search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.66k stars 379 forks source link

Allow updating configuration profiles in place #19215

Open willmayhone88 opened 1 month ago

willmayhone88 commented 1 month ago

Problem

TODO As an endpoint admin, sometime a deployed configuration profile needs to have a portion of the configuration profile updated to either support a new workflow or meet a new requirement. Currently to do this in Fleet, you need to delete the old profile and upload a brand new one. This can be an issue if deployed a required configuration profile for an application, where the time during the old profile being removed, and the new one being uploaded and deployed, results in the application or service not able to work. This could could result in a security agent not reporting back to the server, or an end user not able to perform an action if trying to during that gap between removal and installation of the new profile. Some other mdms allow you to update the configuration profile, and have it instantly deploy a new version, where the removal and reinstall takes place immediately causing no gap in time.

Potential solutions

  1. One option would be to have a configuration profile editor built into Fleet.
  2. Another option could be to allow a replacement action for current configuration profiles. This would still require building a new profile outside of Fleet, but could be easier to implement.
noahtalerman commented 1 month ago

Hey @willmayhone88 is the prospect planning on using Fleet's best practice GitOps?

Using GitOps, when a profile edit in a PR is merged Fleet replaces the profile.

Technically, this means Fleet only sends an InstallProfile command to update the profile. No RemoveProfile command is sent.