Discovery Agent for Next-Gen Trust Security releases¶

Learn about current and past releases of Discovery Agent for Next-Gen Trust Security.

The Helm chart and container image for Discovery Agent for Next-Gen Trust Security are public.

Release 1.13.1¶

Discovery Agent for Next-Gen Trust Security v1.13.1 was released on 28 October, 2026.

Key features¶

• This release removes trust in the compromised eMudhra certificate authority (CA).

Fixes and updates¶

• Updated the base image.
• Updated Go to v1.27.3 to address CVE-2026-111943.

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent:1.13.1
• Container image: registry.ngts.paloaltonetworks.com/discovery-agent/discovery-agent:v1.13.1

Release 1.13.0¶

Discovery Agent for Next-Gen Trust Security v1.13.0 was released on 14 October, 2026.

Fixes and updates¶

• Fixed authentication with a Built-in Account that uses WIF and belongs to a workspace. NGTS now looks only for tenant-level accounts unless the token request includes a workspace ID. Set spec.ngts.workspaceID on the Connection resource to the account's workspace ID. This field needs the Connection resource CRD from v0.7.0 or later. To learn more, see Authenticate to Next-Gen Trust Security with Workload Identity Federation.
• Updated the base image.

• Updated the following dependencies:

  • Go to v1.27.2
  • golang.org/x/net to v0.60.0
  • google/cel-go to v0.31.0
  • Kubernetes Go libraries to v0.37.0
  • controller-runtime to v0.25.0
  • prometheus/client_golang to v1.24.1
  • go-logr/logr to v1.4.4
  • venafi-connection-lib to v0.7.0

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent:1.13.0
• Container image: registry.ngts.paloaltonetworks.com/discovery-agent/discovery-agent:v1.13.0

Release 1.12.0¶

Discovery Agent for Next-Gen Trust Security v1.12.0 was released on 28 September, 2026.

Fixes and updates¶

• Updated the base image.

• Updated the following dependencies:

  • Go to v1.27.1
  • golang.org/x/crypto to v0.57.0
  • golang.org/x/net to v0.58.0
  • golang.org/x/text to v0.42.0
  • golang.org/x/sys to v0.48.0
  • golang.org/x/term to v0.46.0
  • golang.org/x/sync to v0.23.0
  • google/cel-go to v0.30.0

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent:1.12.0
• Container image: registry.ngts.paloaltonetworks.com/discovery-agent/discovery-agent:v1.12.0

Release 1.11.0¶

Discovery Agent for Next-Gen Trust Security v1.11.0 was released on 4 June, 2026.

Key features¶

• Discovery Agent now supports Workload Identity Federation (WIF) for authenticating to Next-Gen Trust Security. With WIF, Discovery Agent authenticates through a Kubernetes ServiceAccount token instead of a private key. To learn more, see Authenticate to Next-Gen Trust Security with Workload Identity Federation.
• Discovery Agent can now authenticate to NGTS through Connection for Next-Gen Trust Security (Connection resource) using the venafiConnection block in the Helm chart. To learn more, see Installing Discovery Agent using Helm.
• The Discovery Agent Helm chart can now install the Connection resource CRD and role-based access control, removing the need for a separate install when Discovery Agent is the only component in the cluster using Connection resource. Set venafiConnection.include to true in your Helm values to install Connection resource.
• GitOps tool annotations that may contain secret material are now redacted. Discovery Agent strips the following annotations from reported objects: kapp.k14s.io/original, objectset.rio.cattle.io/applied, and banzaicloud.com/last-applied.

Fixes and updates¶

• User-supplied excludeAnnotationKeysRegex and excludeLabelKeysRegex patterns are now appended to the built-in defaults instead of replacing them.
• --tsg-id and --ngts-server-url are now mutually exclusive. Supplying both caused a startup error.
• Removed the vcert library as a dependency.

• Updated the following dependencies:

  • Go to v1.26.4
  • venafi-connection-lib to v0.6.1
  • lestrrat-go/jwx to v3.1.1
  • Kubernetes Go libraries to v0.36.1
  • controller-runtime to v0.24.1

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent:1.11.0
• Container image: registry.ngts.paloaltonetworks.com/discovery-agent/discovery-agent:v1.11.0

Release 1.10.0¶

Discovery Agent for Next-Gen Trust Security v1.10.0 was released on 7 May, 2026.

Fixes and updates¶

• Updated the following dependencies:

  • Go to 1.26.2
  • vcert to v5.12.2
  • venafi-connection-lib to v0.5.2
  • Kubernetes Go libraries to v0.34.3
  • controller-runtime to v0.22.4

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent:1.10.0
• Container image: registry.ngts.paloaltonetworks.com/discovery-agent/discovery-agent:v1.10.0