Skip MDM Declaration Validation logic with Configuration.

[weswhet]

Related issue: Resolves #

This PR adds the ability to skip any Fleet logic that validates on whether or not an MDM Declaration is usable with Fleet by setting a configuration of FLEET_MDM_SKIP_DECLARATION_VALIDATION to True. We would like to leverage declarations such as config files as well as other none configuration declarations that are restricted like Activations, and any declaration that requires AssetData. We understand that these are not usable by most Fleet customers, especially those that use Fleets cloud hosting option.

Since we run Fleet on our own infrastructure we are able to leverage our proxy to support all additional data components needed for declarations above.

Testing

I've built and run Fleet locally and validated that with the FLEET_MDM_SKIP_DECLARATION_VALIDATION I am able to add any declarations I please. Without the config I am unable to add the requested declaration types above.

• Added/updated automated tests

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features

  • Added experimental mdm.allow_all_declarations configuration option to permit all Apple MDM declaration types when enabled, overriding default validation checks.

• Documentation

  • Updated configuration documentation with details for the new experimental MDM option, including defaults, environment variables, YAML format, and safety considerations.

[codecov]

Codecov Report

❌ Patch coverage is 84.61538% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.25%. Comparing base (44cf3c2) to head (1308cb5).
⚠️ Report is 24 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/apple_mdm.go	66.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #38212      +/-   ##
==========================================
- Coverage   66.28%   66.25%   -0.04%     
==========================================
  Files        2467     2467              
  Lines      197447   197273     -174     
  Branches     8732     8732              
==========================================
- Hits       130881   130704     -177     
- Misses      54724    54732       +8     
+ Partials    11842    11837       -5     

Flag	Coverage Δ
backend	68.06% <84.61%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mostlikelee]

Thanks for the PR! Since this is a product change (opposed to a bug), we pass it through to our product team to review.

[noahtalerman]

Thanks @weswhet!

Since this is a product change (opposed to a bug), we pass it through to our product team to review.

@mostlikelee's right! Tim, just a reminder to assign the relevant Product Designer (@marko-lisica in this case) and notify them in Slack: https://fleetdm.com/handbook/engineering#review-a-community-pull-request:~:text=Assign%20the%20PR,compliance%20Slack%20channel.

[weswhet]

Hey @marko-lisica I fixed most of the failing checks minus the current CodeQL one which isn't related to my changes. Let me know if you need anything else from me.

[Patagonia121]

Thanks @weswhet - we'll be in touch shortly once we get @marko-lisica to weigh in on this.

[Patagonia121]

Hey @marko-lisica - just curious but when do you anticipate being able to merge this PR? I spent time with customer-starchik last night and they're really hoping we can get this merged soon to help unblock them/reduce friction.

Thanks in advance!

[marko-lisica]

Hey @Patagonia121, we are planning to ship this change in 4.83. It is currently on the drafting board, and we follow our regular drafting process. Next sprint engineering team will pick it up, review/QA, and make sure we can ship it. Later, we plan to officially release this so that all Fleet customers can use all DDM features after we test it internally.

[zayhanlon]

hey @marko-lisica just want to confirm that we're still good to go on 4.83 for this PR merge? thx

[MagnusHJensen]

Hi @weswhet Looking at this now.

Could I get you to update all code references for skip_declaration_validation to allow_all_declarations like seen in the updated contributor docs?

[MagnusHJensen]

@weswhet I fixed the comments myself, will do a QA pass and then merge the PR.

Thanks for the contribution 🎉

[MagnusHJensen]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

This change introduces an experimental configuration flag mdm.allow_all_declarations that permits bypassing validation for Apple MDM declarations. The flag is added to the server configuration structure with documentation and integrated into the declaration validation workflow. When enabled, the flag skips validation checks in the Apple MDM declaration creation and deletion flows. The function signature for getAppleProfiles was updated to accept the full MDM configuration object instead of a single boolean parameter. Tests were added to verify behavior with validation both enabled and disabled.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is missing several required checklist items from the template, including a changes file entry, database-related items, and GitOps configuration checks that appear applicable to this configuration feature.	Complete the checklist by confirming: changes file was added, database checks if applicable, GitOps exclusion or documentation, and verify all testing and validation requirements are met.
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding the ability to skip MDM Declaration validation through a configuration option.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

server/config/config.go (1)

1591-1591: Clarify the flag description to match actual behavior.

The current description says it allows declaration types, but this flag bypasses broader declaration validation checks. Updating the help text would reduce operator confusion.

Proposed wording update

-	man.addConfigBool("mdm.allow_all_declarations", false, "Experimental feature: Allows all MDM declaration types to be sent")
+	man.addConfigBool("mdm.allow_all_declarations", false, "Experimental feature: bypasses Apple declaration validation checks")

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/config/config.go` at line 1591, Update the help text passed to
man.addConfigBool for the "mdm.allow_all_declarations" flag so it accurately
reflects behavior: instead of saying it "Allows all MDM declaration types to be
sent", change the description to indicate it bypasses broader declaration
validation checks (e.g., "Experimental: Bypass MDM declaration validation
checks; may permit unsupported or invalid declaration types"). Locate the call
to man.addConfigBool("mdm.allow_all_declarations", ...) and replace the existing
description string with the clarified wording.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/Contributing/reference/configuration-for-contributors.md`:
- Line 251: Replace the malformed bold label `**Note: **` with `**Note:**` in
the markdown snippet so the emphasis has no inner trailing space and conforms to
markdownlint MD037; update the line containing the Asset declaration note (the
bold "Note" label) to use `**Note:**` exactly.

---

Nitpick comments:
In `@server/config/config.go`:
- Line 1591: Update the help text passed to man.addConfigBool for the
"mdm.allow_all_declarations" flag so it accurately reflects behavior: instead of
saying it "Allows all MDM declaration types to be sent", change the description
to indicate it bypasses broader declaration validation checks (e.g.,
"Experimental: Bypass MDM declaration validation checks; may permit unsupported
or invalid declaration types"). Locate the call to
man.addConfigBool("mdm.allow_all_declarations", ...) and replace the existing
description string with the clarified wording.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 941816e and 136a52d.

📒 Files selected for processing (6)

• changes/38366-contributor-flag-for-allowing-all-declarations
• docs/Contributing/reference/configuration-for-contributors.md
• server/config/config.go
• server/service/apple_mdm.go
• server/service/apple_mdm_test.go
• server/service/mdm.go

[MagnusHJensen]

@rachaelshaw Can you approve this PR as the contributor docs DRI?

[rachaelshaw]

Let's use the default experimental message:

Suggested change

	> Experimental feature. Use with caution.
	> **Experimental feature.** This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.

[rachaelshaw]

actually, never mind, I'll make this change after this is merged so I don't undo other approvals to this PR

[MagnusHJensen]

@rachaelshaw Merged the PR feel free to do the follow up doc change