vuln processing distinct command (#9813)

closes https://github.com/fleetdm/fleet/issues/3723 Add new vuln processing command, configs, and documentation on how to utilize.
2023-02-17 10:00:57 -05:00
parent c21d592fe1
commit 0db432f7e3
9 changed files with 284 additions and 61 deletions
@@ -127,6 +127,38 @@ found in the [configuration documentation](https://fleetdm.com/docs/deploying/co

 You'll need to restart the Fleet instances after changing these settings.

+### Advanced Configuration
+
+Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful
+for frictionless deployments and is well suited for most use cases. However, in larger deployments, 
+where there can be dozens of Fleet server replicas sitting behind a load balancer, it is desirable to manage vulnerability processing externally.
+
+The reasons for this are as follows:
+
+- lower resource requirements across the entire Fleet server deployment (as vulnerability processing requires considerably more resources than just running Fleet server alone)
+- more control over scheduling constraints (only process during windows of low utilization, etc.)
+
+It is possible to limit vulnerability processing to a single [dedicated host](https://fleetdm.com/docs/deploying/configuration#current-instance-checks), by setting
+`current_instance_checks` to `no` but still run one Fleet server as `yes`, but the drawback here is still having to dedicate resources
+for this single host 24/7. The Fleet binary has a command which handles the same vulnerability processing, but will exit (successfully with 0) on completion. Using this sub-command we can delegate vulnerability processing
+to external systems such as:
+
+- [ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html)
+- [K8S](https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/)
+- [GCP](https://cloud.google.com/run/docs/triggering/using-scheduler#create_job)
+- [Plain old cron](https://en.wikipedia.org/wiki/Cron)
+
+To opt into this functionality, be sure to configure your Fleet server deployment with
+```
+FLEET_VULNERABILITIES_DISABLE_SCHEDULE=true
+```
+which will **disable** the internal scheduling mechanism for vulnerability processing.
+
+And then externally run with the same environment variables/configuration files passed to the server command.
+```
+fleet vuln_processing
+```
+
 ## Performance

 ### Windows/Mac OS