Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

fix: return error in gitops if using deprecated field and there are more than 1 abm tokens (#23768)

Browse source 
> Related issue: #22359

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
This commit is contained in:
Jahziel Villasana-Espinoza 2024-11-13 14:07:59 -05:00 committed by GitHub
parent 12b66f9186
commit e3618e8335
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 40 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
changes/22359-gitops-mult-abm Normal file
View file

@ -0,0 +1,2 @@
- Updates GitOps to return an error if the deprecated `apple_bm_default_team` key is used and there
are more than 1 ABM tokens in Fleet.

10
cmd/fleetctl/gitops.go
View file

@ -162,6 +162,7 @@ func gitopsCommand() *cli.Command {
// name.) Because teams can be created/deleted during the same gitops run, we
// grab some information to help us determine allowed/restricted actions and
// when to perform the associations.
if isGlobalConfig && totalFilenames > 1 && !(totalFilenames == 2 && noTeamPresent) && isPremium {
abmTeams, hasMissingABMTeam, usesLegacyABMConfig, err = checkABMTeamAssignments(config, fleetClient)
if err != nil {
@ -298,6 +299,15 @@ func checkABMTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
}
abmToks, err := fleetClient.ListABMTokens()
if err != nil {
return nil, false, false, err
}
if hasLegacyConfig && len(abmToks) > 1 {
return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
}
if !hasLegacyConfig && !hasNewConfig {
return nil, false, false, nil
}

41
cmd/fleetctl/gitops_test.go
View file

@ -2605,26 +2605,27 @@ software:
assert.Contains(t, out, "[!] gitops succeeded")
},
},
// {
// name: "deprecated config with two tokens in the db fails",
// cfgs: []string{
// global("apple_bm_default_team: 💻 Workstations"),
// workstations,
// },
// tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
// dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
// require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
// assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
// assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
// assert.NotContains(t, out, "[!] gitops dry run succeeded")
// },
// realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
// require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
// assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
// assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
// assert.NotContains(t, out, "[!] gitops dry run succeeded")
// },
// },
{
name: "deprecated config with two tokens in the db fails",
cfgs: []string{
global("apple_bm_default_team: 💻 Workstations"),
workstations,
},
tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
t.Logf("got: %s", out)
require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
assert.NotContains(t, out, "[!] gitops dry run succeeded")
},
realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
assert.NotContains(t, out, "[!] gitops succeeded")
},
},
{
name: "new key all valid",
cfgs: []string{

7
server/service/client_mdm.go
View file

@ -40,6 +40,13 @@ func (c *Client) GetAppleBM() (*fleet.AppleBM, error) {
return responseBody.AppleBM, err
}
func (c *Client) ListABMTokens() ([]*fleet.ABMToken, error) {
verb, path := "GET", "/api/latest/fleet/abm_tokens"
var responseBody listABMTokensResponse
err := c.authenticatedRequestWithQuery(nil, verb, path, &responseBody, "")
return responseBody.Tokens, err
}
// RequestAppleCSR requests a signed CSR from the Fleet server and returns the
// CSR bytes
func (c *Client) RequestAppleCSR() ([]byte, error) {