fleet/articles/automatic-software-install-in-fleet.md

Automatically install software

In Fleet, you can automatically and remotely install software on hosts. This guide will walk you through the process of configuring Fleet to install software on your hosts.

Step-by-step instructions

1. Adding software: Follow the deploying software guide to make a software title available for installation. Note that for Fleet maintained Apps and custom packages all installation steps (pre-install query, install script, and post-install script) will be executed as configured, regardless of the policy that triggers the installation.

Current supported software deployment formats:

• macOS: .pkg and App Store (VPP) app
• Windows: .msi, .exe
• Linux: .deb, .rpm

If you check the "Automatic install" box when adding software, you do not have to create your own policy, so you can skip the remaining steps of this process.

2. Add a policy: In Fleet, add a policy that failure to pass will trigger the required installation. Go the Policies tab, select a team, then press the Add policy button. Next, click Create your own policy, enter your policy SQL, click Save, fill in remaining details in the Save modal, then and click Save again.

SELECT 1 FROM apps WHERE bundle_identifier = 'com.adobe.Reader' AND version_compare(bundle_short_version, '23.001.20687') >= 0;

The bundle ID for a macOS installer or VPP app can be found in the bundle_identifier field when viewing the associated software title via the API.

3. Open the software install automation modal: In the Policies tab, click the Manage automations button on the top-right, then select Install software from the context menu that pops up.

4. Select policy: Click the checkbox next to your newly created policy's name. To the right of it select from the drop-down list the software you would like to be installed upon failure of this policy.

Upon failure of the selected policy, the selected software installation will be triggered.

Adding a software automation to a policy, or changing the automated software title, will reset the policy's host counts.

How does it work?

• After configuring Fleet to auto-install a specific software the rest will be done automatically.
• The policy check mechanism runs on a typical one-hour cadence on all online hosts.
• Fleet will send install requests to the hosts on the first policy failure (first "No" result for the host) or if a policy goes from "Yes" to "No". Currently, Fleet will not send an install request if a policy is already failing and continues to fail ("No" -> "No"). See the following flowchart for details.

Detailed flowchart

App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business Manager). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry installing the app on the host's Host details page. To retry on multiple hosts at once, head to Policies > Manage Automations in Fleet and turn the app's policy automation off and back on.

Currently, App Store apps (VPP) are not installed as Managed Apps. Uninstalling VPP apps is coming soon.

Templates for policy queries

Use the following policy templates to see if the software is already installed at at least the desired version.

macOS (pkg and VPP)

SELECT 1 FROM apps WHERE bundle_identifier = '<YOUR_APP_BUNDLE_ID>' AND version_compare(bundle_short_version, '<SOFTWARE_PACKAGE_VERSION>') >= 0;

You can also use the name column for matching (e.g. "Google Chrome.app"), but using bundle_identifier is more reliable for macOS apps that have bundle identifiers.

Windows (msi and exe)

SELECT 1 FROM programs WHERE name = '<SOFTWARE_TITLE_NAME>' AND version_compare(version, '<VERSION>') >= 0;

Debian-based (deb)

SELECT 1 FROM deb_packages WHERE name = '<SOFTWARE_TITLE_NAME>' AND version_compare(version, '<SOFTWARE_PACKAGE_VERSION>') >= 0;

If your team has both Ubuntu and RHEL-based hosts then you should use the following template for the policy queries:

SELECT 1 WHERE EXISTS (
   -- This will mark the policies as successful on non-Debian-based hosts.
   -- This is only required if Debian-based and RPM-based hosts share a team.
   SELECT 1 WHERE (SELECT COUNT(*) FROM deb_packages) = 0
) OR EXISTS (
   SELECT 1 FROM deb_packages WHERE name = '<SOFTWARE_TITLE_NAME>' AND version_compare(version, '<SOFTWARE_PACKAGE_VERSION>') >= 0
);

RPM-based (rpm)

SELECT 1 FROM rpm_packages WHERE name = '<SOFTWARE_TITLE_NAME>' AND version_compare(version, '<SOFTWARE_PACKAGE_VERSION>') >= 0;

If your team has both Ubuntu and RHEL-based hosts then you should use the following template for the policy queries:

SELECT 1 WHERE EXISTS (
   -- This will mark the policies as successful on non-RPM-based hosts.
   -- This is only required if Debian-based and RPM-based hosts share a team.
   SELECT 1 WHERE (SELECT COUNT(*) FROM rpm_packages) = 0
) OR EXISTS (
   SELECT 1 FROM rpm_packages WHERE name = '<SOFTWARE_TITLE_NAME>' AND version_compare(version, 'SOFTWARE_PACKAGE_VERSION') >= 0
);

Via the API

Fleet provides a REST API for managing policies, including software install automations. Learn more about Fleet's REST API.

Via GitOps

To manage software automations using Fleet's best practice GitOps, check out the install_software key in the policies section of the GitOps reference documentation.

Conclusion

Software deployment can be time-consuming and risky. This guide presents Fleet's ability to mass deploy software to your fleet in a simple and safe way. Starting with uploading a trusted installer and ending with deploying it to the proper set of machines answering the exact policy defined by you.

Leveraging Fleet’s ability to install and upgrade software on your hosts, you can streamline the process of controlling your hosts, replacing old versions of software and having the up-to-date info on what's installed on your fleet.

By automating software deployment, you can gain greater control over what's installed on your machines and have better oversight of version upgrades, ensuring old software with known issues is replaced.