sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-agent: install agent.env from /tmp/agent (complete staging fix)

Browse Source 
Companion to the previous commit's file move: point the 2b-agent install at
/tmp/agent/agent.env (the agent's own upload) instead of the deleted
/tmp/etc-stage path, update the file-provisioner comment, the enable_agent var
description, and the TODO source-path reference. packer validate passes.
This commit is contained in:
Audiobuzz
2026-07-05 06:36:54 +00:00
parent d0f39443ce
commit 254ec79cae
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+7 -5
View File
@@ -132,7 +132,7 @@ variable "kiosk_url" {
variable "enable_agent" {
type = bool
description = "Build-time feature flag for the on-host fleet-agent (telemetry client that dials the fleet-manager over TPM-mTLS and streams health; docs/fleet-management-design.md). true (default) installs /usr/local/bin/fleet-agent + fleet-agent.service; false skips it (the auth stack still boots — the agent is a management add-on). Config is fleet-generic in files/etc/fleet-agent/agent.env; set the manager DNS name there per environment."
description = "Build-time feature flag for the on-host fleet-agent (telemetry client that dials the fleet-manager over TPM-mTLS and streams health; docs/fleet-management-design.md). true (default) installs /usr/local/bin/fleet-agent + fleet-agent.service; false skips it (the auth stack still boots — the agent is a management add-on). Config is fleet-generic in files/agent/agent.env; set the manager DNS name there per environment."
default = true
}
@@ -265,9 +265,11 @@ build {
destination = "/tmp/fleet-hostapi"
}
# On-host fleet-agent: the systemd unit is staged from here; the static binary
# (built OUT OF THE VM like enrol/hostapi) is staged separately. The baked,
# fleet-generic config lands via the /tmp/etc-stage contents upload below.
# On-host fleet-agent: the systemd unit AND the baked fleet-generic config
# (agent.env) are staged from here to /tmp/agent (installed in the 2b-agent step,
# which runs AFTER /tmp/etc-stage is cleaned — so config must ride this upload,
# not files/etc). The static binary (built OUT OF THE VM like enrol/hostapi) is
# staged separately below.
provisioner "file" {
source = "files/agent"
destination = "/tmp/"
@@ -644,7 +646,7 @@ build {
"if [ \"$ENABLE_AGENT\" != \"true\" ]; then echo 'enable_agent=false -> skipping fleet-agent install.'; exit 0; fi",
"install -D -m0755 /tmp/fleet-agent /usr/local/bin/fleet-agent",
"install -D -m0644 /tmp/agent/fleet-agent.service /etc/systemd/system/fleet-agent.service",
"install -D -m0644 /tmp/etc-stage/fleet-agent/agent.env /etc/fleet-agent/agent.env",
"install -D -m0644 /tmp/agent/agent.env /etc/fleet-agent/agent.env",
"restorecon -R /usr/local/bin/fleet-agent /etc/systemd/system/fleet-agent.service /etc/fleet-agent 2>/dev/null || true",
"systemctl enable fleet-agent.service",
"rm -rf /tmp/agent /tmp/fleet-agent",
docs/TODO.md
+1 -1
View File
@@ -1406,7 +1406,7 @@ the design forks resolved:
**receives `DesiredState`/`Command` but only LOGS them** (zero host mutation).
Static `CGO_ENABLED=0` binary built out-of-VM in CI (like enrol/hostapi), staged
by the `2b-agent` provisioner (`enable_agent`, default on), fapolicyd-trusted,
fleet-generic config in `files/etc/fleet-agent/agent.env`. mTLS handshake proven
fleet-generic config in `files/agent/agent.env`. mTLS handshake proven
end-to-end against the go-tpm software simulator (`files/agent/simtest`). No
dracut/initramfs changes (post-switch-root only). **STILL TO BUILD (deferred):**
the **reconcile actuators** — apply kiosk_url, reboot_at/REBOOT, drain — wired to