Add "exceptions" GitOps config - #42013
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new gitops.exceptions configuration object (with labels, software, secrets booleans) to Fleet’s AppConfig, including defaults for new installs and a migration to backfill existing instances, plus integration/migration test coverage.
Changes:
- Extend
fleet.UIGitOpsModeConfigwith a newExceptionsfield and add new-install defaults. - Add MySQL migration to initialize exceptions for existing instances (labels/secrets enabled, software disabled).
- Add integration test coverage for PATCH/GET semantics around GitOps exceptions and add a migration unit test.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| server/service/integration_enterprise_test.go | Adds an end-to-end test validating PATCH merge behavior and GET response for gitops.exceptions. |
| server/fleet/app.go | Introduces GitOpsExceptions and wires it into UIGitOpsModeConfig, plus new-install defaults. |
| server/datastore/mysql/migrations/tables/20260318210346_AddGitOpsExceptionsToAppConfig.go | Migration to populate gitops.exceptions for existing instances. |
| server/datastore/mysql/migrations/tables/20260318210346_AddGitOpsExceptionsToAppConfig_test.go | Unit test validating the migration sets the intended defaults on existing app config JSON. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #42013 +/- ##
==========================================
- Coverage 66.53% 66.51% -0.03%
==========================================
Files 2519 2520 +1
Lines 202294 202330 +36
Branches 9049 9065 +16
==========================================
- Hits 134590 134571 -19
- Misses 55551 55606 +55
Partials 12153 12153
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
ea61adf to
08c67dd
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
WalkthroughThis PR adds a new Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can enforce grammar and style rules using `languagetool`.Configure the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@server/datastore/mysql/schema.sql`:
- Line 147: The schema snapshot contains an upgraded-instance default
(gitops.exceptions.labels=true) that conflicts with ApplyDefaultsForNewInstalls
in server/fleet/app.go which sets labels=false for new installs; update the
migration or default-generation code that produces the app_config_json insert
(the generator that emits server/datastore/mysql/schema.sql) so the generated
default JSON sets "gitops.exceptions.labels": false (or aligns with
ApplyDefaultsForNewInstalls), regenerate schema.sql, and ensure the migration
that seeds the app_config_json row (the migration function that builds the
default app config) is changed rather than hand-editing schema.sql.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0030ce92-5c34-4673-8af2-12f32a9c6d44
📒 Files selected for processing (17)
cmd/fleetctl/fleetctl/gitops_test.gocmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/generateGitops/appConfig.jsoncmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.ymlserver/datastore/mysql/migrations/tables/20260318210346_AddGitOpsExceptionsToAppConfig.goserver/datastore/mysql/migrations/tables/20260318210346_AddGitOpsExceptionsToAppConfig_test.goserver/datastore/mysql/schema.sqlserver/fleet/app.goserver/service/client.goserver/service/integration_enterprise_test.gotools/cloner-check/generated_files/appconfig.txt
| // Enable GitOps mode first | ||
| s.Do("PATCH", "/api/latest/fleet/config", json.RawMessage(`{ | ||
| "gitops": { "gitops_mode_enabled": true, "repository_url": "https://example.com/repo" } | ||
| }`), http.StatusOK) |
There was a problem hiding this comment.
We don't need this anymore right?
There was a problem hiding this comment.
actually yeah but just to check that patching the exceptions doesn't blow away the gitops mode properties.
Related issue: Resolves #42008
Details
Step one in #40171.
This PR adds a new
exceptionssubsection to the current GitOps config, with boolean keys for software, secrets and labels. For existing instances a migration is included to set labels and secrets totrue. For new instances, onlysecretswill betrue.Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
n/a, will put changelog in when more functionality is implemented.
Testing
(https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another)
gitops.exceptionswithsoftware: false, secrets: true, labels: truegitops.exceptionswithsoftware: false, secrets: true, labels: falseDatabase migrations
n/a
n/a
COLLATE utf8mb4_unicode_ci).n/a
New Fleet configuration settings
these will not be set in GitOps, since they're about how GitOps works.
Summary by CodeRabbit
Release Notes
New Features
Improvements