fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.15k stars 432 forks source link

Fleet maintained apps - dependencies #24037

Open dherder opened 10 hours ago

dherder commented 10 hours ago

Gong snippet: prospect-hubble: https://us-65885.app.gong.io/call?id=4210985230183928646&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A647%2C%22to%22%3A713%7D%5D

Problem

There is an order of operations of things especially with security agents around the configuration profile needing to be present before the app can be installed or it'll install into a bunk state and we got to reinstall it. Nobody has control over say APNs and when the profile comes down typically fast but there's always room for a race condition and we want to omit that risk.

Via Fleet maintained apps, the admin requires specification of the dependencies that need to be fulfilled (ie wait until the config profile exists, type of stuff or this package needs to exist prior to the installation), thinking things like Rosetta back in the day when they made the silicon transfer from Intel to Mac, silicon, things like that. Just like these are the dependencies required prior to installation or invocation of this package.

Today, this can be detected (but not remediated "in-line") with the "pre-install query" in the app definition of custom apps, but cannot be controlled with Fleet maintained apps.