Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

speed up macOS profile delivery for initial enrollments (#41960)

Browse Source 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #34433 

It speeds up the cron, meaning fleetd, bootstrap and now profiles should
be sent within 10 seconds of being known to fleet, compared to the
previous 1 minute.

It's heavily based on my last PR, so the structure and changes are close
to identical, with some small differences.
**I did not do the redis key part in this PR, as I think that should
come in it's own PR, to avoid overlooking logic bugs with that code, and
since this one is already quite sized since we're moving core pieces of
code around.**

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Faster macOS onboarding: device profiles are delivered and installed
as part of DEP enrollment, shortening initial setup.
* Improved profile handling: per-host profile preprocessing, secret
detection, and clearer failure marking.

* **Improvements**
  * Consolidated SCEP/NDES error messaging for clearer diagnostics.
  * Cron/work scheduling tuned to prioritize Apple MDM profile delivery.

* **Tests**
* Expanded MDM unit and integration tests, including
DeclarativeManagement handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Magnus Jensen
2026-03-19 14:58:10 -05:00
committed by GitHub
parent b46414ed56
commit a8c9e261d7
33 changed files with 2512 additions and 2132 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/fleet/cron.go
+49 -10
View File
@@ -732,8 +732,6 @@ func newWorkerIntegrationsSchedule(
logger *slog.Logger,
depStorage *mysql.NanoDEPStorage,
commander *apple_mdm.MDMAppleCommander,
bootstrapPackageStore fleet.MDMBootstrapPackageStore,
vppInstaller fleet.AppleMDMVPPInstaller,
androidModule android.Service,
) (*schedule.Schedule, error) {
const (
@@ -782,13 +780,7 @@ func newWorkerIntegrationsSchedule(
DEPService: depSvc,
DEPClient: depCli,
}
appleMDM := &worker.AppleMDM{
Datastore: ds,
Log: logger,
Commander: commander,
BootstrapPackageStore: bootstrapPackageStore,
VPPInstaller: vppInstaller,
}
vppVerify := &worker.AppleSoftware{
Datastore: ds,
Log: logger,
@@ -803,7 +795,7 @@ func newWorkerIntegrationsSchedule(
Log: logger,
AndroidModule: androidModule,
}
w.Register(jira, zendesk, macosSetupAsst, appleMDM, dbMigrate, vppVerify, softwareWorker)
w.Register(jira, zendesk, macosSetupAsst, dbMigrate, vppVerify, softwareWorker)
// Read app config a first time before starting, to clear up any failer client
// configuration if we're not on a fleet-owned server. Technically, the ServerURL
@@ -904,6 +896,53 @@ func newFailerClient(forcedFailures string) *worker.TestAutomationFailer {
return failerClient
}
func newAppleMDMWorkerSchedule(
ctx context.Context,
instanceID string,
ds fleet.Datastore,
logger *slog.Logger,
commander *apple_mdm.MDMAppleCommander,
bootstrapPackageStore fleet.MDMBootstrapPackageStore,
vppInstaller fleet.AppleMDMVPPInstaller,
) (*schedule.Schedule, error) {
const (
name = string(fleet.CronAppleMDMWorker)
scheduleInterval = 10 * time.Second // schedule a worker to run every 10 seconds if none is running
maxRunTime = 10 * time.Minute // allow the worker to run for 10 minutes
)
logger = logger.With("cron", name)
w := worker.NewWorker(ds, logger)
appleMDM := &worker.AppleMDM{
Datastore: ds,
Log: logger,
Commander: commander,
BootstrapPackageStore: bootstrapPackageStore,
VPPInstaller: vppInstaller,
}
w.Register(appleMDM)
s := schedule.New(
ctx, name, instanceID, scheduleInterval, ds, ds,
schedule.WithAltLockID("apple_mdm"),
schedule.WithLogger(logger),
schedule.WithJob("apple_mdm_worker", func(ctx context.Context) error {
workCtx, cancel := context.WithTimeout(ctx, maxRunTime)
defer cancel()
if err := w.ProcessJobs(workCtx); err != nil {
return fmt.Errorf("processing apple mdm jobs: %w", err)
}
return nil
}),
)
return s, nil
}
func newCleanupsAndAggregationSchedule(
ctx context.Context,
instanceID string,
cmd/fleet/serve.go
+11 -3
View File
@@ -30,6 +30,7 @@ import (
"github.com/fleetdm/fleet/v4/ee/server/service/est"
"github.com/fleetdm/fleet/v4/ee/server/service/hostidentity"
"github.com/fleetdm/fleet/v4/ee/server/service/hostidentity/httpsig"
"github.com/fleetdm/fleet/v4/ee/server/service/scep"
"github.com/fleetdm/fleet/v4/pkg/fleethttp"
"github.com/fleetdm/fleet/v4/pkg/scripts"
"github.com/fleetdm/fleet/v4/pkg/str"
@@ -872,7 +873,7 @@ the way that the Fleet server works.
}
eh := errorstore.NewHandler(ctx, redisPool, logger, config.Logging.ErrorRetentionPeriod)
scepConfigMgr := eeservice.NewSCEPConfigService(logger, nil)
scepConfigMgr := scep.NewSCEPConfigService(logger, nil)
digiCertService := digicert.NewService(digicert.WithLogger(logger))
ctx = ctxerr.NewContext(ctx, eh)
@@ -1176,12 +1177,19 @@ the way that the Fleet server works.
if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
commander := apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService)
vppInstaller := svc.(fleet.AppleMDMVPPInstaller)
return newWorkerIntegrationsSchedule(ctx, instanceID, ds, logger, depStorage, commander, bootstrapPackageStore, vppInstaller, androidSvc)
return newWorkerIntegrationsSchedule(ctx, instanceID, ds, logger, depStorage, commander, androidSvc)
}); err != nil {
initFatal(err, "failed to register worker integrations schedule")
}
if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
commander := apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService)
vppInstaller := svc.(fleet.AppleMDMVPPInstaller)
return newAppleMDMWorkerSchedule(ctx, instanceID, ds, logger, commander, bootstrapPackageStore, vppInstaller)
}); err != nil {
initFatal(err, "failed to register apple_mdm_worker schedule")
}
if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
return newAppleMDMDEPProfileAssigner(ctx, instanceID, config.MDM.AppleDEPSyncPeriodicity, ds, depStorage, logger)
}); err != nil {
cmd/fleetctl/integrationtest/gitops/gitops_enterprise_integration_test.go
+2 -2
View File
@@ -22,8 +22,8 @@ import (
"github.com/fleetdm/fleet/v4/cmd/fleetctl/fleetctl/testing_utils"
"github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest"
ma "github.com/fleetdm/fleet/v4/ee/maintained-apps"
eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
"github.com/fleetdm/fleet/v4/ee/server/service/digicert"
"github.com/fleetdm/fleet/v4/ee/server/service/scep"
"github.com/fleetdm/fleet/v4/server/config"
"github.com/fleetdm/fleet/v4/server/datastore/filesystem"
"github.com/fleetdm/fleet/v4/server/datastore/mysql"
@@ -111,7 +111,7 @@ func (s *enterpriseIntegrationGitopsTestSuite) SetupSuite() {
SCEPStorage: scepStorage,
Pool: redisPool,
APNSTopic: "com.apple.mgmt.External.10ac3ce5-4668-4e58-b69a-b2b5ce667589",
SCEPConfigService: eeservice.NewSCEPConfigService(slog.New(slog.NewTextHandler(os.Stdout, nil)), nil),
SCEPConfigService: scep.NewSCEPConfigService(slog.New(slog.NewTextHandler(os.Stdout, nil)), nil),
DigiCertService: digicert.NewService(),
SoftwareTitleIconStore: softwareTitleIconStore,
}