[merge after testing backwards compat.] Dogfood: teams => "fleets" and queries => "reports" #39383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

mikermcneil merged 80 commits into main from after-testing-backwards-compat-dogfood-gets-updated

Mar 3, 2026

CODEOWNERS

-Original file line number
+Diff line change
@@ Expand Up / @@ -138,12 +138,6 @@ go.mod @fleetdm/go @@
     ##############################################################################################
     #/.github/ISSUE_TEMPLATE     @mikermcneil @sampfluger88 @lukeheath  # Covered in custom.js See https://github.com/fleetdm/fleet/pull/18668
-    ##############################################################################################
-    # 🌐 Fleet website
-    ##############################################################################################
-    /website/.sailsrc 		@eashaw # Note: eashaw will not approve any PR that changes this file. This codeowner exists to make sure no changes are committed to the repo.
     ##############################################################################################
     # 🌐 GitHub workflows
     ##############################################################################################
@@ Expand Down @@

website/.sailsrc

-Original file line number
+Diff line change
@@ -1,7 +1,8 @@
     {
       "generators": {
         "modules": {
-          "landing-page": "./generators/landing-page"
+          "landing-page": "./generators/landing-page",
+          "gitops": "./generators/gitops"
         }
       },
       "_generatedWith": {
@@ Expand Down @@

website/config/custom.js

-Original file line number
+Diff line change
@@ Expand Up / @@ -148,7 +148,8 @@ module.exports.custom = { @@
         'website/config': 'eashaw',
         'website/config/routes.js': 'eashaw',//« Website redirects and URLs
         'website/scripts': 'eashaw',
-        'website/package.json': 'eashaw',
+        'website/package.json': 'eashaw',// « This is where new website dependencies get added
+        'website/.sailsrc': 'eashaw', // «This gets changed automatically when docs are compiled, so it's easy to accidentally check in changes that shouldn't be checked in.
         // 🫧 Vulnerability dashboard
         'ee/vulnerability-dashboard': 'eashaw',// (catch-all)
@@ Expand Down @@

website/generators/gitops/README.md

-Original file line number
+Diff line change
@@ -0,0 +1,7 @@
+    To test:
+    `cd website/`
+    Then:
+    `rm -rf /tmp/it-and-security/ && sails generate gitops && mv it-and-security /tmp/it-and-security && subl /tmp/it-and-security/`

website/generators/gitops/index.js

-Original file line number
+Diff line change
@@ -0,0 +1,93 @@
+    module.exports = {
+      targets: {
+        './it-and-security/README.md': { copy: './README.md.template' },
+        './it-and-security/.github': { folder: {} },
+        './it-and-security/.github/fleet-gitops': { folder: {} },
+        './it-and-security/.github/fleet-gitops/action.yml': { copy: './github/fleet-gitops/action.yml.template' },
+        './it-and-security/.github/fleet-gitops/gitops.sh': { copy: './github/fleet-gitops/gitops.sh.template' },
+        './it-and-security/.github/workflows': { folder: {} },
+        './it-and-security/.github/workflows/fleet-gitops-workflow.yml': { copy: './github/workflows/fleet-gitops-workflow.yml.template' },
+        './it-and-security/.gitlab-ci.yml': { copy: './gitlab-ci.yml.template' },
+        './it-and-security/.gitignore': { copy: './gitignore.template' },
+        './it-and-security/default.yml': { copy: './default.yml.template' },
+        './it-and-security/fleets/': { folder: {} },
+        './it-and-security/fleets/workstations.yml': { copy: './fleets/workstations.yml.template' },
+        './it-and-security/fleets/personal-mobile-devices.yml': { copy: './fleets/personal-mobile-devices.yml.template' },
+        './it-and-security/labels/': { folder: {} },
+        './it-and-security/labels/apple-silicon-macos-hosts.yml': { copy: './labels/apple-silicon-macos-hosts.yml.template' },
+        './it-and-security/labels/x86-based-windows-hosts.yml': { copy: './labels/x86-based-windows-hosts.yml.template' },
+        './it-and-security/labels/arm-based-windows-hosts.yml': { copy: './labels/arm-based-windows-hosts.yml.template' },
+        './it-and-security/labels/debian-based-linux-hosts.yml': { copy: './labels/debian-based-linux-hosts.yml.template' },
+        './it-and-security/platforms/': { folder: {} },
+        './it-and-security/platforms/linux': { folder: {} },
+        './it-and-security/platforms/linux/policies/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/linux/reports/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/linux/scripts/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/linux/software/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/windows': { folder: {} },
+        './it-and-security/platforms/windows/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/windows/policies/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/windows/reports/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/windows/scripts/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/windows/software/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos': { folder: {} },
+        './it-and-security/platforms/macos/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/declaration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/enrollment-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/enrollment-profiles/automatic-enrollment.dep.json': { copy: './platforms/macos/enrollment-profiles/automatic-enrollment.dep.json.template' },
+        './it-and-security/platforms/macos/commands/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/policies/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/policies/all-software-updates-installed.yml': { copy: './platforms/macos/policies/all-software-updates-installed.yml' },
+        './it-and-security/platforms/macos/reports/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/scripts/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/macos/software/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/ios': { folder: {} },
+        './it-and-security/platforms/ios/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/ios/declaration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/ipados': { folder: {} },
+        './it-and-security/platforms/ipados/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/ipados/declaration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        // './it-and-security/platforms/tvos': { folder: {} },
+        // './it-and-security/platforms/tvos/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/android': { folder: {} },
+        './it-and-security/platforms/android/configuration-profiles/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/android/managed-app-configurations/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/all/': { folder: {} },
+        './it-and-security/platforms/all/icons/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/all/reports/.gitkeep': { copy: './gitkeep.template' },
+        './it-and-security/platforms/all/policies/.gitkeep': { copy: './gitkeep.template' },
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // • e.g. create a folder:
+        // ```
+        // './hey_look_a_folder': { folder: {} }
+        // ```
+        //
+        // • e.g. create a dynamically-named file relative to `scope.rootPath`
+        // (defined by the `filename` scope variable).
+        //
+        // The `template` helper reads the specified template, making the
+        // entire scope available to it (uses underscore/JST/ejs syntax).
+        // Then the file is copied into the specified destination (on the left).
+        // ```
+        // './:filename': { template: 'example.template.js' },
+        // ```
+        //
+        // • See https://sailsjs.com/docs/concepts/extending-sails/generators for more documentation.
+        // (Or visit https://sailsjs.com/support and talk to a maintainer of a core or community generator.)
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      },
+      /**
+       * The absolute path to the `templates` for this generator
+       * (for use with the `template` and `copy` builtins)
+       *
+       * @type {String}
+       */
+      templatesDirectory: require('path').resolve(__dirname, './templates')
+    };

website/generators/gitops/templates/README.md.template

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		TODO

website/generators/gitops/templates/default.yml.template

-Original file line number
+Diff line change
@@ -0,0 +1,138 @@
+    # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+    #
+    # default.yml
+    #
+    # Use this global manifest (`default.yml`) to configure
+    # top-level settings for your organization as a whole, and
+    # controls/reports/etc that apply to all of your fleets.
+    #
+    # To see all supported options, check out:
+    #   • https://fleetdm.com/docs/configuration/yaml-files
+    #
+    # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+    org_settings:
+      org_info:
+        ###########################################################
+        # The name of your organization is displayed to end users
+        # during the setup experience for new hardware, and to admins
+        # in the Fleet UI.
+        #
+        # Read more:
+        #   • https://fleetdm.com/docs/configuration/yaml-files#org-info
+        ###########################################################
+        org_name: "My organization"
+        #         ^TODO: Replace with the name of your organization
+      server_settings:
+        ###########################################################
+        # The server URL where Fleet is running.
+        #
+        #   • No trailing slash at the end
+        #   • `http://` or `https://` at the beginning.
+        #
+        # (You can copy this from the URL bar in your browser.)
+        #
+        # Warning: Careful not to change this URL after enrolling
+        # Apple devices with MDM pointed at Fleet. If this URL changes
+        # and Apple hosts already have MDM turned on, then end users
+        # will have to take action to restore MDM functionality (due
+        # to the way Apple's device management protocol works.)
+        ###########################################################
+        server_url: "https://fleet.example.com"
+        #           ^TODO: Replace with the URL where Fleet is running.
+      ###########################################################
+      # Uncomment to use single sign-on (SSO) for admins accessing Fleet.
+      #
+      # Read more:
+      #   • https://fleetdm.com/docs/configuration/yaml-files#sso-settings
+      #   • https://fleetdm.com/docs/deploy/single-sign-on-sso
+      ###########################################################
+      # sso_settings:
+      #   idp_name: "Okta" # e.g. "Entra", "Okta", "Google Workspace", etc.  (This appears to admins on the login screen as a "Sign in with ________" button.)
+      #   metadata_url: "https://okta.com/replace-this-url" # This must exactly match the "IdP metadata URL" provided by your identity provider (IdP) when setting up this integration.
+      #   entity_id: "fleet-admins" # This must exactly match the "Entity ID" field you chose when setting up this integration in your identity provider (IdP).
+      mdm:
+        ###########################################################
+        # Uncomment to use single-sign on (SSO) to authenticate
+        # new computers enrolling in Fleet during end user setup.
+        #
+        # Read more:
+        #   • https://fleetdm.com/docs/configuration/yaml-files#end-user-authentication
+        #   • https://fleetdm.com/guides/setup-experience#end-user-authentication
+        ###########################################################
+        # end_user_authentication:
+        #   idp_name: "Okta"  e.g. "Entra", "Okta", "Google Workspace", etc. (Displayed to end users.)
+        #   metadata_url: "https://okta.com/replace-this-url" # This must exactly match the "IdP metadata URL" provided by your identity provider (IdP) when setting up this integration.
+        #   entity_id: "fleet-end-users" # This must exactly match the "Entity ID" field you chose when setting up this integration in your identity provider (IdP).
+        ###########################################################
+        # Uncomment when you are ready to start using zero-touch enrollment
+        # for Apple devices via Apple Business Manager (ABM).
+        #
+        # Read more:
+        #   • https://fleetdm.com/docs/configuration/yaml-files#apple-business-manager
+        #   • https://fleetdm.com/guides/apple-mdm-setup#apple-business-manager-abm
+        ###########################################################
+        # apple_business_manager:
+        #   - macos_fleet: "💻 Workstations" # Where new macOS devices from ABM will appear
+        ###########################################################
+        # Uncomment to start using Apple's volume purchase program (VPP)
+        # for making software available from the App Store and managing
+        # software licenses.
+        #
+        # Read more:
+        #   • https://fleetdm.com/docs/configuration/yaml-files#volume-purchasing-program
+        #   • https://fleetdm.com/guides/apple-mdm-setup#volume-purchasing-program-vpp
+        ###########################################################
+        # volume_purchasing_program:
+        #   - fleets:
+        #       - "💻 Workstations"
+        #       - "📱🔐 Personal mobile devices"
+    controls:
+      ###########################################################
+      # Uncomment when you are ready to migrate Macs to Fleet
+      # from a different MDM server, especially devices running
+      # macOS ≤v26.
+      #
+      # For more information about what this does, see:
+      #   • https://fleetdm.com/docs/configuration/yaml-files#macos-migration
+      #   • https://fleetdm.com/guides/mdm-migration#end-user-workflow
+      #
+      # Note: This is a global setting that cannot be applied per-fleet.
+      ###########################################################
+      # macos_migration:
+      #   enable: true
+      #   mode: voluntary # Start with "voluntary", then change this to "forced" closer to the deadline.
+      #   webhook_url: "https://your-custom-webhook-or-one-provided-off-the-shelf-by-fleet-for-the-mdm-you-are-coming-from.example.com/webhooks/receive-from-fleet"
+      #   # ^ When end users click "Migrate to Fleet", this webhook is triggered.
+      #   # By convention it looks up the device and unmanages it in the old MDM,
+      #   # then enrolls the device in Fleet.  Unsure?  Get help @ fleetdm.com/support.
+    ###########################################################
+    # Labels are static or dynamic groupings of computers for
+    # scoping, reporting, and more.  Use labels for everything
+    # from "x86 macs" to "finance department" to "needs new battery".
+    #
+    # For more, see:
+    #   • https://fleetdm.com/docs/configuration/yaml-files#labels
+    #   • https://fleetdm.com/guides/managing-labels-in-fleet
+    #
+    # (Optional) You can choose to manage labels in the Fleet GUI
+    # instead of in your git repo by **commenting out** `labels`
+    # below and removing the `labels/` folder.
+    #
+    # > Note: If you exclude `labels` from your git repo, then any
+    # > AI-assisted tools you may be using like Claude/Copilot/Kilocode
+    # > won't be able to see them as easily for use in scoping,
+    # > and could make it harder to do prompts like, for example:
+    # > "Make sure everyone in finance has the latest version of Excel"
+    ###########################################################
+    labels:
+      - paths: ./labels/*.yml

website/generators/gitops/templates/fleets/personal-mobile-devices.yml.template

-Original file line number
+Diff line change
@@ -0,0 +1,109 @@
+    # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+    #
+    # personal-mobile-devices.yml
+    #
+    # Use this fleet manifest to configure controls, software,
+    # and settings that apply only to computing devices (hosts)
+    # in this particular fleet.
+    #
+    # > Note: By convention, the "📱🔐 Personal mobile devices"
+    # > fleet is where employee-owned iPhone and Android phones
+    # > are enrolled, for example as part of a BYOD ("bring your
+    # > own device") program.  This allows for clear separation
+    # > and encourages employee freedom and privacy.
+    #
+    # To see all supported options, check out:
+    #   • https://fleetdm.com/docs/configuration/yaml-files
+    #
+    # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+    name: "📱🔐 Personal mobile devices"
+    controls:
+      apple_setup:
+        ###########################################################
+        # Uncomment to use single-sign on (SSO) to authenticate
+        # end users enrolling their personal device.
+        #
+        # Read more:
+        #   • https://fleetdm.com/docs/configuration/yaml-files#end-user-authentication
+        #   • https://fleetdm.com/guides/setup-experience#end-user-authentication
+        ###########################################################
+        # enable_end_user_authentication: true
+      ###########################################################
+      # Presets, restrictions, and configs
+      #
+      # > Since the mobile devices in this fleet are personal
+      # > devices owned by employees, it can be appropriate to
+      # > cherry-pick only a very limited set of restrictions
+      # > and presets to maximize privacy and employee freedom.
+      #
+      # For more, see:
+      #   • https://fleetdm.com/docs/configuration/yaml-files#apple-settings-and-windows-settings
+      #   • https://fleetdm.com/docs/configuration/yaml-files#android-settings
+      ###########################################################
+      apple_settings:
+        profiles:
+          # … e.g.
+          # - path: ../lib/ios/declaration-profiles/Passcode settings.json
+          # - path: ../lib/ios/configuration-profiles/self-service.mobileconfig
+      android_settings:
+        profiles:
+        certificates:
+      ###########################################################
+      # Managed OS updates
+      #
+      # To enable and enforce managed OS updates on iOS/iPadOS,
+      # uncomment `ios_updates` and `ipados_updates`.
+      #
+      # See also:
+      #   • https://fleetdm.com/docs/configuration/yaml-files#ios-updates
+      #   • https://fleetdm.com/docs/configuration/yaml-files#ipados-updates
+      #   • https://fleetdm.com/guides/enforce-os-updates#apple-macos-ios-and-ipados-end-user-experience
+      ###########################################################
+      # ios_updates:
+      #   deadline: "2030-04-01"
+      #   minimum_version: "18.5"
+      # ipados_updates:
+      #   deadline: "2030-04-01"
+      #   minimum_version: "18.5"
+    ###########################################################
+    # Apps to make available from the Apple App Store or Google Play
+    ###########################################################
+    software:
+      app_store_apps:
+        ###########################################################
+        # iOS apps
+        ###########################################################
+        # …
+        # - app_store_id: "618783545" # Slack
+        #   display_name: "Slack"
+        #   self_service: true
+        #   setup_experience: true
+        #   platform: ios
+        #   categories:
+        #     - "Communication"
+        ###########################################################
+        # iPadOS apps
+        ###########################################################
+        # …
+        # - app_store_id: "618783545" # Slack
+        #   display_name: "Slack"
+        #   self_service: true
+        #   setup_experience: true
+        #   platform: ipados
+        #   categories:
+        #     - "Productivity"
+        #     - "Communication"
+        ###########################################################
+        # Android apps
+        ###########################################################
+        # …
+        # - app_store_id: "com.Slack" # Slack
+        #   platform: android
+        #   display_name: "Slack"
+        #   self_service: true
+        #   setup_experience: true

Navigation Menu

Uh oh!

[merge after testing backwards compat.] Dogfood: teams => "fleets" and queries => "reports" #39383

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!