Having an issue configuring Fleet with a YAML file. The password is specified in the file, but when I attempt to start it up using

fleet serve --config /etc/fleet/fleet.yml

, I’m getting:

mysql="could not connect to db: Error 1045: Access denied for user 'fleet'@'localhost' (using password: NO), sleeping 0s"

If instead I specify the password with a CLI flag, it works fine. The config file is fairly simple:

apiVersion: v1
kind: config
spec:
  mysql:
    password: '<my password>'
  server:
    address: 0.0.0.0:443
    cert: '/etc/letsencrypt/live/<my domain>/fullchain.pem'
    key: '/etc/letsencrypt/live/<my domain>/privkey.pem'

Anyone know why fleet would seem to be ignoring my config file?

Hi @Shawn Maddock! Could you try with:

mysql:
  password: '<my password>'
server:
  address: 0.0.0.0:443  
  cert: '/etc/letsencrypt/live/<my domain>/fullchain.pem'
  key: '/etc/letsencrypt/live/<my domain>/privkey.pem'

See https://fleetdm.com/docs/deploying/configuration#using-a-yaml-config-file

Okay, that worked… but that means https://fleetdm.com/docs/deploying/configuration#example-yaml and https://fleetdm.com/docs/using-fleet/configuration-files are incorrect

Yes, probably outdated docs. I'll open an issue and link this thread.

Yikes. I mean, thanks, but yikes. I hope that top level structure is the only thing outdated.

Oh seems we already have an issue for this: https://github.com/fleetdm/fleet/issues/7557

That “two different configs” is very confusing, and needs to be called out.

Indeed. Thanks for the feedback!

So since I’m still a little confused and a newb, can all

config

type settings be specified in the one passed by

fleet --config

, or are there some that can only be set via

fleetctl apply

?

No, only some settings can be applied via

fleetctl apply

, like queries, packs, osquery agent settings. These settings are defined here: https://fleetdm.com/docs/using-fleet/configuration-files

I think that makes sense. I’ll keep playing around and reach back out if I run into other issues. Thanks!

Hi @Shawn Maddock! You can pull the full config with

fleetctl get config --include-server-config

. I'm sorry about the weirdness in the docs, I'll dig in to that and make sure everything is up to date.

That flag is not actually adding anything to the output on my instance

That's really odd! Can you share that output with anything sensitive removed? I know there's been a lot of back and forth on this already, so I'd also be happy to jump on a quick Zoom call so you can do some show and tell to streamline things if you'd like.