diff --git a/.github/workflows/dogfood-gitops-rc.yml b/.github/workflows/dogfood-gitops-rc.yml deleted file mode 100644 index 01e14885e1..0000000000 --- a/.github/workflows/dogfood-gitops-rc.yml +++ /dev/null @@ -1,116 +0,0 @@ -name: "RC: Apply latest configuration to dogfood with GitOps" - -on: - push: - branches: - - main - paths: - - "it-and-security/**" - - ".github/workflows/dogfood-gitops.yml" - pull_request: - paths: - - "it-and-security/**" - - ".github/workflows/dogfood-gitops.yml" - workflow_dispatch: # allows manual triggering - schedule: - - cron: "0 6 * * *" # Nightly 6AM UTC - -# Prevent concurrent runs of this workflow, but allow all runs to finish. -concurrency: - group: ${{ github.workflow }} - cancel-in-progress: false - -defaults: - run: - shell: bash - -# Limit permissions of GITHUB_TOKEN. -permissions: - contents: read - -jobs: - fleet-gitops: - timeout-minutes: 10 - runs-on: ubuntu-latest - steps: - - name: Harden Runner - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0 - with: - egress-policy: audit - - - name: Checkout our repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - - name: Checkout GitOps repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - with: - repository: fleetdm/fleet-gitops - ref: main - path: fleet-gitops - - - name: Apply latest configuration to Fleet - uses: ./fleet-gitops/.github/gitops-action-rc - with: - working-directory: ${{ github.workspace }}/fleet-gitops - dry-run-only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} - fleet-branch: rc-minor-fleet-v4.82.0 - env: - FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security - FLEET_URL: https://dogfood.fleetdm.com - FLEET_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }} - DOGFOOD_APPLE_BM_DEFAULT_TEAM: "๐Ÿ’ป Workstations" - DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL: ${{ secrets.DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL }} - DOGFOOD_GLOBAL_ENROLL_SECRET: ${{ secrets.DOGFOOD_GLOBAL_ENROLL_SECRET }} - DOGFOOD_SSO_METADATA: ${{ secrets.DOGFOOD_SSO_METADATA }} - DOGFOOD_MDM_SSO_METADATA_URL: ${{ secrets.DOGFOOD_MDM_SSO_METADATA_URL }} - DOGFOOD_FAILING_POLICIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_FAILING_POLICIES_WEBHOOK_URL }} - DOGFOOD_VULNERABILITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_VULNERABILITIES_WEBHOOK_URL }} - DOGFOOD_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_ENROLL_SECRET }} - DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET }} - DOGFOOD_SERVERS_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_ENROLL_SECRET }} - DOGFOOD_SERVERS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_CANARY_ENROLL_SECRET }} - DOGFOOD_EXPLORE_DATA_ENROLL_SECRET: ${{ secrets.DOGFOOD_EXPLORE_DATA_ENROLL_SECRET }} - DOGFOOD_CALENDAR_API_KEY: ${{ secrets.DOGFOOD_CALENDAR_API_KEY }} - DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET }} - DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET }} - DOGFOOD_COMPANY_OWNED_MOBILE_DEVICES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_MOBILE_DEVICES_ENROLL_SECRET }} - DOGFOOD_PERSONAL_MOBILE_DEVICES_ENROLL_SECRET: ${{ secrets.DOGFOOD_PERSONAL_MOBILE_DEVICES_ENROLL_SECRET }} - FLEET_SECRET_MANAGED_CHROME_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }} - DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET }} - DOGFOOD_ACTIVITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_ACTIVITIES_WEBHOOK_URL }} - DOGFOOD_CALENDAR_WEBHOOK_URL: ${{ secrets.DOGFOOD_CALENDAR_WEBHOOK_URL }} - DOGFOOD_HOST_STATUS_WEBHOOK_URL: ${{ secrets.DOGFOOD_HOST_STATUS_WEBHOOK_URL }} - DOGFOOD_END_USER_SSO_METADATA: ${{ secrets.DOGFOOD_END_USER_SSO_METADATA }} - DOGFOOD_TESTING_AND_QA_ENROLL_SECRET: ${{ secrets.DOGFOOD_TESTING_AND_QA_ENROLL_SECRET }} - DOGFOOD_OKTA_CA_CERTIFICATE: ${{ secrets.DOGFOOD_OKTA_CA_CERTIFICATE }} - DOGFOOD_OKTA_VERIFY_WINDOWS_URL: ${{ secrets.DOGFOOD_OKTA_VERIFY_WINDOWS_URL }} - FLEET_ENABLE_LOG_TOPICS: deprecated-field-names - - - name: Notify on Gitops failure - if: failure() && github.ref_name == 'main' - uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 - with: - payload: | - { - "text": "GitOps run failed for ${{ env.RUN_URL }}", - "blocks": [ - { - "type": "section", - "text": { - "type": "mrkdwn", - "text": "GitOps run failed on ${{ github.ref_name }}" - } - }, - { - "type": "section", - "text": { - "type": "mrkdwn", - "text": "For more details see:\n${{ env.RUN_URL }}" - } - } - ] - } - env: - RUN_URL: https://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }} - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_DOGFOODING_WEBHOOK_URL }} - SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml index d76bfc3cb3..b5d302344f 100644 --- a/.github/workflows/dogfood-gitops.yml +++ b/.github/workflows/dogfood-gitops.yml @@ -1,19 +1,19 @@ -name: 'Apply latest configuration to dogfood with GitOps' +name: "Apply latest configuration to dogfood with GitOps" on: push: branches: - main paths: - - 'it-and-security/**' - - '.github/workflows/dogfood-gitops.yml' + - "it-and-security/**" + - ".github/workflows/dogfood-gitops.yml" pull_request: paths: - - 'it-and-security/**' - - '.github/workflows/dogfood-gitops.yml' + - "it-and-security/**" + - ".github/workflows/dogfood-gitops.yml" workflow_dispatch: # allows manual triggering schedule: - - cron: '0 6 * * *' # Nightly 6AM UTC + - cron: "0 6 * * *" # Nightly 6AM UTC # Prevent concurrent runs of this workflow, but allow all runs to finish. concurrency: @@ -49,10 +49,11 @@ jobs: path: fleet-gitops - name: Apply latest configuration to Fleet - uses: ./fleet-gitops/.github/gitops-action + uses: ./fleet-gitops/.github/gitops-action-rc with: working-directory: ${{ github.workspace }}/fleet-gitops dry-run-only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} + fleet-branch: rc-minor-fleet-v4.82.0 env: FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security FLEET_URL: https://dogfood.fleetdm.com diff --git a/it-and-security/default.yml b/it-and-security/default.yml index 83bf94cc69..b9530074fa 100644 --- a/it-and-security/default.yml +++ b/it-and-security/default.yml @@ -26,16 +26,16 @@ org_settings: end_user_license_agreement: ../it-and-security/lib/macos/misc/eula.pdf apple_business_manager: - organization_name: Fleet Device Management Inc. - macos_team: "๐Ÿ’ป Workstations" - ios_team: "๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices" - ipados_team: "๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices" + macos_fleet: "๐Ÿ’ป Workstations" + ios_fleet: "๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices" + ipados_fleet: "๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices" - organization_name: Mactivate LLC - macos_team: "๐Ÿงช Testing & QA" - ios_team: "๐Ÿงช Testing & QA" - ipados_team: "๐Ÿงช Testing & QA" + macos_fleet: "๐Ÿงช Testing & QA" + ios_fleet: "๐Ÿงช Testing & QA" + ipados_fleet: "๐Ÿงช Testing & QA" volume_purchasing_program: - location: Fleet Device Management Inc. - teams: + fleets: - "๐Ÿ’ป Workstations" - "๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices" - "๐Ÿ“ฑ๐Ÿ” Personal mobile devices" @@ -48,9 +48,6 @@ org_settings: secrets: - secret: $DOGFOOD_GLOBAL_ENROLL_SECRET server_settings: - debug_host_ids: - - 1 - - 3 deferred_save_host: false enable_analytics: true live_query_disabled: false @@ -87,13 +84,13 @@ org_settings: destination_url: $DOGFOOD_ACTIVITIES_WEBHOOK_URL enable_activities_webhook: true policies: -queries: - - path: ./lib/all/queries/collect-fleetd-information.yml - - path: ./lib/all/queries/collect-operating-system-information.yml - - path: ./lib/all/queries/collect-known-vulnerable-chrome-extensions.yml - - path: ./lib/macos/queries/detect-apns-certificate.yml - - path: ./lib/macos/queries/collect-macos-compatibility-data.yml - - path: ./lib/macos/queries/collect-xprotect-reports.yml +reports: + - path: ./lib/all/reports/collect-fleetd-information.yml + - path: ./lib/all/reports/collect-operating-system-information.yml + - path: ./lib/all/reports/collect-known-vulnerable-chrome-extensions.yml + - path: ./lib/macos/reports/detect-apns-certificate.yml + - path: ./lib/macos/reports/collect-macos-compatibility-data.yml + - path: ./lib/macos/reports/collect-xprotect-reports.yml controls: enable_disk_encryption: true macos_migration: diff --git a/it-and-security/teams/company-owned-mobile-devices.yml b/it-and-security/fleets/company-owned-mobile-devices.yml similarity index 99% rename from it-and-security/teams/company-owned-mobile-devices.yml rename to it-and-security/fleets/company-owned-mobile-devices.yml index 5989cfd5b8..cd6c936583 100644 --- a/it-and-security/teams/company-owned-mobile-devices.yml +++ b/it-and-security/fleets/company-owned-mobile-devices.yml @@ -1,5 +1,5 @@ name: ๐Ÿ“ฑ๐Ÿข Employee-issued mobile devices -team_settings: +settings: features: host_expiry_settings: host_expiry_enabled: false @@ -27,7 +27,7 @@ controls: enable_end_user_authentication: true scripts: policies: -queries: +reports: software: app_store_apps: # iOS apps diff --git a/it-and-security/teams/no-team.yml b/it-and-security/fleets/no-team.yml similarity index 73% rename from it-and-security/teams/no-team.yml rename to it-and-security/fleets/no-team.yml index f67d1b93d4..e418e3281c 100644 --- a/it-and-security/teams/no-team.yml +++ b/it-and-security/fleets/no-team.yml @@ -1,4 +1,4 @@ -name: No team +name: Unassigned policies: software: controls: diff --git a/it-and-security/teams/personal-mobile-devices.yml b/it-and-security/fleets/personal-mobile-devices.yml similarity index 99% rename from it-and-security/teams/personal-mobile-devices.yml rename to it-and-security/fleets/personal-mobile-devices.yml index b6f8fea69d..15290a1eb7 100644 --- a/it-and-security/teams/personal-mobile-devices.yml +++ b/it-and-security/fleets/personal-mobile-devices.yml @@ -1,5 +1,5 @@ name: ๐Ÿ“ฑ๐Ÿ” Personal mobile devices -team_settings: +settings: features: host_expiry_settings: host_expiry_enabled: false @@ -25,7 +25,7 @@ controls: enable_end_user_authentication: true scripts: policies: -queries: +reports: software: app_store_apps: # iOS apps diff --git a/it-and-security/teams/servers.yml b/it-and-security/fleets/servers.yml similarity index 96% rename from it-and-security/teams/servers.yml rename to it-and-security/fleets/servers.yml index d855e15649..ec9c800df2 100644 --- a/it-and-security/teams/servers.yml +++ b/it-and-security/fleets/servers.yml @@ -1,5 +1,5 @@ name: "โ˜๏ธ IT servers" -team_settings: +settings: features: enable_host_users: true enable_software_inventory: true @@ -28,5 +28,5 @@ controls: grace_period_days: null scripts: policies: -queries: +reports: software: diff --git a/it-and-security/teams/testing-and-qa.yml b/it-and-security/fleets/testing-and-qa.yml similarity index 98% rename from it-and-security/teams/testing-and-qa.yml rename to it-and-security/fleets/testing-and-qa.yml index bf318d2834..ee4b57e719 100644 --- a/it-and-security/teams/testing-and-qa.yml +++ b/it-and-security/fleets/testing-and-qa.yml @@ -1,5 +1,5 @@ name: "๐Ÿงช Testing & QA" -team_settings: +settings: features: enable_host_users: true enable_software_inventory: true @@ -48,7 +48,7 @@ policies: - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml # Linux policies - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml -queries: +reports: software: packages: # Linux apps diff --git a/it-and-security/teams/workstations.yml b/it-and-security/fleets/workstations.yml similarity index 97% rename from it-and-security/teams/workstations.yml rename to it-and-security/fleets/workstations.yml index f2982dd62e..6c8794be3e 100644 --- a/it-and-security/teams/workstations.yml +++ b/it-and-security/fleets/workstations.yml @@ -1,5 +1,5 @@ -name: $DOGFOOD_APPLE_BM_DEFAULT_TEAM -team_settings: +name: "๐Ÿ’ป Workstations" +settings: webhook_settings: failing_policies_webhook: destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL @@ -54,8 +54,6 @@ controls: - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig - # - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig - # Commenting out until I understand why we have this and if there's a better multi-platform solution - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig @@ -151,10 +149,10 @@ policies: - path: ../lib/linux/policies/disk-encryption-check.yml - path: ../lib/linux/policies/disk-space-check.yml - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml -queries: - - path: ../lib/macos/queries/detect-apple-intelligence.yml - - path: ../lib/macos/queries/collect-santa-denied-logs.yml - - path: ../lib/all/queries/dex-queries.yml +reports: + - path: ../lib/macos/reports/detect-apple-intelligence.yml + - path: ../lib/macos/reports/collect-santa-denied-logs.yml + - path: ../lib/all/reports/dex-queries.yml software: packages: # macOS apps diff --git a/it-and-security/lib/all/queries/collect-fleetd-information.yml b/it-and-security/lib/all/reports/collect-fleetd-information.yml similarity index 100% rename from it-and-security/lib/all/queries/collect-fleetd-information.yml rename to it-and-security/lib/all/reports/collect-fleetd-information.yml diff --git a/it-and-security/lib/all/queries/collect-known-vulnerable-chrome-extensions.yml b/it-and-security/lib/all/reports/collect-known-vulnerable-chrome-extensions.yml similarity index 100% rename from it-and-security/lib/all/queries/collect-known-vulnerable-chrome-extensions.yml rename to it-and-security/lib/all/reports/collect-known-vulnerable-chrome-extensions.yml diff --git a/it-and-security/lib/all/queries/collect-operating-system-information.yml b/it-and-security/lib/all/reports/collect-operating-system-information.yml similarity index 100% rename from it-and-security/lib/all/queries/collect-operating-system-information.yml rename to it-and-security/lib/all/reports/collect-operating-system-information.yml diff --git a/it-and-security/lib/all/queries/dex-queries.yml b/it-and-security/lib/all/reports/dex-queries.yml similarity index 100% rename from it-and-security/lib/all/queries/dex-queries.yml rename to it-and-security/lib/all/reports/dex-queries.yml diff --git a/it-and-security/lib/linux/queries/all-deb-hosts.yml b/it-and-security/lib/linux/reports/all-deb-hosts.yml similarity index 100% rename from it-and-security/lib/linux/queries/all-deb-hosts.yml rename to it-and-security/lib/linux/reports/all-deb-hosts.yml diff --git a/it-and-security/lib/linux/queries/all-rpm-hosts.yml b/it-and-security/lib/linux/reports/all-rpm-hosts.yml similarity index 100% rename from it-and-security/lib/linux/queries/all-rpm-hosts.yml rename to it-and-security/lib/linux/reports/all-rpm-hosts.yml diff --git a/it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml b/it-and-security/lib/macos/reports/collect-macos-compatibility-data.yml similarity index 100% rename from it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml rename to it-and-security/lib/macos/reports/collect-macos-compatibility-data.yml diff --git a/it-and-security/lib/macos/queries/collect-santa-denied-logs.yml b/it-and-security/lib/macos/reports/collect-santa-denied-logs.yml similarity index 100% rename from it-and-security/lib/macos/queries/collect-santa-denied-logs.yml rename to it-and-security/lib/macos/reports/collect-santa-denied-logs.yml diff --git a/it-and-security/lib/macos/queries/collect-xprotect-reports.yml b/it-and-security/lib/macos/reports/collect-xprotect-reports.yml similarity index 100% rename from it-and-security/lib/macos/queries/collect-xprotect-reports.yml rename to it-and-security/lib/macos/reports/collect-xprotect-reports.yml diff --git a/it-and-security/lib/macos/queries/detect-apns-certificate.yml b/it-and-security/lib/macos/reports/detect-apns-certificate.yml similarity index 100% rename from it-and-security/lib/macos/queries/detect-apns-certificate.yml rename to it-and-security/lib/macos/reports/detect-apns-certificate.yml diff --git a/it-and-security/lib/macos/queries/detect-apple-intelligence.yml b/it-and-security/lib/macos/reports/detect-apple-intelligence.yml similarity index 100% rename from it-and-security/lib/macos/queries/detect-apple-intelligence.yml rename to it-and-security/lib/macos/reports/detect-apple-intelligence.yml diff --git a/it-and-security/lib/windows/queries/all-arm-hosts.yml b/it-and-security/lib/windows/reports/all-arm-hosts.yml similarity index 100% rename from it-and-security/lib/windows/queries/all-arm-hosts.yml rename to it-and-security/lib/windows/reports/all-arm-hosts.yml diff --git a/it-and-security/lib/windows/queries/all-x86-hosts.yml b/it-and-security/lib/windows/reports/all-x86-hosts.yml similarity index 100% rename from it-and-security/lib/windows/queries/all-x86-hosts.yml rename to it-and-security/lib/windows/reports/all-x86-hosts.yml