Eric
f19cc81772
Closes: https://github.com/fleetdm/fleet/issues/41799 Changes: - Added support for a new required meta tag for anonymous case study articles: `cardTitleForCustomersPage`. The value of this meta tag is used as the title of the automatically generated card link for the article on the /customers page. - Added support for a new meta tag for anonymous case study articles: `cardBodyForCustomersPage`. If provided, the card link for the article will use this value for the body text, if not provided, the card link will display the `articleTitle` meta tag value. - Updated the /customers page to automatically create card links for case study articles that have `useBasicArticleTemplate` and `cardTitleForCustomersPage` meta tags.
4.8 KiB
Deploy Santa with Fleet GitOps and skip the sync server
Links to article series:
- Part 1: Deploy Santa with Fleet GitOps and skip the sync server
- Part 2: How we deployed Santa at Fleet
Santa is a binary authorization system for macOS. It has become important to organizations that are serious about application blocking and control. However, the traditional Santa deployment model comes with operational overhead at scale, primarily centered around the need for a dedicated Santa sync server.
In the conventional setup, Santa requires a custom sync server to:
- Distribute allow / deny rules across your fleet
- Collect execution events and blocked binary reports
- Manage configuration changes and rule updates
At the time of this writing, there are currently three off-the-shelf sync server solutions available:
- Moroz - A golang server that serves hardcoded rules from simple configuration files.
- Rudolph - An AWS-based serverless sync service built on API GW, DynamoDB, and Lambda components.
- Zentral - An event hub to gather, process, and monitor system events and link them to an inventory.
Running any of these solutions may incur additional infrastructure costs and upkeep. You also might have to adopt an unfamiliar configuration language specific to the solution.
But, what if you could get all the benefits and functionality of a sync server using your existing device management solution?
Enter Fleet + GitOps + Santa
The combination of Fleet's device management platform, GitOps principles, and Santa's binary authorization creates a powerful alternative that eliminates the need for a traditional Santa sync server entirely.
How Fleet replaces the Santa sync server
Fleet acts as a modern, API-driven replacement for traditional Santa sync servers by using:
Configuration as code management
Fleet's GitOps workflow allows you to manage Santa configurations stored in git repositories. Instead of hosting sync server infrastructure, you define Santa rules and configurations declaratively through familiar XML .mobileconfig files on macOS.
Automated rule distribution
Fleet's agent (fleetd) and Apple MDM automatically apply Santa configurations across your macOS devices. Changes pushed to your git repository trigger automatic deployment through Fleet's GitOps pipeline.
Event collection and monitoring
Fleet's osquery integration captures Santa events, eliminating the need for custom event collection endpoints.
Implementation overview
Here is how the Fleet + GitOps + Santa workflow operates in practice:
- Configuration Definition: Security and IT teams define Santa rules in files within a Git repository.
- Change Management: Rule updates go through standard pull request review processes.
- Automated Deployment: Fleet GitOps detects changes and applies configurations.
- Real-time Monitoring:
osquerytables provide visibility into Santa events. - Incident Response: Fleet's Reports and Policy queries trigger automated workflows for investigation or remediation.
The bottom line
Fleet believes in reducing complexity. Fleet's GitOps-native approach integrates the functionality of a custom Santa sync server with Fleet's enterprise device management capabilities. Operations and change management are simplified. Infrastructure maintenance is reduced. It's a more scalable and secure approach to binary authorization that aligns with modern infrastructure practices.
Ready to build your Santa deployment? Fleet's open-source platform makes it easier than ever.
Stay tuned into the progress and discussion on a native Santa + Fleet integration currently in design by viewing this Fleet feature request on GitHub
Fleet is an open-source device management platform that provides GitOps-native configuration management, comprehensive device visibility, and enterprise-grade security for organizations managing thousands of endpoints.
The next article in this series is a step-by-step guide showing how we implemented this deployment model for Santa internally at Fleet.