[API] Patch policies: Install new version when app is closed - #49021
Conversation
Documents the proposed only_when_closed field on patch policies and the install_skipped activity/result field, for design review ahead of implementation.
marko-lisica
changed the title
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Dev notes
Get software install results endpoint
GET /api/v1/fleet/software/install/:install_uuid/results
- When
patch_when_closedis set for FMA, and pre-install query doesn't return results/fails, the output for FMAs with this option enabled should be different from the regular pre-install query output, so UI can show "skipped" status.
It should return: "Query dind't return result\nThe app was open.", instead of "Query didn't return result or failed\nInstall stopped".
Continuous automation
patch_when_closed / continuous_automations_enabled validation
If patch_when_closed is true on a policy (existing or being set in the same request) and the request explicitly sets continuous_automations_enabled to false, Fleet rejects the request instead of silently overriding it.
Error message:
▎ If "patch_when_closed" is true, "continuous_automations_enabled" can't be set to false.
Applies on both create and update (API), and on fleetctl gitops (YAML). This only blocks an explicit false — omitting continuous_automations_enabled while enabling patch_when_closed still auto-sets it to true.
Update package endpoint
PATCH /api/v1/fleet/software/titles/:id/package
patch_when_closed requires patch
patch_when_closed is only meaningful when patch is true (either in the same request, or already enabled on that title). Reject the request if patch_when_closed is set while patch isn't true.
Error message:
▎ If "patch_when_closed" is set, "patch" must be true.
Applies on update; the same constraint should hold wherever patch_when_closed is accepted.
There was a problem hiding this comment.
^ @marko-lisica you might want to update the naming in the dev note (patch_only_when_closed -> patch_when_closed) to avoid confusion about the parameter name
There was a problem hiding this comment.
Thanks for catching this. Done ✅
| | labels_include_all | array | body | Target hosts that have all labels, specified by label name, in the array. | | ||
| | labels_include_any | array | body | Target hosts that have any label, specified by label name, in the array. Only one of either `labels_include_any` or `labels_exclude_any` can be specified. | | ||
| | labels_exclude_any | array | body | Target hosts that don't have any label, specified by label name, in the array. | | ||
| | automatic_install | boolean | body | Enables or disables "Force install": a policy that triggers a software install only on hosts missing the software (doesn't check version). Set to `false` to remove the policy. | |
There was a problem hiding this comment.
@marko-lisica TODO: do we want automatic_install for custom packages on PATCH endpoint
3 participants
Related to: