qq - I saw the 'global queries' and merge queries ...
# fleet
v
qq - I saw the 'global queries' and merge queries change announcement https://osquery.slack.com/archives/C01DXJL16D8/p1690301752005349 I've tried making sense of this via github but wasn't really sucessful e.g this https://github.com/fleetdm/fleet/pull/13078 Can someone explain the impact for this Our scenario is we manage packs and queries via packs via api pipeline. [Fleet 4.30.1 in kube gcp. No premium license] More specifically we have a prod label set and uat label set and uat/prod pack targeted to those labels to be able to test new content we declare the labels, and packs + queries as yaml and then push them via/check current state vs git
Copy code
/api/latest/fleet/packs
/api/latest/fleet/packs/schedule
/api/latest/fleet/labels
/api/latest/fleet/queries
/api/latest/fleet/queries/{query['id']}
/api/latest/fleet/packs/{pack['id']}
/api/latest/fleet/labels/{label_id}
with global scheduled queries disabled We also occasionally use the https://meow.meow/packs/manage ui to spot check (yes i understand this is errr deprecated]
so i guess the short version is - if we upgrade to let's say 4.36: 1. can we still keep the global scheduled queries disabled or do we now need to turn them on 2. can we still target queries to labels (static pc/mac sets in our case for UAT ) or is that deprecated now and requires teams/premium. 3. of the apis above - what do we need to change 4. what exactly is fleetctl
upgrade-packs
and how does this fit into the picture of upgrading from 4.30 to 4.36 / changing the pipeline 5. is the secret https://meow.meow/packs/manage going away by 4.36 😄 ? 6. do we need to reenable global queries 😕 🆘
k
Hi @Vlad Previn! The packs functionality is still there for backwards compatibility! We just changed things about to make managing queries and schedule more streamlined and get back to using Packs as they were originally intended (a fast way to import groups of queries). There are some changes to the Queries Api.
upgrade-packs
is a tool to help with the transition from Packs to Schedule, but isn't something you're required to do.
v
i see thanks Kathy. Hmm so we're not required to re-enable global queries ?