Migrating teams to fleets and queries to reports (#40726)

.github/workflows/dogfood-gitops-rc.yml

@@ -1,116 +0,0 @@
-name: "RC: Apply latest configuration to dogfood with GitOps"
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "it-and-security/**"
-      - ".github/workflows/dogfood-gitops.yml"
-  pull_request:
-    paths:
-      - "it-and-security/**"
-      - ".github/workflows/dogfood-gitops.yml"
-  workflow_dispatch: # allows manual triggering
-  schedule:
-    - cron: "0 6 * * *" # Nightly 6AM UTC
-
-# Prevent concurrent runs of this workflow, but allow all runs to finish.
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-# Limit permissions of GITHUB_TOKEN.
-permissions:
-  contents: read
-
-jobs:
-  fleet-gitops:
-    timeout-minutes: 10
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout our repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-
-      - name: Checkout GitOps repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        with:
-          repository: fleetdm/fleet-gitops
-          ref: main
-          path: fleet-gitops
-
-      - name: Apply latest configuration to Fleet
-        uses: ./fleet-gitops/.github/gitops-action-rc
-        with:
-          working-directory: ${{ github.workspace }}/fleet-gitops
-          dry-run-only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
-          fleet-branch: rc-minor-fleet-v4.82.0
-        env:
-          FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security
-          FLEET_URL: https://dogfood.fleetdm.com
-          FLEET_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }}
-          DOGFOOD_APPLE_BM_DEFAULT_TEAM: "💻 Workstations"
-          DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL: ${{ secrets.DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL }}
-          DOGFOOD_GLOBAL_ENROLL_SECRET: ${{ secrets.DOGFOOD_GLOBAL_ENROLL_SECRET }}
-          DOGFOOD_SSO_METADATA: ${{ secrets.DOGFOOD_SSO_METADATA }}
-          DOGFOOD_MDM_SSO_METADATA_URL: ${{ secrets.DOGFOOD_MDM_SSO_METADATA_URL }}
-          DOGFOOD_FAILING_POLICIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_FAILING_POLICIES_WEBHOOK_URL }}
-          DOGFOOD_VULNERABILITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_VULNERABILITIES_WEBHOOK_URL }}
-          DOGFOOD_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_ENROLL_SECRET }}
-          DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET }}
-          DOGFOOD_SERVERS_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_ENROLL_SECRET }}
-          DOGFOOD_SERVERS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_CANARY_ENROLL_SECRET }}
-          DOGFOOD_EXPLORE_DATA_ENROLL_SECRET: ${{ secrets.DOGFOOD_EXPLORE_DATA_ENROLL_SECRET }}
-          DOGFOOD_CALENDAR_API_KEY: ${{ secrets.DOGFOOD_CALENDAR_API_KEY }}
-          DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET }}
-          DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET }}
-          DOGFOOD_COMPANY_OWNED_MOBILE_DEVICES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_MOBILE_DEVICES_ENROLL_SECRET }}
-          DOGFOOD_PERSONAL_MOBILE_DEVICES_ENROLL_SECRET: ${{ secrets.DOGFOOD_PERSONAL_MOBILE_DEVICES_ENROLL_SECRET }}
-          FLEET_SECRET_MANAGED_CHROME_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }}
-          DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET }}
-          DOGFOOD_ACTIVITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_ACTIVITIES_WEBHOOK_URL }}
-          DOGFOOD_CALENDAR_WEBHOOK_URL: ${{ secrets.DOGFOOD_CALENDAR_WEBHOOK_URL }}
-          DOGFOOD_HOST_STATUS_WEBHOOK_URL: ${{ secrets.DOGFOOD_HOST_STATUS_WEBHOOK_URL }}
-          DOGFOOD_END_USER_SSO_METADATA: ${{ secrets.DOGFOOD_END_USER_SSO_METADATA }}
-          DOGFOOD_TESTING_AND_QA_ENROLL_SECRET: ${{ secrets.DOGFOOD_TESTING_AND_QA_ENROLL_SECRET }}
-          DOGFOOD_OKTA_CA_CERTIFICATE: ${{ secrets.DOGFOOD_OKTA_CA_CERTIFICATE }}
-          DOGFOOD_OKTA_VERIFY_WINDOWS_URL: ${{ secrets.DOGFOOD_OKTA_VERIFY_WINDOWS_URL }}
-          FLEET_ENABLE_LOG_TOPICS: deprecated-field-names
-
-      - name: Notify on Gitops failure
-        if: failure() && github.ref_name == 'main'
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
-        with:
-          payload: |
-            {
-              "text": "GitOps run failed for ${{ env.RUN_URL }}",
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "GitOps run failed on ${{ github.ref_name }}"
-                  }
-                },
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "For more details see:\n${{ env.RUN_URL }}"
-                  }
-                }
-              ]
-            }
-        env:
-          RUN_URL: https://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_DOGFOODING_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/dogfood-gitops.yml

@@ -1,19 +1,19 @@
-name: 'Apply latest configuration to dogfood with GitOps'
+name: "Apply latest configuration to dogfood with GitOps"
 
 on:
   push:
     branches:
       - main
     paths:
-      - 'it-and-security/**'
-      - '.github/workflows/dogfood-gitops.yml'
+      - "it-and-security/**"
+      - ".github/workflows/dogfood-gitops.yml"
   pull_request:
     paths:
-      - 'it-and-security/**'
-      - '.github/workflows/dogfood-gitops.yml'
+      - "it-and-security/**"
+      - ".github/workflows/dogfood-gitops.yml"
   workflow_dispatch: # allows manual triggering
   schedule:
-  - cron: '0 6 * * *' # Nightly 6AM UTC
+    - cron: "0 6 * * *" # Nightly 6AM UTC
 
 # Prevent concurrent runs of this workflow, but allow all runs to finish.
 concurrency:
@@ -49,10 +49,11 @@ jobs:
           path: fleet-gitops
 
       - name: Apply latest configuration to Fleet
-        uses: ./fleet-gitops/.github/gitops-action
+        uses: ./fleet-gitops/.github/gitops-action-rc
         with:
           working-directory: ${{ github.workspace }}/fleet-gitops
           dry-run-only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
+          fleet-branch: rc-minor-fleet-v4.82.0
         env:
           FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security
           FLEET_URL: https://dogfood.fleetdm.com

it-and-security/default.yml

@@ -26,16 +26,16 @@ org_settings:
     end_user_license_agreement: ../it-and-security/lib/macos/misc/eula.pdf
     apple_business_manager:
       - organization_name: Fleet Device Management Inc.
-        macos_team: "💻 Workstations"
-        ios_team: "📱🏢 Employee-issued mobile devices"
-        ipados_team: "📱🏢 Employee-issued mobile devices"
+        macos_fleet: "💻 Workstations"
+        ios_fleet: "📱🏢 Employee-issued mobile devices"
+        ipados_fleet: "📱🏢 Employee-issued mobile devices"
       - organization_name: Mactivate LLC
-        macos_team: "🧪 Testing & QA"
-        ios_team: "🧪 Testing & QA"
-        ipados_team: "🧪 Testing & QA"
+        macos_fleet: "🧪 Testing & QA"
+        ios_fleet: "🧪 Testing & QA"
+        ipados_fleet: "🧪 Testing & QA"
     volume_purchasing_program:
       - location: Fleet Device Management Inc.
-        teams:
+        fleets:
           - "💻 Workstations"
           - "📱🏢 Employee-issued mobile devices"
           - "📱🔐 Personal mobile devices"
@@ -48,9 +48,6 @@ org_settings:
   secrets:
     - secret: $DOGFOOD_GLOBAL_ENROLL_SECRET
   server_settings:
-    debug_host_ids:
-      - 1
-      - 3
     deferred_save_host: false
     enable_analytics: true
     live_query_disabled: false
@@ -87,13 +84,13 @@ org_settings:
       destination_url: $DOGFOOD_ACTIVITIES_WEBHOOK_URL
       enable_activities_webhook: true
 policies:
-queries:
-  - path: ./lib/all/queries/collect-fleetd-information.yml
-  - path: ./lib/all/queries/collect-operating-system-information.yml
-  - path: ./lib/all/queries/collect-known-vulnerable-chrome-extensions.yml
-  - path: ./lib/macos/queries/detect-apns-certificate.yml
-  - path: ./lib/macos/queries/collect-macos-compatibility-data.yml
-  - path: ./lib/macos/queries/collect-xprotect-reports.yml
+reports:
+  - path: ./lib/all/reports/collect-fleetd-information.yml
+  - path: ./lib/all/reports/collect-operating-system-information.yml
+  - path: ./lib/all/reports/collect-known-vulnerable-chrome-extensions.yml
+  - path: ./lib/macos/reports/detect-apns-certificate.yml
+  - path: ./lib/macos/reports/collect-macos-compatibility-data.yml
+  - path: ./lib/macos/reports/collect-xprotect-reports.yml
 controls:
   enable_disk_encryption: true
   macos_migration:

it-and-security/fleets/company-owned-mobile-devices.yml

@@ -1,5 +1,5 @@
 name: 📱🏢 Employee-issued mobile devices
-team_settings:
+settings:
   features:
   host_expiry_settings:
     host_expiry_enabled: false
@@ -27,7 +27,7 @@ controls:
     enable_end_user_authentication: true
   scripts:
 policies:
-queries:
+reports:
 software:
   app_store_apps:
     # iOS apps

it-and-security/fleets/no-team.yml

@@ -1,4 +1,4 @@
-name: No team
+name: Unassigned
 policies:
 software:
 controls:

it-and-security/fleets/personal-mobile-devices.yml

@@ -1,5 +1,5 @@
 name: 📱🔐 Personal mobile devices
-team_settings:
+settings:
   features:
   host_expiry_settings:
     host_expiry_enabled: false
@@ -25,7 +25,7 @@ controls:
     enable_end_user_authentication: true
   scripts:
 policies:
-queries:
+reports:
 software:
   app_store_apps:
     # iOS apps

it-and-security/fleets/servers.yml

@@ -1,5 +1,5 @@
 name: "☁️ IT servers"
-team_settings:
+settings:
   features:
     enable_host_users: true
     enable_software_inventory: true
@@ -28,5 +28,5 @@ controls:
     grace_period_days: null
   scripts:
 policies:
-queries:
+reports:
 software:

it-and-security/fleets/testing-and-qa.yml

@@ -1,5 +1,5 @@
 name: "🧪 Testing & QA"
-team_settings:
+settings:
   features:
     enable_host_users: true
     enable_software_inventory: true
@@ -48,7 +48,7 @@ policies:
   - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml
   # Linux policies
   - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
-queries:
+reports:
 software:
   packages:
     # Linux apps

it-and-security/fleets/workstations.yml

@@ -1,5 +1,5 @@
-name: $DOGFOOD_APPLE_BM_DEFAULT_TEAM
-team_settings:
+name: "💻 Workstations"
+settings:
   webhook_settings:
     failing_policies_webhook:
       destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL
@@ -54,8 +54,6 @@ controls:
       - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig
       - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig
       - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig
-      # - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig
-      # Commenting out until I understand why we have this and if there's a better multi-platform solution
       - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig
       - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig
       - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig
@@ -151,10 +149,10 @@ policies:
   - path: ../lib/linux/policies/disk-encryption-check.yml
   - path: ../lib/linux/policies/disk-space-check.yml
   - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
-queries:
-  - path: ../lib/macos/queries/detect-apple-intelligence.yml
-  - path: ../lib/macos/queries/collect-santa-denied-logs.yml
-  - path: ../lib/all/queries/dex-queries.yml
+reports:
+  - path: ../lib/macos/reports/detect-apple-intelligence.yml
+  - path: ../lib/macos/reports/collect-santa-denied-logs.yml
+  - path: ../lib/all/reports/dex-queries.yml
 software:
   packages:
     # macOS apps