Add guide for setting up a canary fleet to catch fleetd conflicts - #46347
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
There was a problem hiding this comment.
Pull request overview
Adds a new guide article explaining how to set up a “canary” Fleet Premium fleet using the edge update channel to detect fleetd/EDR compatibility issues before rolling updates to production hosts.
Changes:
- New article describing what the
edgechannel is and how to configureupdate_channelsfor orbit/osqueryd/desktop. - Guidance on enrolling representative test devices and what signals to monitor (offline hosts, EDR alerts, query failures).
- Notes an important orbit downgrade edge case and links to the agent configuration docs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
WalkthroughThis PR contains three independent infrastructure updates: advancing the Fleet-maintained apps submodule with refreshed installer URLs and SHA-256 checksums for multiple applications, refactoring the CIS benchmarks conversion script from a hardcoded downloader to a parameterized GitOps converter that processes YAML files, and updating a development worktree reference pointer. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.claude/worktrees/interesting-ramanujan-6fb826 (2)
129-129:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate documentation to match new file-based output.
The documentation states "The converted YAML is written to standard out in the Terminal. Copy/paste the CIS policies..." but the updated script now writes output directly to a file (
../gitops/<filename>) instead of stdout. The instructions should be updated to reflect this change.📝 Proposed documentation update
-3. The converted YAML is written to standard out in the Terminal. Copy/paste the CIS policies you wish to use into your own YAML file and run Fleet GitOps. +3. The converted YAML is written to a file in the `../gitops/` directory. Review the output file and run Fleet GitOps.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/worktrees/interesting-ramanujan-6fb826 at line 129, Update the documentation that currently says "The converted YAML is written to standard out in the Terminal. Copy/paste the CIS policies..." to reflect that the script now writes output to a file under ../gitops/<filename>; change all references to stdout and manual copy/paste to state that the converted YAML is saved to ../gitops/<filename> and can be applied via Fleet GitOps from that file, and adjust any examples/usage steps to show the new file-based workflow and path instead of instructing users to copy/paste from the terminal.
113-113:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winHardcoded macOS Homebrew path breaks portability.
The script uses
/opt/homebrew/bin/yqwhich only exists on macOS with Homebrew installed. This breaks portability to Linux and other systems whereyqwould be installed elsewhere.🔧 Proposed fix to use yq from PATH
-/opt/homebrew/bin/yq eval-all ' +yq eval-all ' [select(.spec.name != null and .spec.name != "") | .spec | { "name": ((.name // "") | sub("\n$", "")), "description": ((.description // "") | sub("\n$", "")), "resolution": ((.resolution // "") | sub("\n$", "")), "query": ((.query // "") | sub("\n$", "")), "platform": ((.platform // "") | sub("\n$", "")), "critical": ((.tags // "") | test("critical:true")), "calendar_events_enabled": false, "tags": ((.tags // "") | sub("\n$", "")) }] -' "$cispath" | /opt/homebrew/bin/yq eval '.[] | [.]' - | /opt/homebrew/bin/yq eval-all '. as $item ireduce ([]; . + $item)' - > "$outputfile" +' "$cispath" | yq eval '.[] | [.]' - | yq eval-all '. as $item ireduce ([]; . + $item)' - > "$outputfile"Alternatively, add installation/requirements documentation if the Homebrew version is specifically required.
Also applies to: 124-124
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/worktrees/interesting-ramanujan-6fb826 at line 113, Replace the hardcoded macOS Homebrew binary path "/opt/homebrew/bin/yq" with an invocation that uses the yq on the PATH (e.g. "yq eval-all") or a configurable fallback (env var like YQ_PATH) so the script works on Linux and other systems; update the two occurrences of "/opt/homebrew/bin/yq" in the script to call "yq" from PATH (or check/assign YQ_PATH first) and optionally add a brief runtime check that exits with a helpful error if yq is not found.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.claude/worktrees/interesting-ramanujan-6fb826:
- Line 129: Update the documentation that currently says "The converted YAML is
written to standard out in the Terminal. Copy/paste the CIS policies..." to
reflect that the script now writes output to a file under ../gitops/<filename>;
change all references to stdout and manual copy/paste to state that the
converted YAML is saved to ../gitops/<filename> and can be applied via Fleet
GitOps from that file, and adjust any examples/usage steps to show the new
file-based workflow and path instead of instructing users to copy/paste from the
terminal.
- Line 113: Replace the hardcoded macOS Homebrew binary path
"/opt/homebrew/bin/yq" with an invocation that uses the yq on the PATH (e.g. "yq
eval-all") or a configurable fallback (env var like YQ_PATH) so the script works
on Linux and other systems; update the two occurrences of "/opt/homebrew/bin/yq"
in the script to call "yq" from PATH (or check/assign YQ_PATH first) and
optionally add a brief runtime check that exits with a helpful error if yq is
not found.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7cf3d428-c2b5-4a68-a604-470bc5b65880
⛔ Files ignored due to path filters (1)
articles/canary-fleet-for-fleetd-updates.mdis excluded by!**/*.md
📒 Files selected for processing (3)
.claude/worktrees/blissful-yonath-9b0d81.claude/worktrees/interesting-ramanujan-6fb826.claude/worktrees/sweet-gauss-fa2930
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Removed section about downgrading orbit version to prevent restart loop.
Summary by CodeRabbit
Chores
New Features