Adding changes for Fleet v4.62.0 (#25092)

Ready for review.
This commit is contained in:
Luke Heath
2025-01-13 16:23:26 -06:00
committed by GitHub
parent 6bc0bf92c9
commit 4cca22384d
75 changed files with 107 additions and 95 deletions
+75
View File
@@ -1,3 +1,78 @@
## Fleet 4.62.0 (Jan 09, 2025)
## Endpoint operations
- Updated macos 13, 14 per latest CIS documents. Added macos 15 support.
- Updated queries API to support above targeted platform filtering.
- Updated UI queries page to filter, sort, paginate, etc. via query params in call to server.
- Added searchable query targets and cleaner UI for uses with many teams or labels.
## Device management (MDM)
- Added ability to use secrets (`$FLEET_SECRET_YOURNAME`) in scripts and profiles.
- Added ability to scope Fleet-maintained apps and custom packages via labels in UI, API, and CLI.
- Added capability to automatically generate "trigger policies" for custom software packages.
- Added UI for scoping software via labels.
- Added validation to prevent label deletion if it is used to scope the hosts targeted by a software installer.
- Added ability to filter host software based on label scoping.
- Added support for Fleet secret validation in software installer scripts.
- Updated `fleetctl gitops` to support scope software installers by labels, with the `labels_include_any` or `labels_exclude_any` conditions.
- Updated `fleetctl gitops` to identify secrets in scripts and profiles and saves them on the Fleet server.
- Updated `fleetctl gitops` so that when it updates profiles, if the secret value has changed, the profile is updated on the host.
- Added `/fleet/spec/secret_variables` API endpoint.
- Added functionality for skipping automatic installs if the software is not scoped to the host via labels.
- Added the ability to click a software row on the my device page and see the details of that software's installation on the host.
- Allowed software uninstalls and script-based host lock/unlock/wipe to run while global scripts are disabled.
## Vulnerability management
- Added missing vulncheck data from NVD feeds.
- Fixed MSI parsing for packages including long interned strings (e.g. licenses for the OpenVPN Connect installer).
- Fixed a panic (and resulting failure to load CVE details) on new installs when OS versions have not been populated yet.
- Fixed CVE-2024-10004 false positive on Fleet-supported platforms (vuln is iOS-only and iOS vuln checking is not supported).
## Bug fixes and improvements
- Added license key validation on `fleetctl preview` if a license key is provided; fixes cases where an invalid license key would cause `fleetctl preview` to hang.
- Increased maximum length for installer URLs specified in GitOps to 4000 characters.
- Stopped older scheduled queries from filling logs with errors.
- Changed script upload endpoint (`POST /api/v1/fleet/scripts`) to automatically switch CRLF line endings to LF.
- Fleshed out server response from `queries` endpoint to include `count` and `meta` pagination information.
- Updated platform filtering on queries page to refer to targeted platforms instead of compatible platforms.
- Included osquery pre-releases in daily UI constant update GitHub Actions job.
- Updated to send alert via SNS when a scheduled "cron" job returns errors.
- SNS topic for job error alerts can be configured separately from the existing monitor alert by adding "cron_job_failure_monitoring" to sns_topic_arns_map, otherwise defaults to the using the same topic.
- Improved validation workflow on SMTP settings page.
- Allowed team policy endpoint (`PATCH /api/latest/fleet/teams/{team_id}/policies/{policy_id}`) to receive explicit `null` as a value for `script_id` or `software_title_id` to unset a script or software installer respectively.
- Aliased EAP versions of JetBrains IDEs to "last release version plus all fixes" (e.g. 2024.3 EAP -> 2024.2.99) to avoid vulnerability false positives.
- Removed server error if no private IP was found by detail_query_network_interface.
- Updated `fleetctl` dependencies that cause warnings.
- Added service annotation field to Helm Chart.
- Updated so that on policy deletion any associated pending software installer or scripts are deleted.
- Added fallback to FileVersion on EXE installers when FileVersion is set but ProductVersion isn't to allow more custom packages to be uploaded.
- Added Mastodon icon and URL to server email templates.
- Improved table text wrapper in UI.
- Added helpful tooltip for the install software setup experience page.
- Added offset to the tooltips on hover of the profile aggregate status indicators.
- Added the `software_title_id` field to the `added_software` activity details.
- Allow maintainers to manage install software or run scripts on policy automations.
- Removed duplicate software records from homebrew casks already reported in the osquery `apps` table to address false positive vulnerabilities due to lack of bundle_identifier.
- Added the `labels_include_any` and `labels_exclude_any` fields to the software installer activities.
- Updated the get host endpoint to include disk encryption stats for a linux host only if the setting is enabled.
- Updated Helm chart to support customization options such as the Google cloud_sql_proxy in the fleet-migration job.
- Updated example windows policies.
- Added a descriptive error when a GitOps file contains script references that are missing paths.
- Removed `invalid UUID` log message when validating Apple MDM UDID.
- Added validation Fleet secrets embedded into scripts and profiles on ingestion.
- Display the correct percentage of hosts online when there are no hosts online.
- Fixed bug when creating a label to preserve the selected team.
- Fixed export to CSV trimming leading zeros by treating those values as strings.
- Fixed reporting of software uninstall results after a host has been locked/unlocked.
- Fixed issue where minio software was not scanned for vulnerabilities correctly because of unexpected trailing characters in the version string.
- Fixed bug on the "Controls" page where incorrect timestamp information was displayed while the "Current versions" table was loading.
- Fixed policy truncation UI bug.
- Fixed cases where showing results of an inherited query viewed inside a team would include results from hosts not on thta team by adding an optional team_id parameter to queris report endpoint (`GET /api/latest/fleet/queries/{query_id}/report`).
- Fixed issue where deleted Apple config profiles were installing on devices because devices were offline when the profile was added.
- Fixed UI bug involving pagination of subsections within the "Controls" page.
- Fixed "Verifying" disk encryption status count and filter for macOS hosts to not include hosts where end-user action is required.
- Fixed a bug in determining sort type of query result columns by deducing that type from the data present in those columns.
## Fleet 4.61.0 (Dec 17, 2024)
## Endpoint operations
-2
View File
@@ -1,2 +0,0 @@
- Send alert via SNS when a scheduled "cron" job returns errors
- SNS topic for job error alerts can be configured separately from the existing monitor alert by adding "cron_job_failure_monitoring" to sns_topic_arns_map, otherwise defaults to the using the same topic
-5
View File
@@ -1,5 +0,0 @@
- Fleshed out server response from `queries` endpoint to include `count` and `meta` pagination information.
- Updated UI queries page to filter, sort, paginate, etc. via query params in call to server.
- Updated platform filtering on queries page to refer to targeted platforms instead of compatible
platforms
- Updated queries API to support above targeted platform filtering
-1
View File
@@ -1 +0,0 @@
* Added a descriptive error when a GitOps file contains script references that are missing paths
-1
View File
@@ -1 +0,0 @@
- Fleet UI: Add searchable query targets and cleaner UI I for uses with many teams or labels
-1
View File
@@ -1 +0,0 @@
* Fixed a panic (and resulting failure to load CVE details) on new installs when OS versions have not been populated yet.
-1
View File
@@ -1 +0,0 @@
* Aliased EAP versions of JetBrains IDEs to "last release version plus all fixes" (e.g. 2024.3 EAP -> 2024.2.99) to avoid vulnerability false positives
-1
View File
@@ -1 +0,0 @@
- Added features to scope Fleet-maintained apps and custom packages via labels in UI, API, and CLI.
@@ -1 +0,0 @@
* Allowed software uninstalls and script-based host lock/unlock/wipe to run while global scripts are disabled.
-1
View File
@@ -1 +0,0 @@
* Added license key validation on `fleetctl preview` if a license key is provided; fixes cases where an invalid license key would cause `fleetctl preview` to hang.
-1
View File
@@ -1 +0,0 @@
* removed duplicate software records from homebrew casks already reported in the osquery `apps` table to address false positive vulnerabilities due to lack of bundle_identifier
-2
View File
@@ -1,2 +0,0 @@
- Fixed a bug in determining sort type of query result columns by deducing that type from the data
present in those columns.
@@ -1,5 +0,0 @@
Added ability to use secrets ($FLEET_SECRET_YOURNAME) in scripts and profiles.
- Added `/fleet/spec/secret_variables` API endpoint.
- fleetctl gitops identifies secrets in scripts and profiles and saves them on the Fleet server.
- secret values are populated when scripts and profiles are sent to devices.
- When fleetctl gitops updates profiles, if the secret value has changed, the profile is updated on the host.
@@ -1 +0,0 @@
* Added Mastodon icon and URL to server email templates.
@@ -1,2 +0,0 @@
* Add the ability to click a software row on the my device page and see the details of that
software's installation on the host.
@@ -1 +0,0 @@
- Fleet UI bug fix: Allow maintainers to manage install software or run scripts on policy automations
@@ -1 +0,0 @@
* Allowed team policy endpoint (`PATCH /api/latest/fleet/teams/{team_id}/policies/{policy_id}`) to receive explicit `null` as a value for `script_id` or `software_title_id` to unset a script or software installer respectively.
-1
View File
@@ -1 +0,0 @@
* Added fallback to FileVersion on EXE installers when FileVersion is set but ProductVersion isn't to allow more custom packages to be uploaded
-1
View File
@@ -1 +0,0 @@
* fixed issue where minio software was not scanned for vulnerabilities correctly because of unexpected trailing characters in the version string
@@ -1 +0,0 @@
* Fixed CVE-2024-10004 false positive on Fleet-supported platforms (vuln is iOS-only and iOS vuln checking is not supported)
-1
View File
@@ -1 +0,0 @@
* Updated macos 13, 14 per latest CIS documents. Added macos 15 support.
-1
View File
@@ -1 +0,0 @@
- Fixed UI bug involving pagination of subsections within the "Controls" page.
-1
View File
@@ -1 +0,0 @@
* Display the correct percentage of hosts online, 0, when there are no hosts online.
-1
View File
@@ -1 +0,0 @@
- Fleet UI: Fix export to CSV from trimming leading zeros by treating those values as strings
@@ -1 +0,0 @@
* On policy deletion any associated pending software installer or scripts are deleted.
-1
View File
@@ -1 +0,0 @@
* Fixed cases where showing results of an inherited query viewed inside a team would include results from hosts not on thta team by adding an optional team_id parameter to queries report endpoint (`GET /api/latest/fleet/queries/{query_id}/report`)
-1
View File
@@ -1 +0,0 @@
- Fix bug when creating a label to preserve the selected team
-1
View File
@@ -1 +0,0 @@
Helm chart: Supported customization options such as the Google cloud_sql_proxy in the fleet-migration job.
-1
View File
@@ -1 +0,0 @@
- Adds the `software_title_id` field to the `added_software` activity details.
-1
View File
@@ -1 +0,0 @@
* Changed script upload endpoint (`POST /api/v1/fleet/scripts`) to automatically switch CRLF line endings to LF
@@ -1 +0,0 @@
* Fixed "Verifying" disk encryption status count and filter for macOS hosts to not include hosts where end-user action is required
-1
View File
@@ -1 +0,0 @@
* Update fleetctl dependencies that cause warnings
-1
View File
@@ -1 +0,0 @@
* added missing vulncheck data from nvd feeds
@@ -1 +0,0 @@
- Update example windows policies
-1
View File
@@ -1 +0,0 @@
- Fix policy truncation UI bug
@@ -1 +0,0 @@
* Added capability to automatically generate "trigger policies" for custom software packages.
-1
View File
@@ -1 +0,0 @@
- Stop older scheduled queries from filling logs with errors
@@ -1 +0,0 @@
- Updated the get host endpoint to include disk encryption stats for a linux host only if the setting is enabled
-1
View File
@@ -1 +0,0 @@
* Added service annotation field to Helm Chart
-1
View File
@@ -1 +0,0 @@
- Adds functionality for skipping automatic installs if the software is not scoped to the host via labels.
-1
View File
@@ -1 +0,0 @@
- Add functionality to filter host software based on label scoping.
@@ -1 +0,0 @@
* Added a validation to prevent label deletion if it is used to scope the hosts targeted by a software installer.
@@ -1 +0,0 @@
- add UI for scoping software via labels
@@ -1 +0,0 @@
- Validate fleet secrets embedded into scripts and profiles on ingestion
@@ -1 +0,0 @@
* Added `fleetctl gitops` support to scope software installers by labels, with the `labels_include_any` or `labels_exclude_any` conditions.
-1
View File
@@ -1 +0,0 @@
Removed server error if no private IP was found by detail_query_network_interface.
@@ -1 +0,0 @@
* Added the `labels_include_any` and `labels_exclude_any` fields to the software installer activities.
@@ -1 +0,0 @@
- add helpful tooltip for the install software setup experience page
@@ -1 +0,0 @@
- Add support for fleet secret validation in software installer scripts
-1
View File
@@ -1 +0,0 @@
* Increased maximum length for installer URLs specified in GitOps to 4000 characters
-1
View File
@@ -1 +0,0 @@
Removed `invalid UUID` log message when validating Apple MDM UDID.
@@ -1 +0,0 @@
* Add offset to the tooltips on hover of the profile aggregate status indicators.
-1
View File
@@ -1 +0,0 @@
- Fleet UI: Clean up some table text wrapping
+2 -2
View File
@@ -4,11 +4,11 @@ name: fleet
keywords:
- fleet
- osquery
version: v6.3.0
version: v6.3.1
home: https://github.com/fleetdm/fleet
sources:
- https://github.com/fleetdm/fleet.git
appVersion: v4.61.0
appVersion: v4.62.0
dependencies:
- name: mysql
condition: mysql.enabled
+1 -1
View File
@@ -3,7 +3,7 @@
hostName: fleet.localhost
replicas: 3 # The number of Fleet instances to deploy
imageRepository: fleetdm/fleet
imageTag: v4.61.0 # Version of Fleet to deploy
imageTag: v4.62.0 # Version of Fleet to deploy
podAnnotations: {} # Additional annotations to add to the Fleet pod
serviceAnnotations: {} # Additional annotations to add to the Fleet service
serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
@@ -56,7 +56,7 @@ variable "database_name" {
variable "fleet_image" {
description = "the name of the container image to run"
default = "fleetdm/fleet:v4.61.0"
default = "fleetdm/fleet:v4.62.0"
}
variable "software_inventory" {
@@ -68,7 +68,7 @@ variable "redis_mem" {
}
variable "image" {
default = "fleetdm/fleet:v4.61.0"
default = "fleetdm/fleet:v4.62.0"
}
variable "software_installers_bucket_name" {
+2 -2
View File
@@ -2,8 +2,8 @@
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "4.61.0"
constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.61.0"
version = "4.62.0"
constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.62.0"
hashes = [
"h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
"zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
+1 -1
View File
@@ -2,7 +2,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.61.0"
version = "~> 4.62.0"
}
}
backend "s3" {
@@ -2,7 +2,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.61.0"
version = "~> 4.62.0"
}
}
backend "s3" {
@@ -2,8 +2,8 @@
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "4.61.0"
constraints = ">= 3.63.0, ~> 4.61.0"
version = "4.62.0"
constraints = ">= 3.63.0, ~> 4.62.0"
hashes = [
"h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
"zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
@@ -20,7 +20,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.61.0"
version = "~> 4.62.0"
}
}
backend "s3" {
@@ -2,8 +2,8 @@
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "4.61.0"
constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.61.0"
version = "4.62.0"
constraints = ">= 3.0.0, >= 4.8.0, >= 4.9.0, ~> 4.62.0"
hashes = [
"h1:fuIdjl9f2JEH0TLoq5kc9NIPbJAAV7YBbZ8fvNp5XSg=",
"zh:0341a460210463a0bebd5c12ce13dc49bd8cae2399b215418c5efa607fed84e4",
@@ -15,7 +15,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.61.0"
version = "~> 4.62.0"
}
}
backend "s3" {
@@ -2,7 +2,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.61.0"
version = "~> 4.62.0"
}
}
backend "s3" {
+1 -1
View File
@@ -9,7 +9,7 @@ No requirements.
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.61.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.62.0 |
## Modules
@@ -24,7 +24,7 @@ variable "fleet_config" {
vuln_processing_cpu = optional(number, 2048)
vuln_data_stream_mem = optional(number, 1024)
vuln_data_stream_cpu = optional(number, 512)
image = optional(string, "fleetdm/fleet:v4.61.0")
image = optional(string, "fleetdm/fleet:v4.62.0")
family = optional(string, "fleet-vuln-processing")
sidecars = optional(list(any), [])
extra_environment_variables = optional(map(string), {})
@@ -82,7 +82,7 @@ variable "fleet_config" {
vuln_processing_cpu = 2048
vuln_data_stream_mem = 1024
vuln_data_stream_cpu = 512
image = "fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.62.0"
family = "fleet-vuln-processing"
sidecars = []
extra_environment_variables = {}
+1 -1
View File
@@ -6,7 +6,7 @@ No requirements.
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.61.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.62.0 |
## Modules
@@ -16,7 +16,7 @@ variable "fleet_config" {
mem = optional(number, 4096)
cpu = optional(number, 512)
pid_mode = optional(string, null)
image = optional(string, "fleetdm/fleet:v4.61.0")
image = optional(string, "fleetdm/fleet:v4.62.0")
family = optional(string, "fleet")
sidecars = optional(list(any), [])
depends_on = optional(list(any), [])
@@ -119,7 +119,7 @@ variable "fleet_config" {
mem = 512
cpu = 256
pid_mode = null
image = "fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.62.0"
family = "fleet"
sidecars = []
depends_on = []
+2 -2
View File
@@ -77,7 +77,7 @@ variable "fleet_config" {
mem = optional(number, 4096)
cpu = optional(number, 512)
pid_mode = optional(string, null)
image = optional(string, "fleetdm/fleet:v4.61.0")
image = optional(string, "fleetdm/fleet:v4.62.0")
family = optional(string, "fleet")
sidecars = optional(list(any), [])
depends_on = optional(list(any), [])
@@ -205,7 +205,7 @@ variable "fleet_config" {
mem = 512
cpu = 256
pid_mode = null
image = "fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.62.0"
family = "fleet"
sidecars = []
depends_on = []
+1 -1
View File
@@ -17,7 +17,7 @@ provider "aws" {
}
locals {
fleet_image = "fleetdm/fleet:v4.61.0"
fleet_image = "fleetdm/fleet:v4.62.0"
domain_name = "example.com"
}
+2 -2
View File
@@ -170,7 +170,7 @@ variable "fleet_config" {
mem = optional(number, 4096)
cpu = optional(number, 512)
pid_mode = optional(string, null)
image = optional(string, "fleetdm/fleet:v4.61.0")
image = optional(string, "fleetdm/fleet:v4.62.0")
family = optional(string, "fleet")
sidecars = optional(list(any), [])
depends_on = optional(list(any), [])
@@ -298,7 +298,7 @@ variable "fleet_config" {
mem = 512
cpu = 256
pid_mode = null
image = "fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.62.0"
family = "fleet"
sidecars = []
depends_on = []
+2 -2
View File
@@ -63,8 +63,8 @@ module "fleet" {
fleet_config = {
# To avoid pull-rate limiting from dockerhub, consider using our quay.io mirror
# for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.61.0" # override default to deploy the image you desire
# for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.62.0"
image = "fleetdm/fleet:v4.62.0" # override default to deploy the image you desire
# See https://fleetdm.com/docs/deploy/reference-architectures#aws for appropriate scaling
# memory and cpu.
autoscaling = {
+2 -2
View File
@@ -218,7 +218,7 @@ variable "fleet_config" {
mem = optional(number, 4096)
cpu = optional(number, 512)
pid_mode = optional(string, null)
image = optional(string, "fleetdm/fleet:v4.61.0")
image = optional(string, "fleetdm/fleet:v4.62.0")
family = optional(string, "fleet")
sidecars = optional(list(any), [])
depends_on = optional(list(any), [])
@@ -346,7 +346,7 @@ variable "fleet_config" {
mem = 512
cpu = 256
pid_mode = null
image = "fleetdm/fleet:v4.61.0"
image = "fleetdm/fleet:v4.62.0"
family = "fleet"
sidecars = []
depends_on = []
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "fleetctl",
"version": "v4.61.0",
"version": "v4.62.0",
"description": "Installer for the fleetctl CLI tool",
"bin": {
"fleetctl": "./run.js"