See if scripts are enabled/disabled on Host details page #17148

Patagonia121 · 2024-02-23T23:44:30Z

Goal

User story
As an IT admin on the Host details page,
I want to see if scripts are enabled/disabled
so that I can know I have to deploy a new fleetd w/ scripts enabled if I want to run scripts on this host.

Context

Product designer: @rachaelshaw

Currently, when a user runs a script on a host w/ scripts disabled, the user has to wait for the host to respond to know scripts are disabled. If we add an enabled/disabled flag in the API, we can improve this UX so that the user doesn't have to wait for a host to respond (i.e. disable run script button)

Changes

Product

UI changes: Figma
CLI usage changes: In Figma
REST API changes:
- Get host: Draft PR
- Run script: Add validation (error message in Figma)
- Run live script: Add validation (error message in Figma)

Engineering

Database schema migrations: host_orbit_info.scripts_enabled

ℹ️ Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

Risk level: Low

Manual testing steps

Platform testing matrix: linux, darwin, windows
Orbit testing matrix: previous orbit version with scripts enabled, new orbit with scripts disabled, new orbit with scripts enabled
Lock/unlock fleetctl command should be tested on linux and windows
Wipe fleetctl command should be tested on linux
Running scripts via API should be tested on linux, darwin, windows

Testing notes

The previous orbit version with scripts enabled should function the same as before -- none of the changes in this story should apply to it.

Confirmation

Engineer (@____): Added comment to user story confirming successful completion of QA.
QA (@____): Added comment to user story confirming successful completion of QA.

noahtalerman · 2024-03-08T15:22:38Z

Hey @Patagonia121 heads up, this story was prioritized during feature fest.

Aiming to ship an improvement in the next 6 weeks.

noahtalerman · 2024-03-20T21:16:26Z

Hey @rachaelshaw! I think I may have brought us down the wrong direction.

Instead of adding a new item to the Host details page, I think let's disable the "Run scripts" when scripts are disabled.
- We can show an easy to understand tooltip: To run scripts on this host, deploy the fleetd agent with --enable-scripts.
- If scripts are disabled at the org level, I think let's hide the "Run scripts" option.
Now that we're storing whether scripts are enabled in the DB, I think we want to take the opportunity to improve the API/CLI experience. Now, we can return an error right away if a host has scripts disabled. Instead of returning that error in the script results.

I go into more detail in the Loom video here.

sharon-fdm · 2024-03-27T18:50:17Z

Agent: We will need to have this information available. (Maybe in a table)
Backend: Will need to fetch and store in DB
Frontend: Display according Figma.

Estimations:
Agent + BE : 5
FE: 2

getvictor · 2024-04-08T20:12:02Z

@rachaelshaw On macOS agents, scripts can be enabled with MDM config profile. But the server/UI won't see this until a detail query occurs (once every hour). So, the server could be blocking scripts for up to 1 hour.

The end user could speed this up by manually refetching the host.

I assume this is OK. Adding :product label to confirm.

UPDATE: Another question.
2. Wanted to confirm that Windows wipe/lock/unlock requires scripts. In the code, I see this done via MDM commands.

getvictor · 2024-04-09T15:52:56Z

@RachelElysia scripts_enabled == null means this agent is not an orbit agent, or this agent is version <=1.23.0 which is not collecting the scripts enabled info

rachaelshaw · 2024-04-09T16:04:49Z

On macOS agents, scripts can be enabled with MDM config profile. But the server/UI won't see this until a detail query occurs (once every hour). So, the server could be blocking scripts for up to 1 hour.

The end user could speed this up by manually refetching the host.

@noahtalerman do you foresee this being a problem?

Wanted to confirm that Windows wipe/lock/unlock requires scripts. In the code, I see this done via MDM commands.

I believe it does require scripts— recently tested lock on Noah's Windows machine and it failed because scripts weren't enabled.

noahtalerman · 2024-04-09T16:20:45Z

On macOS agents, scripts can be enabled with MDM config profile. But the server/UI won't see this until a detail query occurs (once every hour). So, the server could be blocking scripts for up to 1 hour.

The end user could speed this up by manually refetching the host.

@rachaelshaw and @getvictor I think this is ok.

Victor, there's the same potential delay for macOS (no MDM), Windows, and Linux hosts right?

If it's the same for all platforms, maybe we update the tooltip copy/error messages. Something like this: "To run scripts on this host, deploy the fleetd agent with --enable-scripts and refetch host vitals."

Rachael, what do you think?

noahtalerman · 2024-04-09T16:22:07Z

Wanted to confirm that Windows wipe/lock/unlock requires scripts. In the code, I see this done via MDM commands.

@getvictor Windows wipe is an MDM command. Lock/unlock are scripts.

@rachaelshaw I totally forgot that Windows wipe is an MDM command. I don't think we should disable Wipe if a Windows host doesn't have scripts enabled. What do you think?

rachaelshaw · 2024-04-09T16:53:00Z

@noahtalerman makes sense, I'll update the Figma 👍

…st details. (#18123) #17361 #17148 In GET fleet/hosts/:id response, added the following fields: - orbit_version - `orbit_version == null` means this agent is not an orbit agent - fleet_desktop_version - `fleet_desktop_version == null` means this agent is not an orbit agent or it is an older version which is not collecting the desktop version - `fleet_desktop_version == ""` means this agent is an orbit agent but does not have fleet desktop - scripts_enabled - `scripts_enabled == null` means this agent is not an orbit agent or it is an older version which is not collecting scripts_enabled In orbit_info table, added the following fields: - desktop_version - scripts_enabled Updated docs for orbit_info PR: #18135 Updated API docs: #17814 MDM lock/unlock/wipe error messages are not part of this PR. They will be in a separate PR. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [x] Added/updated tests - [x] If database migrations are included, checked table schema to confirm autoupdate - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).

#17148 #17361 In orbit_info table, added the following fields: - desktop_version - scripts_enabled

#17148 Added error messages to lock/unlock/wipe when scripts are disabled. # Checklist for submitter - [x] Added/updated tests - [x] Manual QA for all new/changed functionality

noahtalerman · 2024-04-11T18:17:07Z

Doc changes for obit_info table: #18135

Heads up, the doc changes are live on fleetdm.com/tables however, the feature hasn't been shipped.

noahtalerman · 2024-04-19T16:14:38Z

@getvictor and @rachaelshaw re "Run scripts," "Lock," and "Wipe," buttons are available if the host has plain osquery installed.

What happens when we run a script against a host w/ plain osquery, does the user see an error?

I think up to @rachaelshaw on whether we decide to make changes and timing (now or file a story to bring through feature fest).

cc @RachelElysia @jacobshandling

xpkoala · 2024-04-22T18:20:02Z

@noahtalerman I'm testing this scenario right now. ~~As far as I can tell the script execution stays stuck in the "pending" state for plain osquery hosts.~~ We actually are showing an error message, I was interacting with the wrong host when I first outlined the behavior.

noahtalerman · 2024-04-23T15:08:25Z

We actually are showing an error message, I was interacting with the wrong host when I first outlined the behavior.

Ah, nice.

I think that's an acceptable UX.

FYI @rachaelshaw

For #17148.

rachaelshaw · 2024-04-25T18:21:36Z

@Patagonia121 this was shipped in v4.49.0

fleet-release · 2024-04-25T18:21:39Z

Script status shown,
Admins in cloud city,
Effort overthrown.

Patagonia121 added customer-reedtimmer ~feature fest Will be reviewed at next Feature Fest labels Feb 23, 2024

noahtalerman assigned Patagonia121 Mar 7, 2024

noahtalerman added story A user story defining an entire feature :product Product Design department (shows up on 🦢 Drafting board) and removed ~feature fest Will be reviewed at next Feature Fest labels Mar 8, 2024

noahtalerman unassigned Patagonia121 Mar 8, 2024

noahtalerman assigned rachaelshaw Mar 8, 2024

noahtalerman changed the title ~~Indicate in the Fleet UI whether scripts are enabled for a host~~ See if scripts are enabled/disabled on Host details page Mar 11, 2024

noahtalerman added the #g-endpoint-ops Endpoint ops product group label Mar 11, 2024

This was referenced Mar 22, 2024

#17148 API changes: See if scripts are enabled for a host #17812

Closed

#17148 API changes: See if scripts are enabled for a host #17813

Merged

rachaelshaw assigned sharon-fdm and unassigned rachaelshaw Mar 22, 2024

sharon-fdm assigned getvictor and RachelElysia and unassigned sharon-fdm Apr 1, 2024

sharon-fdm added :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. and removed :product Product Design department (shows up on 🦢 Drafting board) labels Apr 1, 2024

sharon-fdm added this to the 4.49.0-tentative milestone Apr 1, 2024

RachelElysia mentioned this issue Apr 4, 2024

Fleet UI: Make disabled dropdown tooltip a part of reusable dropdown component and implement #18054

Merged

2 tasks

getvictor mentioned this issue Apr 8, 2024

Added orbit_version, fleet_desktop_version, and scripts_enabled to host details. #18123

Merged

7 tasks

getvictor added the :product Product Design department (shows up on 🦢 Drafting board) label Apr 8, 2024

getvictor mentioned this issue Apr 8, 2024

Updating orbit_info schema. #18135

Merged

getvictor mentioned this issue Apr 10, 2024

Added error messages when scripts are disabled. #18174

Merged

2 tasks

getvictor added a commit that referenced this issue Apr 10, 2024

Updating orbit_info schema. (#18135)

a27634d

#17148 #17361 In orbit_info table, added the following fields: - desktop_version - scripts_enabled

getvictor removed the :product Product Design department (shows up on 🦢 Drafting board) label Apr 10, 2024

RachelElysia mentioned this issue Apr 12, 2024

[Unreleased bug and Unit tests] Test all disabled dropdown options on host actions dropdown #18231

Merged

1 task

jacobshandling mentioned this issue Apr 17, 2024

Fleet UI run script disabled when host has scripts enabled and on orbit < 1.24.0 #18382

Closed

lukeheath added :product Product Design department (shows up on 🦢 Drafting board) #g-endpoint-ops Endpoint ops product group and removed #g-endpoint-ops Endpoint ops product group labels Apr 24, 2024

rachaelshaw added a commit that referenced this issue Apr 25, 2024

#17148 API changes: See if scripts are enabled for a host (#17813)

de26973

For #17148.

rachaelshaw closed this as completed Apr 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

See if scripts are enabled/disabled on Host details page #17148

See if scripts are enabled/disabled on Host details page #17148

Patagonia121 commented Feb 23, 2024 •

edited by getvictor

Loading

noahtalerman commented Mar 8, 2024

noahtalerman commented Mar 20, 2024

sharon-fdm commented Mar 27, 2024

getvictor commented Apr 8, 2024 •

edited

Loading

getvictor commented Apr 9, 2024

rachaelshaw commented Apr 9, 2024

noahtalerman commented Apr 9, 2024

noahtalerman commented Apr 9, 2024

rachaelshaw commented Apr 9, 2024

noahtalerman commented Apr 11, 2024

noahtalerman commented Apr 19, 2024

xpkoala commented Apr 22, 2024 •

edited

Loading

noahtalerman commented Apr 23, 2024

rachaelshaw commented Apr 25, 2024

fleet-release commented Apr 25, 2024

See if scripts are enabled/disabled on Host details page #17148

See if scripts are enabled/disabled on Host details page #17148

Comments

Patagonia121 commented Feb 23, 2024 • edited by getvictor Loading

Goal

Context

Changes

Product

Engineering

QA

Risk assessment

Manual testing steps

Testing notes

Confirmation

noahtalerman commented Mar 8, 2024

noahtalerman commented Mar 20, 2024

sharon-fdm commented Mar 27, 2024

getvictor commented Apr 8, 2024 • edited Loading

getvictor commented Apr 9, 2024

rachaelshaw commented Apr 9, 2024

noahtalerman commented Apr 9, 2024

noahtalerman commented Apr 9, 2024

rachaelshaw commented Apr 9, 2024

noahtalerman commented Apr 11, 2024

noahtalerman commented Apr 19, 2024

xpkoala commented Apr 22, 2024 • edited Loading

noahtalerman commented Apr 23, 2024

rachaelshaw commented Apr 25, 2024

fleet-release commented Apr 25, 2024

Patagonia121 commented Feb 23, 2024 •

edited by getvictor

Loading

getvictor commented Apr 8, 2024 •

edited

Loading

xpkoala commented Apr 22, 2024 •

edited

Loading