Scope App Store apps via labels

[marko-lisica]

Goal

User story
As an IT admin,
I want to install the App Store apps (during the first boot or later) only on macOS hosts that are a member of the specific label
so that I can scope software install more granularly (e.g. by department, role, hardware, etc.).

Key result

Fleet users can automatically install any software in Fleet w/o writing policies

Original requests

• Automatically install and scope software within a team #21825

Context

• Product designer: @marko-lisica

Changes

Product

• UI changes: Figma link
• CLI (fleetctl) usage changes: No changes.
• YAML changes: [API/YAML changes] Scope App Store apps via labels #24709
• REST API changes: [API/YAML changes] Scope App Store apps via labels #24709
• Fleet's agent (fleetd) changes: No changes.
• Activity changes: [Activity changes] Scope App Store apps via labels #24785
• Permissions changes: No changes. Permissions covered by "Add, edit, and delete software" row in the permissions guide.
• Changes to paid features or tiers: Fleet Premium.
• Other reference documentation changes: No changes.
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Feature guide changes: https://fleetdm.com/guides/install-vpp-apps-on-macos-using-fleet
• Database schema migrations: N/A
• Load testing: unable to loadtest VPP at this time

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: No (see above)
• Risk level: Low

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

#23744 and #24989 are related and testing efforts should be made to test these together.

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[marko-lisica]

@georgekarrv, I cut out the scoping of VPP software into a separate story. Subtasks are moved as well. I added activities additionally. I'm moving it to "Ready to spec" so you can decide if this needs another estimation.

[lukeheath]

@mostlikelee Moving back to "Ready for spec" to resolve TODOs.

[noahtalerman]

@mostlikelee reminder that this one is ready to spec. Can you please complete the "TODOs" in "Engineering" section so we can estimate this one?

[mostlikelee]

needs more discussion, will schedule meeting

[mostlikelee]

@lukeheath @noahtalerman I believe we want to block this story until the larger discussion around extending Policies occurs. Happy to serve as discussion coordinator if needed.

[lukeheath]

@mostlikelee Correct, that's my understanding.

[noahtalerman]

• Release as-is with copy updates (Figma here) for 4.62.0. Issue with copy updates is here.
• In a follow up iteration, update the UI so that policies outside software scope are filtered from the list of policies on the host details page. Tracked in a user story here: Hide policies outside software target on Host details and My device page #25226
• In the iteration in which we draft "Scope policies using labels" (Scope policies using labels #24097), Which the #g-orchestration team will take on this quarter (Q1 2025), decide if we want to revise policy behavior or extend our policy results processing and keep policies as-is.

@mostlikelee I don't think we need to block this story.

During our call. this week, we decided on the plan above (from the separate issue here). I think we can continue down the current path (keep policies as-is) and ship this story before we get to filtering out policies or extending policies.

Tim, if you don't think moving forward with this story is the right call please schedule some time with me and @lukeheath. Thanks!

[lukeheath]

@noahtalerman Thanks for the clarification! I think the confusion is whether or not we're waiting on #25226 before implementing this. I suggest they be included in the same sprint so that we can implement this feature and hide the out of scope policies in the same release.

@mostlikelee Let's continue spec'ing and estimating this based on the understanding that we will continue to use the existing policy approach Jahziel implemented. Separately, we will have another story to filter the results out during policy results processing.

[noahtalerman]

Hey @mostlikelee can you please complete the TODOs in the "Engineering" section so we can bring this one to estimation on Weds?

Note that is the last g-software story that won't go through the new User story review process before estimation.