@noahtalerman: For the following bug:
- https://github.com/fleetdm/fleet/issues/43160
## Summary
- Condense and relocate the S3 `endpoint_url` override warning from the
general `## S3` section header into the individual `endpoint_url`
setting sections
- The primary warning now lives in
`s3_software_installers_endpoint_url`; the `s3_carves_endpoint_url` and
`packaging_s3_endpoint_url` sections cross-reference it
- Condense region-discovery notes similarly (primary in
`s3_software_installers_region`, cross-references elsewhere)
- Condense the Reference Architectures S3 section to a single paragraph
## Changes
**`docs/Configuration/fleet-server-configuration.md`:**
- Removed the large callout block under `## S3`
- Added concise warning to `s3_software_installers_endpoint_url` with
link to [#42349](https://github.com/fleetdm/fleet/issues/42349)
- Added concise note to `s3_software_installers_region`
- Updated `s3_carves_endpoint_url`, `s3_carves_region`,
`packaging_s3_endpoint_url`, and `packaging_s3_region` with short
cross-references
**`docs/Deploy/Reference-Architectures.md`:**
- Condensed the `S3 configuration for AWS deployments` section to a
single paragraph with link to the config reference
## Related
- Relates to #42349
---
Built for
[ntalerman](https://fleetdm.slack.com/archives/D0AEA6U4SM9/p1775051868003859?thread_ts=1775051234.724799&cid=D0AEA6U4SM9)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
- @noahtalerman: We decided to stop calling the settings experimental
and just warn in the docs what happens if you turn it on. That way we’re
not calling them “experimental” which feels unsafe. They're not
experimental; they're just deliberately allowing custom profiles.
## Summary
- Clarifies in the MySQL docs intro that read replica configuration is
fully independent — no values are inherited from the primary config
- Adds explicit callout that `mysql_read_replica_region` must be set
separately when using IAM authentication
- Adds note to `mysql_tls_config` explaining that this setting is
typically not needed for RDS IAM auth since Fleet uses bundled RDS CA
certificates (including GovCloud regions)
These changes address real-world customer confusion where a GovCloud
deployment failed because `FLEET_MYSQL_READ_REPLICA_REGION` was not set
independently of `FLEET_MYSQL_REGION`.
Note: related to #39832
## Testing
Documentation-only change — no code impact.
Added information about silent migration enrollment profile for Apple
MDM devices.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Relates #39796
Resolves#40813
* Added configurable body size limits for the `/api/osquery/log`,
`/api/osquery/distributed/write` and `/api/osquery/config` endpoints.
* Fixed false positive `PayloadTooLargeError` errors.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Add documentation for enabling bootstrap packages during MDM migration.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39634
**Related issue:** Resolves
[34890](https://github.com/fleetdm/fleet/issues/34890)
# Checklist for submitter
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
## New Fleet configuration settings
Looking at other log destinations, I couldn't find anything relevant in
GitOps. Please let me know if I missed something, however.
## fleetd/orbit/Fleet Desktop
I've tested this on both Linux and MacOS.
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: nulmete <nicoulmete1@gmail.com>
Resolves#36909.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Summary
• Allow custom CISA vulnerability data source URL to work around blocked
requests
• Updates vulnerability sync logic to use configurable CISA endpoint
• Enables organizations to use CISA mirrors when direct access is
blocked
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#22791
This will prevent the occasional redirect from breaking live queries.
Customers can still disable the redirects by setting
`redis.cluster_follow_redirections` to `false`.
- Update section headers so that config options show up in the right
side bar. Today, there's only one header that shows up in the sidebar:
- Remove "Example YAML" sections b/c they're redundant. More to maintain
Eric