Advanced Alternate Configurations

In addition to the standard methods of configuring a single main super workflow via command line and MDM configuration profiles, you can also create multiple alternate configurations that can be used to start a variety of different super workflows on demand.

Understanding Advanced Alternate Configurations

The general idea behind advanced alternate configurations is to allow for the creation of a wide variety of different super workflows. As a simple example, if your main super configuration only allows for macOS minor updates, you could also have an alternate temporary configuration that allows for macOS major upgrades. You would then only enable this temporary macOS major upgrade workflow once a year when you are ready to move your fleet to the next major version of macOS.

These advanced alternate configuration settings files are stored in the /Library/Management/super/configs/ folder. You can use the various --config-* options documented below to create, edit, delete, and start alternate configurations. While you can use these options on each of your deployed systems to create all your alternate configuration settings files, you could also deploy an entire /Library/Management/super/configs/ folder full of configuration settings files using traditional file copy or package methods.

Code Signed Alternate Configurations

If you deploy your super alternate configuration settings files using traditional file copy or package methods, then you can also take advantage of code signing to ensure the settings files aren't tampered with. Code signing of alternate configuration preference files is entirely optional, but if a preference file has been code signed, then it must be valid for super to accept it. Therefore, super will not accept any code signed alternate configuration preference files that have been modified from their original signed state.

While none of the --config-* options documented below can generate code-signed alternate configuration settings files,you can use built-in Apple command-line tools(https://macblog.org/sign-scripts/) to sign these files after super has created them. You can further secure your workflows by requiring that all alternate configuration settings files are code-signed with a matching identifier. You can enable this security feature using the following option that can ONLY be deployed via a super MDM configuration profile.

Configuration profile example:
<key>ConfigCodeSignature</key>
<string>Identifier</string>

If this managed preference option is deployed, then the super workflow will only accept alternate configuration preference files that are code-signed and match the specified identifier. Both Apple Bundle and Apple Team identifiers are supported.

Edit the Main Configuration

Edit configuration options in the main super settings file(this option does not start any workflow).

Command option example:
--config-edit-main

Any other workflow options specified at the same time (or in the same command line) are added to the main /Library/Management/super/com.macjutsu.super.plist.

Note that because other items in this settings file are regularly modified by active super workflows, this file cannot take advantage of code-signing techniques.

Create or Edit an Alternate Configuration

Create or edit configuration options in an alternate super settings file(this option does not start any workflow).

Command option example:
--config-edit=ConfigurationName

Any other workflow options specified at the same time (or in the same command line) are added to an alternate settings file located at /Library/Management/super/configs/com.macjutsu.super.ConfigurationName.plist.

Note that some super command line options cannot be saved to an advanced alternate configuration. Please refer to this spreadsheet (tab-separated values) for super command line options that are compatible with advanced alternate configurations].

Clone or Edit an Alternate Configuration

Duplicate an existing alternate configuration settings file(this option does not start any workflow).

Command option example:
--config-clone=SourceConfigurationName

This option must be used along with the --config-edit=ConfigurationName option to specify (a new or existing) settings file for the copy of the cloned configuration. Any additional options specified in the same run are also applied to the destination settings file.

Note that some super command line options cannot be saved to an advanced alternate configuration. Please refer to this spreadsheet (tab-separated values) for super command line options that are compatible with advanced alternate configurations].

Delete a Specific Alternate Configuration

Delete the specified alternate configuration settings file.

Command option example:
--config-delete=ConfigurationName

Obviously, if the deleted configuration was being used for an active workflow, then that workflow is also stopped.

Delete All Alternate Configurations

Deletes all alternate configuration settings files.

Command option example:
--config-delete-all

This removes all alternate configuration settings files in the /Library/Management/super/configs/ folder. Obviously, if any of the deleted configurations were being used for an active workflow, then those workflows are also stopped.

Start a Default Alternate Configuration

Start the specified alternate configuration as the default super workflow.

Command option example:
--config-start-default=ConfigurationName

Command option disable example:
--config-start-default=X

Workflow options in the default configuration take priority over similar options in the main super configuration.

Additionally, specific options that are only found in the main super configuration are also used in the resulting workflow. Further, all options (unique or conflicting) that are specified via a super MDM configuration profile take priority over all local configuration settings.

Start a Temporary Configuration

Start the specified alternate configuration as a temporary super workflow.

Command option example:
--config-start-temp=ConfigurationName

Command option disable example:
--config-start-temp=X

Workflow options in the temporary configuration take priority over BOTH the default configuration and the main super configuration. However, once the workflow defined by the temporary configuration has completed, super returns to the default configuration or the main super configuration (if there is no alternate default configuration).

Additionally, specific options that are only found in the main super configuration are also used in the resulting workflow. Further, all options (unique or conflicting) that are specified via a super MDM configuration profile take priority over all local configuration settings unless you also configure the ConfigTempOverride key.

Allow Temporary Configuration Override

Allow temporary alternate configuration options (started via the --config-start-temp=ConfigurationName option) to also override conflicting managed preference opinions.

Configuration profile example:
<key>ConfigTempOverride</key>
<true/>

To prevent workflow tampering, this option can ONLY be deployed via a super MDM configuration profile.

Display Configuration Status

Show the current status of a wide variety of system and super related items.

Command option examples:
sudo super --config-status

While this option does require root permissions, it does not start or interrupt any super workflow. The output from this option is ideal for troubleshooting configuration issues without having to interrogate any super log files. Further, the output from this option does not contain any saved credential details, so it's ideal for sharing with others to assist in your troubleshooting efforts.

Configuration status shown by this option includes: