From c7c0ee34da9fa403f36bee80c085e04097d47088 Mon Sep 17 00:00:00 2001 From: Gabriel Hernandez Date: Thu, 8 Jan 2026 11:07:38 +0000 Subject: [PATCH] Improved error message when trying to apply CAs via gitops without a premium license (#37981) **Related issue:** Resolves #35645 This changes the error message for an invalid license when trying to apply certificate authorities via GitOps - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually --- changes/issue-32110-new-err-message-license-ca-gitops | 1 + cmd/fleetctl/fleetctl/apply.go | 2 +- server/service/client.go | 7 ++++++- server/service/endpoint_setup.go | 1 + 4 files changed, 9 insertions(+), 2 deletions(-) create mode 100644 changes/issue-32110-new-err-message-license-ca-gitops diff --git a/changes/issue-32110-new-err-message-license-ca-gitops b/changes/issue-32110-new-err-message-license-ca-gitops new file mode 100644 index 0000000000..61f68104b9 --- /dev/null +++ b/changes/issue-32110-new-err-message-license-ca-gitops @@ -0,0 +1 @@ +- add better errro message when trying to apply certificate authorities via gitops without the correct license diff --git a/cmd/fleetctl/fleetctl/apply.go b/cmd/fleetctl/fleetctl/apply.go index 0abf980676..6c3016ad72 100644 --- a/cmd/fleetctl/fleetctl/apply.go +++ b/cmd/fleetctl/fleetctl/apply.go @@ -95,7 +95,7 @@ func applyCommand() *cli.Command { teamsVPPApps := make(map[string][]fleet.VPPAppResponse) teamsScripts := make(map[string][]fleet.ScriptResponse) - _, _, _, _, err = fleetClient.ApplyGroup(c.Context, false, specs, baseDir, logf, nil, opts, teamsSoftwareInstallers, teamsVPPApps, teamsScripts) + _, _, _, _, err = fleetClient.ApplyGroup(c.Context, false, specs, baseDir, logf, nil, opts, teamsSoftwareInstallers, teamsVPPApps, teamsScripts, nil) if err != nil { return err } diff --git a/server/service/client.go b/server/service/client.go index 6785a99970..4967212e7e 100644 --- a/server/service/client.go +++ b/server/service/client.go @@ -530,6 +530,7 @@ func (c *Client) ApplyGroup( teamsSoftwareInstallers map[string][]fleet.SoftwarePackageResponse, teamsVPPApps map[string][]fleet.VPPAppResponse, teamsScripts map[string][]fleet.ScriptResponse, + filename *string, ) (map[string]uint, map[string][]fleet.SoftwarePackageResponse, map[string][]fleet.VPPAppResponse, map[string][]fleet.ScriptResponse, error) { logfn := func(format string, args ...interface{}) { if logf != nil { @@ -578,6 +579,10 @@ func (c *Client) ApplyGroup( if specs.CertificateAuthorities != nil { if err := c.ApplyCertificateAuthoritiesSpec(*specs.CertificateAuthorities, opts.ApplySpecOptions); err != nil { + // only do this custom message for gitops as we reference the applying filename which only makes sense in gitops + if err.Error() == "missing or invalid license" && viaGitOps && filename != nil { + return nil, nil, nil, nil, fmt.Errorf("Couldn't edit \"%s\" at \"certificate_authorities\": Missing or invalid license. Certificate authorities are available in Fleet Premium only.", *filename) + } return nil, nil, nil, nil, fmt.Errorf("applying certificate authorities: %w", err) } // TODO(hca): is more detailed logging a hard requirement or can it be a follow up improvement? @@ -2300,7 +2305,7 @@ func (c *Client) DoGitOps( Overwrite: true, }, ExpandEnvConfigProfiles: true, - }, teamsSoftwareInstallers, teamsVPPApps, teamsScripts) + }, teamsSoftwareInstallers, teamsVPPApps, teamsScripts, &filename) if err != nil { return nil, err } diff --git a/server/service/endpoint_setup.go b/server/service/endpoint_setup.go index 807b6428d5..dfff7da05a 100644 --- a/server/service/endpoint_setup.go +++ b/server/service/endpoint_setup.go @@ -248,6 +248,7 @@ func ApplyStarterLibrary( teamsSoftwareInstallers, teamsVPPApps, teamsScripts, + nil, ) return err }