Open alexmitchelliii opened 1 month ago
Updated this issue to user story format and moved the original issue description here:
Goal: Silently, and remotely enable script execution for already deployed agents (note that this is intentionally not possible generally to preserve read-only guarantees for security-sensitive users)
Context: Company doesn't have any management tool to push a new agent to the devices (Fleet script execution would be that management tool for them moving forward if accomplished). It's a bootstrapping problem.
Hey @zwass heads up, I updated the issue to user story format. When you get the chance, can you please take a look at the fleetd changes section? That's my understanding of what needs to happen. Please feel free to tweak it.
After we get a signed order form from prospect-montague
please feel free to assign the issue to yourself.
Plan is in the doc here:
Heads up @roperzh and @lucasmrod, I think we'll need your help once Zach writes the code (see the "Changes" section in the issue). At that point, @zwass please add the issue to either the MDM or Endpoint ops sprint board and assign @georgekarrv (MDM EM) or @sharon-fdm (Endpoint ops EM).
cc @alexmitchelliii @lukeheath @AnthonySnyder8
Fleet Free user: All binaries are unique because we have user binaries built in to them.
Zach: Some things changed in fleetctl package
but not in fleetd binary. Changes would be taking place in fleetd binary.
Goal
Context
Requestor(s): @alexmitchelliii
Product designer: @noahtalerman
Today,
prospect-montague
has deployed fleetd to Linux workstations. They want to enable scripts w/o deploying a new fleetd agent. Scripts cannot be enabled remotely (intentional feature for read-only customers).Today, a Fleet Free user has deployed fleetd to tens of thousands of hosts. They need to update the certificate bundle for their fleetd. The certificate bundle cannot be renewed remotely (Fleet hasn't gotten to building this yet).
Changes
Product
enable-scripts
andrenew-certificates
tags respectively to the Fleet-hosted public-facing update server.enable-scripts
andrenew-certificates
tags respectively from the Fleet-hosted public-facing update server.Engineering
QA
Risk assessment
Manual testing steps
Testing notes
Confirmation