fleet/server/service/client_software.go

107 lines
3.8 KiB
Go
Raw Normal View History

package service
import (
"errors"
"fmt"
"net/url"
"time"
"github.com/fleetdm/fleet/v4/server/fleet"
)
// ListSoftwareVersions retrieves the software versions installed on hosts.
func (c *Client) ListSoftwareVersions(query string) ([]fleet.Software, error) {
verb, path := "GET", "/api/latest/fleet/software/versions"
var responseBody listSoftwareVersionsResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query)
if err != nil {
return nil, err
}
return responseBody.Software, nil
}
// ListSoftwareTitles retrieves the software titles installed on hosts.
func (c *Client) ListSoftwareTitles(query string) ([]fleet.SoftwareTitleListResult, error) {
verb, path := "GET", "/api/latest/fleet/software/titles"
var responseBody listSoftwareTitlesResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query)
if err != nil {
return nil, err
}
return responseBody.SoftwareTitles, nil
}
Fix macos_setup not always being exported correctly by generate-gitops (#30504) for #30502 # Details This PR fixes an issue where `fleetctl generate-gitops` would not always add a `macos_setup` setting to a .yml file even if the team had a setup experience configured. This was due to relying on the `MacOSSetup` config returned by app/team config APIs to have this data populated, which turned out to be an incorrect assumption. Instead, we now utilize various APIs to check for the presence of setup software, scripts, bootstrap packages and profiles. Note that for now, `generate-gitops` will only output a `TODO` line if setup experience is detected; https://github.com/fleetdm/fleet/issues/30210 is open to flesh this out. In the meantime `fleetctl gitops` will fail if this TODO is inserted, so that the user must go and fix it manually. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality # Testing I set up MDM on a local instance and tried the following both on No Team and a regular team: * Turned "End user authentication on", verified that `fleetctl generate-gitops` output a `macos_setup` setting for the team. Turned it back off and verified that `macos_setup` was no longer exported by `fleetctl generate-gitops`. * Did the same for bootstrap package. * Did the same for install software, and additionally verified that having software available but _not_ selected did not cause `macos_setup` to be exported. Same for teams with no software available at all. * Did the same for setup assistant. I also tested that changes to No Team didn't affect the output when exporting a regular team. --------- Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2025-07-02 12:07:58 +00:00
// Get the software titles available for the setup experience.
API endpoints for Linux setup experience (#32493) For #32040. --- Backend changes to unblock the development of the orbit and frontend changes. New GET and PUT APIs for setting/getting software for Linux Setup Experience: ``` curl -k -X GET -H "Authorization: Bearer $TEST_TOKEN" https://localhost:8080/api/latest/fleet/setup_experience/linux/software?team_id=8&per_page=3000 curl -k -X PUT -H "Authorization: Bearer $TEST_TOKEN" https://localhost:8080/api/latest/fleet/setup_experience/linux/software -d '{"team_id":8,"software_title_ids":[3000, 3001, 3007]}' ``` New setup_experience/init API called by orbit to trigger the Linux setup experience on the device: ``` curl -v -k -X POST -H "Content-Type: application/json" "https://localhost:8080/api/fleet/orbit/setup_experience/init" -d '{"orbit_node_key": "ynYEtFsvv9xZ7rX619UE8of1I28H+GCj"}' ``` Get status API to call on "My device": ``` curl -v -k -X POST "https://localhost:8080/api/latest/fleet/device/7d940b6e-130a-493b-b58a-2b6e9f9f8bfc/setup_experience/status" ``` --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [X] Verified that the setting is exported via `fleetctl generate-gitops` - [X] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [X] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added Linux support for Setup Experience alongside macOS. - Introduced platform-specific admin APIs to configure and retrieve Setup Experience software (macOS/Linux). - Added device API to report Setup Experience status and an Orbit API to initialize Setup Experience on non-macOS devices. - Setup Experience now gates policy queries on Linux until setup is complete. - New activity log entry when Setup Experience software is edited (includes platform and team). - Documentation - Updated audit logs reference to include the new “edited setup experience software” event. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-04 15:58:47 +00:00
func (c *Client) GetSetupExperienceSoftware(platform string, teamID uint) ([]fleet.SoftwareTitleListResult, error) {
verb, path := "GET", "/api/latest/fleet/setup_experience/software"
Fix macos_setup not always being exported correctly by generate-gitops (#30504) for #30502 # Details This PR fixes an issue where `fleetctl generate-gitops` would not always add a `macos_setup` setting to a .yml file even if the team had a setup experience configured. This was due to relying on the `MacOSSetup` config returned by app/team config APIs to have this data populated, which turned out to be an incorrect assumption. Instead, we now utilize various APIs to check for the presence of setup software, scripts, bootstrap packages and profiles. Note that for now, `generate-gitops` will only output a `TODO` line if setup experience is detected; https://github.com/fleetdm/fleet/issues/30210 is open to flesh this out. In the meantime `fleetctl gitops` will fail if this TODO is inserted, so that the user must go and fix it manually. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality # Testing I set up MDM on a local instance and tried the following both on No Team and a regular team: * Turned "End user authentication on", verified that `fleetctl generate-gitops` output a `macos_setup` setting for the team. Turned it back off and verified that `macos_setup` was no longer exported by `fleetctl generate-gitops`. * Did the same for bootstrap package. * Did the same for install software, and additionally verified that having software available but _not_ selected did not cause `macos_setup` to be exported. Same for teams with no software available at all. * Did the same for setup assistant. I also tested that changes to No Team didn't affect the output when exporting a regular team. --------- Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2025-07-02 12:07:58 +00:00
var responseBody getSetupExperienceSoftwareResponse
query := fmt.Sprintf("platform=%s&team_id=%d", platform, teamID)
Fix macos_setup not always being exported correctly by generate-gitops (#30504) for #30502 # Details This PR fixes an issue where `fleetctl generate-gitops` would not always add a `macos_setup` setting to a .yml file even if the team had a setup experience configured. This was due to relying on the `MacOSSetup` config returned by app/team config APIs to have this data populated, which turned out to be an incorrect assumption. Instead, we now utilize various APIs to check for the presence of setup software, scripts, bootstrap packages and profiles. Note that for now, `generate-gitops` will only output a `TODO` line if setup experience is detected; https://github.com/fleetdm/fleet/issues/30210 is open to flesh this out. In the meantime `fleetctl gitops` will fail if this TODO is inserted, so that the user must go and fix it manually. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality # Testing I set up MDM on a local instance and tried the following both on No Team and a regular team: * Turned "End user authentication on", verified that `fleetctl generate-gitops` output a `macos_setup` setting for the team. Turned it back off and verified that `macos_setup` was no longer exported by `fleetctl generate-gitops`. * Did the same for bootstrap package. * Did the same for install software, and additionally verified that having software available but _not_ selected did not cause `macos_setup` to be exported. Same for teams with no software available at all. * Did the same for setup assistant. I also tested that changes to No Team didn't affect the output when exporting a regular team. --------- Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2025-07-02 12:07:58 +00:00
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query)
if err != nil {
return nil, err
}
return responseBody.SoftwareTitles, nil
}
Add "generate-gitops" command (#28555) For #27476 # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) # Details This PR adds a new command `generate-gitops` to the `fleetctl` tool. The purpose of this command is to output GitOps-ready files that can then be used with `fleetctl-gitops`. The general usage of the command is: ``` fleectl generate-gitops --dir /path/to/dir/to/add/files/to ``` By default, the outputted files will not contain sensitive data, but will instead add comments where the data needs to be replaced by a user. In cases where sensitive data is redacted, the tool outputs warnings to the user indicating which keys need to be updated. The tool uses existing APIs to gather data for use in generating configuration files. In some cases new API client methods needed to be added to support the tool: * ListConfigurationProfiles * GetProfileContents * GetScriptContents * GetSoftwareTitleByID Additionally, the response for the /api/latest/fleet/software/batch endpoint was updated slightly to return `HashSHA256` for the software installers. This allows policies that automatically install software to refer to that software by hash. Other options that we may or may not choose to document at this time: * `--insecure`: outputs sensitive data in plaintext instead of leaving comments * `--print`: prints the output to stdout instead of writing files * `--key`: outputs the value at a keypath to stdout, e.g. `--key agent_options.config` * `--team`: only generates config for the specified team name * `--force`: overwrites files in the given directory (defaults to false, which errors if the dir is not empty) # Technical notes The command is implemented using a `GenerateGitopsCommand` type which holds some state (like a list of software and scripts encountered) as well as a Fleet client instance (which may be a mock instance for tests) and the CLI context (containing things like flags and output writers). The actual "action" of the CLI command calls the `Run()` method of the `GenerateGitopsCommand` var, which delegates most of the work to other methods like `generateOrgSettings()`, `generateControls()`, etc. Wherever possible, the subroutines use reflection to translate Go struct fields into JSON property names. This guarantees that the correct keys are written to config files, and protects against the unlikely event of keys changing. When sensitive data is encountered, the subroutines call `AddComment()` to get a new token to add to the config files. These tokens are replaced with comments like `# TODO - Add your enrollment secrets here` in the final output. # Known issues / TODOs: * The `macos_setup` configuration is not output by this tool yet. More planning is required for this. In the meantime, if the tool detects that `macos_setup` is configured on the server, it outputs a key with an invalid value and prints a warning to the user that they'll need to configure it themselves. * `yara_rules` are not output yet. The tool adds a warning that if you have Yara rules (which you can only upload via GitOps right now) that you'll have to migrate them manually. Supporting this will require a new API that we'll have to discuss the authz for, so punting on it for now. * Fleet maintained apps are not supported by GitOps yet (coming in https://github.com/fleetdm/fleet/issues/24469). In the meantime, this tool will output a `fleet_maintained_apps` key and trigger a warning, and GitOps will fail if that key is present. --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
2025-05-06 20:25:44 +00:00
// GetSoftwareTitleByID retrieves a software title by ID.
//
//nolint:gocritic // ignore captLocal
func (c *Client) GetSoftwareTitleByID(ID uint, teamID *uint) (*fleet.SoftwareTitle, error) {
var query string
if teamID != nil {
query = fmt.Sprintf("team_id=%d", *teamID)
}
verb, path := "GET", "/api/latest/fleet/software/titles/"+fmt.Sprint(ID)
var responseBody getSoftwareTitleResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, query)
if err != nil {
return nil, err
}
return responseBody.SoftwareTitle, nil
}
func (c *Client) ApplyNoTeamSoftwareInstallers(softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) ([]fleet.SoftwarePackageResponse, error) {
query, err := url.ParseQuery(opts.RawQuery())
if err != nil {
return nil, err
}
return c.applySoftwareInstallers(softwareInstallers, query, opts.DryRun)
}
func (c *Client) applySoftwareInstallers(softwareInstallers []fleet.SoftwareInstallerPayload, query url.Values, dryRun bool) ([]fleet.SoftwarePackageResponse, error) {
path := "/api/latest/fleet/software/batch"
var resp batchSetSoftwareInstallersResponse
if err := c.authenticatedRequestWithQuery(map[string]any{"software": softwareInstallers}, "POST", path, &resp, query.Encode()); err != nil {
return nil, err
}
if dryRun && resp.RequestUUID == "" {
return nil, nil
}
requestUUID := resp.RequestUUID
for {
var resp batchSetSoftwareInstallersResultResponse
if err := c.authenticatedRequestWithQuery(nil, "GET", path+"/"+requestUUID, &resp, query.Encode()); err != nil {
return nil, err
}
switch {
case resp.Status == fleet.BatchSetSoftwareInstallersStatusProcessing:
time.Sleep(1 * time.Second)
case resp.Status == fleet.BatchSetSoftwareInstallersStatusFailed:
return nil, errors.New(resp.Message)
case resp.Status == fleet.BatchSetSoftwareInstallersStatusCompleted:
return resp.Packages, nil
default:
return nil, fmt.Errorf("unknown status: %q", resp.Status)
}
}
}
// InstallSoftware triggers a software installation (VPP or software package)
// on the specified host.
func (c *Client) InstallSoftware(hostID uint, softwareTitleID uint) error {
verb, path := "POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", hostID, softwareTitleID)
var responseBody installSoftwareResponse
return c.authenticatedRequest(nil, verb, path, &responseBody)
}