Custom targets (labels) for queries

[pintomi1989]

Goal

User story
As a user adding/editing a query,
I want my scheduled query to target hosts based on labels
so that I can target a more specific set of hosts.

Key result

None.

Original requests

• Custom target (labels) for policies & queries #24091

Context

• Product designer: @rachaelshaw

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: Figma
• YAML changes: PR here Edited in this PR
• REST API changes: PR here
• Fleet's agent (fleetd) changes: No changes
• GitOps mode changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: Fleet Premium
• Transparency changes: No changes
• First draft of test plan added
• Other reference documentation changes: No changes
• Once shipped, requester has been notified
  • Leaving this story open until we resolve this bug: GitOps: can't add labels and use labels in the same commit #28154
  • More context here: Ability to manage labels via best practice GitOps #17944 (comment)
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Feature guide changes: Updated here
• Database schema migrations: Yes. query_labels table added.
• Load testing: No need

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: No need
• Risk level: Medium
• Risk description: Applying labels could make issue with triggering queries.

Test plan

@xpkoala, this was expedited and we did not have enough time to approve the test-plan.
Can you please find the time to review? This is aimed at 4.66 so we have time.

1. Create a new query with labels in the UI.
   • Ensure that data is only collected from hosts with any of those labels
2. Update query to target 1 manual label that applies to different hosts
   • Query report should be deleted
   • New results should be from different hosts
3. Go to /hosts and select the targeted manual label from the filters. Click the delete button to open the delete label modal.
   • Verify text matches what's in Figma
4. In Fleet Free, check that:
   • Targets form section is not visible in Save query modal
   • Targets form section is not visible on Edit query page
   • Bullet-point text in Delete label modal is hidden. (Confirmation text reads simply: "Are you sure you wish to delete this label?")
5. In a team YAML file, add labels_include_any to a query.
   • Should save labels_include_any to the query.
6. Make changes to labels_include_any and run fleetctl gitops
   • Changes to query's labels_include_any should apply
7. In the YAML file for a Fleet Free instance, add labels_include_any to a query.
   • labels_include_any should not be saved to the query. (No error, field is ignored.)

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[noahtalerman]

@rachaelshaw we decided we want to purge the query report if a query's platforms, labels, or minimum osquery version change, right? (each option changes the targets)

I updated this dev note to reflect this:

[noahtalerman]

@rachaelshaw heads up, I added this sentence to the dev note here to clarify the behavior when there are no matching hosts:

(Mike brought this up during "Product design check-in call"

[rachaelshaw]

@rachaelshaw we decided we want to purge the query report if a query's platforms, labels, or minimum osquery version change, right? (each option changes the targets)

@noahtalerman yes; handling platforms/min version change is filed as a bug here: #17018