fleet/server/mdm
Victor Lyuboslavsky 109b4e10cd
Throttle CA access through MDM (#42114)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #38002 

Demo video: https://www.youtube.com/watch?v=JOZh1iQ34iI
Docs: https://github.com/fleetdm/fleet/pull/42190/changes

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [x] Setting(s) is/are explicitly excluded from GitOps

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the `FLEET_MDM_CERTIFICATE_PROFILES_LIMIT` configuration option
to control the number of certificate authority (CA) profiles installed
during each Apple MDM profile reconciliation cycle. This new setting
enables administrators to throttle CA profile installations and manage
installation performance during normal reconciliation operations across
large-scale deployments. Set this value to 0 to disable throttling.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:04:55 -05:00
..
android Converted old activity module into function. Cleaned up activity types. (#40752) 2026-03-03 01:01:42 -06:00
apple Throttle CA access through MDM (#42114) 2026-03-23 09:04:55 -05:00
assets Updated SQL modes in tests to match production. (#31445) 2025-08-03 08:18:13 +02:00
crypto Update nanomdm dependency with latest bug fixes and improvements. (#23906) 2024-11-20 11:47:11 -06:00
cryptoutil Refactoring crypto code for future reuse. (#25148) 2025-01-07 16:14:12 -06:00
internal/commonmdm friday tidy up party (#18106) 2024-04-08 08:42:42 -03:00
lifecycle reset MDM enrollment if SCEP renewal but awaiting configuration (#41881) 2026-03-17 15:31:08 -05:00
linux Linux Encryption Docs (#23622) 2024-12-10 08:26:46 -07:00
maintainedapps FMA version rollback (#40038) 2026-02-24 14:00:32 -05:00
microsoft Added support for NDES CA for Windows hosts (#41356) 2026-03-12 15:36:44 -05:00
nanodep Update server-proto version to 9, implement THROTTLED w/ 24h cooldown (#38920) 2026-01-29 15:31:28 -05:00
nanomdm update nanomdm types to avoid confusion (#41877) 2026-03-18 13:10:56 -05:00
profiles Added support for NDES CA for Windows hosts (#41356) 2026-03-12 15:36:44 -05:00
scep Remove unused/confusing --mdm_apple_scep_signer_allow_renewal_days config (#40800) 2026-03-04 11:53:59 -05:00
testing_utils Update DEP enrollment flow to apply minimum macOS version check when specified (#40720) 2026-03-12 16:54:46 -05:00
mdm.go handle non atomic windows profiles when sending and receiving (#38332) 2026-01-19 11:16:28 -05:00
mdm_test.go Feature branch for Android config profiles (#32976) 2025-09-22 11:29:57 -04:00