v0.16.0

(github-actions[bot]) released this 2026-03-19 18:32:09 +0000 UTC

Breaking Changes

Helm repository credentials are no longer forwarded to a chart repository by default. They are only sent when the repository URL matches the pattern configured in helmRepoURLRegex`. A pre-upgrade migration Job and a hidden fleet migrate gitrepo-helm-url-regex CLI command populate the field on existing GitRepo s. Require helmRepoURLRegex for Helm credential forwarding (GHSA-hx4v-cxpf-vh8m) by @thardeck in #5141

Future Deprecation Notice

  • GitRepoRestriction will be deprecated in v0.17 and may be removed as soon as v0.18. It remains supported until removed, but has known security limitations: its repo patterns are matched unanchored, and it does not cover HelmOp or Bundle resources. Migration to the new Policy resource is strongly recommended.

  • Unauthenticated webhook calls are still supported, but will be deprecated in a future release. Migrating to using authenticated webhooks is strongly recommended.

Notable Changes

  • Fleet v0.16.0 introduces the Policy custom resource, a new upstream authorization model for multi-tenant setups. Policy restricts which ServiceAccount, credential secrets, and source repositories the GitRepo, HelmOp, and Bundle resources in a namespace may use, extending coverage beyond what GitRepoRestriction offered.

Additions

Multi-tenancy and access control

  • Introduce Policy custom resource for multi-tenant authorization by @p-se in #5152

  • Allow rejecting empty TTL and restrict cluster registration secret access (#5157) by @0xavi0 in #5158

Targeting and bundle management

Drift detection

Enable drift correction after the Bundle is deployed (#4945) by @0xavi0 in #5114

Helm and Git

  • HTTP proxy support for SSH in GitOps (#3595) by @p-se in #4781

  • Make CA bundle configurable for HTTPS_PROXY (#4870) by @p-se in #4888

  • bundlereader: merge PROXY_CA_BUNDLE into CABundle for HTTPS git clones (#4869) by @p-se in #4919

  • Fall back to Rancher CA bundles for HelmOps (#3845) by @thardeck in #4724

  • Use Custom CAs when pulling OCI artifact (#4897) by @0xavi0 in #5128

  • Add Go duration validation across CRDs, Helm schemas, and config loader by @0xavi0 in #5299

Agent management

  • Add option to disable the management cluster’s agent (#4807) by @0xavi0 in #5250

  • Support image pull secrets for Fleet controllers and agents (#5050) by @weyfonk in #5201

  • Support cluster-level image pull secrets for agent deployments (#5254) by @weyfonk in #5258

  • Propagate CATTLE_WRANGLER_CHECK_GVK_ERROR_MAPPING to fleet-agent (#5060) by @0xavi0 in #5085

CLI

Security hardening

  • Remove go-getter dependency, replacing git/HTTP fetching with native go-git/stdlib (#4877) by @thardeck in #4841

  • Reduce Fleet image footprint and CVE exposure with bci-nano (#5407) by @thardeck in #5346

Bugfixes

Stability

  • Fix doNotDeploy bypassed when a broader target precedes it in the target list (#3580) by @dockerized-nl in #4688

  • Refine conditions for reconciles from cluster updates across shards (#4484) by @weyfonk in #4730

  • Fix drift correction regression when correctDrift.force is false (#4938) by @0xavi0 in #4939

  • Reintroduce legacyscheme defaults for drift detection (#5020) by @p-se in #5215

  • Restore status fields when gitjob creation fails (#4948) by @0xavi0 in #4949

  • Self-heal BundleDeployment secret when having a hash mismatch (#4962) by @0xavi0 in #4963

  • Avoid race condition on first gitjob creation with polling enabled by @0xavi0 in #4986

  • Fix PollingInterval update dropped by Status().Patch() in webhook handler by @thardeck in #5098

  • Improve webhook handling for out-of-order and pre-HEAD-update deliveries (#5216, #5077) by @0xavi0 in #5218

  • Fix fleet-agent bundles not deleted when cluster is deleted (#3588) by @p-se in #5220

  • Deduplicate appended slices in options.Merge by @thardeck in #5197

  • Inherit node selectors for GitRepo sync jobs (#5011) by @immanuwell in #5086

  • Catch unknown-field errors in deployErrToStatus by @thardeck in #4956

  • Fix stale bundle error when cluster is offline after a bad commit by @thardeck in #4780

Helm and Git

Security

  • Fix credential leaks and DoS risk in GetContent archive handling (#4877) by @thardeck in #4891

  • webhook: use regexp.QuoteMeta for hostname and path (GHSA-jmf4-m7j9-g72r) by @p-se in #5153

  • Validate resolved paths stay within the clone directory (GHSA-c45g-6c2c-rj3p) by @thardeck in #5276

  • Align Helm deployer client construction (GHSA-765j-qfrp-hm3j) by @thardeck in #5069

  • Validate kubeConfig namespaces against known Fleet namespaces by @thardeck in #5224

  • Verify cluster in API server before deleting namespace (#3830) by @thardeck in #5224

Observability

Notable Dependency Updates

  • Update Kubernetes dependencies to v0.36.2 by @thardeck in #5094

  • Update Go toolchain to 1.26.4 by @thardeck in #4947

  • Update github.com/go-git/go-git/v5 to v5.19.1 [security] by @thardeck in #5165

  • Update module helm.sh/helm/v4 to v4.2.2 [security] by renovate in #5353

  • Update module github.com/rancher/wrangler/v3 to v3.7.0 by renovate in #5142

  • Update module golang.org/x/net to v0.55.0 [security] by renovate in #5190

  • Update oras.land/oras-go/v2 to v2.6.2 and golang.org/x/crypto to v0.54.0 [security] by @thardeck in #5429

New Contributors

Full Changelog:

Full Changelog: v0.15.0…​v0.16.0

Download

Information retrieved from Fleet v0.16.0