Fix `fleetctl generate-gitops` when MDM is turned off by lucasmrod · Pull Request #30677 · fleetdm/fleet

lucasmrod · 2025-07-09T13:49:40Z

For unreleased bug #30656.

Added/updated automated tests
Manual QA for all new/changed functionality
For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.

Summary by CodeRabbit

Bug Fixes
- Improved handling to ensure MDM-related data is only generated when MDM is enabled and properly configured.
- Errors related to MDM configuration are now surfaced instead of being silently ignored.
Tests
- Added new tests to verify correct behavior when MDM is disabled and not configured, ensuring empty or minimal outputs for MDM-related data in this scenario.

coderabbitai · 2025-07-09T13:49:49Z

Walkthrough

The changes update MDM-related generation logic in the Fleet GitOps command to ensure MDM data is only generated or retrieved when MDM is enabled and configured. Additionally, tests are added to verify that outputs are empty or minimal when MDM is disabled, and special error handling for unconfigured MDM states is removed.

Changes

File(s)	Change Summary
cmd/fleetctl/fleetctl/generate_gitops.go	Added conditional checks for MDM configuration before generating MDM data; removed special error handling for MDM-not-configured in profile listing.
cmd/fleetctl/fleetctl/generate_gitops_test.go	Added tests for behavior when MDM is disabled and not configured; extended mock for new test scenario.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant GenerateGitopsCommand
    participant AppConfig
    participant MDMSubsystem

    User->>GenerateGitopsCommand: generateControls(teamId)
    GenerateGitopsCommand->>AppConfig: Check MDM.EnabledAndConfigured
    alt MDM enabled and configured
        GenerateGitopsCommand->>MDMSubsystem: Generate profiles, EULA, etc.
        MDMSubsystem-->>GenerateGitopsCommand: Return MDM data
    else MDM not enabled or configured
        GenerateGitopsCommand-->>User: Return empty/minimal MDM data
    end
    GenerateGitopsCommand-->>User: Return controls output

Possibly related PRs

fleetdm/fleet#30595: Adjusts handling of the EULA path value, which is also affected by conditional MDM checks in this PR.

Poem

A rabbit hopped through GitOps code,
Where MDM checks now guard the road.
If MDM’s off, no data appears—
Just empty maps, no need for tears.
With tests to prove what’s left behind,
The code is safe, robust, and kind!
🐇✨

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7fb9a94 and 4aa2b4d.

📒 Files selected for processing (2)

cmd/fleetctl/fleetctl/generate_gitops.go (3 hunks)
cmd/fleetctl/fleetctl/generate_gitops_test.go (3 hunks)

🧰 Additional context used

🧠 Learnings (1)

📓 Common learnings

Learnt from: getvictor
PR: fleetdm/fleet#30589
File: server/datastore/mysql/migrations/tables/20250707095725_HostIdentitySCEPCertificates.go:53-55
Timestamp: 2025-07-08T16:13:39.073Z
Learning: In the Fleet codebase, Down migration functions are intentionally left empty/no-op. The team does not implement rollback functionality for database migrations, so empty Down_* functions in migration files are correct and should not be flagged as issues.

🧬 Code Graph Analysis (1)

cmd/fleetctl/fleetctl/generate_gitops_test.go (2)

server/fleet/app.go (5)

MDM (153-229)

MDMAppleABMAssignmentInfo (138-143)

MDMEndUserAuthentication (530-535)

MDMAppleVolumePurchasingProgramInfo (147-150)

AppConfig (546-601)

cmd/fleetctl/fleetctl/generate_gitops.go (2)

GenerateGitopsCommand (117-126)

Messages (31-34)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (33)

GitHub Check: test-packaging (ubuntu-latest)
GitHub Check: test-packaging (macos-15)
GitHub Check: test-packaging (ubuntu-latest, remote)
GitHub Check: test-packaging (ubuntu-latest, local)
GitHub Check: check-doc-gen
GitHub Check: test-preview (ubuntu-latest)
GitHub Check: test-go (mysql, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (mysql, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: Analyze (javascript)
GitHub Check: test-go (service, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (scripts, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (main, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (vuln, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (vuln, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (service, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (integration-mdm, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: Analyze (go)
GitHub Check: test-go (fleetctl, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (main, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (fleetctl, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (integration-enterprise, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (fast, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (integration-mdm, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (integration-core, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: test-go (integration-core, ubuntu-latest, mysql:9.3.0, false)
GitHub Check: test-go (integration-enterprise, ubuntu-latest, mysql:8.0.36, false)
GitHub Check: lint (windows-latest)
GitHub Check: lint (macos-latest)
GitHub Check: publish
GitHub Check: lint (ubuntu-latest)
GitHub Check: build-binaries
GitHub Check: build-and-check
GitHub Check: test-db-changes

🔇 Additional comments (7)

cmd/fleetctl/fleetctl/generate_gitops.go (4)

14-14: Import addition looks correct.

The optjson import is needed for the new test that manipulates optjson.Slice fields in the MDM configuration.

809-817: Proper conditional check for EULA generation.

The EULA generation is now correctly guarded by the cmd.AppConfig.MDM.EnabledAndConfigured check, preventing attempts to retrieve EULA data when MDM is disabled. This addresses the core issue where the command would fail when MDM services are not configured.

891-909: Correct conditional logic for profile generation.

The profile generation is now properly guarded by the MDM enabled check. The nested conditional logic correctly handles the case where profiles exist and processes them into the appropriate macOS and Windows settings sections.

931-931: Appropriate guard for team-specific MDM queries.

The additional check ensures that team-specific MDM setup queries (setup software, bootstrap packages, setup scripts, enrollment profiles) only execute when both a team ID is provided and MDM is enabled and configured. This prevents unnecessary API calls and potential failures.

cmd/fleetctl/fleetctl/generate_gitops_test.go (3)

14-14: Import addition is appropriate.

The optjson import is needed for the new test that manipulates optjson.Slice fields in the MDM configuration.

98-99: Mock extension supports new test scenario.

The addition of the team_id=6 case returning nil scripts is appropriate for testing the scenario where MDM APIs should not be called for unhandled team IDs when MDM is disabled.

1128-1171: Comprehensive test for MDM disabled scenario.

The new test function properly validates the fix by:

Explicitly disabling MDM (EnabledAndConfigured = false, WindowsEnabledAndConfigured = false)

Clearing MDM-related configuration fields

Testing that generateControls produces empty scripts output for an unhandled team ID

Testing that generateMDM returns empty values for all expected MDM-related keys

This provides good coverage for the conditional logic introduced in the main implementation and ensures the command behaves correctly when MDM is disabled.

✨ Finishing Touches

📝 Generate Docstrings

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

codecov · 2025-07-09T14:02:25Z

Codecov Report

Attention: Patch coverage is 70.83333% with 7 lines in your changes missing coverage. Please review.

Project coverage is 64.12%. Comparing base (aef507e) to head (4aa2b4d).
Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/fleetctl/fleetctl/generate_gitops.go	70.83%	5 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #30677      +/-   ##
==========================================
+ Coverage   62.13%   64.12%   +1.99%     
==========================================
  Files        1877     1878       +1     
  Lines      184526   184545      +19     
  Branches     5357     5357              
==========================================
+ Hits       114657   118347    +3690     
+ Misses      60687    56893    -3794     
- Partials     9182     9305     +123

Flag	Coverage Δ
backend	`65.11% <70.83%> (+2.19%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

For unreleased bug #30656. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality - [X] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.  ## Summary by CodeRabbit * **Bug Fixes** * Improved handling to ensure MDM-related data is only generated when MDM is enabled and properly configured. * Errors related to MDM configuration are now surfaced instead of being silently ignored. * **Tests** * Added new tests to verify correct behavior when MDM is disabled and not configured, ensuring empty or minimal outputs for MDM-related data in this scenario.

…#30677) (#30687) For unreleased bug #30656. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality - [X] For unreleased bug fixes in a release candidate, confirmed that the fix is not expected to adversely impact load test results or alerted the release DRI if additional load testing is needed.  ## Summary by CodeRabbit * **Bug Fixes** * Improved handling to ensure MDM-related data is only generated when MDM is enabled and properly configured. * Errors related to MDM configuration are now surfaced instead of being silently ignored. * **Tests** * Added new tests to verify correct behavior when MDM is disabled and not configured, ensuring empty or minimal outputs for MDM-related data in this scenario.

Fix generate-gitops when MDM is turned off

4aa2b4d

lucasmrod assigned dantecatalfamo Jul 9, 2025

lucasmrod requested a review from a team as a code owner July 9, 2025 13:49

lucasmrod temporarily deployed to Docker Hub July 9, 2025 13:49 — with GitHub Actions Inactive

lucasmrod linked an issue Jul 9, 2025 that may be closed by this pull request

fleetctl generate-gitops fails if Apple MDM is not enabled and configured #30656

Closed

dantecatalfamo approved these changes Jul 9, 2025

View reviewed changes

lucasmrod merged commit 0488e4e into main Jul 9, 2025

lucasmrod deleted the 30656-fix-generate-gitops-mdm-off branch July 9, 2025 16:01

georgekarrv mentioned this pull request Jul 10, 2025

update rc with patch changelog #30772

Merged

coderabbitai Bot mentioned this pull request Dec 4, 2025

GitOps: "503 Service Unavailable" from Apple causes GitOps pipeline to fail #36693

Closed

4 tasks

coderabbitai Bot mentioned this pull request Mar 25, 2026

Fix fleetctl generate-gitops failing to include VPP fleet assignments #42429

Merged

Navigation Menu

Uh oh!

Fix `fleetctl generate-gitops` when MDM is turned off - #30677

Fix `fleetctl generate-gitops` when MDM is turned off#30677
lucasmrod merged 1 commit into
mainfrom
30656-fix-generate-gitops-mdm-off

lucasmrod commented Jul 9, 2025 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 9, 2025 •

edited

Loading

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

codecov Bot commented Jul 9, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lucasmrod commented Jul 9, 2025 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Possibly related PRs

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

codecov Bot commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lucasmrod commented Jul 9, 2025 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 9, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

codecov Bot commented Jul 9, 2025 •

edited

Loading