Add policies for "No team"

changes/21467-policies-for-no-team

@@ -0,0 +1 @@
+* Added support for policies in "No team" that run on hosts that belong to "No team".

cmd/fleetctl/gitops.go

@@ -77,6 +77,23 @@ func gitopsCommand() *cli.Command {
 			if appConfig.License == nil {
 				return errors.New("no license struct found in app config")
 			}
+			logf := func(format string, a ...interface{}) {
+				_, _ = fmt.Fprintf(c.App.Writer, format, a...)
+			}
+
+			// We need to extract the controls from no-team.yml to be able to apply them when applying the global app config.
+			var noTeamControls spec.Controls
+			for _, flFilename := range flFilenames.Value() {
+				if filepath.Base(flFilename) == "no-team.yml" {
+					baseDir := filepath.Dir(flFilename)
+					config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig, logf)
+					if err != nil {
+						return err
+					}
+					noTeamControls = config.Controls
+					break
+				}
+			}
 
 			var originalABMConfig []any
 			var originalVPPConfig []any
@@ -92,7 +109,7 @@ func gitopsCommand() *cli.Command {
 			secrets := make(map[string]struct{})
 			for _, flFilename := range flFilenames.Value() {
 				baseDir := filepath.Dir(flFilename)
-				config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig)
+				config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig, logf)
 				if err != nil {
 					return err
 				}
@@ -109,6 +126,21 @@ func gitopsCommand() *cli.Command {
 					firstFileMustBeGlobal = ptr.Bool(false)
 				}
 
+				if isGlobalConfig {
+					if noTeamControls.Set() && config.Controls.Set() {
+						return errors.New("'controls' cannot be set on both global config and on no-team.yml")
+					}
+					if !noTeamControls.Defined && !config.Controls.Defined {
+						if appConfig.License.IsPremium() {
+							return errors.New("'controls' must be set on global config or no-team.yml")
+						}
+						return errors.New("'controls' must be set on global config")
+					}
+					if !config.Controls.Set() {
+						config.Controls = noTeamControls
+					}
+				}
+
 				// Special handling for tokens is required because they link to teams (by
 				// name.) Because teams can be created/deleted during the same gitops run, we
 				// grab some information to help us determine allowed/restricted actions and
@@ -160,9 +192,6 @@ func gitopsCommand() *cli.Command {
 						}
 					}
 				}
-				logf := func(format string, a ...interface{}) {
-					_, _ = fmt.Fprintf(c.App.Writer, format, a...)
-				}
 				if flDryRun {
 					incomingSecrets := fleetClient.GetGitOpsSecrets(config)
 					for _, secret := range incomingSecrets {