Override default disk encryption settings on macOS

[willmayhone88]

Goal

User story
As an IT admin enforcing disk encryption on the Controls > OS settings > Disk encryption page,
I want to override Fleet's default disk encryption settings w/ a custom profile
so that I can customize the end user experience (ex. DeferDontAskAtUserLogout and DeferForceAtUserLoginMaxBypassAttempts on macOS).

Context

• Product designer: @marko-lisica

Changes

Product

• UI changes: Figma link
• CLI usage changes: Figma link
• REST API changes: API design: Override default disk encryption settings on macOS #19168
• Permissions changes: Admin and GitOps can edit and view custom settings for disk encryption. Team roles can do the same on the teams they have permission.
• Outdated documentation changes: TODO

Engineering

• Database schema migrations: TODO
• Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

@willmayhone88, thanks for tracking this.

Makes sense to have an "Advanced" option for disk encryption to override the profile that Fleet uses today.

[dherder]

This should also be done for Windows Disk Encryption (Bitlocker)

[noahtalerman]

Hey @willmayhone88 I updated this issue to the user story format and moved your original issue description below.

Please take a look at the user story in the issue description and let me know if you have any feedback. Thanks!

---

Problem

Currently you cannot add a configuration profile for additional FileVault 2 options such as, "DeferDontAskAtUserLogout, DeferForceAtUserLoginMaxBypassAttempts" via a configuration profile, due to FileVault 2 settings being managed by Fleet. If trying to upload a profile that contains these settings, you are presented with an error. Some organizations need the ability to configure those options. Requesting the ability to manage additional FileVault 2 options, that Apple allows.

Potential solutions

1. One option would be to have these settings configurable either through the Fleet UI, or through a Fleet configuration file.
2. Another option would be to have the ability to upload a custom configuration profile with FileVault 2 settings.

[nonpunctual]

@noahtalerman do you want a separate issue for BitLocker config customization?

#20805

[JoStableford]

Related to a Slack conversation

[noahtalerman]

do you want a separate issue for BitLocker config customization?

@nonpunctual yes please.

In that issue can you please include which BitLocker options the requester is trying to tweak? Thanks :)

This defines the problem more specifically which makes it more helpful to consider all possible solutions.

[nonpunctual]

related: #16866

[nonpunctual]

@noahtalerman #20848 Seperate issue for BitLocker / Windows.