memcached Agent Type.
• Log files rotated have now 30 days of retention.
• Added agent-type validate --file <path> subcommand to newrelic-agent-control-cli and newrelic-agent-control-k8s-cli for schema-level validation of agent type definition files.
• Extended agent-type validate with semantic validation: every ${nr-var:X} reference in deployment must have a matching variables declaration.
• Enable cache for remote Agent Type registry

Security updates

• Updated rust crate kube to 4.2.0
• Updated rust crate rustls-pki-types to 1.15.1
• Updated rust crate base64 to 0.23.0
• Updated rust crate either to 1.17.0
• Updated rust crate jsonwebtoken to v11
• Updated rust crate serial_test to v4
• Updated rust crate schemars to 1.2.2
• Updated alpine/kubectl to v1.36.3
• Updated rust crate toml to 1.1.4

For a detailed description of changes, see the release notes.