Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24114

jacobshandling · 2024-11-23T01:18:49Z

Addresses #24112, #24116, #23587

For #24112, Counts included:

Include counts when disk encryption is enforced
Exclude counts when disk encryption isn't enforced
__
Added/updated tests
Manual QA for all new/changed functionality

codecov · 2024-11-23T01:21:45Z

Codecov Report

Attention: Patch coverage is 11.68831% with 68 lines in your changes missing coverage. Please review.

Project coverage is 54.07%. Comparing base (ee73249) to head (259fcad).
Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/mdm.go	0.00%	39 Missing ⚠️
server/service/linux_mdm.go	0.00%	19 Missing ⚠️
ee/server/service/teams.go	20.00%	4 Missing ⚠️
server/service/apple_mdm.go	20.00%	4 Missing ⚠️
frontend/services/entities/mdm.ts	0.00%	1 Missing ⚠️
server/datastore/mysql/labels.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #24114      +/-   ##
==========================================
- Coverage   63.42%   54.07%   -9.35%     
==========================================
  Files        1579     1579              
  Lines      149948   150098     +150     
  Branches     3818     3818              
==========================================
- Hits        95106    81172   -13934     
- Misses      47261    62208   +14947     
+ Partials     7581     6718     -863

Flag	Coverage Δ
backend	`54.10% <11.84%> (-10.20%)`	⬇️
frontend	`52.55% <0.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚨 Try these New Features:

Flaky Tests Detection - Detect and resolve failed and flaky tests
JS Bundle Analysis - Avoid shipping oversized bundles

server/fleet/service.go

server/service/linux_mdm.go

iansltx · 2024-11-23T02:28:27Z

Merging in my existing integration tests branch here as I need the integration test started there to confirm this is behaving correctly. Will probably expand PR scope for the other config known issue(s).

…ility in profiles stats by whether disk encryption is enabled

…ult on enabling encryption if macOS MDM isn't enabled

…urned on, skip FileVault config when enabling disk encryption when macOS MDM is off Also ensures disk encryption on a per-team basis works as expected. TODO: set up FileVault if Mac MDM gets enabled after encryption enforcement is enabled.

…nfigured, set up FileVault escrow at that time

…s cert upload

… to ensure LUKS platform check works on key retrieval

server/service/mdm.go

lucasmrod

LGTM!

Left just a small question.

mna · 2024-11-25T13:34:42Z

server/service/mdm.go

+		}
+	}
+	// Enable FileVault escrow for teams that already have disk encryption enforced
+	// For later: add a data store method to avoid making an extra query per team to check whether encryption is enforced


I think ListTeams is used in a few places to list all teams along with their config? E.g. here:

fleet/server/cron/calendar_cron.go

Lines 76 to 82 in b6c5113

teams, err := ds.ListTeams(

ctx, fleet.TeamFilter{

User: &fleet.User{

GlobalRole: ptr.String(fleet.RoleAdmin),

},

}, fleet.ListOptions{},

)

Yep. Considered that but it pulls way more data so it wasn't clear that it was better than an N+1 here, so will leave this as is.

iansltx

My approval specifically covers the FE changes @jacobshandling made (and that I didn't touch), in my capacity as "being able to review FE code"; thx @lucasmrod for the BE approval!

iansltx · 2024-11-25T14:34:36Z

TestIntegrationSync is an unrelated failure, as are the native tooling/Docker publish failures.

…ate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS (#24114) ## Addresses #24112, #24116, #23587 **For #24112, Counts included:** <img width="1392" alt="Screenshot 2024-11-22 at 5 31 06 PM" src="https://github.com/user-attachments/assets/2bb306d7-1130-4106-aef8-475b8be1f6b2"> - [x] Include counts when disk encryption is enforced - [x] Exclude counts when disk encryption isn't enforced __ - [x] Added/updated tests --------- Co-authored-by: Jacob Shandling <[email protected]> Co-authored-by: Ian Littman <[email protected]>

…ofiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS (#24124) Cherry-pick of #24114, for #24112, #24116, #23587 Co-authored-by: jacobshandling <[email protected]> Co-authored-by: Jacob Shandling <[email protected]>

jacobshandling temporarily deployed to Docker Hub November 23, 2024 01:18 — with GitHub Actions Inactive

iansltx reviewed Nov 23, 2024

View reviewed changes

server/fleet/service.go Outdated Show resolved Hide resolved

server/service/linux_mdm.go Outdated Show resolved Hide resolved

jacobshandling had a problem deploying to Docker Hub November 23, 2024 01:33 — with GitHub Actions Error

jacobshandling force-pushed the aggregate-status-missing-linux branch from bfc10d1 to d8b51c9 Compare November 23, 2024 01:41

jacobshandling had a problem deploying to Docker Hub November 23, 2024 01:41 — with GitHub Actions Failure

iansltx changed the title ~~Aggregate status missing linux~~ Include Linux disk encryption status in configuration profiles aggregate status response when applicable Nov 23, 2024

iansltx had a problem deploying to Docker Hub November 23, 2024 02:26 — with GitHub Actions Failure

Jacob Shandling and others added 7 commits November 22, 2024 20:46

update UI to call newer endpoint

702d6b1

wire up linux DE summary to aggregate endpoint

c037277

only include Linux DE counts in aggregate for premium users

5f7f1ac

Use MDM config profiles return type, gate Linux disk encryption visib…

047d549

…ility in profiles stats by whether disk encryption is enabled

Confirm that config profiles summary is no longer behind MDM wall

b63b725

Start Linux disk encryption enterprise test, don't touch macOS FileVa…

f748190

…ult on enabling encryption if macOS MDM isn't enabled

Test configuration profile visibility for Linux disk encryption

1a716f5

iansltx force-pushed the aggregate-status-missing-linux branch from ad30999 to 1a716f5 Compare November 23, 2024 02:46

iansltx had a problem deploying to Docker Hub November 23, 2024 02:47 — with GitHub Actions Failure

iansltx marked this pull request as ready for review November 23, 2024 02:51

iansltx requested review from a team as code owners November 23, 2024 02:51

iansltx assigned lucasmrod Nov 23, 2024

iansltx had a problem deploying to Docker Hub November 23, 2024 07:01 — with GitHub Actions Failure

If Mac MDM setup is completed after disk encryption enforcement is co…

7be62b0

…nfigured, set up FileVault escrow at that time

iansltx had a problem deploying to Docker Hub November 24, 2024 23:21 — with GitHub Actions Failure

Skip FilveVault escrow setup if Mac MDM was already configured on APN…

e1cfd02

…s cert upload

iansltx had a problem deploying to Docker Hub November 24, 2024 23:32 — with GitHub Actions Failure

iansltx requested a review from mna November 24, 2024 23:55

Finish building integration test for LUKS encryption, add OS platform…

259fcad

… to ensure LUKS platform check works on key retrieval

iansltx had a problem deploying to Docker Hub November 25, 2024 05:17 — with GitHub Actions Failure

iansltx assigned RachelElysia Nov 25, 2024

lucasmrod reviewed Nov 25, 2024

View reviewed changes

server/service/mdm.go Show resolved Hide resolved

lucasmrod approved these changes Nov 25, 2024

View reviewed changes

mna reviewed Nov 25, 2024

View reviewed changes

RachelElysia approved these changes Nov 25, 2024

View reviewed changes

iansltx had a problem deploying to Docker Hub November 25, 2024 13:55 — with GitHub Actions Failure

iansltx approved these changes Nov 25, 2024

View reviewed changes

iansltx merged commit 61a79f5 into main Nov 25, 2024
23 of 27 checks passed

iansltx deleted the aggregate-status-missing-linux branch November 25, 2024 14:34

iansltx mentioned this pull request Nov 25, 2024

Cherry-Pick: Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24124

Merged

iansltx mentioned this pull request Nov 26, 2024

Linux disk encryption is not reflected on host OS settings end disk encryption filters #24174

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24114

Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24114

jacobshandling commented Nov 23, 2024 •

edited by iansltx

Loading

codecov bot commented Nov 23, 2024 •

edited

Loading

iansltx commented Nov 23, 2024

lucasmrod left a comment

mna Nov 25, 2024

iansltx Nov 25, 2024

iansltx left a comment

iansltx commented Nov 25, 2024

	teams, err := ds.ListTeams(
	ctx, fleet.TeamFilter{
	User: &fleet.User{
	GlobalRole: ptr.String(fleet.RoleAdmin),
	},
	}, fleet.ListOptions{},
	)

Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24114

Include Linux disk encryption status in configuration profiles aggregate status response when applicable, fix disk encryption/MDM configuration order-of-operations issues, add integration tests for LUKS #24114

Conversation

jacobshandling commented Nov 23, 2024 • edited by iansltx Loading

Addresses #24112, #24116, #23587

codecov bot commented Nov 23, 2024 • edited Loading

Codecov Report

iansltx commented Nov 23, 2024

lucasmrod left a comment

Choose a reason for hiding this comment

mna Nov 25, 2024

Choose a reason for hiding this comment

iansltx Nov 25, 2024

Choose a reason for hiding this comment

iansltx left a comment

Choose a reason for hiding this comment

iansltx commented Nov 25, 2024

jacobshandling commented Nov 23, 2024 •

edited by iansltx

Loading

codecov bot commented Nov 23, 2024 •

edited

Loading