--- title: "Aerospike Backup Service 3.7.1 release notes" description: "Aerospike Backup Service 3.7.1 release notes covering configuration handling fixes for read-only and HTTP(S) configuration sources, stricter validation, a breaking Helm chart update, and a Go 1.26 security update." --- # Aerospike Backup Service 3.7.1 release notes > For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt) > > All documentation pages available in markdown. November 5, 2026  |  **[Download](https://aerospike.com/download/backupservice/backup_service)** ## New in this version Aerospike Backup Service (ABS) 3.7.1 is built on [`backup-go` v0.13.0](https://github.com/aerospike/backup-go/releases/tag/v0.13.0) and Go 1.26. It is a maintenance release for the 3.7 line that fixes configuration handling when the configuration source is read-only or served over HTTP(S), as reported during the Aerospike Kubernetes Operator (AKO) integration of ABS 3.7.0, and corrects the Helm chart documentation. This release has no new features. The ABS configuration file needs no changes unless it holds a cron expression that never fires again or a literal `"[secret]"` placeholder, which ABS 3.7.1 rejects. The Helm chart has breaking changes that can affect an existing values file. See [Breaking changes](#breaking-changes). ## Breaking changes ### Helm chart The Helm chart moves from version 2.1.0 to 3.0.1. \[BKRS-397\] - The `args` value is applied. Earlier charts ignored it and always started ABS with `-c /etc/aerospike-backup-service/aerospike-backup-service.yml`. If your values file sets `args`, check that the list includes `-c`, or remove it. - The HTTP container port follows `backupServiceConfig.service.http.port`, and the chart adds the HTTPS container port when HTTPS is enabled. The probes use the HTTP port, or the HTTPS port when `backupServiceConfig.service.http.disabled` is `true`. A probe that sets its own `httpGet` in your values file is used as written. If your values file copies the `httpGet` probe blocks from the chart 2.1.0 defaults, remove them. `service.port` sets only the Kubernetes Service port. - The probes follow the configured context path. - `terminationGracePeriodSeconds` is 45 instead of the Kubernetes default of 30. - The chart runs one pod per release. A `replicaCount` above `1` or `autoscaling.enabled: true` fails the install, and the chart no longer creates a HorizontalPodAutoscaler. Remove `autoscaling` from your values file. - The Deployment uses the `Recreate` strategy, so an upgrade stops the old pod before it starts the new one. Expect a short outage during each upgrade. ### Linux packages - The stock configuration file changed. If you edited `/etc/aerospike-backup-service/aerospike-backup-service.yml`, the RPM upgrade replaces it with the stock file and saves your file as `aerospike-backup-service.yml.rpmsave`. Restore your file after the upgrade. The Debian package keeps your file, and `dpkg` asks which version to keep. See [Upgrade ABS](https://aerospike.com/docs/database/tools/backup-and-restore/backup-service/upgrade#upgrade-abs). ## Improvements - A configuration change against a source that can never be written, such as a read-only file system, a file without write permission, or a configuration served over HTTP(S), returns `405 Method Not Allowed`. A write failure where a retry may succeed, such as a full disk, returns `503 Service Unavailable`. ABS 3.7.0 returned `500 Internal Server Error` for both. \[BKRS-490\] - Configuration validation rejects a cron schedule that can never fire, such as one with a year in the past, with `400 Bad Request`, so a configuration that passes validation can always be applied. \[BKRS-489\] - A backup policy whose `encryption.key-secret` is a `secrets:` reference no longer needs a routine that uses it to be defined first. The policy checks only that the reference is well-formed. Each routine whose policy reads the key from a Secret Agent must set `secret-agent`, and validation reports the routine. A restore request whose policy reads `key-secret` from a Secret Agent without one fails validation instead of failing during the restore. \[BKRS-482\] - The Helm chart `values.yaml` configuration reference and README are corrected and now checked by the repository’s documentation tests. The `storage` template includes the storage-name level, the routine key is `rack-list`, and `prefer-racks` is shown on the cluster. The non-existent `no-bins` policy option is removed. The documented defaults for `parallel`, `socket-timeout`, and the Secret Agent `timeout` match the service. The Secret Agent `address` and the file logger `filename` are marked required. The README no longer refers to an `extraVolumes` value or an `examples` folder. \[BKRS-397\] - The Helm chart is no longer attached to the GitHub release. Install it from the Aerospike Helm repository. See [Install ABS on Kubernetes with Helm](https://aerospike.com/docs/database/tools/backup-and-restore/backup-service/install#install-abs-on-kubernetes-with-helm). - ABS is built with Go 1.26, which allows `golang.org/x/net` 0.59 and later and current releases of the Google Cloud, OpenTelemetry, and Prometheus client libraries. This resolves CVE-2026-78669 in HTTP/2 code reachable through the Azure Blob client and the HTTP configuration source. \[BKRS-485\] - The Docker image is based on the Alpine 3.24 release line instead of `alpine:latest`, and no longer installs the unused `shadow` package. The image creates `/var/log/aerospike-backup-service` owned by the service user, so the default `file-writer` path works without a mounted volume. ## Bug fixes - Fixed a configuration change becoming visible in memory and in `GET /v1/config` before it was written to the configuration source. When the write failed, the API returned `500`, the scheduler kept the old routines, and a retry returned `409` because the entity already existed. The change is now written first and takes effect only after the write succeeds. A failed write leaves the running configuration, the source, and the scheduler unchanged. \[BKRS-412\] - Fixed the `"[secret]"` placeholder being accepted as a literal credential in a configuration file, a remote configuration, `/v1/config/apply`, and restore requests. This made ABS authenticate to Aerospike with the password `[secret]` and caused every subsequent configuration API change to fail with `400`. These paths now reject the placeholder with a validation error naming each field that holds it. The configuration API `GET`, edit, `PUT` round trip is unchanged. \[BKRS-481\] - Fixed a duplicate `enum` key in the HTTPS `min-version` definition in the published OpenAPI specification and configuration JSON schema. Strict JSON parsers such as Jackson, and the OpenAPI client generators built on them, rejected the duplicate key. \[BKRS-480\] For additional details about fixes, improvements, and maintenance in this release, see the [release page on GitHub](https://github.com/aerospike/aerospike-backup-service/releases/tag/v3.7.1).