GitOps run fails when moving labels from Global to fleet scope

[ksatter]

Fleet versions

• Discovered: v4.84.2
• Reproduced:

---

💥  Actual behavior

After moving labels that previously existed in Fleet as Global labels to workstations.yml, GitOps dry-run succeeded, but the GitOps run failed when applying the config to Fleet with the following error:

[+] applying MDM profiles for fleet Workstations
Error: applying custom settings for fleet "Workstations": POST /api/latest/fleet/mdm/profiles/batch received status 500 converting NULL to uint is unsupported: converting NULL to uint is unsupported (API time: 45ms) 

We also noted that not all labels were present in the Fleet UI.

After removing all references to labels, GitOps ran successfully. In observing the logs, we noted that the operation to move labels from the Global scope to the team scope was occurring after MDM profiles were applied

Awaiting Logs

All labels were also now present in the Fleet UI.

We were then able to re-add all label references for profiles and software to the yaml and apply successfully.

🛠️ Expected behavior

1. When creating labels in Fleet that have the same name as a label that previously existed on a different scope (e.g. if a global label is deleted and fleet-level label created with the same name), GitOps should handle anything that references those labels by name (e.g. update configuration profiles to reference the new label instead of breaking because the label w/ the referenced name has a different ID).
2. If fleet-level labels are deleted and re-created under a different fleet, show a clear error message for anything referencing those labels on fleets that don't have access to the label

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• [ x] Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Create labels in the Global scope using GitOps
2. Add configuration profiles that reference those labels
3. Move the labels from the Global scope into a team yaml

🕯️ More info (optional)

N/A

[zayhanlon]

@noahtalerman from todays escalation!

[Sampfluger88]

Linked to Unthread ticket:

Conversation #16158

[noahtalerman]

Hey @sharon-fdm I think this bug deserves P1. panoramix is about to migrate to Fleet and this bug is hurting their confidence/readiness.

FYI @zayhanlon

[sharon-fdm]

@noahtalerman, thanks for pointing that out.
Yeah, looks like breaking the flow so P1 approved.
I'll assign asap.

[rachaelshaw]

@sharon-fdm this is ready to start working on: basically, we need GitOps to be a bit smarter and not automatically break profiles when labels are deleted, it should check if they exist somewhere first. In this case, moving label YAML from global scope to a specific fleet broke configuration profiles. Labels with the names referenced in the profiles did exist, but they didn't have the same IDs as the labels the config profile was previously referencing, so the profiles all got broken: true when those global labels were deleted.