1.29.0 — Fleet Configuration and verified job activation

2026-09-18

Adds structured Admin/REST configuration publishing and restore, graceful job activation with per-node revision checks, and S3 client reuse. Existing GeoIP publishers must enable S3 versioning before upgrading.

Breaking

• Fleet and existing GeoIP configuration publishing now require S3 bucket versioning to be Enabled. Enable it and grant the scoped version-history permissions before upgrading deployments that use those saves.

Added

• Fleet Configuration in Admin and REST: registered typed settings, secret-preserving edits, conditional S3 publishing, version restore, and asynchronous Apply now.
• Separate publication and per-node activation status, including worker-only nodes and loaded-configuration checks for job engines, the scheduler, and the request service where enabled.

Changed

• Automatic configuration activation gracefully retires managed job engines and schedulers. Active jobs retain lease protection until completion; existing cron supervision starts replacements.

Fixed

• File and avatar URL generation reuses bounded S3 clients across manager instances while preserving credential isolation, automatic refresh, and fork safety.
• GeoIP publishing preserves unrelated configuration overrides.
• Apply tracking continues after dispatch completes and reports missing runners, stale processes, and activation timeouts without claiming fleet health.

Security

• Deployment permission repair preserves restricted configuration-file permissions. Fleet writes require interactive superuser authorization and the existing fresh-auth policy; secret values are excluded from responses, request logs, and audit events.

Upgrade notes

• Install application schemas and independent allowlists on every target node, configure the complete expected-node roster, and install the fixed config-sync trigger permissions before using Fleet Configuration.
• Upgrade and restart existing job processes during rollout. Verified jobs health requires the standard managed Linux/cron setup; custom supervisors are not certified.
• Publishing is live: existing timers can activate it. Apply now accelerates the same flow; it does not provide a health-gated rolling restart.
• Long-running jobs can exceed the activation observation window without being force-killed. Refresh fleet state to check later convergence.
• Restart workers after changing ambient AWS profile or environment credentials; botocore-managed credential refresh remains automatic.