Add contributor server config to skip MDM declaration validations

[marko-lisica]

Goal

User story
As an advanced Fleet user,
I want to enable my Fleet instance to accept all Apple declarations (e.g., activations and assets) that are not supported in Fleet
so that I can manage critical system services and test all declarations.

Roadmap item

None.

Original requests

• Skip MDM Declaration Validation logic with Configuration. #38212

Resources

Changes

Product

• UI changes: No changes.
• CLI (fleetctl) usage changes: No changes.
• YAML changes: No changes.
• REST API changes: No changes.
• Fleet's agent (fleetd) changes: No changes.
• Fleet server configuration changes:
  • Changes specified in Skip MDM Declaration Validation logic with Configuration. #38212
  • Change config name to: FLEET_MDM_ALLOW_ALL_DECLARATIONS
• Exposed, public API endpoint changes: No changes.
• fleetdm.com changes: No changes.
• GitOps mode UI changes: No changes.
• GitOps generation changes: No changes.
• Activity changes: No changes.
• Permissions changes: No changes.
• Changes to paid features or tiers: Fleet Free and Premium.
• My device and fleetdm.com/better changes: No changes.
• Usage statistics: No changes.
• Other reference documentation changes: No changes.
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• This is a premium only feature: No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Risk level: Low

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Note: This is exploration, so if one of the declarations doesn't work in Fleet, that's ok for this first testing iteration, because it's gated with server config.

• Test that user can add all kinds of Apple declarations if enabled via server config.
• Make sure that adding this server config and these declarations doesn't break other profiles and validations. Currently supported declarations install and verify properly when this flag is used
• Make sure that all of the declarations below are blocked when the server config is not enabled
• Add SecurityCertificate profile and AssetCredentialCertificate that is referenced in the first one.
• Add PasscodeSettings declaration, and add ActivationSimple declaration that checks (predicate) if the host is macOS before it activates PasscodeSettings on the host.
• Add ManagementProperties declaration and then add ActivationSimple declaration that uses custom properties to activate 3rd declaration.

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[marko-lisica]

UPDATE:

We decided that we'll ship this as a contributor config for now. That will enable us to dogfood this and then officially support all types of declarations in a follow-up story: #38986

[marko-lisica]

Hey @lukeheath, heads up, this is a community PR. We want to ship this in 4.83 if possible.