Configure END_USER_EMAIL, and FLEET_DESKTOP when installing base fleetd for Windows (.msi)

[nonpunctual]

Goal

User story
As an IT admin,
I want to configure fleetd base installer for Windows
so that I can manage fleetd without additional dependencies.

Context

• Requestor(s): @nonpunctual
• Product designer: @marko-lisica

Customer-eponym feedback:

Having to maintain dependencies & resources for building Fleet install packages is non-optimal for customers who just want to run an installer to enroll a Host.

Customized Fleet install packages have dependencies on Wix, Wine, Docker. Enrolling hosts into known tenants that are cloud-managed should be easier.

Not all fleetctl package options need to be built into the installers but oft-requested options are the ability to toggle enabling / disabling scripts & enabling / disabling the Fleet Desktop app.

Changes

Product

• Changes:

• Add new parameter to enable/disable Fleet Desktop installation (FLEET_DESKTOP):

msiexec /i fleetd-base.msi FLEET_DESKTOP=true FLEET_URL="<target_url>" FLEET_SECRET="<secret_to_use>"

• Add new parameter to enable users to supply end user email address (END_USER_EMAIL):

msiexec /i fleetd-base.msi  END_USER_EMAIL=<email> FLEET_URL="<target_url>" FLEET_SECRET="<secret_to_use>"

• Docs changes: In article explains that install parameter overrides value that's added at package time
  • Note: Our fleetd-base.msi has Fleet desktop enabled by default. We must enable it by default to include the fleet-desktop executable in the package.

Engineering

• Database schema migrations: TODO
• Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Risk level: Low

Manual testing steps

1. Use the TUF testing flow to build a Windows installer with fleet-desktop enabled. (It must be enabled to include the fleet-desktop executable in the MSI package.)
2. Install the MSI package on windows

• with FLEET_DESKTOP=false or FLEET_DESKTOP=1 or without (should be enabled by default)
• with/without END_USER_EMAIL
• example: msiexec /i fleet-osquery.msi FLEET_URL="https://host.docker.internal:8080" FLEET_SECRET="XXX" FLEET_DESKTOP=false END_USER_EMAIL="bozo@example.com"

3. ensure hosts get enrolled with configs in place

• Note: after custom email is applied to the host, it is not cleared automatically

Backward compatibility tests

1. Using the new fleetctl, build MSI package using stable orbit 1.27.0 (or earlier) with/without --end-user-email option and make sure it can be installed.

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Hey @nonpunctual, Fleet has a base fleetd for Windows here: https://download.fleetdm.com/fleetd-base.msi

Instructions for installing fleetd + hooking it up to Fleet are in this article: https://fleetdm.com/guides/config-less-fleetd-agent-deployment

Does the workflow described in the article work for customer-eponym? If we don't know, maybe we can tag them in this GitHub issue?

[nonpunctual]

The base packages are not configurable. The request is for configurable base packages.

[nonpunctual]

#17528

[noahtalerman]

What happens if you set an option at package time (for ex. enroll secret) and then you pass as a parameter at install time? What’s the behavior today? Does it make sense?
What happens if you install w/o required options? Is there an error message? What are required options?
I think it’s enroll secret and server URL

cc @marko-lisica @noahtalerman

[marko-lisica]

What happens if you install w/o required options? Is there an error message? What are required options?

Hey @dantecatalfamo, I'm trying to answer this question. I've installed fleetd-base.msi on my VM and it went through, even though it can't work without SERVER_URL and ENROLL_SECRET. Is it possible at all for msiexec to throw an error if some params are missing?

[dantecatalfamo]

What happens if you install w/o required options? Is there an error message? What are required options?

Hey @dantecatalfamo, I'm trying to answer this question. I've installed fleetd-base.msi on my VM and it went through, even though it can't work without SERVER_URL and ENROLL_SECRET. Is it possible at all for msiexec to throw an error if some params are missing?

That's a good question, I don't know

[marko-lisica]

What happens if you set an option at package time (for ex. enroll secret) and then you pass as a parameter at install time? What’s the behavior today? Does it make sense?

@noahtalerman I tested this. I generated .msi installer with package command with server URL and enroll secret baked in. At install time I passed enroll secret for another team and it overwritten one that was added at package time.

What happens if you install w/o required options? Is there an error message? What are required options?
I think it’s enroll secret and server URL

Tested this as well. I was able to install fleetd-base.msi without any parameters. Installation was successful and host wasn't enrolled. Still figuring out if it's possible to have required parameters when installing with msiexec

[georgekarrv]

Hey team! Please add your planning poker estimate with Zenhub @dantecatalfamo @ghernandez345 @gillespi314 @mna @roperzh