mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
Move enable_custom_os_updates_and_filevault and allow_all_declarations to Fleet server configuration (#42938)
- @noahtalerman: We decided to stop calling the settings experimental and just warn in the docs what happens if you turn it on. That way we’re not calling them “experimental” which feels unsafe. They're not experimental; they're just deliberately allowing custom profiles.
This commit is contained in:
kilo-code-bot[bot]
GitHub
parent
0e7107b0ab
commit
7b49a20f7c
3 changed files with 36 additions and 31 deletions
|
|
@ -3356,6 +3356,38 @@ If you have an [Apple Developer account that is enabled as an MDM vendor](https:
|
|||
apple_vpp_app_metadata_api_bearer_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ92eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikp
|
||||
```
|
||||
|
||||
### mdm.enable_custom_os_updates_and_filevault
|
||||
|
||||
*Available in Fleet Premium.*
|
||||
|
||||
Allows users to add custom Apple MDM profiles for OS updates and FileVault management, including the [SoftwareUpdateEnforcementSpecific declaration (DDM)](https://developer.apple.com/documentation/devicemanagement/softwareupdateenforcementspecific), [FDEFileVault](https://developer.apple.com/documentation/devicemanagement/fdefilevault), [FDEFileVaultOptions](https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions), [FDERecoveryKeyEscrow](https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow), and [/Vendor/MSFT/Policy/Config/Update/](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update) configuration profiles.
|
||||
|
||||
> Enabling this option may cause conflicts between your custom OS update or FileVault configuration profiles and the profiles Fleet manages under the hood for these features.
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT`
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
enable_custom_os_updates_and_filevault: true
|
||||
```
|
||||
|
||||
### mdm.allow_all_declarations
|
||||
|
||||
Allows all types of Apple [declaration profiles](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations) to be sent, bypassing all safety checks. By default, Fleet doesn't allow [these configurations](https://github.com/fleetdm/fleet/blob/9589631a7f25a342ed24571c08deffbc959661ec/server/fleet/apple_mdm.go#L704-L717).
|
||||
|
||||
> Enabling this option bypasses all safety checks for declarations, including checks for forbidden declaration types, reserved identifiers, and required prefixes. Only enable this when you need to deploy declarations that Fleet would otherwise block.
|
||||
|
||||
[Asset](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations#Assets) declarations require additional infrastructure. You need to self-host the asset and include the URL in the [declaration](https://developer.apple.com/documentation/devicemanagement/assetdata#Asset-example).
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_MDM_ALLOW_ALL_DECLARATIONS`
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
allow_all_declarations: true
|
||||
```
|
||||
|
||||
### fleet_allow_bootstrap_package_during_migration
|
||||
|
||||
When set to `1` or `true`, this environment variable enables Fleet to install bootstrap packages on hosts during MDM migration enrollments (i.e. non-DEP enrollments). By default, bootstrap packages are only installed for DEP-enrolled hosts. Setting this variable restores the previous behavior, ensuring all new enrollments receive the bootstrap package.
|
||||
|
|
|
|||
|
|
@ -196,19 +196,7 @@ Key that allows the Fleet server to communicate to the Microsoft compliance part
|
|||
|
||||
### mdm.enable_custom_os_updates_and_filevault
|
||||
|
||||
> Experimental feature. This feature will be removed when Fleet adds the ability to add custom OS update and FileVault profiles via Fleet's UI, API, and YAML.
|
||||
|
||||
This configuration option is not production ready. It hasn't been tested by Fleet. There will be conflicts between custom OS updates / FileVault configuration profiles and the profiles Fleet uses for these features under-the-hood.
|
||||
|
||||
If set to `true`, Fleet allows users to add the [SoftwareUpdateEnforcementSpecific declaration (DDM)](https://developer.apple.com/documentation/devicemanagement/softwareupdateenforcementspecific) profile, [FDEFileVault](https://developer.apple.com/documentation/devicemanagement/fdefilevault), [FDEFileVaultOptions](https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions), [FDERecoveryKeyEscrow](https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow), and [/Vendor/MSFT/Policy/Config/Update/](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update) configuration profiles.
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT`
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
enable_custom_os_updates_and_filevault: true
|
||||
```
|
||||
Documentation for setting has moved to the [Fleet server configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#mdm-enable_custom_os_updates_and_filevault) reference.
|
||||
|
||||
### logging.tracing_enabled
|
||||
|
||||
|
|
@ -244,22 +232,7 @@ Enables exporting logs to an OpenTelemetry collector in addition to stderr outpu
|
|||
|
||||
### mdm.allow_all_declarations
|
||||
|
||||
> Experimental feature. This feature will be removed when Fleet adds the ability to add any declaration via Fleet's UI, API, and YAML.
|
||||
|
||||
This configuration option is not production ready. It hasn't been tested by Fleet. Enabling this option bypasses all safety checks for declarations, including checks for forbidden declaration types, reserved identifiers, and required prefixes. Use only when you need to
|
||||
deploy declarations that Fleet would otherwise block.
|
||||
|
||||
If set to `true`, you can add all types of Apple [declaration profiles](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations). By default, Fleet doesn't allow [these configurations](https://github.com/fleetdm/fleet/blob/9589631a7f25a342ed24571c08deffbc959661ec/server/fleet/apple_mdm.go#L704-L717).
|
||||
|
||||
[Asset](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations#Assets) declarations require additional infrastructure. You need to self-host the asset and include the URL in the [declaration](https://developer.apple.com/documentation/devicemanagement/assetdata#Asset-example).
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_MDM_ALLOW_ALL_DECLARATIONS`
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
allow_all_declarations: true
|
||||
```
|
||||
Documentation for setting has moved to the [Fleet server configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#mdm-allow_all_declarations) reference.
|
||||
|
||||
### FLEET_ENABLE_POST_CLIENT_DEBUG_ERRORS
|
||||
|
||||
|
|
|
|||
|
|
@ -1602,8 +1602,8 @@ func (man Manager) addConfigs() {
|
|||
man.addConfigString("mdm.windows_wstep_identity_key_bytes", "", "Microsoft WSTEP PEM-encoded private key bytes")
|
||||
man.addConfigInt("mdm.sso_rate_limit_per_minute", 0, "Number of allowed requests per minute to MDM SSO endpoints (default is sharing login rate limit bucket)")
|
||||
man.addConfigInt("mdm.certificate_profiles_limit", 100, "Maximum number of CA certificate profile installations per batch (0 = unlimited)")
|
||||
man.addConfigBool("mdm.enable_custom_os_updates_and_filevault", false, "Experimental feature: allows usage of specific Apple MDM profiles for OS updates and FileVault")
|
||||
man.addConfigBool("mdm.allow_all_declarations", false, "Experimental feature: Allows all MDM declaration types to be sent")
|
||||
man.addConfigBool("mdm.enable_custom_os_updates_and_filevault", false, "Allows usage of custom Apple MDM profiles for OS updates and FileVault (Fleet Premium required)")
|
||||
man.addConfigBool("mdm.allow_all_declarations", false, "Allows all MDM declaration types to be sent, bypassing safety checks")
|
||||
man.addConfigString("mdm.android_agent.package", "com.fleetdm.agent", "Package name for the Fleet Android agent")
|
||||
man.addConfigString("mdm.android_agent.signing_sha256", "x+IyvrwVbQEBYV/ojWmLavJE0VIZE1RAT2JmxeI5sFw=", "Signing certificate SHA256 fingerprint for the Fleet Android agent")
|
||||
man.hideConfig("mdm.android_agent.package")
|
||||
|
|
|
|||
Loading…
Reference in a new issue