Software: Custom targets with "Include any" and "Exclude any"

[noahtalerman]

Goal

User story
As an IT admin that's targeting specific hosts by adding a label (include) to sel-service software that's available for install,
I want to exclude some hosts within that label
so that I can have more control over which hosts present that software in self-service without having to write a long label query.

Roadmap item

Original requests

• Allow combination of inclusions and exclusions using labels #29207

Context

• Product Designer: _________________________
• Engineer: _________________________

Changes

Product

• UI changes: TODO
• CLI (fleetctl) usage changes: TODO
• YAML changes: TODO
• REST API changes: TODO
• Fleet's agent (fleetd) changes: TODO
• GitOps mode UI changes: TODO
• GitOps generation changes: TODO
• Activity changes: TODO
• Permissions changes: TODO
• Changes to paid features or tiers: TODO
• My device and fleetdm.com/better changes: TODO
• Usage statistics: TODO
• Other reference documentation changes: TODO
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Load testing/osquery-perf improvements: TODO
• This is a premium only feature: Yes / No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

1. TODO
2. TODO
3. TODO

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[georgekarrv]

@mna I would appreciate you weighing in on the level of effort here. I think this sounds like a S (1 dev 1 sprint) or possibly even an XS but I know you worked on these targets originally and might know the barbs lying in wait with this.

[georgekarrv]

Marking it XS but Martin feel free to update it based on what you think

[mna]

@georgekarrv It looks like this will be only for software installs (not policies/custom profiles/other places where we may have label conditions). And for software installs, it looks like we only support "include any" and "exclude any" (i.e. not "include all").

So it looks like it's mainly this query that will need to be updated (don't take this for cash - I may have missed some other places, took a quick look):

fleet/server/datastore/mysql/software_installers.go

Line 2952 in 2fc46bf

func (ds *Datastore) isSoftwareLabelScoped(ctx context.Context, softwareID, hostID uint, swType softwareType) (bool, error) {

And some validations. Doesn't look like DB schema changes will be required (label ID is unique within an installer, which means it won't be able to be used as both include and exclude, but that's probably a good thing).

The query will be tricky to update, as it currently expects that only one category of labels is possible, and tests with labels are painful/long to write. I think S sounds good if it means 1 dev 1 sprint. I assume XS is like 1 dev a week? Could be a bit aggressive, I can see it taking a bit of time and figuring out edge cases to get the query right.

[georgekarrv]

Updated to S ty!