fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up: 1. Bake the real fleet CA into the image. New `fleet_ca` build var (default = the committed placeholder) file-provisions the trust anchor to /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file and passes -var fleet_ca; unset => placeholder (lab). No CA material committed. 2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root only). Host TPM certs are leaf-only in NV and signed by the step-ca intermediate, so a root-only client CA makes the manager advertise only the root in its CertificateRequest -> Go clients send no cert ("tls: certificate required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves. 3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand: seeds/updates an inventory record for a host enrolled out of band (bench broker, migrated fleet) through the real store, so its agent stream is accepted. The manual counterpart to the authorise-approve flow. 4. The agent surfaces the authoritative recv-side gRPC status instead of the bare io.EOF gRPC returns on the send side when the server ends the stream — so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".
2026-07-10 05:51:57 +00:00
parent 4b99816394
commit a89c3d2af1
7 changed files with 193 additions and 15 deletions
@@ -71,6 +71,14 @@ FP=$(openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -
 echo "    root fingerprint: $FP"
 echo "    copy to: files/etc/dot1x/radius-ca.pem  (image trust anchor)"

+# Also export the INTERMEDIATE: leaf certs (host TPM identities, RADIUS, the
+# fleet-manager server cert) are signed by it, so the fleet-manager agent-plane
+# CLIENT CA must be root+intermediate (server-pki.sh reads it via
+# FLEET_CA_INTERMEDIATE). Best-effort — a single-tier CA has none.
+incca cp /home/step/certs/intermediate_ca.crt /export/intermediate_ca.crt 2>/dev/null \
+    && echo "    exported intermediate_ca.crt (-> server-pki.sh fleet-ca.crt bundle)" \
+    || echo "    (no intermediate_ca.crt — single-tier CA)"
+
 # --- 1b. raise the CA cert-duration claim (idempotent) ----------------------
 # A stock step-ca caps issued certs at 24h. Both the RADIUS server cert below
 # AND the enrol-broker (--not-after 720h) need longer-lived fleet certs, so the
@@ -163,3 +163,81 @@ func runRegisterAdmin(args []string) int {
 	fmt.Printf("Enrolment link for %q (valid %s) — open on the mgmt network, then tap the YubiKey:\n\n  %s/#/enrol?token=%s\n\n", name, ttl.String(), base, tok)
 	return 0
 }
+
+// runRegisterHost implements:
+//
+//	fleet-manager register-host [-name S] [-hostnqn N] [-inventory F] <cert-serial-hex>
+//
+// It seeds or updates an inventory record for a host enrolled OUT OF BAND (the
+// standalone bench broker, or a manager inheriting an existing fleet), so the
+// agent stream — which the manager refuses for an unknown serial (agent.go
+// "host is not enrolled") — is accepted. Normally the record is born by the
+// authorise-approve flow; this is the manual import path. It writes through the
+// real jsonStore (atomic save), so it must point at the SAME inventory file the
+// service uses (FLEET_MGR_INVENTORY, default /data in the container). Run it via
+// `docker compose run --rm fleet-manager register-host ...`.
+func runRegisterHost(args []string) int {
+	fs := flag.NewFlagSet("register-host", flag.ContinueOnError)
+	name := fs.String("name", "", "starship name (dnsmasq fleet-namer join; advisory)")
+	inv := fs.String("inventory", env("FLEET_MGR_INVENTORY", "/var/lib/fleet-manager/inventory.json"), "inventory file (must match the service's FLEET_MGR_INVENTORY)")
+	nqn := fs.String("hostnqn", "", "host NQN (default: $HOSTNQN_BASE + serial)")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	serial := strings.ToLower(strings.TrimSpace(fs.Arg(0)))
+	if !isHexSerial(serial) {
+		fmt.Fprintln(os.Stderr, "usage: fleet-manager register-host [-name S] [-hostnqn N] [-inventory F] <cert-serial-hex>")
+		return 2
+	}
+
+	store, err := newJSONStore(*inv)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "inventory %s: %v\n", *inv, err)
+		return 1
+	}
+	hostnqn := *nqn
+	if hostnqn == "" {
+		hostnqn = env("HOSTNQN_BASE", "nqn.2026-06.org.example.fleet:host-") + serial
+	}
+	now := time.Now().UTC()
+
+	h, existed := store.Get(serial)
+	if !existed {
+		h = &Host{Identity: Identity{CertSerial: serial}, FirstSeen: now}
+	}
+	h.Identity.CertSerial = serial
+	h.Identity.Hostnqn = hostnqn
+	if *name != "" {
+		h.Identity.StarshipName = *name
+	}
+	if h.Enrolled.At.IsZero() {
+		h.Enrolled = Enrolled{Approver: "register-host CLI", At: now}
+	}
+	h.LastSeen = now
+
+	if err := store.Upsert(h); err != nil {
+		fmt.Fprintf(os.Stderr, "write inventory %s: %v\n", *inv, err)
+		return 1
+	}
+	verb := "registered"
+	if existed {
+		verb = "updated"
+	}
+	fmt.Printf("%s host %s (starship=%q hostnqn=%s) in %s\n", verb, serial, h.Identity.StarshipName, hostnqn, *inv)
+	return 0
+}
+
+// isHexSerial reports whether s is a non-empty lowercase-hex cert serial (the
+// inventory key form). Serials can be odd-length hex (big-int %x), so we validate
+// characters rather than decoding.
+func isHexSerial(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')) {
+			return false
+		}
+	}
+	return true
+}
@@ -112,6 +112,13 @@ func main() {
 	if len(os.Args) > 1 && os.Args[1] == "register-admin" {
 		os.Exit(runRegisterAdmin(os.Args[2:]))
 	}
+	// Subcommand: `fleet-manager register-host <serial>` seeds/updates an inventory
+	// record for a host enrolled OUT OF BAND (bench broker, migrated fleet) so its
+	// agent stream is accepted — the manual counterpart to the authorise-approve
+	// flow that normally births the record.
+	if len(os.Args) > 1 && os.Args[1] == "register-host" {
+		os.Exit(runRegisterHost(os.Args[2:]))
+	}

 	log.SetFlags(log.LstdFlags | log.LUTC)
 	cfg := loadConfig()
@@ -29,6 +29,7 @@ OUT=${OUT:-./pki/agent}
 AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
 FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
 FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
+FLEET_CA_INTERMEDIATE=${FLEET_CA_INTERMEDIATE:-../dot1x-bench/pki/intermediate_ca.crt}
 STEP_PROVISIONER=${STEP_PROVISIONER:-enrol}
 STEP_PROVISIONER_PASSWORD_FILE=${STEP_PROVISIONER_PASSWORD_FILE:-../dot1x-bench/pki/stepca/secrets/password}
 CERT_NOT_AFTER=${CERT_NOT_AFTER:-8760h}
@@ -39,9 +40,6 @@ command -v step >/dev/null || { echo "error: 'step' CLI not found (smallstep/cli

 mkdir -p "$OUT"

-# The fleet root doubles as the agent-plane CLIENT CA (verifies host TPM certs).
-cp "$FLEET_CA_ROOT" "$OUT/fleet-ca.crt"
-
 # First SAN is the CN; every SAN (DNS name / IP) hosts might dial goes in --san.
 primary=${AGENT_SANS%%,*}
 san_args=()
@@ -60,6 +58,30 @@ step ca certificate "$primary" "$OUT/server.crt" "$OUT/server.key" \

 chmod 600 "$OUT/server.key"

+# fleet-ca.crt = the agent-plane CLIENT CA that verifies host TPM identity certs.
+# Host certs are stored LEAF-ONLY in TPM NV and are signed by the step-ca
+# INTERMEDIATE, so this MUST be root + intermediate. Root-only fails two ways:
+# (1) the manager can't build leaf->intermediate->root, and (2) it advertises only
+# the root in its TLS CertificateRequest, so a Go client whose leaf is issued by
+# the intermediate sends NO cert at all ("remote error: tls: certificate
+# required"). Prefer an explicit intermediate file; else pull it from the chain
+# step wrote into the just-issued server.crt (every cert after the leaf).
+intermediate=""
+if [ -f "$FLEET_CA_INTERMEDIATE" ]; then
+    intermediate=$(cat "$FLEET_CA_INTERMEDIATE")
+else
+    intermediate=$(awk 'BEGIN{c=0} /-----BEGIN CERTIFICATE-----/{c++} c>1' "$OUT/server.crt")
+fi
+{
+    [ -n "$intermediate" ] && printf '%s\n' "$intermediate"
+    cat "$FLEET_CA_ROOT"
+} > "$OUT/fleet-ca.crt"
+if [ -z "$intermediate" ]; then
+    echo "WARNING: no intermediate CA found (set FLEET_CA_INTERMEDIATE, or the CA has none) —" >&2
+    echo "         fleet-ca.crt is ROOT-ONLY; leaf-only host certs issued by an intermediate" >&2
+    echo "         will fail mTLS with 'tls: certificate required'." >&2
+fi
+
 echo
 echo "done. staged in $OUT :"
 echo "  server.crt / server.key   -> FLEET_MGR_AGENT_CERT / _KEY"