Prepare Fleet v4.67.3 (#28881)

- **Add imagePullSecrets option to Helm Chart (#28783)**
- **Prepare Fleet v4.67.3**

---------

Co-authored-by: Phillip Boushy <[email protected]>
Co-authored-by: Robert Fairburn <[email protected]>

Author: 3 people

CHANGELOG.md

@@ -1,3 +1,8 @@
+## Fleet 4.67.3 (May 6, 2025)
+
+- Removed error caused by macOS electron helper apps during ingestion.
+- Added a temporary index during macOS software names migration to speed up host software installed paths cleanup introduced in 4.67.2. This change only affects upgrades from pre-4.67.0 versions.
+
 ## Fleet 4.67.2 (Apr 27, 2025)
 
 - Fixed software deduplication when migrating from < 4.67.0 for cases where exactly two software entries would be merged into one, and for cases where the same bundle ID has more than one version, each with more than one that needs to be converted into a single software entry.

changes/28619-remove-paths-err

@@ -4,11 +4,11 @@ name: fleet
 keywords:
   - fleet
   - osquery
-version: v6.5.4
+version: v6.6.1
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.67.2
+appVersion: v4.67.3
 dependencies:
   - name: mysql
     condition: mysql.enabled

changes/migration-speedup

@@ -203,6 +203,10 @@ spec:
               runAsUser: {{ int64 .Values.fleet.securityContext.runAsUser }}
               runAsNonRoot: true
           {{- end }}
+          {{- with .Values.imagePullSecrets }}
+          imagePullSecrets:
+            {{- toYaml . | nindent 12}}
+          {{- end }}
           serviceAccountName: fleet
           volumes:
             - name: tmp

charts/fleet/Chart.yaml

@@ -370,6 +370,10 @@ spec:
       hostPID: false
       hostNetwork: false
       hostIPC: false
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8}}
+      {{- end }}
       serviceAccountName: fleet
       {{- if or (.Values.fleet.tls.enabled) (.Values.database.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
       volumes:

charts/fleet/templates/cron-vulnprocessing.yaml

@@ -164,6 +164,10 @@ spec:
           runAsUser: {{ int64 .Values.fleet.securityContext.runAsUser }}
           runAsNonRoot: true
       {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8}}
+      {{- end }}
       serviceAccountName: fleet
       volumes:
         {{- if .Values.database.tls.enabled }}

charts/fleet/templates/deployment.yaml

@@ -22,6 +22,9 @@ rules:
   - {{ .Values.cache.secretName }}
   - {{ .Values.fleet.secretName }}
   - {{ .Values.osquery.secretName }}
+  {{- range .Values.imagePullSecrets }}
+  - {{ .name }}
+  {{- end }}
   verbs:
   - get
 ---

charts/fleet/templates/job-migration.yaml

@@ -3,7 +3,11 @@
 hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 imageRepository: fleetdm/fleet
-imageTag: v4.67.2 # Version of Fleet to deploy
+imageTag: v4.67.3 # Version of Fleet to deploy
+# imagePullSecrets is optional.
+# imagePullSecrets:
+#   - name: docker
+#   - name: internal
 podAnnotations: {} # Additional annotations to add to the Fleet pod
 serviceAnnotations: {} # Additional annotations to add to the Fleet service
 serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account

charts/fleet/templates/rbac.yaml

@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.67.2"
+  default     = "fleetdm/fleet:v4.67.3"
 
 variable "software_inventory" {
   description = "enable/disable software inventory (default is enabled)"