Lucas Manuel Rodriguez
60d8f51374
Two reasons: - It's a testing/QA tool, so it should be under `tools/` - Reduce security-noise because it's just an internal tool (all findings under tools/ should be ignored). Failing dependency review expected because of the security findings in the docker Go packages. (Which can be fixed/updated when a patch is issued but without urgency because this is an internal tool.) ## Testing - [x] QA'd all new/changed functionality manually Ran: ``` cd tools/upgrade FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added an end-to-end upgrade test scenario across two Fleet versions. * Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis, osquery) with local TLS certs/keys and osquery flags. * **Tests** * Added automated Fleet readiness checks and host enrollment verification before and after upgrade. * **Chores / Security** * Updated the database upgrade test workflow and Go module tooling for the new upgrade test setup. * Adjusted secret scanning allow-rules and refreshed Go dependencies for the upgrade module. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
50 lines
1.3 KiB
YAML
50 lines
1.3 KiB
YAML
services:
|
|
mysql:
|
|
platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
|
|
image: mysql:8.0.44
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: toor
|
|
MYSQL_DATABASE: fleet
|
|
MYSQL_USER: fleet
|
|
MYSQL_PASSWORD: fleet
|
|
ports:
|
|
- "3306"
|
|
|
|
redis:
|
|
image: redis:6
|
|
|
|
fleet:
|
|
image: fleetdm/fleet:${FLEET_VERSION:-latest}
|
|
environment:
|
|
FLEET_MYSQL_ADDRESS: mysql:3306
|
|
FLEET_MYSQL_DATABASE: fleet
|
|
FLEET_MYSQL_USERNAME: fleet
|
|
FLEET_MYSQL_PASSWORD: fleet
|
|
FLEET_REDIS_ADDRESS: redis:6379
|
|
FLEET_SERVER_ADDRESS: 0.0.0.0:8080
|
|
FLEET_SERVER_CERT: /fleet.crt
|
|
FLEET_SERVER_KEY: /fleet.key
|
|
FLEET_LOGGING_JSON: "true"
|
|
FLEET_OSQUERY_LABEL_UPDATE_INTERVAL: 1m
|
|
FLEET_VULNERABILITIES_CURRENT_INSTANCE_CHECKS: "yes"
|
|
FLEET_VULNERABILITIES_DATABASES_PATH: /fleet/vulndb
|
|
FLEET_VULNERABILITIES_PERIODICITY: 5m
|
|
FLEET_LOGGING_DEBUG: "true"
|
|
volumes:
|
|
- ./fleet.crt:/fleet.crt
|
|
- ./fleet.key:/fleet.key
|
|
ports:
|
|
- "8080"
|
|
depends_on:
|
|
- mysql
|
|
- redis
|
|
|
|
osquery:
|
|
image: "osquery/osquery:4.7.0-ubuntu20.04"
|
|
volumes:
|
|
- ./fleet.crt:/etc/osquery/fleet.crt
|
|
- ./osquery.flags:/etc/osquery/osquery.flags
|
|
environment:
|
|
ENROLL_SECRET: "${ENROLL_SECRET:-foobar}"
|
|
command: osqueryd --flagfile=/etc/osquery/osquery.flags
|