Feature Request: Target Agent Upgrades to Canary Team only for new agent versions

[nv-mikeelliott]

Goal

As the IT QA administrator at my company, responsible for testing updates and changes to end-user systems before wide release, I’d like to propose a method to withhold automatic agent (fleetd) updates to clients when the Fleet server is updated. This would allow me to selectively push the updated agent to a specific group (e.g., a "Canary Team") for testing, ensuring stability before it’s rolled out to the entire organization.

User Story

As an IT QA administrator:

• I want to prevent all clients from automatically receiving an updated agent (fleetd) when the Fleet server is upgraded, so that untested changes don’t impact the entire organization unexpectedly.
• I want to target the updated agent push to a designated group, such as a "Canary Team," so that I can test the new agent version in a controlled environment before approving it for broader deployment.
• After successful testing, I want the ability to confidently trigger the rollout to all end-user systems.

Proposed Solution

1. Withhold Agent Updates by Default: Add a server-side configuration option (e.g., in agent_options or a new setting) to disable automatic fleetd updates on server upgrade. For example, a global toggle like auto_update_agents: false in the config YAML would keep agents on their current version until explicitly updated.
2. Targeted Update Mechanism: Enhance the existing update_channels functionality (ref: Remotely configure fleetd update channels in agent options #13825) to support targeting agent updates to specific teams or labels. For example:

   apiVersion: v1
   kind: team
   spec:
     name: Canary Team
     agent_options:
       update_channels:
         fleetd: <new_version>  # e.g., "4.42.0" or "edge"
       target_update: true      # New flag to trigger update for this team