Issue applying MDM config: MDMAppleConfigProfile.PayloadIdentifier com.fleetdm.fleet.mdm.filevault already exists

[getvictor]

Fleet version:
4.44
Web browser and operating system:

---

💥  Actual behavior

When I try to apply a global MDM config, I get:

Error: applying fleet config: PATCH /api/latest/fleet/config received status 409 Resource Already Exists: MDMAppleConfigProfile.PayloadIdentifier com.fleetdm.fleet.mdm.filevault already exists

Trying to apply it a 2nd time does not result in an issue.

Video: https://www.loom.com/share/cbe95ed5a7b34f07aa19f47531dd1597?sid=c1b1581a-488d-4943-997b-66aa4904742e

🧑‍💻  Steps to reproduce

Load the following config (from fleetctl get config)

---
apiVersion: v1
kind: config
spec:
  agent_options:
    command_line_flags: null
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT hostname AS hostname FROM system_info;
      options:
        disable_distributed: false
        distributed_interval: 10
        distributed_plugin: tls
        distributed_tls_max_attempts: 3
        logger_tls_endpoint: /api/v1/osquery/log
        pack_delimiter: /
  features:
    enable_host_users: true
    enable_software_inventory: true
  fleet_desktop:
    transparency_url: https://fleetdm.com/transparency
  host_expiry_settings:
    host_expiry_enabled: false
    host_expiry_window: 10
  integrations:
    jira:
    - api_token: '********'
      enable_failing_policies: true
      enable_software_vulnerabilities: false
      project_key: JIR
      url: https://fleetdm.atlassian.net
      username: redacted
    zendesk: []
  mdm:
    apple_bm_default_team: Workstations
    apple_bm_enabled_and_configured: false
    apple_bm_terms_expired: false
    enable_disk_encryption: false
    enabled_and_configured: true
    end_user_authentication:
      entity_id: ""
      idp_name: ""
      issuer_uri: ""
      metadata: ""
      metadata_url: ""
    macos_migration:
      enable: false
      mode: ""
      webhook_url: ""
    macos_settings:
      custom_settings:
      - path: ./lib/macos-password.mobileconfig
    macos_setup:
      bootstrap_package: null
      enable_end_user_authentication: false
      macos_setup_assistant: null
    macos_updates:
      deadline: null
      minimum_version: null
    windows_enabled_and_configured: true
    windows_settings:
      custom_settings:
      - path: ./lib/windows-screenlock.xml
    windows_updates:
      deadline_days: null
      grace_period_days: null
  org_info:
    contact_url: https://fleetdm.com/company/contact
    org_logo_url: ""
    org_logo_url_light_background: ""
    org_name: Fleet Device Management
  scripts:
  - ./lib/collect-fleetd-logs.sh
  server_settings:
    debug_host_ids:
    - 1
    - 3
    deferred_save_host: false
    enable_analytics: true
    live_query_disabled: false
    query_reports_disabled: false
    scripts_disabled: false
    server_url: https://dogfood.fleetdm.com
  sso_settings:
    enable_jit_provisioning: true
    enable_jit_role_sync: false
    enable_sso: true
    enable_sso_idp_login: false
    entity_id: dogfood.fleetdm.com
    idp_image_url: ""
    idp_name: Google Workspace
    issuer_uri: ""
    metadata: ""
    metadata_url: https://mocksaml.com/api/saml/metadata
  vulnerability_settings:
    databases_path: ""
  webhook_settings:
    failing_policies_webhook:
      destination_url: https://host.docker.internal:8080/bozo
      enable_failing_policies_webhook: false
      host_batch_size: 0
      policy_ids: []
    host_status_webhook:
      days_count: 0
      destination_url: ""
      enable_host_status_webhook: false
      host_percentage: 0
    interval: 24h0m0s
    vulnerabilities_webhook:
      destination_url: https://example.tines.com/webhook
      enable_vulnerabilities_webhook: true
      host_batch_size: 0

Try to apply a new config:

---
apiVersion: v1
kind: config
spec:
  mdm:
    apple_bm_default_team: "Team1"
    enable_disk_encryption: true
    macos_settings:
      custom_settings:
        - path: ../lib/macos-password.mobileconfig
    windows_settings:
      custom_settings:
        - path: ../lib/windows-screenlock.xml
    macos_setup:
      bootstrap_package: null
      enable_end_user_authentication: false
      macos_setup_assistant: null
    macos_updates:
      deadline: null
      minimum_version: null
    windows_enabled_and_configured: true
    windows_updates:
      deadline_days: null
      grace_period_days: null

🕯️ More info (optional)

N/A

[roperzh]

@getvictor thanks so much for the report and the video. I've been trying to reproduce and think about ways to reproduce this morning but I couldn't.

Are there any other details you think might be relevant? some questions ideas:

1. Did a previous fleetctl apply failed for you for other reason?
2. Can you consistently reproduce? if so, is it only by applying the two configs one after the other?
3. Could you try running fleetctl apply with --debug?
4. Do you see anything that might give us another hint in the server logs?

Thanks and sorry for hammering you with questions.