Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

48093 auld api gitops latest os version (#50213)

Browse Source 
**Related issue:** Resolves #48093

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`

- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added “latest” version enforcement for macOS, iOS, and iPadOS updates
using required `deadline_days`.
* Updates dynamically target each device’s available OS version and
deadline.
  * Configuration and GitOps outputs now include `deadline_days`.

* **Bug Fixes**
* Improved validation when switching update modes or omitting deadline
settings.
* GitOps updates now clear previously stored deadline values when
omitted.
  * Changes to `deadline_days` are detected and applied consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
This commit is contained in:
Andrew Mellor
2026-08-05 12:37:11 +01:00
committed by GitHub
co-authored by Magnus Jensen
parent 5e95589554
commit 192ac4eb51
38 changed files with 1383 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/fleetctl/fleetctl/gitops_test.go
+17
View File
@@ -7498,6 +7498,23 @@ software:
return false, nil
}
})
t.Run("update_new_hosts derives true in latest mode", func(t *testing.T) {
savedTeam = existingTeamWithMacOSUpdates("", "")
teamFile, err := os.CreateTemp(t.TempDir(), "*.yml")
require.NoError(t, err)
// "latest" has no deadline, so deriving from the deadline alone would
// leave new hosts unenforced.
_, err = teamFile.WriteString(teamYAML(
" macos_updates:\n minimum_version: \"latest\"\n deadline_days: 7"))
require.NoError(t, err)
_ = runAppForTest(t, []string{"gitops", "-f", teamFile.Name()})
require.Equal(t, optjson.SetBool(true), savedTeam.Config.MDM.MacOSUpdates.UpdateNewHosts)
require.Equal(t, optjson.SetInt(7), savedTeam.Config.MDM.MacOSUpdates.DeadlineDays)
})
})
t.Run("ios_updates", func(t *testing.T) {
cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json
Vendored
+3
View File
@@ -135,16 +135,19 @@
"macos_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ios_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ipados_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"windows_updates": {
cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json
Vendored
+3
View File
@@ -108,16 +108,19 @@
"macos_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ios_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ipados_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"windows_updates": {
cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml
Vendored
+3
View File
@@ -62,14 +62,17 @@ spec:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ios_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ipados_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
windows_updates:
deadline_days: 7
grace_period_days: 3
cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
Vendored
+3
View File
@@ -61,14 +61,17 @@ spec:
macos_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
ios_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
ipados_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
windows_updates:
deadline_days: 7
cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
Vendored
+3
View File
@@ -88,16 +88,19 @@
"macos_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ios_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"ipados_updates": {
"minimum_version": null,
"deadline": null,
"deadline_days": null,
"update_new_hosts": null
},
"windows_updates": {
cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
Vendored
+3
View File
@@ -61,14 +61,17 @@ spec:
macos_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
ios_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
ipados_updates:
minimum_version: null
deadline: null
deadline_days: null
update_new_hosts: null
windows_updates:
deadline_days: 7
cmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.json
Vendored
+12
View File
@@ -37,16 +37,19 @@
"enable_recovery_lock_password": false,
"ios_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
"ipados_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
"macos_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
@@ -122,11 +125,13 @@
"enable_recovery_lock_password": false,
"ios_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
"ipados_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
@@ -149,6 +154,7 @@
},
"macos_updates": {
"deadline": null,
"deadline_days": null,
"minimum_version": null,
"update_new_hosts": null
},
@@ -234,16 +240,19 @@
"enable_recovery_lock_password": true,
"ios_updates": {
"deadline": "2022-11-15",
"deadline_days": null,
"minimum_version": "17.5",
"update_new_hosts": null
},
"ipados_updates": {
"deadline": "2023-01-01",
"deadline_days": null,
"minimum_version": "18.0",
"update_new_hosts": null
},
"macos_updates": {
"deadline": "2021-12-14",
"deadline_days": null,
"minimum_version": "12.3.1",
"update_new_hosts": null
},
@@ -334,11 +343,13 @@
"enable_recovery_lock_password": true,
"ios_updates": {
"deadline": "2022-11-15",
"deadline_days": null,
"minimum_version": "17.5",
"update_new_hosts": null
},
"ipados_updates": {
"deadline": "2023-01-01",
"deadline_days": null,
"minimum_version": "18.0",
"update_new_hosts": null
},
@@ -361,6 +372,7 @@
},
"macos_updates": {
"deadline": "2021-12-14",
"deadline_days": null,
"minimum_version": "12.3.1",
"update_new_hosts": null
},
cmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.yml
Vendored
+10
View File
@@ -24,14 +24,17 @@ spec:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ios_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ipados_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
windows_updates:
deadline_days: null
grace_period_days: null
@@ -85,14 +88,17 @@ spec:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ios_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
ipados_updates:
update_new_hosts: null
minimum_version: null
deadline: null
deadline_days: null
windows_updates:
deadline_days: null
grace_period_days: null
@@ -158,9 +164,11 @@ spec:
ios_updates:
minimum_version: "17.5"
deadline: "2022-11-15"
deadline_days: null
macos_updates:
minimum_version: "18.0"
deadline: "2023-01-01"
deadline_days: null
windows_updates:
deadline_days: 7
grace_period_days: 3
@@ -218,9 +226,11 @@ spec:
ios_updates:
minimum_version: "17.5"
deadline: "2022-11-15"
deadline_days: null
macos_updates:
minimum_version: "18.0"
deadline: "2023-01-01"
deadline_days: null
windows_updates:
deadline_days: 7
grace_period_days: 3
cmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yaml
Vendored
+3
View File
@@ -18,14 +18,17 @@ android_settings:
macos_updates:
minimum_version: "15.1"
deadline: "2024-12-31"
deadline_days:
update_new_hosts: true
ios_updates:
minimum_version: "18.1"
deadline: "2025-12-31"
deadline_days:
update_new_hosts:
ipados_updates:
minimum_version: "18.2"
deadline: "2026-12-31"
deadline_days:
update_new_hosts:
windows_updates:
deadline_days: 5
cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/team-a-thumbsup.yml
Vendored
+3
View File
@@ -31,14 +31,17 @@ controls:
enable_recovery_lock_password: false
ios_updates:
deadline: "2021-12-31"
deadline_days:
minimum_version: "98.1"
update_new_hosts:
ipados_updates:
deadline: "2022-12-31"
deadline_days:
minimum_version: "98.2"
update_new_hosts:
macos_updates:
deadline: "2020-12-31"
deadline_days:
minimum_version: "95.1"
update_new_hosts: true
name_template: iPad $FLEET_VAR_HOST_HARDWARE_SERIAL
cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/unassigned.yml
Vendored
+3
View File
@@ -6,10 +6,12 @@ controls:
enable_turn_on_windows_mdm_manually: false
ios_updates:
deadline: "2025-12-31"
deadline_days:
minimum_version: "18.1"
update_new_hosts:
ipados_updates:
deadline: "2026-12-31"
deadline_days:
minimum_version: "18.2"
update_new_hosts:
macos_migration:
@@ -18,6 +20,7 @@ controls:
webhook_url: https://some-macos-migration-webhook-url.com
macos_updates:
deadline: "2024-12-31"
deadline_days:
minimum_version: "15.1"
update_new_hosts: true
name_template: No team Mac $FLEET_VAR_HOST_UUID
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
Vendored
+3
View File
@@ -100,14 +100,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
Vendored
+3
View File
@@ -100,14 +100,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
Vendored
+12
View File
@@ -44,14 +44,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -105,14 +108,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -167,12 +173,15 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
windows_updates:
deadline_days: null
@@ -221,12 +230,15 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
windows_updates:
deadline_days: null
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
Vendored
+12
View File
@@ -44,14 +44,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -105,14 +108,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -167,12 +173,15 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
windows_updates:
deadline_days: null
@@ -222,12 +231,15 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
windows_updates:
deadline_days: null
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
Vendored
+6
View File
@@ -40,14 +40,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -101,14 +104,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.yml
Vendored
+6
View File
@@ -43,14 +43,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates:
@@ -104,14 +107,17 @@ spec:
software: null
macos_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ios_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
ipados_updates:
deadline: null
deadline_days: null
minimum_version: null
update_new_hosts: null
windows_updates: