Merge branch 'main' into automation/vendor-portal-release-notes-v2025.10.20-2

Author: paigecalvert

docs/enterprise/installing-general-requirements.mdx

@@ -266,7 +266,9 @@ KOTS has been tested for compatibility with the following registries:
 
 <DockerCompatibility/>
 
-## Firewall Openings for Online Installations with KOTS in an Existing Cluster {#firewall}
+## Network Requirements for Online Installations
+
+### Firewall Openings {#firewall}
 
 <FirewallOpeningsIntro/>
 
@@ -304,3 +306,7 @@ KOTS has been tested for compatibility with the following registries:
 &#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
 
 &#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).
+
+### IPv4 or IPv4/IPv6 Dual-Stack Only
+
+KOTS does not support online installations in single-stack IPv6-only environments. Environments that use IPv4 or dual-stack IPv4/IPv6 networking are supported.

docs/enterprise/installing-kurl-requirements.mdx

@@ -36,7 +36,9 @@ You must meet the additional kURL system requirements when applicable:
 
 - **Cloud Disk Performance**: For a list of cloud VM instance and disk combinations that are known to provide sufficient performance for etcd and pass the write latency preflight, see [Cloud Disk Performance](https://kurl.sh/docs/install-with-kurl/system-requirements#cloud-disk-performance) in the kURL documentation.
 
-## Firewall Openings for Online Installations with kURL {#firewall}
+## Network Requirements for Online Installations
+
+### Firewall Openings {#firewall}
 
 <FirewallOpeningsIntro/>
 
@@ -73,4 +75,8 @@ You must meet the additional kURL system requirements when applicable:
 
 &#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
 
-&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).
+&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).
+
+### IPv4 or IPv4/IPv6 Dual-Stack Only
+
+kURL does not support online installations in single-stack IPv6-only environments. Environments that use IPv4 or dual-stack IPv4/IPv6 networking are supported.

docs/release-notes/rn-vendor-platform.md

@@ -10,12 +10,20 @@ This topic contains release notes for the Replicated Vendor Platform, which incl
 
 <!--RELEASE_NOTES_PLACEHOLDER-->
 
+
 ## v2025.10.20-2
 
 Released on October 20, 2025
 
 ### New Features {#new-features-v2025-10-20-2}
-* CMX: Added support for ssh keys not synchronized via github.
+* Compatibility Matrix: Added support for SSH keys that are not synchronized with GitHub.
+
+## v2025.10.15-2
+
+Released on October 15, 2025
+
+### New Features {#new-features-v2025-10-15-2}
+* Added rate limiting to magic link login endpoints to prevent email abuse. The endpoints are limited to 20 requests per hour per IP address.
 
 
 ## v2025.10.10-3

docs/vendor/custom-domains-using.md

@@ -14,6 +14,10 @@ To add and verify a custom domain:
 
 1. In the **Add custom domain** dropdown, select the target Replicated endpoint.
 
+    :::note
+    There is a known issue when using a custom domain for the Enterprise Portal if any of your customers use link transformers such as Microsoft Defender Safe Links. For more information, see [Known Issue](custom-domains#known-issue) in _About Custom Domains_.
+    :::
+
     The **Configure a custom domain** wizard opens.
 
     <img src="/images/custom-domains-download-configure.png" alt="custom domain wizard" width="500"/>

docs/vendor/custom-domains.md

@@ -38,4 +38,8 @@ Using custom domains has the following limitations:
 
 - Each custom domain can only be used by one team.
 
-- For [Replicated Embedded Cluster](/vendor/embedded-overview) installations, any Helm [`extensions`](/reference/embedded-config) that you add in the Embedded Cluster Config do not use custom domains. During deployment, Embedded Cluster pulls both the repo for the given chart and any images in the chart as written. Embedded Cluster does not rewrite image names to use custom domains.
+- For [Replicated Embedded Cluster](/vendor/embedded-overview) installations, any Helm [`extensions`](/reference/embedded-config) that you add in the Embedded Cluster Config do not use custom domains. During deployment, Embedded Cluster pulls both the repo for the given chart and any images in the chart as written. Embedded Cluster does not rewrite image names to use custom domains.
+
+## Known Issue
+
+If you use a custom domain for the Replicated [Enterprise Portal](/vendor/enterprise-portal-about) and any of your customers use link transformers such as Microsoft Defender Safe Links, then there is a known issue where legitimate URLs in emails generated by the Enterprise Portal can break due to rewrapping. To avoid this issue, request a "Do not rewrite the following URLs" exclusion policy for your custom Enterprise Portal domain.

docs/vendor/embedded-overview.mdx

@@ -137,3 +137,5 @@ Embedded Cluster has the following limitations:
 * **Policy enforcement on Embedded Cluster workloads is not supported**: The Embedded Cluster runs workloads that require higher levels of privilege. If your application installs a policy enforcement engine such as Gatekeeper or Kyverno, ensure that its policies are not enforced in the namespaces used by Embedded Cluster.
 
 * **Installing on STIG- and CIS-hardened OS images is not supported**: Embedded Cluster isn't tested on these images, and issues have arisen when trying to install on them. Embedded Cluster version 2.8.0 and later will install in standard SELinux environments by setting appropriate SELinux file contexts on the bin directory and restoring SELinux contexts for the data directory after creation.
+
+* **Single-stack IPv6 not supported**: Embedded Cluster does not support installations in single-stack IPv6-only environments. Environments that use IPv4 or dual-stack IPv4/IPv6 networking are supported.

docs/vendor/enterprise-portal-about.mdx

@@ -27,15 +27,19 @@ The following diagram shows how customers can use the Enterprise Portal to acces
 
 As shown in the diagram above, your licensed customers can access the installation and update instructions for one or more application releases by logging in to the Enterprise Portal. The Enterprise Portal tracks the customer's installation attempts and progress, and shares those insights back to the Vendor Portal. After installing, customers can also upload support bundles in the Enterprise Portal. Support bundles uploaded to the Enterprise Portal are automatically made available to you in the Vendor Portal. 
 
+You can enable and disable access to the Enterprise Portal for all customers, or on a per-customer basis. For more information about how to enable access, see [Manage Customer Access](/vendor/enterprise-portal-invite#manage-ep-access).
+
 For information about using the Enterprise Portal, see [Access and Use the Enterprise Portal](enterprise-portal-use).
 
 ## Limitations
 
 * The Enterprise Portal is Beta. The features and functionality of the Enterprise Portal are subject to change.
 
+* Installation and upgrade instructions are available only for Embedded Cluster and Helm installations. The Enterprise Portal does not provide instructions for installing and upgrading with KOTS in existing clusters.
+
 * Air gap instance records do not appear in the Enterprise Portal until the end customer creates an air gap instance record by either uploading a support bundle for that instance or manually entering instance information. For more information, see [View Active and Inactive Instances](/vendor/enterprise-portal-use#view-active-and-inactive-instances) in _Access and Use the Enterprise Portal_.
 
-* Installation and upgrade instructions are available only for Embedded Cluster and Helm installations. The Enterprise Portal does not provide instructions for installing and upgrading with KOTS in existing clusters.
+* There is a known issue when using a custom domain for the Enterprise Portal if any of your customers use link transformers such as Microsoft Defender Safe Links. For more information, see [Known Issue](custom-domains#known-issue) in _About Custom Domains_. 
 
 ## Comparison to the Download Portal
 
@@ -51,9 +55,7 @@ You can configure the Enterprise Portal to use a custom domain, add links and co
 
 For more information about customizing the Enterprise Portal, see [Customize the Enterprise Portal](enterprise-portal-configure).
 
-For information about how to set a custom domain for the Enterprise Portal, see [Use Custom Domains](/vendor/custom-domains-using).
-
-You can enable and disable access to the Enterprise Portal for all customers, or on a per-customer basis. For more information about how to enable access, see [Manage Customer Access](/vendor/enterprise-portal-invite#manage-ep-access).
+For information about how to set a custom domain for the Enterprise Portal, see [Use Custom Domains](/vendor/custom-domains-using). 
 
 ## About Instance Reporting with the Enterprise Portal