v0.16.0

Breaking changes

• Helm repository credentials are no longer forwarded to a chart repository by default. They are only sent when the repository URL matches the pattern configured in helmRepoURLRegex. A pre-upgrade migration Job and a hidden fleet migrate gitrepo-helm-url-regex CLI command populate the field on existing GitRepos. Require helmRepoURLRegex for Helm credential forwarding (GHSA-hx4v-cxpf-vh8m) by @thardeck in #5141

Future Deprecation notice

• GitRepoRestriction will be deprecated in v0.17 and may be removed as soon as v0.18. It remains supported until removed, but has known security limitations: its repo patterns are matched unanchored, and it does not cover HelmOp or Bundle resources. Migration to the new Policy resource is strongly recommended.

Notable changes

Fleet v0.16.0 introduces the Policy custom resource, a new upstream authorization model for multi-tenant setups. Policy restricts which ServiceAccount, credential secrets, and source repositories the GitRepo, HelmOp, and Bundle resources in a namespace may use, extending coverage beyond what GitRepoRestriction offered.

Additions

Multi-tenancy and access control

• Introduce Policy custom resource for multi-tenant authorization by @p-se in #5152
• Allow rejecting empty TTL and restrict cluster registration secret access (#5157) by @0xavi0 in #5158

Targeting and bundle management

• Allow more than one targetCustomization to be applied (#3512) by @p-se in #4940
• rollout: Make maxNew configurable (#3829) by @p-se in #4746
• Propagate per-target DownstreamResources to clusters (#4727) by @thardeck in #5177
• Remove experimental guard from downstream resource copy by @thardeck in #5207

Drift detection

• Enable drift correction after the Bundle is deployed (#4945) by @0xavi0 in #5114

Helm and Git

• HTTP proxy support for SSH in GitOps (#3595) by @p-se in #4781
• Make CA bundle configurable for HTTPS_PROXY (#4870) by @p-se in #4888
• bundlereader: merge PROXY_CA_BUNDLE into CABundle for HTTPS git clones (#4869) by @p-se in #4919
• Fall back to Rancher CA bundles for HelmOps (#3845) by @thardeck in #4724
• Use Custom CAs when pulling OCI artifact (#4897) by @0xavi0 in #5128
• Add Go duration validation across CRDs, Helm schemas, and config loader by @0xavi0 in #5299

Agent management

• Add option to disable the management cluster's agent (#4807) by @0xavi0 in #5250
• Support image pull secrets for Fleet controllers and agents (#5050) by @weyfonk in #5201
• Support cluster-level image pull secrets for agent deployments (#5254) by @weyfonk in #5258
• Propagate CATTLE_WRANGLER_CHECK_GVK_ERROR_MAPPING to fleet-agent (#5060) by @0xavi0 in #5085

CLI

• fleet-cli: add missing flag wiring for apply, cleanup subcommands (#5170) by @apoorvajagtap in #5171
• Return CLI List error closer to where it was returned by @0xavi0 in #4822

Bugfixes

Stability

• Fix doNotDeploy bypassed when a broader target precedes it in the target list (#3580) by @dockerized-nl in #4688
• Refine conditions for reconciles from cluster updates across shards (#4484) by @weyfonk in #4730
• Fix drift correction regression when correctDrift.force is false (#4938) by @0xavi0 in #4939
• Reintroduce legacyscheme defaults for drift detection (#5020) by @p-se in #5215
• Restore status fields when gitjob creation fails (#4948) by @0xavi0 in #4949
• Self-heal BundleDeployment secret when having a hash mismatch (#4962) by @0xavi0 in #4963
• Avoid race condition on first gitjob creation with polling enabled by @0xavi0 in #4986
• Fix PollingInterval update dropped by Status().Patch() in webhook handler by @thardeck in #5098
• Improve webhook handling for out-of-order and pre-HEAD-update deliveries (#5216, #5077) by @0xavi0 in #5218
• Fix fleet-agent bundles not deleted when cluster is deleted (#3588) by @p-se in #5220
• Deduplicate appended slices in options.Merge by @thardeck in #5197
• Inherit node selectors for GitRepo sync jobs (#5011) by @immanuwell in #5086
• Catch unknown-field errors in deployErrToStatus by @thardeck in #4956
• Fix stale bundle error when cluster is offline after a bad commit by @thardeck in #4780

Helm and Git

• Fix discrepancy of OCI chart fields between GitOps and HelmOps (#3859) by @p-se in #4698
• Fix --gitrepo and --bundle filters not including HelmOps by @thardeck in #4825
• Remove last git shell-out and fix dropped commit label (#4877) by @thardeck in #4826
• Fix lookup detection for Helm helper templates and define blocks (#5198) by @susesamu in #5199
• Fix cloner when using tags in revision (#5181) by @0xavi0 in #5292
• Do not update secret type when cloning downstream secrets (#5252) by @d3flex in #5294
• Normalize YAML flow-style docs in post-renderer by @thardeck in #5180
• Retain relevant kubernetes.io labels when syncing namespaces by @thardeck in #5156
• Prefer final chart over RC when computing the latest release version by @thardeck in #4866
• Honor insecureSkipTLS in OCI storage secret by @khushalchandak17 in #4890

Security

• Fix credential leaks and DoS risk in GetContent archive handling (#4877) by @thardeck in #4891
• webhook: use regexp.QuoteMeta for hostname and path (GHSA-jmf4-m7j9-g72r) by @p-se in #5153
• Validate resolved paths stay within the clone directory (GHSA-c45g-6c2c-rj3p) by @thardeck in #5276
• Align Helm deployer client construction (GHSA-765j-qfrp-hm3j) by @thardeck in #5069
• Validate kubeConfig namespaces against known Fleet namespaces by @thardeck in #5224
• Verify cluster in API server before deleting namespace (#3830) by @thardeck in #4736

Observability

• Collect fleet dump metrics services across namespaces by @immanuwell in #5188

Notable dependency updates

• Update Kubernetes dependencies to v0.36.2 by @thardeck in #5094
• Update Go toolchain to 1.26.4 by @thardeck in #4947
• Update github.com/go-git/go-git/v5 to v5.19.1 [security] by @thardeck in #5165
• Update module helm.sh/helm/v4 to v4.2.2 [security] by renovate in #5353
• Update module github.com/rancher/wrangler/v3 to v3.7.0 by renovate in #5142
• Update module golang.org/x/net to v0.55.0 [security] by renovate in #5190
• Update oras.land/oras-go/v2 to v2.6.2 and golang.org/x/crypto to v0.54.0 [security] by @thardeck in #5429

New Contributors

• @dockerized-nl made their first contribution in #4688
• @mmartin24 made their first contribution in #5083
• @immanuwell made their first contribution in #5086
• @apoorvajagtap made their first contribution in #5171

Full Changelog: v0.15.0...v0.16.0