<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the Fleet chart release metadata to version 7.0.14.
* Updated the packaged application version to 4.89.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: test <test@test.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from
`rc-minor-fleet-v4.89.0` into `main`.
This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/`
cleanup into main. The CHANGELOG conflict was resolved by placing the
4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1
date of Jul 10, 2026).
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added vulnerability filtering by CVSS score and exploitability in
Fleet Desktop.
* Added default enrollment behavior for fleet-owned Apple devices.
* Added additional filtering options to the Vulnerability Exposure
chart.
* Improved certificate template variables, including IdP values and host
platform.
* **Bug Fixes**
* Fixed policy selection pagination, stale policy/report details, and
missing-host reporting.
* Corrected SSO and email links when Fleet is hosted under a URL
subpath.
* Improved Windows profile validation and MDM command labeling.
* Fixed several display and accessibility issues, including host counts,
checkbox wording, and dark-mode badges.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Released a new Fleet chart and application version.
* Updated deployment defaults to use the latest Fleet container image.
* **Tests**
* Adjusted release-candidate branch expectations to match the new
version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped Fleet to version **v4.87.1** across Helm, Terraform, and the
npm package.
* Updated deployment image tags so environments using the chart or
infrastructure defaults will pick up the new release.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved an issue where team-scoped host vitals labels (from IdP
attributes) failed to populate associated hosts correctly.
* **Chores**
* Updated Fleet/Helm chart versions and container image/CLI package tags
from v4.86.1 to v4.86.2 across the deployment chart, values,
infrastructure defaults, and tooling manifest, with no other
configuration changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes#40303
### Summary
Adds support for Google Application Default Credentials (ADC) bearer
token authentication when using GCS's S3-compatible endpoint. This
allows Fleet deployments on GCP to use workload identity instead of
static HMAC keys.
Changes
- Add `s3_software_installers_gcs_iam_auth` config option for software
installer storage
- Add `s3_carves_gcs_iam_auth` config option for file carving storage
- Implement OAuth2 bearer token auth in S3 client via middleware
(removes AWS SigV4 signing)
- Add validation to ensure GCS IAM auth requires endpoint URL containing
`storage.googleapis.com`
- Add Helm chart values and deployment env vars for both options
- Add documentation for new configuration options
- Add tests for GCS IAM auth validation and integration
### Usage
Enable GCS IAM auth by setting the endpoint URL to Google's
S3-compatible endpoint and enabling the IAM auth flag:
```yaml
s3:
software_installers_endpoint_url: https://storage.googleapis.com
software_installers_gcs_iam_auth: true
software_installers_bucket: my-bucket
software_installers_force_s3_path_style: true
```
Or via environment variables:
```
FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL=https://storage.googleapis.com
FLEET_S3_SOFTWARE_INSTALLERS_GCS_IAM_AUTH=true
FLEET_S3_SOFTWARE_INSTALLERS_BUCKET=my-bucket
FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE=true
```
### Testing
- Unit tests validate configuration requirements (GCS endpoint, no HMAC
keys, no STS role)
- Integration test verifies bearer token is correctly injected into
requests
**Related issue:** Resolves #
## Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [TODO] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [X] Setting(s) is/are explicitly excluded from GitOps
> [!NOTE]
These are infrastructure-level server settings (env vars/config file),
not app-level settings managed via GitOps YAML.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Google Cloud Storage (GCS) IAM authentication support for file
carving and software installer storage using Google Application Default
Credentials
* **Configuration**
* New authentication configuration option available for both carving and
software installer S3 storage in Helm deployments and configuration
files
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/40374)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fleet version bumped to v4.86.1 across Helm charts, Terraform
configurations, and fleetctl package manager to ensure consistent
deployment versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Kubernetes deployment chart to v7.0.1 with application version
v4.84.3.
* Updated container image versions across cloud deployment
configurations to v4.84.3.
* Updated command-line tool version to v4.84.3.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Resolves: #34771
This moves away from relying on discontinued bitnami charts and instead
adds a small mysql chart, a valkey/redis chart and a brief guide update
on how to migrate from one to the other.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Helm chart bumped to v7.0.0.
* Replaced Redis with Valkey as the caching backend and added Valkey
configuration options.
* Added an optional embedded MySQL chart with configurable auth,
persistence, service, and credentials handling.
* **Chores**
* CI now adds the Valkey Helm repository and builds chart dependencies
before templating.
* .gitignore adjusted to only ignore packaged chart archives (*.tgz).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: georgekarrv <1501415+georgekarrv@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Version bumped to v4.84.2 across Helm charts, container images,
deployment infrastructure, and npm package.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Fleet version from v4.84.0 to v4.84.1 across deployment
configurations (Helm values, container images, Terraform for AWS/GCP,
and npm package) and bumped Helm chart package version v6.9.1 → v6.9.2.
* **Documentation**
* Updated CLI help/example text to reference the v4.84.1 milestone.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43330
- Update tmp volume mounts to be unconditional
- Fixes an issue where `fleet.tls.enabled = false`, `databse.tls.enabled
= false`, `osquery.logging.statusPlugin != "filesystem"`,
`osquery.logging.resultPlugin != "filesystem"`, and
`fleet.additionalCAs.enabled = false`, all at once, would lead to
exclusion of the `tmp` volume mount and affecting software installer
uploads.
- Bump helm chart version from `6.8.10` -> `6.9.0`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Release**
* Updated Helm chart version to v6.9.0
* **Improvements**
* Enhanced deployment configuration to properly support additional
Certificate Authority (CA) handling alongside existing security
configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Issue
Closes#43330
## Description
This PR allows self-hosted, Kubernetes-based Fleet users to configure
`securityContext.readOnlyRootFilesystem` in `values.yaml`, which is then
propagated down to the `deployment.yaml` template.
This change provides a convenient mechanism for users to fix a known
issue while preserving the current default behavior.
## Testing
The underlying `deployment.yaml` change has been tested in a standard
Google Kubernetes Engine cluster, and is confirmed to fix the linked
issue when using either Ubuntu-based or Container-Optimized OS
(COS)-based `containerd` container runtimes in GKE.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Enhanced fleet container security by making the read-only root
filesystem setting configurable. Deployments can now customize this
security parameter to meet specific requirements, while secure defaults
are automatically applied for standard installations that don't require
custom configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Released patch version v4.83.2 with updated Helm chart and application
metadata.
* Updated deployment configurations to use the latest container image
version across cloud providers.
* Updated published package version to v4.83.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Luke Heath <luke@fleetdm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Released patch v4.83.1: updated chart and app metadata, container
image tags, Terraform deployment defaults, and npm package version to
v4.83.1.
* **Documentation**
* Updated CLI help/example to reference the v4.83.1 milestone.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Increments Helm chart to `6.8.0`
- Adds Fleet Helm chart support for adding additional CA certificates to
the Fleet container's trust store
- Allows adding additional CA certificates stored in kubernetes secrets
and kubernetes config maps to
- Fleet pods
- Fleet vulnerability processing pods
- Bump helm chart version to v6.7.4
- Add `metadata.namespace` to the ingress template to ensure that
ingress is deployed in the same namespace as all other resources
- Add `spec.revisionHistoryLimit` to the deployment template
(`.Values.revisionHistoryLimit`)
Signed-off-by: t0x01 <T0x01@protonmail.ch>
- Bumps helm chart version to v6.7.0
- Adds s3 softwareinstallers region
(`.Values.fleet.softwareinstallers.s3.region`)
- Adds s3 carving region (`.Values.fleet.carving.s3.region`)
Luke Heath
