Update `fleetctl apply` to support new bootstrap package

[lukeheath]

CLI

Update config YAML file

Example config YAML file:

apiVersion: v1
kind: config
spec:
  mdm:
    macos_setup:
      bootstrap_package: https://s3.amazon/folderX/dsdfkasdjfsfad/mypackage
  ...

• Add a macos_setup and bootstrap_package key under the mdm top level key in the config YAML file.
• bootstrap_package accepts an URL to a bootstrap package (.pkg file).
• This updates the bootstrap package for hosts that automatically enroll to no team
• Check if the package is signed.
• Generate checksum.

Empty

• If the user applies a config file with an empty bootstrap_package the package is deleted from Fleet. Any host that automatically enrolls to no team in the future won't get the package. The package is not uninstalled from hosts that already enrolled.

Errors

• Error if the URL does not exist or isn't accessible to the public internet. Error message matches the current behavior of fleetctl apply: Error: the URL to the bootstrap_package doesn't exist. Please make this URL publicly accessible to the internet.
• Error if Fleet is not connected to Apple (MDM is not turned on in Fleet)
• Error if the user tries to add a file that's not a .pkg: Couldn’t edit bootstrap_package. The file must be a package (.pkg).
• Error if the user tries to add a package that isn't signed: Couldn’t edit bootstrap_package. The bootstrap_package must be signed. Learn how to sign the package here in the Fleet documentation: https://fleetdm.com/docs/using-fleet/mdm-macos-setup

User added bootstrap package in UI

• If user added a bootstrap package in the UI, the bootstrap_package key doesn't include the bootstrap package when the user gets the config YAML.
• When applying the config file, the bootstrap package specified in bootstrap_package overrides the bootstrap package added in the UI.

Update team YAML file

Example team YAML file:

apiVersion: v1
kind: team
spec:
  team:
    name: Workstations
    mdm:
      macos_setup:
        bootstrap_package: https://s3.amazon/folderX/dsdfkasdjfsfad/mypackage
    ...

• Add a macos_setup and a bootstrap_package key under the mdm top level key in the team YAML file.
• bootstrap_package accepts a paths to a bootstrap package (.pkg file). Path is relative to directory that the YAML file is in.
• This updates the bootstrap package for hosts that automatically enroll to the tam
• Use the same "Empty" behavior from the config file above (above).
• Use the same "Errors" behavior from the config YAML file (above).
• Use the same "User added bootstrap package in the UI" behavior from the config YAML file (above).

[lukeheath]

Hey team! Please add your planning poker estimate with Zenhub @mna @roperzh @gillespi314

[roperzh]

@noahtalerman sanity check (probably a nitpick): does it make sense to say "Couldn’t upload." in the errors? In the UI that's intuitive, but here we're not uploading the package.

[noahtalerman]

@roperzh agreed! We should update that error message. Good catch.

What about this?

Couldn’t edit bootstrap_package...

I think this language is what we use for custom_settings (configuration profiles) errors.

[roperzh]

That looks great, thanks!

[fleet-release]

Cloud city package, Fleetctl apply update, Signed, secure, and smooth.