fleet/ee/tools/puppet/fleetdm

fleetdm

Table of Contents

1. Description
2. Setup - The basics of getting started with fleetdm
   • Setup requirements
   • Beginning with fleetdm
3. Usage - Configuration options and additional functionality
   • Defining profiles for a device
   • Releasing a device from await configuration
4. Limitations - OS compatibility, etc.
5. Development - Guide for contributing to the module

Description

Manage MDM settings for macOS devices using Fleet

Setup

Setup Requirements

This module requires to add fleetdm as a reporter in your report settings, this helps Fleet understand when your Puppet run is finished and assign the device to a team with the necessary profiles.

For example, in your server configuration:

reports = http,fleetdm

To communicate with the Fleet server, you also need to provide your server URL and a token as Hiera values:

---
fleetdm::host: https://example.com
fleetdm::token: my_token 

Note: for the token, we recommend using an API-only user, with a GitOps role.

Beginning with fleetdm

Usage

Defining profiles for a device

The examples/ folder in this repo contain some examples. Generally, you can define profiles using the custom resource type fleetdm::profile:

node default {
  fleetdm::profile { 'com.apple.universalaccess':
    template => template('fleetdm/profile-template.mobileconfig.erb'),
    group    => 'workstations',
  }
}

Releasing a device from await configuration

If your DEP profile had await_device_configured set to true, you can use the fleetdm::release_device function to release the device:

$host_uuid = $facts['system_profiler']['hardware_uuid']
$response = fleetdm::release_device($host_uuid)
$err = $response['error']

if $err != '' {
  notify { "error releasing device: ${err}": }
}

Limitations

At the moment, this module only works for macOS devices.

Development

To trigger a puppet run locally:

puppet apply --debug --test --modulepath="$(pwd)/.." --reports=fleetdm  --hiera_config hiera.yaml examples/multiple-teams.pp

To lint/fix Puppet (.pp) files, use:

pdk bundle exec puppet-lint --fix .

To lint/fix Ruby (.rb) files, use:

pdk bundle exec rubocop -A