mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
Prepare for Fleet 4.10.0 (#4161)
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
This commit is contained in:
Noah Talerman
GitHub
parent
e0716d0c2a
commit
67827474c2
44 changed files with 76 additions and 66 deletions
2
.github/workflows/goreleaser-fleet.yaml
vendored
2
.github/workflows/goreleaser-fleet.yaml
vendored
|
|
@ -27,7 +27,7 @@ jobs:
|
|||
- name: Set up Go
|
||||
uses: actions/setup-go@v2
|
||||
with:
|
||||
go-version: 1.17.2
|
||||
go-version: 1.17.7
|
||||
|
||||
- name: Install JS Dependencies
|
||||
run: make deps-js
|
||||
|
|
|
|||
51
CHANGELOG.md
51
CHANGELOG.md
|
|
@ -1,3 +1,54 @@
|
|||
## Fleet 4.10.0 (Feb 10, 2022)
|
||||
|
||||
* Upgrade Go to 1.17.7 with security fixes for crypto/elliptic (CVE-2022-23806), math/big (CVE-2022-23772), and cmd/go (CVE-2022-23773). These are not likely to be high impact in Fleet deployments, but we are upgrading in an abundance of caution.
|
||||
|
||||
* Add aggregate software and vulnerability information on the new **Software** page.
|
||||
|
||||
* Add ability to see how many hosts have a specific vulnerable software installed on the
|
||||
**Software** page. This information is also available in the `GET /api/v1/fleet/software` API route.
|
||||
|
||||
* Add ability to send a webhook request if a new vulnerability (CVE) is
|
||||
found on at least one host. Documentation on what data is included the webhook
|
||||
request and when the webhook request is sent can be found here on [fleedm.com/docs](https://fleetdm.com/docs/using-fleet/automations#vulnerability-automations).
|
||||
|
||||
* Add aggregate Mobile Device Management and Munki data on the **Home** page.
|
||||
|
||||
* Add email and URL validation across the entire Fleet UI.
|
||||
|
||||
* Add ability to filter software by "Vulnerable" on the **Host details** page.
|
||||
|
||||
* Update standard policy templates to use new naming convention. For example, "Is FileVault enabled on macOS
|
||||
devices?" is now "Full disk encryption enabled (macOS)."
|
||||
|
||||
* Add db-innodb-status and db-process-list to `fleetctl debug` command.
|
||||
|
||||
* Fleet Premium: Add the ability to generate a Fleet installer and manage enroll secrets on the **Team details**
|
||||
page.
|
||||
|
||||
* A ability for users with the observer role to view which platforms (macOS, Windows, Linux) a query
|
||||
is compatible with.
|
||||
|
||||
* Improve the experience for editing queries and policies in the Fleet UI.
|
||||
|
||||
* Improve vulnerability processing for NPM packages.
|
||||
|
||||
* Support triggering a webhook for newly detected vulnerabilities with a list of affected hosts.
|
||||
|
||||
* Add filter software by CVE.
|
||||
|
||||
* Add the ability to disable scheduled query performance statistics.
|
||||
|
||||
* Add ability to filter the host summary information by platform (macOS, Windows, Linux) on the **Home** page.
|
||||
|
||||
* Fix a bug in Fleet installers for Linux in which a computer restart would stop the host from
|
||||
reporting to Fleet.
|
||||
|
||||
* Make sure ApplyTeamSpec only works with premium deployments.
|
||||
|
||||
* Disable MDM, Munki, and Chrome profile queries on unsupported platforms to reduce log noise.
|
||||
|
||||
* Properly handle paths in CVE URL prefix.
|
||||
|
||||
## Fleet 4.9.1 (Feb 2, 2022)
|
||||
|
||||
### This is a security release.
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
* Allow to disable scheduled query stats through fleet serve config
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Disable MDM, Munki, and Chrome profile queries on unsupported platforms to reduce log noise.
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Properly handle paths in CVE URL prefix
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add filter software by CVE
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add generate installer and manage enroll secrets to team details page
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Expose vulnerabilities webhook config in app config.
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Support triggering a webhook for newly detected vulnerabilities with a list of affected hosts
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
* Add new "Software" tab to Host details page
|
||||
* Add ability to filter software by "Vulnerable" on the Host details page
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add `hosts_count` field for each software (and `counts_updated_at` timestamp as a top-level field) to the response payload of `GET /api/v1/fleet/software`
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Cleanup unused `software` entries after having calculated the count of hosts
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Refine and improve query and policy editing interface
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add db-innodb-status and db-process-list to fleetctl debug
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add aggregation of mdm and munki data
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add platform filter to the host_summary endpoint
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
* Add new feature: Software page
|
||||
* Replace "View all software" modal with link to software page
|
||||
* Add hosts counts and last updated time to software card on homepage dashboard
|
||||
|
|
@ -1 +0,0 @@
|
|||
* App wide frontend validators for email addresses and urls
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Amend webhook db lock duration to be always one hour.
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Success and error messages for resetting a user's password and session
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add max length to user, query and policy name inputs
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Ability in UI to set a software vulnerability automation on Software page
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Make sure ApplyTeamSpec only works with premium deployments.
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
- Added platform filter to homepage dashboard
|
||||
- Added Munki and MDM data cards to homepage dashboard for macOS devices
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Fix label search crashing app on special character input
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Apply the whole yaml instead of just parts of it in preview
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Clean up team schedules when deleting a team.
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
* Move settings tab into account drawer
|
||||
* Refactor nav bar to new frontend patterns
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Properly match target_sw when looking for vulnerabilities within npm packages
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add new endpoint get team by id
|
||||
|
|
@ -1 +0,0 @@
|
|||
* /logout route automatically logs the user out of Fleet
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Check that user is authorized to update query in update query specs endpoint
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Return backend validation in the label of query/policy creation form
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Bug fix in UI: Loading current failing policies webhooks data
|
||||
|
|
@ -1 +0,0 @@
|
|||
* An observer can view a query's operating system compatibility
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Add software automation details to UI modal
|
||||
|
|
@ -1 +0,0 @@
|
|||
* Fix generated Linux packages to keep service enabled after computer restart.
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
* Update standard policy templates to use new naming convention. For example, "Is FileVault enabled on macOS
|
||||
devices?" is now "Full disk encryption enabled (macOS)."
|
||||
|
|
@ -4,8 +4,8 @@ name: fleet
|
|||
keywords:
|
||||
- fleet
|
||||
- osquery
|
||||
version: v4.9.1
|
||||
version: v4.10.0
|
||||
home: https://github.com/fleetdm/fleet
|
||||
sources:
|
||||
- https://github.com/fleetdm/fleet.git
|
||||
appVersion: v4.9.1
|
||||
appVersion: v4.10.0
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# All settings related to how Fleet is deployed in Kubernetes
|
||||
hostName: fleet.localhost
|
||||
replicas: 3 # The number of Fleet instances to deploy
|
||||
imageTag: v4.9.1 # Version of Fleet to deploy
|
||||
imageTag: v4.10.0 # Version of Fleet to deploy
|
||||
createIngress: true # Whether or not to automatically create an Ingress
|
||||
ingressAnnotations: {} # Additional annotation to add to the Ingress
|
||||
podAnnotations: {} # Additional annotations to add to the Fleet pod
|
||||
|
|
|
|||
|
|
@ -12,9 +12,11 @@ Add a "Performance" section below the list of changes. This section should summa
|
|||
hosts that the Fleet server can handle, call out if this number has
|
||||
changed since the last release, and list the infrastructure used in the load testing environment.
|
||||
|
||||
Update the NPM [package.json](../../tools/fleetctl-npm/package.json) with the new version number (do
|
||||
not yet `npm publish`). Update the [Helm chart](../../charts/fleet/Chart.yaml) and [values
|
||||
file](../../charts/fleet/values.yaml) with the new version number.
|
||||
Update version numbers in the relevant files:
|
||||
|
||||
- [package.json](../../tools/fleetctl-npm/package.json) (do not yet `npm publish`)
|
||||
- [Helm chart](../../charts/fleet/Chart.yaml) and [values file](../../charts/fleet/values.yaml)
|
||||
- [Terraform variables](../../tools/terraform/variables.tf)
|
||||
|
||||
Commit these changes via Pull Request and pull the changes on the `main` branch locally. Check that
|
||||
`HEAD` of the `main` branch points to the commit with these changes.
|
||||
|
|
@ -54,7 +56,7 @@ Please visit our [update guide](https://fleetdm.com/docs/using-fleet/updating-fl
|
|||
|
||||
### Documentation
|
||||
|
||||
Documentation for this release can be found at https://github.com/fleetdm/fleet/blob/<VERSION>/docs/README.md
|
||||
Documentation for Fleet is available at [fleetdm.com/docs](https://fleetdm.com/docs).
|
||||
|
||||
### Binary Checksum
|
||||
|
||||
|
|
@ -73,7 +75,7 @@ When editing is complete, publish the release.
|
|||
|
||||
> If releasing a "prerelease" of Fleet, run `npm publish --tag prerelease`. This way, you can
|
||||
> publish a prerelease of fleetctl while the most recent fleetctl npm package, available for public
|
||||
> download, is still the latest *official* release.
|
||||
> download, is still the latest _official_ release.
|
||||
|
||||
5. Announce the release in the #fleet channel of [osquery
|
||||
Slack](https://osquery.slack.com/join/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw#/) and
|
||||
|
|
@ -110,7 +112,7 @@ must be created and relevant changes cherry-picked onto that branch:
|
|||
```
|
||||
|
||||
2. Cherry pick the necessary commits into the new branch:
|
||||
|
||||
|
||||
```
|
||||
git cherry-pick d34db33f
|
||||
```
|
||||
|
|
@ -123,8 +125,7 @@ must be created and relevant changes cherry-picked onto that branch:
|
|||
|
||||
When a `patch-*` branch is pushed, the [Docker publish
|
||||
Action](https://github.com/fleetdm/fleet/actions/workflows/goreleaser-snapshot-fleet.yaml) will
|
||||
be invoked to push a container image for QA with `fleetctl preview` (eg. `fleetctl preview
|
||||
--tag patch-fleet-v4.3.1`).
|
||||
be invoked to push a container image for QA with `fleetctl preview` (eg. `fleetctl preview --tag patch-fleet-v4.3.1`).
|
||||
|
||||
4. Check in the GitHub UI that Actions ran successfully for this branch and perform [QA smoke
|
||||
testing](../../.github/ISSUE_TEMPLATE/smoke-tests.md).
|
||||
|
|
@ -142,4 +143,4 @@ must be created and relevant changes cherry-picked onto that branch:
|
|||
timestamps. If they do not, submit a new Pull Request to increase the timestamps and ensure that
|
||||
migrations are run in the appropriate order.
|
||||
|
||||
TODO [#2850](https://github.com/fleetdm/fleet/issues/2850): Improve docs/tooling for this.
|
||||
TODO [#2850](https://github.com/fleetdm/fleet/issues/2850): Improve docs/tooling for this.
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ CREATE TABLE `app_config_json` (
|
|||
UNIQUE KEY `id` (`id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
|
||||
/*!40101 SET character_set_client = @saved_cs_client */;
|
||||
INSERT INTO `app_config_json` VALUES (1,'{\"org_info\": {\"org_name\": \"\", \"org_logo_url\": \"\"}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_sso_idp_login\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/v1/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"host_settings\": {\"enable_host_users\": true, \"enable_software_inventory\": false, \"enable_scheduled_query_stats\": true}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"deferred_save_host\": false, \"live_query_disabled\": false}, \"webhook_settings\": {\"interval\": \"24h0m0s\", \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
|
||||
INSERT INTO `app_config_json` VALUES (1,'{\"org_info\": {\"org_name\": \"\", \"org_logo_url\": \"\"}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_sso_idp_login\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/v1/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"host_settings\": {\"enable_host_users\": true, \"enable_software_inventory\": false}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"deferred_save_host\": false, \"live_query_disabled\": false}, \"webhook_settings\": {\"interval\": \"24h0m0s\", \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
|
||||
/*!40101 SET @saved_cs_client = @@character_set_client */;
|
||||
/*!40101 SET character_set_client = utf8 */;
|
||||
CREATE TABLE `carve_blocks` (
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "fleetctl",
|
||||
"version": "v4.9.1",
|
||||
"version": "v4.10.0",
|
||||
"description": "Installer for the fleetctl CLI tool",
|
||||
"bin": {
|
||||
"fleetctl": "./run.js"
|
||||
|
|
|
|||
|
|
@ -24,12 +24,12 @@ variable "vulnerabilities_path" {
|
|||
|
||||
variable "fleet_backend_cpu" {
|
||||
default = 256
|
||||
type = number
|
||||
type = number
|
||||
}
|
||||
|
||||
variable "fleet_backend_mem" {
|
||||
default = 512
|
||||
type = number
|
||||
type = number
|
||||
}
|
||||
|
||||
variable "async_host_processing" {
|
||||
|
|
@ -37,7 +37,7 @@ variable "async_host_processing" {
|
|||
}
|
||||
|
||||
variable "logging_debug" {
|
||||
default = "false"
|
||||
default = "false"
|
||||
}
|
||||
|
||||
variable "logging_json" {
|
||||
|
|
@ -51,12 +51,12 @@ variable "database_user" {
|
|||
|
||||
variable "database_name" {
|
||||
description = "the name of the database fleet will create/use"
|
||||
default = "fleet"
|
||||
default = "fleet"
|
||||
}
|
||||
|
||||
variable "fleet_image" {
|
||||
description = "the name of the container image to run"
|
||||
default = "fleetdm/fleet:v4.9.0"
|
||||
default = "fleetdm/fleet:v4.10.0"
|
||||
}
|
||||
|
||||
variable "software_inventory" {
|
||||
|
|
@ -72,13 +72,13 @@ variable "vuln_db_path" {
|
|||
variable "cpu_migrate" {
|
||||
description = "cpu units for migration task"
|
||||
default = 1024
|
||||
type = number
|
||||
type = number
|
||||
}
|
||||
|
||||
variable "mem_migrate" {
|
||||
description = "memory limit for migration task in MB"
|
||||
default = 2048
|
||||
type = number
|
||||
type = number
|
||||
}
|
||||
|
||||
variable "fleet_max_capacity" {
|
||||
|
|
@ -103,5 +103,5 @@ variable "cpu_tracking_target_value" {
|
|||
|
||||
variable "fleet_license" {
|
||||
description = "Fleet Premium license key"
|
||||
default = ""
|
||||
}
|
||||
default = ""
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue