| Migration Test | Verify Fleet can migrate to the next version with no issues. |
diff --git a/.github/ISSUE_TEMPLATE/story.md b/.github/ISSUE_TEMPLATE/story.md
index dd3c1190c9..8c708a6020 100644
--- a/.github/ISSUE_TEMPLATE/story.md
+++ b/.github/ISSUE_TEMPLATE/story.md
@@ -41,8 +41,8 @@ What else should contributors [keep in mind](https://fleetdm.com/handbook/compan
### Product
- [ ] UI changes: TODO
- [ ] CLI (fleetctl) usage changes: TODO
-- [ ] YAML changes: TODO
-- [ ] REST API changes: TODO
+- [ ] YAML changes: TODO
+- [ ] REST API changes: TODO
- [ ] Fleet's agent (fleetd) changes: TODO
- [ ] Activity changes: TODO
- [ ] Permissions changes: TODO
diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml
index 0d3220cea7..df03e86818 100644
--- a/.github/workflows/dogfood-gitops.yml
+++ b/.github/workflows/dogfood-gitops.yml
@@ -76,6 +76,7 @@ jobs:
DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET }}
DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET }}
MANAGED_CHROME_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }}
+ DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_PERSONALLY_OWNED_IPHONES_ENROLL_SECRET }}
- name: Notify on Gitops failure
if: failure() && github.ref_name == 'main'
diff --git a/CODEOWNERS b/CODEOWNERS
index c8512f309c..14a7406a05 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -65,9 +65,9 @@ go.mod @fleetdm/go
#
# (see website/config/custom.js for DRIs of other paths not listed here)
##############################################################################################
-/docs @rachaelshaw
-/docs/REST\ API/rest-api.md @rachaelshaw # « REST API reference documentation
-/docs/Contributing/API-for-contributors.md @rachaelshaw # « Advanced / contributors-only API reference documentation
+/docs @marko-lisica
+/docs/REST\ API/rest-api.md @iansltx # « REST API reference documentation
+/docs/Contributing/API-for-contributors.md @iansltx # « Advanced / contributors-only API reference documentation
/schema @eashaw # « Data tables (osquery/fleetd schema) documentation
/render.yaml @edwardsb
diff --git a/articles/deploying-cloudflare-warp-with-fleet.md b/articles/deploying-cloudflare-warp-with-fleet.md
new file mode 100644
index 0000000000..cae8d1c16b
--- /dev/null
+++ b/articles/deploying-cloudflare-warp-with-fleet.md
@@ -0,0 +1,103 @@
+# Deploying Cloudflare WARP with Fleet
+
+Cloudflare WARP is a secure VPN-like service that encrypts internet traffic and routes it through Cloudflare's network, improving privacy and security without compromising speed.
+
+## MacOS
+
+1. Create custom MDM Config
+ a. Download the example `.mobileconfig` file
+ b. Tailor the payload with the [desired parameters](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) to satisfy your deployment
+
+2. Upload `.mobileconfig` to Fleet
+ a. In the Fleet admin console, navigate to **Controls**
+ b. Select the **Team** that requires Cloudflare WARP
+ c. Select **OS settings** > **Custom settings**
+ d. Select **Add profile** and upload the `.mobileconfig` from step 1
+ e. Select the hosts which require Cloudflare WARP:
+ - **All hosts:** Deploys WARP to all hosts in selected Team
+ - **Custom:** Deploys WARP to a subset of the hosts in the Team using [labels](https://fleetdm.com/guides/managing-labels-in-fleet)
+
+> Note that the payload will be installed on all targeted hosts, but the WARP agent is not yet installed. Proceed to step 3 to complete the process.
+
+3. Install WARP on hosts
+ a. In the Fleet admin console, navigate to **Software**
+ b. Select the **Team** that requires Cloudflare WARP
+ c. Select **Add software**
+ - Either add Cloudflare WARP from the **Fleet-maintained** library or
+ - Upload a custom `.pkg` obtained from [Cloudflare.](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/#macos) If deploying with this approach, WARP will still need to be installed on select hosts via the UI, API or GitOps. Learn more about deploying software from this [article.](https://fleetdm.com/guides/deploy-software-packages)
+
+> If using Fleet-maintained app, you can choose to install on hosts automatically or manually. To allow users to install WARP from Fleet Desktop, check the box for Self-service.
+
+## Windows
+
+1. Download the WARP installer for Windows
+ a. Visit the [Download](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/#windows) page to review system requirements and download the installer for your OS.
+
+2. Upload WARP installer to Fleet
+ a. In the Fleet admin console, navigate to **Software**
+ b. Select the **Team** that requires Cloudflare WARP
+ c. Select **Add software** > **Custom Package** and upload the `.msi` file downloaded from step 1
+ - To allow users to install WARP from Fleet Desktop, select Self-service. (Optional)
+ d. Select **Advanced options**
+ e. In **Install script**, replace the default script:
+
+ ```
+ $logFile = "${env:TEMP}/fleet-install-software.log"
+
+ try {
+
+ $installProcess = Start-Process msiexec.exe `
+ -ArgumentList "/quiet /norestart ORGANIZATION=your-team-name SUPPORT_URL=https://example.com /lv ${logFile} /i `"${env:INSTALLER_PATH}`"" `
+ -PassThru -Verb RunAs -Wait
+
+ Get-Content $logFile -Tail 500
+
+ Exit $installProcess.ExitCode
+
+ } catch {
+ Write-Host "Error: $_"
+ Exit 1
+ }
+ ```
+
+> Refer to Cloudflare's [deployment parameters](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/) for a description of each argument and adjust your script as needed.
+
+4. Install WARP on hosts
+ a. In the Fleet admin console, navigate to **Hosts**
+ b. Select the host that requires the WARP client
+ c. Go to **Software** and search for **Cloudflare WARP**
+ d. Select **Actions** > **Install**
+
+> Learn more about ways to deploy software via the UI, API or GitOps from this [article.](https://fleetdm.com/guides/deploy-software-packages)
+
+## Linux
+
+Fleet allows admins to execute custom scripts on Linux hosts. The following example script creates an [MDM file](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/#linux) and installs WARP on an Ubuntu host:
+
+```
+#!/bin/sh
+
+# Write the mdm.xml file
+touch /var/lib/cloudflare-warp/mdm.xml
+echo -e "\n organization\n your-team-name\n
+" > /var/lib/cloudflare-warp/mdm.xml
+
+# Add cloudflare gpg key
+curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
+
+# Add this repo to your apt repositories
+echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list
+
+# Install
+sudo apt-get -y update && sudo apt-get -y install cloudflare-warp
+```
+
+> To learn about deploying scripts across multiple hosts, check out this [article.](https://fleetdm.com/guides/policy-automation-run-script)
+
+To install WARP on other Linux distributions, refer to the [package repository](https://pkg.cloudflareclient.com/)
+
+
+
+
+
+
diff --git a/articles/fintech-company-migrates-to-fleet.md b/articles/fintech-company-migrates-to-fleet.md
new file mode 100644
index 0000000000..9e656dee2c
--- /dev/null
+++ b/articles/fintech-company-migrates-to-fleet.md
@@ -0,0 +1,73 @@
+# American financial services company migrates to Fleet for MDM and next-gen change management
+
+
+
+“I don't want one bad actor to brick my fleet, I want them to make a pull request first.”
+
+**— Client Platform Engineering Manager**
+
+
+## Challenge
+
+A prominent financial services company encountered substantial challenges with its existing device management solution. The platform demanded excessive resources and time for maintenance while limiting its ability to implement automated GitOps workflows, a focus of its operational strategy. The previous migration experience had been arduous, needing to support a fleet comprising 2,700 devices across macOS, Windows, and iOS devices. They required a scalable and secure platform that could support its configuration-as-code philosophy and reallocate resources to more strategic initiatives.
+
+## Solution
+
+They selected Fleet as its new device management platform to unify its device ecosystem. Fleet's next-gen GitOps capabilities aligned with their commitment to configuration as code, enabling seamless integration with their existing automation workflows. Fleet's support and direct database schema [migration tool](https://github.com/fleetdm/fleet/blob/d563d09baca642d5e4f910759b71619333b500b9/tools/mdm/migration/micromdm/touchless/README.md) facilitated the migration process, ensuring a smooth transition. Additionally, [Fleet's open API](https://fleetdm.com/docs/rest-api/rest-api) and advanced features, such as live query execution, real-time insights, and configurable logging pipelines, provide their teams with real-time visibility and control over their endpoints.
+
+## Results
+
+
+
+Unified device management platform across macOS, Windows, and iOS.
+
+Introduced new infrastructure as code workflows.
+
+Fewer resources are spent configuring device management.
+
+Smooth and seamless migration.
+
+
+
+## Their story
+
+The leading financial services company dedicated to democratizing finance for all. By leveraging cutting-edge technology, they empower millions of users to invest and manage their finances with ease and confidence. The company sought a new device management solution that wouldn’t require strenuous time or resources to manage. They were looking for a more full-featured MDM that enabled customization through configuration as code.
+
+Specifically, they were looking for:
+
+- Next-gen change management and open-source flexibility
+- Increased efficiency
+- An easy migration path
+- Improved support and feature access
+
+### Next-gen change management and open-source flexibility
+
+Fleet is [open-source](https://fleetdm.com/handbook/company/why-this-way#why-open-source), allowing engineering teams to audit, customize, and extend the platform as needed alongside [infrastructure-as-code](https://github.com/fleetdm/fleet-gitops) workflows. This makes device management more agile and automated while reducing errors through peer review.
+
+### Eliminate tool overlap and increase efficiency
+
+They were able to replace multiple legacy tools and consolidate the management of thousands of macOS, Windows, and iOS devices into a single platform. This led to a significant reduction in resources and time spent maintaining their previous tools, allowing efforts to be reallocated towards innovation and development.
+
+
+### Easy migration path
+
+Fleet ensures a smooth transition with minimal disruption. Migrations are directly assisted by Fleet’s [best-in-class support](https://fleetdm.com/support) teams and built-in [migration tools](https://github.com/fleetdm/fleet/tree/main/tools/mdm/migration).
+
+### Improved support and feature access
+
+Fleet has a three-week release schedule that quickly rolls out new features like automated software updates, VPP app support, and [policy-based scripts](https://fleetdm.com/guides/policy-automation-run-script). Faster rollouts and best-in-class support from Fleet enable them to stay ahead of their device management needs.
+
+
+## Conclusion
+
+The migration to [Fleet Device Management](https://fleetdm.com/device-management) exemplifies the fintech company’s dedication to leveraging advanced, flexible, and secure tools to support its expansive infrastructure. Fleet’s comprehensive feature set, combined with its commitment to security and scalability, not only addressed the limitations of legacy tools but also empowered them to increase efficiency and capabilities. This strategic move positions them to continue delivering exceptional financial services while maintaining forward-thinking device management practices.
+
+
+
+
+
+
+
+
+
+
diff --git a/articles/fleet-4.61.0.md b/articles/fleet-4.61.0.md
index 65505d82fd..fd13fd1385 100644
--- a/articles/fleet-4.61.0.md
+++ b/articles/fleet-4.61.0.md
@@ -22,7 +22,7 @@ You can now enable email 2FA for Fleet user accounts. This adds an extra layer o
### Automatic Windows migration
-Fleet now supports migrating Windows workstations from your old MDM solution without end user interaction. Once migrated, you can enforce [disk encryption](https://fleetdm.com/guides/enforce-disk-encryption), [OS updates](https://fleetdm.com/guides/enforce-os-updates), and other [custom OS settings](https://fleetdm.com/guides/custom-os-settings) to consolidating device management into a single, cross-platform MDM.
+Fleet now supports migrating Windows workstations from your old MDM solution without end user interaction. Once migrated, you can enforce [disk encryption](https://fleetdm.com/guides/enforce-disk-encryption), [OS updates](https://fleetdm.com/guides/enforce-os-updates), and other [custom OS settings](https://fleetdm.com/guides/custom-os-settings) to consolidate device management into a single, cross-platform MDM.
## Changes
diff --git a/changes/19930-alert-on-cron-errors b/changes/19930-alert-on-cron-errors
new file mode 100644
index 0000000000..0374bf8b05
--- /dev/null
+++ b/changes/19930-alert-on-cron-errors
@@ -0,0 +1,2 @@
+- Send alert via SNS when a scheduled "cron" job returns errors
+- SNS topic for job error alerts can be configured separately from the existing monitor alert by adding "cron_job_failure_monitoring" to sns_topic_arns_map, otherwise defaults to the using the same topic
diff --git a/changes/23557-minio b/changes/23557-minio
new file mode 100644
index 0000000000..2fa00913f4
--- /dev/null
+++ b/changes/23557-minio
@@ -0,0 +1 @@
+* fixed issue where minio software was not scanned for vulnerabilities correctly because of unexpected trailing characters in the version string
\ No newline at end of file
diff --git a/changes/23579-cve-2024-10004-false-positive b/changes/23579-cve-2024-10004-false-positive
new file mode 100644
index 0000000000..de3ed40f7b
--- /dev/null
+++ b/changes/23579-cve-2024-10004-false-positive
@@ -0,0 +1 @@
+* Fixed CVE-2024-10004 false positive on Fleet-supported platforms (vuln is iOS-only and iOS vuln checking is not supported)
diff --git a/changes/23783-controls-subnav-pagination b/changes/23783-controls-subnav-pagination
new file mode 100644
index 0000000000..46094c2e5f
--- /dev/null
+++ b/changes/23783-controls-subnav-pagination
@@ -0,0 +1 @@
+- Fixed UI bug involving pagination of subsections within the "Controls" page.
diff --git a/changes/24315-update-windows-policy-constants b/changes/24315-update-windows-policy-constants
new file mode 100644
index 0000000000..3603279008
--- /dev/null
+++ b/changes/24315-update-windows-policy-constants
@@ -0,0 +1 @@
+- Update example windows policies
diff --git a/changes/24899-software-installer-scripts-secrets b/changes/24899-software-installer-scripts-secrets
new file mode 100644
index 0000000000..f5f11a77c7
--- /dev/null
+++ b/changes/24899-software-installer-scripts-secrets
@@ -0,0 +1 @@
+- Add support for fleet secret validation in software installer scripts
diff --git a/changes/24917-installer-url-length b/changes/24917-installer-url-length
new file mode 100644
index 0000000000..af3287c807
--- /dev/null
+++ b/changes/24917-installer-url-length
@@ -0,0 +1 @@
+* Increased maximum length for installer URLs specified in GitOps to 4000 characters
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index 0b770ca43a..2fdab8223f 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -1132,6 +1132,7 @@ the way that the Fleet server works.
logger,
mdmCheckinAndCommandService,
ddmService,
+ commander,
); err != nil {
initFatal(err, "setup mdm apple services")
}
diff --git a/cmd/fleetctl/apply_test.go b/cmd/fleetctl/apply_test.go
index 3c2bbee356..8369058eb1 100644
--- a/cmd/fleetctl/apply_test.go
+++ b/cmd/fleetctl/apply_test.go
@@ -208,6 +208,9 @@ func TestApplyTeamSpecs(t *testing.T) {
ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
return nil
}
+ ds.ExpandEmbeddedSecretsFunc = func(ctx context.Context, document string) (string, error) {
+ return document, nil
+ }
filename := writeTmpYml(t, `
---
@@ -1359,6 +1362,9 @@ func TestApplyAsGitOps(t *testing.T) {
ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
return []*fleet.VPPTokenDB{}, nil
}
+ ds.ExpandEmbeddedSecretsFunc = func(ctx context.Context, document string) (string, error) {
+ return document, nil
+ }
// Apply global config.
name := writeTmpYml(t, `---
diff --git a/cmd/fleetctl/gitops_test.go b/cmd/fleetctl/gitops_test.go
index 207dbe480a..93d85eff04 100644
--- a/cmd/fleetctl/gitops_test.go
+++ b/cmd/fleetctl/gitops_test.go
@@ -660,6 +660,10 @@ func TestGitOpsFullGlobal(t *testing.T) {
return []*fleet.ABMToken{}, nil
}
+ ds.ExpandEmbeddedSecretsFunc = func(ctx context.Context, document string) (string, error) {
+ return document, nil
+ }
+
const (
fleetServerURL = "https://fleet.example.com"
orgName = "GitOps Test"
@@ -861,6 +865,10 @@ func TestGitOpsFullTeam(t *testing.T) {
return nil
}
+ ds.ExpandEmbeddedSecretsFunc = func(ctx context.Context, document string) (string, error) {
+ return document, nil
+ }
+
// Queries
query := fleet.Query{}
query.ID = 1
@@ -2591,6 +2599,9 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
ds.SetSetupExperienceScriptFunc = func(ctx context.Context, script *fleet.Script) error {
return nil
}
+ ds.ExpandEmbeddedSecretsFunc = func(ctx context.Context, document string) (string, error) {
+ return document, nil
+ }
t.Setenv("FLEET_SERVER_URL", fleetServerURL)
t.Setenv("ORG_NAME", orgName)
diff --git a/cmd/fleetctl/mdm_test.go b/cmd/fleetctl/mdm_test.go
index 199c59e22c..dee29ff0ec 100644
--- a/cmd/fleetctl/mdm_test.go
+++ b/cmd/fleetctl/mdm_test.go
@@ -274,7 +274,7 @@ func TestMDMRunCommand(t *testing.T) {
return res, nil
}
- enqueuer.EnqueueCommandFunc = func(ctx context.Context, id []string, cmd *mdm.Command) (map[string]error, error) {
+ enqueuer.EnqueueCommandFunc = func(ctx context.Context, id []string, cmd *mdm.CommandWithSubtype) (map[string]error, error) {
return map[string]error{}, nil
}
diff --git a/cmd/osquery-perf/agent.go b/cmd/osquery-perf/agent.go
index 6b306da012..0671766fc2 100644
--- a/cmd/osquery-perf/agent.go
+++ b/cmd/osquery-perf/agent.go
@@ -514,8 +514,7 @@ type agent struct {
MDMCheckInInterval time.Duration
DiskEncryptionEnabled bool
- scheduledQueriesMu sync.Mutex // protects the below members
- scheduledQueryData map[string]scheduledQuery
+ scheduledQueryData *sync.Map
// bufferedResults contains result logs that are buffered when
// /api/v1/osquery/log requests to the Fleet server fail.
//
@@ -668,6 +667,7 @@ func newAgent(
disableFleetDesktop: disableFleetDesktop,
loggerTLSMaxLines: loggerTLSMaxLines,
bufferedResults: make(map[resultLog]int),
+ scheduledQueryData: new(sync.Map),
}
}
@@ -777,9 +777,19 @@ func (a *agent) runLoop(i int, onlyAlreadyEnrolled bool) {
// check if we have any scheduled queries that should be returning results
var results []resultLog
now := time.Now().Unix()
- a.scheduledQueriesMu.Lock()
prevCount := a.countBuffered()
- for queryName, query := range a.scheduledQueryData {
+
+ // NOTE The goroutine that pulls in new configurations
+ // MAY replace this map if it happens to run at the
+ // exact same time. The result would be. The result
+ // would be that the query lastRun does not get
+ // updated and cause the query to run more times than
+ // expected.
+ queryData := a.scheduledQueryData
+ queryData.Range(func(key, value any) bool {
+ queryName := key.(string)
+ query := value.(scheduledQuery)
+
if query.lastRun == 0 || now >= (query.lastRun+int64(query.ScheduleInterval)) {
results = append(results, resultLog{
packName: query.packName,
@@ -787,18 +797,18 @@ func (a *agent) runLoop(i int, onlyAlreadyEnrolled bool) {
numRows: int(query.numRows),
})
// Update lastRun
- v := a.scheduledQueryData[queryName]
- v.lastRun = now
- a.scheduledQueryData[queryName] = v
+ query.lastRun = now
+ queryData.Store(queryName, query)
}
- }
+
+ return true
+ })
if prevCount+len(results) < 1_000_000 { // osquery buffered_log_max is 1M
a.addToBuffer(results)
}
a.sendLogsBatch()
newBufferedCount := a.countBuffered() - prevCount
a.stats.UpdateBufferedLogs(newBufferedCount)
- a.scheduledQueriesMu.Unlock()
}
}
@@ -1518,7 +1528,16 @@ func (a *agent) config() error {
return fmt.Errorf("json parse at config: %w", err)
}
- scheduledQueryData := make(map[string]scheduledQuery)
+ existingLastRunData := make(map[string]int64)
+
+ a.scheduledQueryData.Range(func(key, value any) bool {
+ existingLastRunData[key.(string)] = value.(scheduledQuery).lastRun
+
+ return true
+ })
+
+ newScheduledQueryData := new(sync.Map)
+
for packName, pack := range parsedResp.Packs {
for queryName, query := range pack.Queries {
m, ok := query.(map[string]interface{})
@@ -1546,17 +1565,14 @@ func (a *agent) config() error {
q.Query = m["query"].(string)
scheduledQueryName := packName + "_" + queryName
- if existingEntry, ok := a.scheduledQueryData[scheduledQueryName]; ok {
- // Keep lastRun if the query is already scheduled.
- q.lastRun = existingEntry.lastRun
+ if lastRun, ok := existingLastRunData[scheduledQueryName]; ok {
+ q.lastRun = lastRun
}
- scheduledQueryData[scheduledQueryName] = q
+ newScheduledQueryData.Store(scheduledQueryName, q)
}
}
- a.scheduledQueriesMu.Lock()
- a.scheduledQueryData = scheduledQueryData
- a.scheduledQueriesMu.Unlock()
+ a.scheduledQueryData = newScheduledQueryData
return nil
}
@@ -1852,13 +1868,12 @@ func (a *agent) runPolicy(query string) []map[string]string {
}
func (a *agent) randomQueryStats() []map[string]string {
- a.scheduledQueriesMu.Lock()
- defer a.scheduledQueriesMu.Unlock()
-
var stats []map[string]string
- for scheduledQuery := range a.scheduledQueryData {
+ a.scheduledQueryData.Range(func(key, value any) bool {
+ queryName := key.(string)
+
stats = append(stats, map[string]string{
- "name": scheduledQuery,
+ "name": queryName,
"delimiter": "_",
"average_memory": fmt.Sprint(rand.Intn(200) + 10),
"denylisted": "false",
@@ -1871,7 +1886,9 @@ func (a *agent) randomQueryStats() []map[string]string {
"wall_time": fmt.Sprint(rand.Intn(4) + 1),
"wall_time_ms": fmt.Sprint(rand.Intn(4000) + 10),
})
- }
+
+ return true
+ })
return stats
}
diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md
index 2a4f3e18bb..f232bd675c 100644
--- a/docs/Configuration/yaml-files.md
+++ b/docs/Configuration/yaml-files.md
@@ -203,6 +203,7 @@ The `controls` section allows you to configure scripts and device management (MD
- `scripts` is a list of paths to macOS, Windows, or Linux scripts.
- `windows_enabled_and_configured` specifies whether or not to turn on Windows MDM features (default: `false`). Can only be configured for all teams (`default.yml`).
+- `windows_migration_enabled` specifies whether or not to automatically migrate Windows hosts connected to another MDM solution. If `false`, MDM is only turned on after hosts are unenrolled from your old MDM solution (default: `false`). Can only be configured for all teams (`default.yml`).
- `enable_disk_encryption` specifies whether or not to enforce disk encryption on macOS, Windows, and Linux hosts (default: `false`).
#### Example
@@ -214,6 +215,7 @@ controls:
- path: ../lib/windows-script.ps1
- path: ../lib/linux-script.sh
windows_enabled_and_configured: true
+ windows_migration_enabled: true # Available in Fleet Premium
enable_disk_encryption: true # Available in Fleet Premium
macos_updates: # Available in Fleet Premium
deadline: "2024-12-31"
diff --git a/docs/Contributing/Testing-and-local-development.md b/docs/Contributing/Testing-and-local-development.md
index 5592d460cd..24fdea7290 100644
--- a/docs/Contributing/Testing-and-local-development.md
+++ b/docs/Contributing/Testing-and-local-development.md
@@ -267,7 +267,11 @@ The Fleet repo includes tools to start testing osquery hosts. Please see the doc
To intercept sent emails while running a Fleet development environment, first, as an Admin in the Fleet UI, navigate to the Organization settings.
-Then, in the "SMTP options" section, enter any email address in the "Sender address" field, set the "SMTP server" to `localhost` on port `1025`, and set "Authentication type" to `None`. Note that you may use any active or inactive sender address.
+Then, in the "SMTP options" section, set:
+- "Sender address" to any email address. Note that you may use any active or inactive sender address.
+- "SMTP server" to `localhost` on port `1025`.
+- "Use SSL/TLS to connect (recommended)" to unchecked.
+- "Authentication type" to `None`.
Visit [localhost:8025](http://localhost:8025) to view MailHog's admin interface displaying all emails sent using the simulated mail server.
@@ -275,9 +279,11 @@ Visit [localhost:8025](http://localhost:8025) to view MailHog's admin interface
Alternatively, if you need to test a SMTP server with plain basic authentication enabled, set:
- "SMTP server" to `localhost` on port `1026`
-- "Authentication type" to `Plain`.
-- "SMTP username" to `mailpit-username`.
-- "SMTP password" to `mailpit-password`.
+- "Use SSL/TLS to connect (recommended)" to unchecked.
+- "Authentication type" to `Username and Password`
+- "SMTP username" to `mailpit-username`
+- "SMTP password" to `mailpit-password`
+- "Auth method" to `Plain`
- Note that you may use any active or inactive sender address.
Visit [localhost:8026](http://localhost:8026) to view Mailpit's admin interface displaying all emails sent using the simulated mail server.
diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md
index 4ad8cce17f..5843536ef5 100644
--- a/docs/REST API/rest-api.md
+++ b/docs/REST API/rest-api.md
@@ -6790,7 +6790,7 @@ _Available in Fleet Premium_
- [Add policy](#add-policy)
- [Remove policies](#remove-policies)
- [Edit policy](#edit-policy)
-- [Run automation for all failing hosts of a policy](#run-automation-for-all-failing-hosts-of-a-policy)
+- [Reset automations for all hosts failing policies](#reset-automations-for-all-hosts-failing-policies)
Policies are yes or no questions you can ask about your hosts.
@@ -7084,9 +7084,9 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th
}
```
-### Run automation for all failing hosts of a policy
+### Reset automations for all hosts failing policies
-Triggers [automations](https://fleetdm.com/docs/using-fleet/automations#policy-automations) for *all* hosts failing the specified policies, regardless of whether the policies were previously failing on those hosts.
+Resets [automation](https://fleetdm.com/docs/using-fleet/automations#policy-automations) status for *all* hosts failing the specified policies. On the next automation run, any failing host will be considered newly failing.
`POST /api/v1/fleet/automations/reset`
diff --git a/ee/bulk-operations-dashboard/api/controllers/software/edit-software.js b/ee/bulk-operations-dashboard/api/controllers/software/edit-software.js
index 1db0bd1c43..0e69202ee5 100644
--- a/ee/bulk-operations-dashboard/api/controllers/software/edit-software.js
+++ b/ee/bulk-operations-dashboard/api/controllers/software/edit-software.js
@@ -167,6 +167,7 @@ module.exports = {
Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
...form.getHeaders()
},
+ maxRedirects: 0
});
})()
.then(()=>{
@@ -261,6 +262,7 @@ module.exports = {
Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
...form.getHeaders()
},
+ maxRedirects: 0,
});
})()
.then(()=>{
diff --git a/ee/bulk-operations-dashboard/api/controllers/software/upload-software.js b/ee/bulk-operations-dashboard/api/controllers/software/upload-software.js
index 86022b50e6..95248be8c9 100644
--- a/ee/bulk-operations-dashboard/api/controllers/software/upload-software.js
+++ b/ee/bulk-operations-dashboard/api/controllers/software/upload-software.js
@@ -89,6 +89,7 @@ module.exports = {
Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
...form.getHeaders()
},
+ maxRedirects: 0
});
})()
.then(()=>{
diff --git a/ee/bulk-operations-dashboard/entrypoint.sh b/ee/bulk-operations-dashboard/entrypoint.sh
index bbec7ef5da..62c3385610 100644
--- a/ee/bulk-operations-dashboard/entrypoint.sh
+++ b/ee/bulk-operations-dashboard/entrypoint.sh
@@ -12,10 +12,12 @@ elif [ -z "$sails_custom__fleetApiToken" ]; then
fi
# Check if the vulnerability dashboard has been initialized before
-if [ ! -f "/usr/src/app/.initialized" ]; then
+if [ ! -f "/usr/src/app/initialized" ]; then
# if it hasn't, lift the app with in console mode with the --drop flag to create our databsae tables.
echo '.exit' | node ./node_modules/sails/bin/sails console --drop
+ touch /usr/src/app/initialized
+
fi
# Start the dashboard
diff --git a/ee/server/service/maintained_apps.go b/ee/server/service/maintained_apps.go
index 4f4269944e..f459d098cb 100644
--- a/ee/server/service/maintained_apps.go
+++ b/ee/server/service/maintained_apps.go
@@ -43,6 +43,10 @@ func (svc *Service) AddFleetMaintainedApp(
return 0, ctxerr.Wrap(ctx, err, "validating software labels")
}
+ if err := svc.ds.ValidateEmbeddedSecrets(ctx, []string{installScript, postInstallScript, uninstallScript}); err != nil {
+ return 0, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("script", err.Error()))
+ }
+
app, err := svc.ds.GetMaintainedAppByID(ctx, appID)
if err != nil {
return 0, ctxerr.Wrap(ctx, err, "getting maintained app by id")
diff --git a/ee/server/service/software_installers.go b/ee/server/service/software_installers.go
index ca9bf5b12f..1773770fad 100644
--- a/ee/server/service/software_installers.go
+++ b/ee/server/service/software_installers.go
@@ -71,6 +71,10 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
// Update $PACKAGE_ID in uninstall script
preProcessUninstallScript(payload)
+ if err := svc.ds.ValidateEmbeddedSecrets(ctx, []string{payload.InstallScript, payload.PostInstallScript, payload.UninstallScript}); err != nil {
+ return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("script", err.Error()))
+ }
+
installerID, titleID, err := svc.ds.MatchOrCreateSoftwareInstaller(ctx, payload)
if err != nil {
return ctxerr.Wrap(ctx, err, "matching or creating software installer")
@@ -190,6 +194,22 @@ func (svc *Service) UpdateSoftwareInstaller(ctx context.Context, payload *fleet.
teamName = &t.Name
}
+ var scripts []string
+
+ if payload.InstallScript != nil {
+ scripts = append(scripts, *payload.InstallScript)
+ }
+ if payload.PostInstallScript != nil {
+ scripts = append(scripts, *payload.PostInstallScript)
+ }
+ if payload.UninstallScript != nil {
+ scripts = append(scripts, *payload.UninstallScript)
+ }
+
+ if err := svc.ds.ValidateEmbeddedSecrets(ctx, scripts); err != nil {
+ return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("script", err.Error()))
+ }
+
// get software by ID, fail if it does not exist or does not have an existing installer
software, err := svc.ds.SoftwareTitleByID(ctx, payload.TitleID, payload.TeamID, fleet.TeamFilter{
User: vc.User,
@@ -1292,12 +1312,14 @@ func (svc *Service) BatchSetSoftwareInstallers(
return "", ctxerr.Wrap(ctx, err, "validating authorization")
}
+ var allScripts []string
+
// Verify payloads first, to prevent starting the download+upload process if the data is invalid.
for _, payload := range payloads {
if len(payload.URL) > fleet.SoftwareInstallerURLMaxLength {
return "", fleet.NewInvalidArgumentError(
"software.url",
- "software URL is too long, must be less than 256 characters",
+ fmt.Sprintf("software URL is too long, must be %d characters or less", fleet.SoftwareInstallerURLMaxLength),
)
}
if _, err := url.ParseRequestURI(payload.URL); err != nil {
@@ -1311,6 +1333,12 @@ func (svc *Service) BatchSetSoftwareInstallers(
return "", err
}
payload.ValidatedLabels = validatedLabels
+
+ allScripts = append(allScripts, payload.InstallScript, payload.PostInstallScript, payload.UninstallScript)
+ }
+
+ if err := svc.ds.ValidateEmbeddedSecrets(ctx, allScripts); err != nil {
+ return "", ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("script", err.Error()))
}
// keyExpireTime is the current maximum time supported for retrieving
diff --git a/frontend/components/AvatarTopNav/AvatarTopNav.tsx b/frontend/components/AvatarTopNav/AvatarTopNav.tsx
index bcbfa3ff3a..47b3a2a10f 100644
--- a/frontend/components/AvatarTopNav/AvatarTopNav.tsx
+++ b/frontend/components/AvatarTopNav/AvatarTopNav.tsx
@@ -39,6 +39,7 @@ const Avatar = ({ className, size, user }: IAvatarInterface): JSX.Element => {
src={gravatar_url_dark || DEFAULT_GRAVATAR_LINK_DARK}
onError={onError}
onLoad={onLoad}
+ data-testid="user-avatar"
/>
);
diff --git a/frontend/components/AvatarTopNav/_styles.scss b/frontend/components/AvatarTopNav/_styles.scss
index b4cbb6e6bb..04d71e5cc2 100644
--- a/frontend/components/AvatarTopNav/_styles.scss
+++ b/frontend/components/AvatarTopNav/_styles.scss
@@ -1,5 +1,4 @@
.avatar-wrapper-top-nav {
- margin-right: 8px;
svg {
display: block;
}
diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tests.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tests.tsx
index 5ef627eea7..d1308b0aa8 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tests.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tests.tsx
@@ -37,18 +37,29 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/settings/i)).toBeInTheDocument();
- expect(screen.getByText(/manage users/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /settings/i })
+ ).toBeInTheDocument();
+
+ expect(
+ screen.getByRole("menuitem", { name: /manage users/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
});
it("renders correct navigation for free global maintainer", async () => {
const render = createCustomRenderer({
@@ -73,16 +84,22 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
expect(screen.queryByText(/manage users/i)).not.toBeInTheDocument();
@@ -109,15 +126,21 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/controls/i)).not.toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
@@ -143,18 +166,28 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/settings/i)).toBeInTheDocument();
- expect(screen.getByText(/manage users/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /settings/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /manage users/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
});
it("renders correct navigation for premium global maintainer", async () => {
const render = createCustomRenderer({
@@ -179,16 +212,22 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
expect(screen.queryByText(/manage users/i)).not.toBeInTheDocument();
@@ -215,15 +254,21 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/controls/i)).not.toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
@@ -252,17 +297,25 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/settings/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /settings/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/manage users/i)).not.toBeInTheDocument();
});
@@ -289,16 +342,22 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/controls/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
expect(screen.queryByText(/manage users/i)).not.toBeInTheDocument();
@@ -325,15 +384,22 @@ describe("SiteTopNav - component", () => {
/>
);
- await user.click(screen.getByTestId("user-menu"));
+ await user.click(screen.getByTestId("user-avatar"));
expect(screen.getByText(/hosts/i)).toBeInTheDocument();
expect(screen.getByText(/software/i)).toBeInTheDocument();
expect(screen.getByText(/queries/i)).toBeInTheDocument();
expect(screen.getByText(/policies/i)).toBeInTheDocument();
- expect(screen.getByText(/my account/i)).toBeInTheDocument();
- expect(screen.getByText(/documentation/i)).toBeInTheDocument();
- expect(screen.getByText(/sign out/i)).toBeInTheDocument();
+
+ expect(
+ screen.getByRole("menuitem", { name: /my account/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /documentation/i })
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /sign out/i })
+ ).toBeInTheDocument();
expect(screen.queryByText(/controls/i)).not.toBeInTheDocument();
expect(screen.queryByText(/settings/i)).not.toBeInTheDocument();
diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index 2f0f0d3b1f..c1fc399914 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -9,10 +9,10 @@ import { IUser } from "interfaces/user";
import { QueryParams } from "utilities/url";
import LinkWithContext from "components/LinkWithContext";
-import UserMenu from "components/top_nav/UserMenu";
// @ts-ignore
import OrgLogoIcon from "components/icons/OrgLogoIcon";
+import UserMenu from "../UserMenu";
import getNavItems, { INavItem } from "./navItems";
interface ISiteTopNavProps {
diff --git a/frontend/components/top_nav/UserMenu/UserMenu.tsx b/frontend/components/top_nav/UserMenu/UserMenu.tsx
index b1228abc25..4a07f1b482 100644
--- a/frontend/components/top_nav/UserMenu/UserMenu.tsx
+++ b/frontend/components/top_nav/UserMenu/UserMenu.tsx
@@ -1,12 +1,22 @@
-import React from "react";
+import React, { useEffect, useState } from "react";
+import { keyframes } from "@emotion/react";
+import Select, {
+ StylesConfig,
+ DropdownIndicatorProps,
+ OptionProps,
+ components,
+ GroupBase,
+} from "react-select-5";
import { IUser } from "interfaces/user";
import { ITeam } from "interfaces/team";
+import { IDropdownOption } from "interfaces/dropdownOption";
+import PATHS from "router/paths";
import { getSortedTeamOptions } from "utilities/helpers";
-import PATHS from "router/paths";
+import { PADDING } from "styles/var/padding";
+import { COLORS } from "styles/var/colors";
-// @ts-ignore
-import DropdownButton from "components/buttons/DropdownButton";
+import Icon from "components/Icon";
import AvatarTopNav from "../../AvatarTopNav";
const baseClass = "user-menu";
@@ -19,6 +29,61 @@ interface IUserMenuProps {
currentUser: IUser;
}
+const bounceDownAnimation = keyframes`
+ 0%, 100% {
+ transform: translateY(0);
+ }
+ 50% {
+ transform: translateY(3px);
+ }
+`;
+
+const getOptionBackgroundColor = (state: any) => {
+ return state.isFocused ? COLORS["ui-vibrant-blue-10"] : "transparent";
+};
+
+const CustomDropdownIndicator = (
+ props: DropdownIndicatorProps<
+ IDropdownOption,
+ false,
+ GroupBase
+ >
+) => {
+ return (
+
+
+
+ );
+};
+
+const CustomOption: React.FC<
+ OptionProps & { isKeyboardFocus: boolean }
+> = (props) => {
+ const { innerRef, data, isFocused, isKeyboardFocus } = props;
+
+ return (
+
+
+ {data.label}
+
+
+ );
+};
+
const UserMenu = ({
onLogout,
onUserMenuItemClick,
@@ -26,28 +91,55 @@ const UserMenu = ({
isGlobalAdmin,
currentUser,
}: IUserMenuProps): JSX.Element => {
- const accountNavigate = onUserMenuItemClick(PATHS.ACCOUNT);
+ // Work around for react-select-5 not having :focus-visible pseudo class that can style dropdown on keyboard tab only
+ // Work around preventing react-select-5 from auto focusing first option unless using keyboard
+ const [isKeyboardFocus, setIsKeyboardFocus] = useState(false);
+
+ useEffect(() => {
+ const handleKeyDown = (e: KeyboardEvent) => {
+ if (e.key === "Tab") {
+ setIsKeyboardFocus(true);
+ }
+ };
+
+ const handleMouseDown = () => {
+ setIsKeyboardFocus(false);
+ };
+
+ document.addEventListener("keydown", handleKeyDown);
+ document.addEventListener("mousedown", handleMouseDown);
+
+ return () => {
+ document.removeEventListener("keydown", handleKeyDown);
+ document.removeEventListener("mousedown", handleMouseDown);
+ };
+ }, []);
+
const dropdownItems = [
{
label: "My account",
- onClick: accountNavigate,
+ value: "my-account",
+ onClick: () => onUserMenuItemClick(PATHS.ACCOUNT),
},
{
label: "Documentation",
- onClick: () => window.open("https://fleetdm.com/docs", "_blank"),
+ value: "documentation",
+ onClick: () => {
+ window.open("https://fleetdm.com/docs", "_blank");
+ },
},
{
label: "Sign out",
+ value: "sign-out",
onClick: onLogout,
},
];
if (isGlobalAdmin) {
- const manageUsersNavigate = onUserMenuItemClick(PATHS.ADMIN_USERS);
-
const manageUserNavItem = {
label: "Manage users",
- onClick: manageUsersNavigate,
+ value: "manage-users",
+ onClick: () => onUserMenuItemClick(PATHS.ADMIN_USERS),
};
dropdownItems.unshift(manageUserNavItem);
}
@@ -61,24 +153,129 @@ const UserMenu = ({
currentUser.global_role === "admin"
? PATHS.ADMIN_ORGANIZATION
: `${PATHS.TEAM_DETAILS_USERS(sortedTeams[0].value)}`;
- const settingsNavigate = onUserMenuItemClick(settingsPath);
const adminNavItem = {
label: "Settings",
- onClick: settingsNavigate,
+ value: "settings",
+ onClick: () => onUserMenuItemClick(settingsPath),
};
dropdownItems.unshift(adminNavItem);
}
+ const customStyles: StylesConfig = {
+ control: (provided, state) => ({
+ ...provided,
+ display: "flex",
+ flexDirection: "row",
+ width: "max-content",
+ padding: "8px",
+ marginRight: "8px",
+ backgroundColor: "initial",
+ border: "2px solid transparent", // So tabbing doesn't shift dropdown
+ borderRadius: "6px",
+ boxShadow: "none",
+ cursor: "pointer",
+ "&:hover": {
+ boxShadow: "none",
+ ".user-menu-select__indicator svg": {
+ animation: `${bounceDownAnimation} 0.3s ease-in-out`,
+ },
+ },
+ ...(state.isFocused &&
+ isKeyboardFocus && {
+ border: `2px solid ${COLORS["ui-blue-25"]}`,
+ }),
+ ...(state.menuIsOpen && {
+ ".user-menu-select__indicator svg": {
+ transform: "rotate(180deg)",
+ },
+ }),
+ }),
+ dropdownIndicator: (provided) => ({
+ ...provided,
+ display: "flex",
+ padding: "6px",
+ svg: {
+ transition: "transform 0.25s ease",
+ },
+ }),
+ menu: (provided) => ({
+ ...provided,
+ boxShadow: "0 2px 6px rgba(0, 0, 0, 0.1)",
+ borderRadius: "4px",
+ zIndex: 6,
+ marginTop: "7px",
+ marginRight: "8px",
+ width: "auto",
+ minWidth: "100%",
+ position: "absolute",
+ left: "auto",
+ right: "0",
+ animation: "fade-in 150ms ease-out",
+ }),
+ menuList: (provided) => ({
+ ...provided,
+ padding: PADDING["pad-small"],
+ maxHeight: "initial", // Override react-select default height of 300px
+ }),
+ valueContainer: (provided) => ({
+ ...provided,
+ padding: 0,
+ }),
+ option: (provided, state) => ({
+ ...provided,
+ padding: "10px 8px",
+ fontSize: "15px",
+ backgroundColor: getOptionBackgroundColor(state),
+ color: COLORS["tooltip-bg"], // TODO: Why the mismatch in names in colors.scss and colors.ts
+ whiteSpace: "nowrap",
+ "&:hover": {
+ backgroundColor: COLORS["ui-vibrant-blue-10"],
+ },
+ "&:active": {
+ backgroundColor: COLORS["ui-vibrant-blue-10"],
+ },
+ "&:last-child, &:nth-last-of-type(2)": {
+ borderTop: `1px solid ${COLORS["ui-fleet-black-10"]}`,
+ },
+ }),
+ };
+
+ const renderPlaceholder = () => {
+ return (
+
+ );
+ };
+
return (
-
-
-
+
+ options={dropdownItems}
+ placeholder={renderPlaceholder()}
+ styles={customStyles}
+ components={{
+ DropdownIndicator: CustomDropdownIndicator,
+ IndicatorSeparator: () => null,
+ Option: (props) => (
+
+ ),
+ SingleValue: () => null,
+ }}
+ controlShouldRenderValue={false}
+ isOptionSelected={() => false}
+ className={baseClass}
+ classNamePrefix={`${baseClass}-select`}
+ menuPlacement="bottom"
+ onChange={(option) => {
+ option?.onClick && option?.onClick();
+ }}
+ isSearchable={false}
+ />
list(object({
name = string
arn_suffix = string
target_group_name = string
target_group_arn_suffix = string
min_containers = optional(string, 1)
ecs_service_name = string
alert_thresholds = optional(
object({
HTTPCode_ELB_5XX_Count = object({
period = number
threshold = number
})
HTTPCode_Target_5XX_Count = object({
period = number
threshold = number
})
}),
{
HTTPCode_ELB_5XX_Count = {
period = 120
threshold = 0
},
HTTPCode_Target_5XX_Count = {
period = 120
threshold = 0
}
}
)
})) | `[]` | no |
-| [cron\_monitoring](#input\_cron\_monitoring) | n/a | object({
mysql_host = string
mysql_database = string
mysql_user = string
mysql_password_secret_name = string
vpc_id = string
subnet_ids = list(string)
rds_security_group_id = string
delay_tolerance = string
run_interval = string
log_retention_in_days = optional(number, 7)
}) | `null` | no |
+| [albs](#input\_albs) | n/a | list(object({
name = string
arn_suffix = string
target_group_name = string
target_group_arn_suffix = string
min_containers = optional(string, 1)
ecs_service_name = string
alert_thresholds = optional(
object({
HTTPCode_ELB_5XX_Count = object({
period = number
threshold = number
})
HTTPCode_Target_5XX_Count = object({
period = number
threshold = number
})
}),
{
HTTPCode_ELB_5XX_Count = {
period = 120
threshold = 0
},
HTTPCode_Target_5XX_Count = {
period = 120
threshold = 0
}
}
)
})) | `[]` | no |
+| [cron\_monitoring](#input\_cron\_monitoring) | n/a | object({
mysql_host = string
mysql_database = string
mysql_user = string
mysql_password_secret_name = string
vpc_id = string
subnet_ids = list(string)
rds_security_group_id = string
delay_tolerance = string
run_interval = string
log_retention_in_days = optional(number, 7)
}) | `null` | no |
| [customer\_prefix](#input\_customer\_prefix) | n/a | `string` | `"fleet"` | no |
| [default\_sns\_topic\_arns](#input\_default\_sns\_topic\_arns) | n/a | `list(string)` | `[]` | no |
| [fleet\_ecs\_service\_name](#input\_fleet\_ecs\_service\_name) | n/a | `string` | `null` | no |
diff --git a/terraform/addons/monitoring/lambda/main.go b/terraform/addons/monitoring/lambda/main.go
index eb56e0123b..2e44c1a198 100644
--- a/terraform/addons/monitoring/lambda/main.go
+++ b/terraform/addons/monitoring/lambda/main.go
@@ -24,6 +24,7 @@ import (
"database/sql"
"fmt"
"log"
+ "strconv"
"strings"
"time"
@@ -37,27 +38,41 @@ import (
flags "github.com/jessevdk/go-flags"
)
-type NullEvent struct{}
+type (
+ NullEvent struct{}
+ SNSTopicArnsMap map[string]string
+)
type OptionsStruct struct {
- LambdaRuntimeAPI string `long:"lambda-runtime-api" env:"AWS_LAMBDA_RUNTIME_API"`
- SNSTopicArns string `long:"sns-topic-arn" env:"SNS_TOPIC_ARNS" required:"true"`
- MySQLHost string `long:"mysql-host" env:"MYSQL_HOST" required:"true"`
- MySQLUser string `long:"mysql-user" env:"MYSQL_USER" required:"true"`
- MySQLSMSecret string `long:"mysql-secretsmanager-secret" env:"MYSQL_SECRETSMANAGER_SECRET" required:"true"`
- MySQLDatabase string `long:"mysql-database" env:"MYSQL_DATABASE" required:"true"`
- FleetEnv string `long:"fleet-environment" env:"FLEET_ENV" required:"true"`
- AWSRegion string `long:"aws-region" env:"AWS_REGION" required:"true"`
- CronDelayTolerance string `long:"cron-delay-tolerance" env:"CRON_DELAY_TOLERANCE" default:"2h"`
+ LambdaRuntimeAPI string `long:"lambda-runtime-api" env:"AWS_LAMBDA_RUNTIME_API"`
+ SNSCronSystemTopicArns string `long:"sns-cron-system-topic-arn" env:"CRON_SYSTEM_MONITOR_SNS_TOPIC_ARNS" required:"true"`
+ SNSCronJobFailureTopicArns string `long:"sns-cron-job-failure-topic-arn" env:"CRON_JOB_FAILURE_MONITOR_SNS_TOPIC_ARNS"`
+ MySQLHost string `long:"mysql-host" env:"MYSQL_HOST" required:"true"`
+ MySQLUser string `long:"mysql-user" env:"MYSQL_USER" required:"true"`
+ MySQLSMSecret string `long:"mysql-secretsmanager-secret" env:"MYSQL_SECRETSMANAGER_SECRET" required:"true"`
+ MySQLDatabase string `long:"mysql-database" env:"MYSQL_DATABASE" required:"true"`
+ FleetEnv string `long:"fleet-environment" env:"FLEET_ENV" required:"true"`
+ AWSRegion string `long:"aws-region" env:"AWS_REGION" required:"true"`
+ CronDelayTolerance string `long:"cron-delay-tolerance" env:"CRON_DELAY_TOLERANCE" default:"2h"`
+ CronMonitorInterval string `long:"monitor-run-interval" env:"CRON_MONITOR_RUN_INTERVAL" default:"1 hour"`
}
-var options = OptionsStruct{}
+var (
+ options = OptionsStruct{}
+ snsTopics = make(SNSTopicArnsMap)
+)
+
+func sendSNSMessage(msg string, topic string, sess *session.Session) {
+ topicArns, ok := snsTopics[topic]
+ if !ok {
+ log.Printf("No SNS topic ARNs available for topic '%s'", topic)
+ return
+ }
-func sendSNSMessage(msg string, sess *session.Session) {
log.Printf("Sending SNS Message")
fullMsg := fmt.Sprintf("Environment: %s\nMessage: %s", options.FleetEnv, msg)
svc := sns.New(sess)
- for _, SNSTopicArn := range strings.Split(options.SNSTopicArns, ",") {
+ for _, SNSTopicArn := range strings.Split(topicArns, ",") {
log.Printf("Sending '%s' to '%s'", fullMsg, SNSTopicArn)
result, err := svc.Publish(&sns.PublishInput{
Message: &fullMsg,
@@ -70,21 +85,50 @@ func sendSNSMessage(msg string, sess *session.Session) {
}
}
-func checkDB(sess *session.Session) (err error) {
+func parseLambdaIntervalToDuration(intervalString string) (duration time.Duration, err error) {
+ var number int
+ var unit string
+
+ _, err = fmt.Sscanf(intervalString, "%d %s", &number, &unit)
+ if err != nil {
+ return 0, err
+ }
+
+ switch unit {
+ case "hour", "hours":
+ unit = "h"
+ case "minute", "minutes":
+ unit = "m"
+ case "day", "days":
+ unit = "h"
+ number *= 24
+ }
+
+ return time.ParseDuration(strconv.Itoa(number) + unit)
+}
+
+type CronStatsRow struct {
+ name string
+ status string
+ errors string
+ created_at time.Time
+ updated_at time.Time
+}
+
+func setupDB(sess *session.Session) (db *sql.DB, err error) {
secretCache, err := secretcache.New()
if err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to initialise SecretsManager helper. Cron status is unknown.", sess)
- return err
+ sendSNSMessage("Unable to initialise SecretsManager helper. Cron status is unknown.", "cronSystem", sess)
+ return db, err
}
secretCache.Client = secretsmanager.New(sess)
-
MySQLPassword, err := secretCache.GetSecretString(options.MySQLSMSecret)
if err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to retrieve SecretsManager secret. Cron status is unknown.", sess)
- return err
+ sendSNSMessage("Unable to retrieve SecretsManager secret. Cron status is unknown.", "cronSystem", sess)
+ return db, err
}
cfg := mysql.Config{
@@ -97,38 +141,36 @@ func checkDB(sess *session.Session) (err error) {
ParseTime: true,
}
- db, err := sql.Open("mysql", cfg.FormatDSN())
- defer db.Close()
+ db, err = sql.Open("mysql", cfg.FormatDSN())
if err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to connect to database. Cron status unknown.", sess)
- return err
+ sendSNSMessage("Unable to connect to database. Cron status unknown.", "cronSystem", sess)
+ return db, err
}
if err = db.Ping(); err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to connect to database. Cron status unknown.", sess)
- return err
+ sendSNSMessage("Unable to connect to database. Cron status unknown.", "cronSystem", sess)
+ return db, err
}
log.Printf("Connected to database!")
- type CronStatsRow struct {
- name string
- status string
- updated_at time.Time
- }
+ return db, err
+}
+// Check that the cron stats table is reachable, and that no cron jobs have been stuck for > 1 run time.
+func checkDB(db *sql.DB, sess *session.Session) (err error) {
rows, err := db.Query("SELECT b.name,IFNULL(status, 'missing cron'),IFNULL(updated_at, FROM_UNIXTIME(0)) AS updated_at FROM (SELECT 'vulnerabilities' AS name UNION ALL SELECT 'cleanups_then_aggregation') b LEFT JOIN (SELECT name, status, updated_at FROM cron_stats WHERE id IN (SELECT MAX(id) FROM cron_stats WHERE status = 'completed' GROUP BY name)) a ON a.name = b.name;")
defer rows.Close()
if err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to SELECT cron_stats table. Unable to continue.", sess)
+ sendSNSMessage("Unable to SELECT cron_stats table. Unable to continue.", "cronSystem", sess)
return err
}
cronDelayDuration, err := time.ParseDuration(options.CronDelayTolerance)
if err != nil {
log.Printf(err.Error())
- sendSNSMessage("Unable to parse cron-delay-tolerance. Check lambda settings.", sess)
+ sendSNSMessage("Unable to parse cron-delay-tolerance. Check lambda settings.", "cronSystem", sess)
return err
}
cronAlertTimestamp := time.Now().Add(-1 * cronDelayDuration)
@@ -136,14 +178,14 @@ func checkDB(sess *session.Session) (err error) {
var row CronStatsRow
if err := rows.Scan(&row.name, &row.status, &row.updated_at); err != nil {
log.Printf(err.Error())
- sendSNSMessage("Error scanning row in cron_stats table. Unable to continue.", sess)
+ sendSNSMessage("Error scanning row in cron_stats table. Unable to continue.", "cronSystem", sess)
return err
}
log.Printf("Row %s last updated at %s", row.name, row.updated_at.String())
if row.updated_at.Before(cronAlertTimestamp) {
log.Printf("*** %s hasn't updated in more than %s, alerting! (status %s)", options.CronDelayTolerance, row.name, row.status)
// Fire on the first match and return. We only need to alert that the crons need looked at, not each cron.
- sendSNSMessage(fmt.Sprintf("Fleet cron '%s' hasn't updated in more than %s. Last status was '%s' at %s.", row.name, options.CronDelayTolerance, row.status, row.updated_at.String()), sess)
+ sendSNSMessage(fmt.Sprintf("Fleet cron '%s' hasn't updated in more than %s. Last status was '%s' at %s.", row.name, options.CronDelayTolerance, row.status, row.updated_at.String()), "cronSystem", sess)
return nil
}
}
@@ -151,6 +193,39 @@ func checkDB(sess *session.Session) (err error) {
return nil
}
+// Check for errors in cron runs.
+func checkCrons(db *sql.DB, sess *session.Session) (err error) {
+ cronMonitorInterval, err := parseLambdaIntervalToDuration(options.CronMonitorInterval)
+ if err != nil {
+ log.Printf(err.Error())
+ sendSNSMessage("Unable to parse cron-delay-tolerance. Check lambda settings.", "cronSystem", sess)
+ return err
+ }
+ cronAlertTimestamp := time.Now().Add(-1 * cronMonitorInterval)
+
+ // Find all cron entries less than cronMonitorInterval old that have errors.
+ rows, err := db.Query("SELECT name, created_at, IFNULL(updated_at, FROM_UNIXTIME(0)) AS updated_at, errors FROM cron_stats WHERE errors IS NOT NULL AND created_at > \"" + cronAlertTimestamp.Format("20060102150405") + "\"")
+ defer rows.Close()
+ if err != nil {
+ log.Printf(err.Error())
+ sendSNSMessage("Unable to SELECT cron_stats table. Unable to continue.", "cronSystem", sess)
+ return err
+ }
+ for rows.Next() {
+ var row CronStatsRow
+ if err := rows.Scan(&row.name, &row.created_at, &row.updated_at, &row.errors); err != nil {
+ log.Printf(err.Error())
+ sendSNSMessage("Error scanning row in cron_stats table. Unable to continue.", "cronSystem", sess)
+ return err
+ }
+ log.Printf("*** %s job had errors, alerting! (errors %s)", row.name, row.errors)
+ // Fire on the first match and return. We only need to alert that the crons need looked at, not each cron.
+ sendSNSMessage(fmt.Sprintf("Fleet cron '%s' (last updated %s) raised errors during its run:\n%s.", row.name, row.updated_at.String(), row.errors), "cronJobFailure", sess)
+ }
+
+ return nil
+}
+
func handler(ctx context.Context, name NullEvent) error {
sess := session.Must(session.NewSessionWithOptions(
session.Options{
@@ -161,7 +236,15 @@ func handler(ctx context.Context, name NullEvent) error {
},
))
- checkDB(sess)
+ db, err := setupDB(sess)
+ defer db.Close()
+
+ if err != nil {
+ return nil
+ }
+
+ checkDB(db, sess)
+ checkCrons(db, sess)
return nil
}
@@ -178,6 +261,14 @@ func main() {
}
}
+ snsTopics["cronSystem"] = options.SNSCronSystemTopicArns
+ snsTopics["cronJobFailure"] = options.SNSCronJobFailureTopicArns
+ // For backwards compatibility, fall back to sending cron failure alerts
+ // to the same SNS topic as cron system alerts.s
+ if snsTopics["cronJobFailure"] == "" {
+ snsTopics["cronJobFailure"] = options.SNSCronSystemTopicArns
+ }
+
// When running from Lambda, this should be read from the environment.
if options.LambdaRuntimeAPI != "" {
log.Printf("Starting Lambda handler.")
diff --git a/terraform/addons/monitoring/main.tf b/terraform/addons/monitoring/main.tf
index 1bea5dbfcf..57a3cb5ae3 100644
--- a/terraform/addons/monitoring/main.tf
+++ b/terraform/addons/monitoring/main.tf
@@ -376,9 +376,11 @@ resource "aws_lambda_function" "cron_monitoring" {
MYSQL_DATABASE = var.cron_monitoring.mysql_database
MYSQL_USER = var.cron_monitoring.mysql_user
MYSQL_SECRETSMANAGER_SECRET = data.aws_secretsmanager_secret.mysql_database_password[0].name
- SNS_TOPIC_ARNS = join(",", lookup(var.sns_topic_arns_map, "cron_monitoring", var.default_sns_topic_arns))
+ CRON_SYSTEM_MONITOR_SNS_TOPIC_ARNS = join(",", lookup(var.sns_topic_arns_map, "cron_monitoring", var.default_sns_topic_arns))
+ CRON_JOB_FAILURE_MONITOR_SNS_TOPIC_ARNS = join(",", lookup(var.sns_topic_arns_map, "cron_job_failure_monitoring", var.default_sns_topic_arns))
FLEET_ENV = var.customer_prefix
CRON_DELAY_TOLERANCE = var.cron_monitoring.delay_tolerance
+ CRON_MONITOR_RUN_INTERVAL = var.cron_monitoring.run_interval
}
}
|