48093 auld api gitops latest os version - #50213
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for configuring Apple OS updates in a new "latest" mode (with deadline_days) across API, GitOps, and declaration generation, including validation and variable-substitution safeguards.
Changes:
- Extend
AppleOSUpdateSettingswithdeadline_days, a"latest"minimum_version sentinel, and mode-specific validation/configured logic. - Generate OS update declarations using Fleet-internal
$FLEET_VAR_HOST_TARGET_OS_VERSION/$FLEET_VAR_HOST_TARGET_OS_DEADLINEplaceholders in"latest"mode, and ensure those vars are rejected in admin-uploaded declarations. - Update GitOps/appconfig/team-spec paths and tests to round-trip and clear
deadline_days.
Reviewed changes
Copilot reviewed 31 out of 31 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| server/service/integration_enterprise_test.go | Updates integration expectations to include deadline_days in MDM OS update settings. |
| server/service/client.go | GitOps apply: sends explicit nulls for deadline_days when omitted to keep YAML as source of truth. |
| server/service/apple_mdm_test.go | Adds coverage ensuring Fleet-internal OS update variables are rejected in user declarations. |
| server/service/appconfig.go | Treats deadline_days changes as OS update edits and adds license gating for deadline_days edits. |
| server/service/appconfig_test.go | Adds tests for free-tier gating and change detection around deadline_days. |
| server/mdm/apple/apple_mdm.go | Skips Apple version lookup when minimum_version is the "latest" sentinel. |
| server/mdm/apple/apple_mdm_test.go | Adds tests confirming "latest" bypasses Apple metadata lookups while mixed modes still validate concrete versions. |
| server/fleet/mdm.go | Introduces Fleet-internal var names for host-target OS version/deadline. |
| server/fleet/app.go | Adds deadline_days, "latest" sentinel, and validation/configured semantics for Apple OS updates. |
| server/fleet/app_test.go | Adds unit tests for "latest" validation and Configured() behavior. |
| ee/server/service/teams.go | Ensures team OS update change detection/validation includes deadline_days and validates iOS/iPadOS updates in specs. |
| ee/server/service/teams_test.go | Adds tests for team modify/spec apply behaviors involving deadline_days and latest-mode declarations. |
| ee/server/service/mdm.go | Emits placeholders + tracks fleet vars when generating latest-mode OS update declarations. |
| ee/server/service/mdm_test.go | Tests declaration JSON and tracked vars for both latest-mode and specific-version mode. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml | Updates expected YAML output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/unassigned.yml | Updates expected generate-gitops output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/team-a-thumbsup.yml | Updates expected generate-gitops output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yaml | Updates expected global controls output to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.yml | Updates expected teams YAML to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.json | Updates expected teams JSON to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml | Updates expected config YAML to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json | Updates expected config JSON to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml | Updates expected app config YAML to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml | Updates expected app config (team maintainer) YAML to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json | Updates expected app config (team maintainer) JSON to include deadline_days. |
| cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json | Updates expected app config JSON to include deadline_days. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughApple OS update settings now support Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/service/client.go (1)
2661-2675: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winInclude
deadline_dayswhen deriving macOSupdate_new_hosts.In latest mode,
minimum_versionanddeadline_daysare set butdeadlineis empty, so the current default evaluates tofalse. This contradicts the comment’s “updates are configured” behavior and disables update enforcement for newly enrolled hosts unless users explicitly setupdate_new_hosts.Proposed fix
if macOSUpdates["update_new_hosts"] == nil { - macOSUpdates["update_new_hosts"] = macOSUpdates["minimum_version"] != "" && macOSUpdates["deadline"] != "" + macOSUpdates["update_new_hosts"] = macOSUpdates["minimum_version"] != "" && + (macOSUpdates["deadline"] != "" || macOSUpdates["deadline_days"] != nil) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/service/client.go` around lines 2661 - 2675, The default derivation of macOS update_new_hosts incorrectly ignores deadline_days. Update the assignment in the macOS updates handling block so it defaults to true when minimum_version and either deadline or deadline_days are configured, while preserving explicit update_new_hosts values and false when no update settings are configured.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/server/service/teams.go`:
- Around line 1434-1444: Update the GitOps MDM validation flow around
MacOSUpdates, IOSUpdates, and IPadOSUpdates to also call
ValidateMDMSettingsAppleSupportedOSVersion for each corresponding platform.
Return the same invalid-argument error pattern when a supported-version check
fails, matching the API path behavior and preventing unsupported minimum_version
values from being persisted.
In `@server/fleet/app.go`:
- Around line 427-446: Update ModifyAppConfig’s AppleOSUpdateSettings patch
handling to clear the stale DeadlineDays value when minimum_version changes away
from "latest", or when both minimum_version and deadline are cleared, before
calling Validate. Preserve explicitly supplied deadline_days and keep
AppleOSUpdateSettings.Validate unchanged for valid latest-update configurations.
In `@server/service/appconfig.go`:
- Around line 1976-1998: Update the shared license-gate error handling after the
platform update flags so the reported field matches the changed platform and
setting: use the iOS or iPadOS field for their respective changes, while
preserving the macOS field for macOS-only changes. Anchor the change to
updatingMacOSDeadlineDays, updatingIOSDeadlineDays, updatingIPadOSDeadlineDays,
and the existing error append logic.
---
Outside diff comments:
In `@server/service/client.go`:
- Around line 2661-2675: The default derivation of macOS update_new_hosts
incorrectly ignores deadline_days. Update the assignment in the macOS updates
handling block so it defaults to true when minimum_version and either deadline
or deadline_days are configured, while preserving explicit update_new_hosts
values and false when no update settings are configured.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fc44f4a3-96ea-4d91-b335-b1689dfd2d5d
📒 Files selected for processing (31)
cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.ymlcmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yamlcmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/team-a-thumbsup.ymlcmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/unassigned.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.ymlee/server/service/mdm.goee/server/service/mdm_test.goee/server/service/teams.goee/server/service/teams_test.goserver/fleet/app.goserver/fleet/app_test.goserver/fleet/mdm.goserver/mdm/apple/apple_mdm.goserver/mdm/apple/apple_mdm_test.goserver/service/appconfig.goserver/service/appconfig_test.goserver/service/apple_mdm_test.goserver/service/client.goserver/service/integration_enterprise_test.go
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #50213 +/- ##
==========================================
- Coverage 68.26% 68.13% -0.13%
==========================================
Files 3949 3934 -15
Lines 252481 252239 -242
Branches 13291 13361 +70
==========================================
- Hits 172348 171861 -487
- Misses 64698 64948 +250
+ Partials 15435 15430 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 31 out of 31 changed files in this pull request and generated no new comments.
Suppressed comments (1)
server/service/client.go:2665
update_new_hostsdefault derivation only checksminimum_versionanddeadline, so in the new "latest" mode (which usesdeadline_daysand leavesdeadlineempty) GitOps will incorrectly defaultupdate_new_hoststofalsewhenever it isn't explicitly set. This will silently change behavior when users adoptminimum_version: latestunless they also remember to setupdate_new_hostsin YAML.
// Send an explicit null when the file omits deadline_days, otherwise the
// PATCH would leave a previously stored value in place and the YAML would
// stop being the source of truth.
if _, ok := macOSUpdates["deadline_days"]; !ok {
macOSUpdates["deadline_days"] = nil
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 37 out of 37 changed files in this pull request and generated no new comments.
Suppressed comments (2)
ee/server/service/mdm.go:1504
- The new "latest"-mode declaration placeholders (
$FLEET_VAR_HOST_TARGET_OS_VERSION / $ {FLEET_VAR_HOST_TARGET_OS_DEADLINE}) will currently make declaration expansion fail at fetch time:MDMAppleDDMService.replaceDeclarationFleetVariables(server/service/apple_mdm.go:1491-1562) returns an error for any unknown Fleet var, and it has no cases for these new vars. That would cause the OS update declaration to be marked failed and omitted from the manifest.
targetOSVersion := updates.MinimumVersion.Value
targetDeadline := updates.Deadline.Value
var usesFleetVars []fleet.FleetVarName
if updates.EnforcesLatestVersion() {
// In "latest" mode the target version and deadline differ per host (they
// depend on the host's hardware and on when Apple released the version it
// can run), so emit placeholders that are resolved at declaration fetch
// time. The deadline placeholder is brace-delimited so it doesn't absorb
// the time suffix appended below, and resolves to a YYYY-MM-DD date, the
// same shape as updates.Deadline in specific-version mode.
targetOSVersion = fmt.Sprintf("$FLEET_VAR_%s", fleet.FleetVarHostTargetOSVersion)
targetDeadline = fmt.Sprintf("${FLEET_VAR_%s}", fleet.FleetVarHostTargetOSDeadline)
usesFleetVars = []fleet.FleetVarName{
fleet.FleetVarHostTargetOSVersion,
fleet.FleetVarHostTargetOSDeadline,
}
server/service/appconfig.go:1905
- This comment is misleading:
optjson.Stringalready marshals tonullwhenValidis false (and existing config JSON includes"deadline": null). Consider rewording to explain why you prefer""here (e.g., to keep deadline an explicit empty string in latest-mode responses / match existing GitOps behavior), rather than claimingnullwould be a breaking change.
// SetString("") rather than the zero value so this still marshals as
// "" — deadline has always been a string on the wire, and null would
// be a breaking change for API consumers.
JordanMontgomery
previously approved these changes
Aug 4, 2026
Contributor
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ee/server/service/teams_test.go (1)
1874-1924: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd mode-specific GitOps validation cases for iOS and iPadOS.
The table tests
deadlinewithlatestonly for macOS. It also does not testdeadline_dayswith a specific version. Add these invalid cases for iOS and iPadOS so each platform preserves both mode-specific restrictions.As per PR objectives,
latestmust rejectdeadline, and specific versions must rejectdeadline_days.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ee/server/service/teams_test.go` around lines 1874 - 1924, Extend TestApplyTeamSpecsOSUpdatesValidation with invalid mode-specific cases for both IOSUpdates and IPadOSUpdates: latest minimum versions paired with a Deadline, and specific minimum versions paired with DeadlineDays. Set each expected error to the corresponding platform field key, preserving coverage that latest rejects deadlines and specific versions reject deadline_days.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@ee/server/service/teams_test.go`:
- Around line 1874-1924: Extend TestApplyTeamSpecsOSUpdatesValidation with
invalid mode-specific cases for both IOSUpdates and IPadOSUpdates: latest
minimum versions paired with a Deadline, and specific minimum versions paired
with DeadlineDays. Set each expected error to the corresponding platform field
key, preserving coverage that latest rejects deadlines and specific versions
reject deadline_days.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 17117b10-31f1-4791-96b6-4367acb2db4f
📒 Files selected for processing (38)
changes/39085-os-updates-latest-versioncmd/fleetctl/fleetctl/gitops_test.gocmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.ymlcmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.jsoncmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.ymlcmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yamlcmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/team-a-thumbsup.ymlcmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/unassigned.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.ymlcmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.ymlee/server/service/mdm.goee/server/service/mdm_test.goee/server/service/teams.goee/server/service/teams_test.goserver/datastore/mysql/schema.sqlserver/datastore/mysql/teams_test.goserver/fleet/app.goserver/fleet/app_test.goserver/fleet/mdm.goserver/mdm/apple/apple_mdm.goserver/mdm/apple/apple_mdm_test.goserver/service/appconfig.goserver/service/appconfig_test.goserver/service/apple_mdm_test.goserver/service/client.goserver/service/integration_enterprise_test.gotools/cloner-check/generated_files/appconfig.txttools/cloner-check/generated_files/teamconfig.txttools/cloner-check/generated_files/teammdm.txt
🚧 Files skipped from review as they are similar to previous changes (30)
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
- cmd/fleetctl/fleetctl/gitops_test.go
- server/mdm/apple/apple_mdm_test.go
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.yml
- cmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.yml
- server/service/apple_mdm_test.go
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
- cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml
- cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/fleets/unassigned.yml
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
- server/service/client.go
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
- cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
- cmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yaml
- ee/server/service/mdm_test.go
- cmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.json
- server/service/appconfig.go
- server/fleet/app.go
- server/fleet/app_test.go
- server/mdm/apple/apple_mdm.go
- server/fleet/mdm.go
- ee/server/service/teams.go
- server/service/appconfig_test.go
- server/service/integration_enterprise_test.go
- ee/server/service/mdm.go
Contributor
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.
Files excluded by content exclusion policy (1)
- changes/39085-os-updates-latest-version
Suppressed comments (1)
ee/server/service/mdm.go:1500
- In "latest" mode this declaration embeds $FLEET_VAR_HOST_TARGET_OS_VERSION / $FLEET_VAR_HOST_TARGET_OS_DEADLINE placeholders, but declaration delivery always runs MDMAppleDDMService.replaceDeclarationFleetVariables for any declaration with VariablesUpdatedAt (server/service/apple_mdm.go:7045-7052). That function currently has no cases for HOST_TARGET_OS_VERSION / HOST_TARGET_OS_DEADLINE and will return an error (server/service/apple_mdm.go:1560-1562), causing the OS update declaration to be marked failed and skipped from the DDM manifest for every host.
This needs an implementation path that resolves these two Fleet vars (ideally only for Fleet’s reserved OS-update declaration) so the manifest generation doesn’t fail in latest mode.
// time. The deadline placeholder is brace-delimited so it doesn't absorb
// the time suffix appended below, and resolves to a YYYY-MM-DD date, the
// same shape as updates.Deadline in specific-version mode.
targetOSVersion = fmt.Sprintf("$FLEET_VAR_%s", fleet.FleetVarHostTargetOSVersion)
targetDeadline = fmt.Sprintf("${FLEET_VAR_%s}", fleet.FleetVarHostTargetOSDeadline)
Contributor
Author
|
Merged
|
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Contributor
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.
Files excluded by content exclusion policy (1)
- changes/39085-os-updates-latest-version
Suppressed comments (2)
ee/server/service/mdm.go:1504
- The OS-update declaration now embeds $FLEET_VAR_HOST_TARGET_OS_VERSION / $FLEET_VAR_HOST_TARGET_OS_DEADLINE placeholders in "latest" mode, but declaration expansion currently rejects unknown vars:
MDMAppleDDMService.replaceDeclarationFleetVariablesfalls through todefaultand returns "Fleet variable ... is not supported in DDM declarations." for these new names. That will cause the reserved OS-update declaration to fail expansion at fetch time and be excluded from the manifest.
To make "latest" mode work, the server-side expander needs explicit support for these vars (likely resolving from host_mdm_apple_os_updates as described in the constant comment in server/fleet/mdm.go), while still rejecting them in admin-supplied declarations.
if updates.EnforcesLatestVersion() {
// In "latest" mode the target version and deadline differ per host (they
// depend on the host's hardware and on when Apple released the version it
// can run), so emit placeholders that are resolved at declaration fetch
// time. The deadline placeholder is brace-delimited so it doesn't absorb
// the time suffix appended below, and resolves to a YYYY-MM-DD date, the
// same shape as updates.Deadline in specific-version mode.
targetOSVersion = fmt.Sprintf("$FLEET_VAR_%s", fleet.FleetVarHostTargetOSVersion)
targetDeadline = fmt.Sprintf("${FLEET_VAR_%s}", fleet.FleetVarHostTargetOSDeadline)
usesFleetVars = []fleet.FleetVarName{
fleet.FleetVarHostTargetOSVersion,
fleet.FleetVarHostTargetOSDeadline,
}
server/service/appconfig.go:1983
- This comment claims "deadline has always been a string on the wire", but Fleet config JSON/YAML already represents an unset deadline as
null(e.g. default app_config_json in schema.sql). Consider rewording to reflect the actual intent here: clearing to an empty string (instead of leaving it unset/null) for this specific mode switch.
MagnusHJensen
approved these changes
Aug 5, 2026
Contributor
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.
Files excluded by content exclusion policy (1)
- changes/39085-os-updates-latest-version
Suppressed comments (1)
ee/server/service/mdm.go:1503
- The new OS-update declaration placeholders (
$FLEET_VAR_HOST_TARGET_OS_VERSION / $ {FLEET_VAR_HOST_TARGET_OS_DEADLINE}) won’t resolve at fetch time with the current code.
Evidence: server/service/apple_mdm.go’s replaceDeclarationFleetVariables switch has no cases for these vars and will hit the default error path ("Fleet variable $FLEET_VAR_%s is not supported in DDM declarations.", around apple_mdm.go:1675-1677). A declaration containing these placeholders will therefore be marked failed and excluded from the DDM manifest.
To make "latest" mode functional, add support in replaceDeclarationFleetVariables to look up the per-host target_os_version and target_deadline (YYYY-MM-DD) from host_mdm_apple_os_updates (schema.sql shows target_os_version and target_deadline columns) and substitute them for these two variables. Validation can still prevent admins from using these vars in user-supplied declarations (as your tests assert).
targetOSVersion = fmt.Sprintf("$FLEET_VAR_%s", fleet.FleetVarHostTargetOSVersion)
targetDeadline = fmt.Sprintf("${FLEET_VAR_%s}", fleet.FleetVarHostTargetOSDeadline)
usesFleetVars = []fleet.FleetVarName{
fleet.FleetVarHostTargetOSVersion,
fleet.FleetVarHostTargetOSDeadline,
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: Resolves #48093
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
Added/updated automated tests
QA'd all new/changed functionality manually
New Fleet configuration settings
If you didn't check the box above, follow this checklist for GitOps-enabled settings:
Verified that the setting is exported via
fleetctl generate-gitopsVerified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
Summary by CodeRabbit
New Features
deadline_days.deadline_days.Bug Fixes
deadline_daysare detected and applied consistently.