Allen Houchins
cc9f8e4891
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA The Fleet UI now displays a policy's targeted platform, so repeating it in the policy name is redundant. This strips the leading `macOS - ` / `Windows - ` / `Linux - ` from all 84 prefixed policies in `it-and-security`. ## Collisions GitOps rejects duplicate policy names within a fleet ([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)), and the Workstations fleet includes macOS, Windows, and Linux policies together. 14 stripped names would collide, so for those the platform moves to a trailing suffix instead of being dropped: | Before | After | |---|---| | `macOS - Gatekeeper enabled` | `Gatekeeper enabled` | | `Windows - Secure Boot enabled` | `Secure Boot enabled` | | `Linux - Removable storage is read-only` | `Removable storage is read-only` | | `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)` | | `Windows - Disk encryption enabled` | `Disk encryption enabled (Windows)` | | `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)` | 49 policies lose the platform entirely; 35 keep it as a suffix. The 14 suffixed names are: Disk encryption enabled, Sufficient disk space available, User .npmrc min-release-age at least 0.5 days, 1Password installed, Battery healthy, and the 9 patch policies that exist for both macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom, Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader). Also updates the descriptions of `macos-screen-lock-exclusions` and `windows-screen-lock-exclusions`, which quote policy names. ## Notes for the reviewer - **This is destructive on apply.** GitOps matches policies by name, so applying this deletes the 84 existing policies and creates new ones. Policy pass/fail history and host results reset. Automations defined in the policy YAML (calendar events, install/script triggers) carry over, but anything referencing these names outside the repo — saved filters, dashboards, Slack workflows — needs updating separately. - `tools/fleet-slackbot/system-prompt.js:338` still documents the `<Platform> - <Description>` convention, and the `fleetctl new` macOS template still ships a prefixed name. Both left alone intentionally — out of scope for dogfood config. - Four policy files appear unused by any fleet and were renamed only for consistency: `lib/{macos,windows}/policies/update-claude.yml` and `update-slack.yml`. Their names duplicate entries already in `patch-fleet-maintained-apps.yml` for the same platform. Worth deleting in a follow-up. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. N/A — dogfood GitOps config only, no product code changes. ## Testing - [x] QA'd all new/changed functionality manually Verified locally: - No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere under `it-and-security/`. - Every fleet passes the same uniqueness rule GitOps enforces — Workstations resolves to 78 policies with 0 duplicate names; all other fleets unchanged. - All 73 touched/related YAML files parse. - The diff touches only `- name:` lines plus the two label descriptions.
74 lines
4.7 KiB
YAML
74 lines
4.7 KiB
YAML
- name: Slack up to date (Windows)
|
|
description: The host may have an outdated version of Slack, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Slack's built-in update functionality."
|
|
type: patch
|
|
fleet_maintained_app_slug: slack/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Slack installed
|
|
- name: 1Password up to date (Windows)
|
|
description: This device may have an outdated version of 1Password, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "1Password is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it."
|
|
type: patch
|
|
fleet_maintained_app_slug: 1password/windows
|
|
install_software: true
|
|
labels_include_any:
|
|
- x86 Windows hosts with 1Password installed
|
|
- name: Claude up to date (Windows)
|
|
description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Claude's built-in update functionality. You can also uninstall Claude if you are no longer using it."
|
|
type: patch
|
|
fleet_maintained_app_slug: claude/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Claude installed
|
|
- name: Firefox up to date (Windows)
|
|
description: The host may have an outdated version of Firefox, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Firefox's built-in update functionality. You can also uninstall Firefox if you are no longer using it."
|
|
type: patch
|
|
fleet_maintained_app_slug: firefox/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Firefox installed
|
|
- name: Google Chrome up to date (Windows)
|
|
description: The host may have an outdated version of Google Chrome, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Google Chrome's built-in update functionality."
|
|
type: patch
|
|
fleet_maintained_app_slug: google-chrome/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Google Chrome installed
|
|
- name: Zoom up to date (Windows)
|
|
description: The host may have an outdated version of Zoom, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Zoom's built-in update functionality."
|
|
type: patch
|
|
fleet_maintained_app_slug: zoom/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Zoom installed
|
|
- name: Visual Studio Code up to date (Windows)
|
|
description: The host may have an outdated version of Visual Studio Code, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Download the latest version from Self-service or check for updates using Visual Studio Code's built-in update functionality. You can also uninstall Visual Studio Code if you are no longer using it."
|
|
type: patch
|
|
fleet_maintained_app_slug: visual-studio-code/windows
|
|
install_software: false
|
|
labels_include_any:
|
|
- x86 Windows hosts with Visual Studio Code installed
|
|
- name: Okta Verify up to date (Windows)
|
|
description: The host may have an outdated version of Okta Verify, potentially risking security vulnerabilities or compatibility issues.
|
|
resolution: "Okta Verify is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it."
|
|
type: patch
|
|
fleet_maintained_app_slug: okta-verify/windows
|
|
install_software: true
|
|
labels_include_any:
|
|
- x86 Windows hosts with Okta Verify installed
|
|
- name: Adobe Acrobat Reader up to date (Windows)
|
|
description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times.
|
|
resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it."
|
|
critical: true
|
|
type: patch
|
|
fleet_maintained_app_slug: adobe-acrobat-reader/windows
|
|
install_software: true
|
|
labels_include_any:
|
|
- x86 Windows hosts with Adobe Acrobat Reader installed
|