George Karr
af51636bda
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/` Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect dependencies in the four `tools/` Go modules to clear 39 high-severity code-scanning (SCA) alerts on `main`. Target versions match the root Fleet module. | Module | x/net | x/crypto | | --- | --- | --- | | `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** | | `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** | | `tools/github-manage` | v0.38.0 → **v0.55.0** | — | CVEs cleared: - **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502 - **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832, -39835, -42508, -46595, -46597 All four modules `go mod verify` clean and build. Dependency-only change to internal dev tooling — no product code, no user-visible behavior. > The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard > "Binary-Artifacts" findings for embedded dibble seed installers; those are > tracked separately and not addressed here. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated several bundled Go dependencies across internal tooling to newer versions. * This includes refreshes to common networking, cryptography, text, and system packages, plus one added telemetry-related dependency. * No user-facing features or behavior changes were introduced. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Terraform Provider for fleets
This is a Terraform provider for managing fleets (formally "teams"). When you have 100+ fleets, and manually managing them is not feasible. The primary setting of concern is the fleet's "agent options" which consists of some settings and command line flags. These (potentially dangerously) configure FleetDM all machines.
Usage
All the interesting commands are in the Makefile. If you just want
to use the thing, see make install and make apply.
Note that if you run terraform apply in the tf directory, it won't
work out of the box. That's because you need to set the
TF_CLI_CONFIG_FILE environment variable to point to a file that
enables local development of this provider. The Makefile does this
for you.
Future work: actually publish this provider.
Development
Code Generation
See make gen. It will create team_resource_gen.go, which defines
the types that Terraform knows about. This is automatically run
when you run make install.
Running locally
See make plan and make apply.
Running Tests
You probably guessed this. See make test. Note that these tests
require a FleetDM server to be running. The tests will create fleets
and delete them when they're done. The tests also require a valid
Fleet API token to be in the FLEETDM_APIKEY environment variable.
Debugging locally
The basic idea is that you want to run the provider in a debugger. When terraform normally runs, it will execute the provider a few times in the course of operations. What you want to do instead is to run the provider in debug mode and tell terraform to contact it.
To do this, you need to start the provider with the -debug flag
inside a debugger. You'll also need to give it the FLEETDM_APIKEY
environment variable. The provider will print out a big environment
variable that you can copy and paste to your command line.
When you run terraform apply or the like, you'll invoke it with
that big environment variable. It'll look something like
TF_REATTACH_PROVIDERS='{"fleetdm.com/tf/fleetdm":{"Protocol":"grpc","ProtocolVersion":6,"Pid":33644,"Test":true,"Addr":{"Network":"unix","String":"/var/folders/32/xw2p1jtd4w10hpnsyrb_4nmm0000gq/T/plugin771405263"}}}' terraform apply
With this magic, terraform will look to your provider that's running in a debugger. You get breakpoints and the goodness of a debugger.