fleet-agent: on-host TPM-mTLS telemetry client (v1)
Build the on-host agent that pairs with fleet-hostapi and feeds the fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the workstation talked to the manager before this; Monitor + InfluxDB stayed empty. Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello + periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk, probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot, drain) are deferred until the telemetry half is bench-verified. - files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi. Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1 proto so it stays self-contained without importing the initramfs enrol module. - files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth handshake (RequireAndVerifyClientCert) against the go-tpm software simulator. - files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state. - fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress). - CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test. - Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust. Post-switch-root only, so no dracut/initramfs changes. - docs: TODO #14 + fleet-management-design as-built updated. Requires the host already enrolled (broker approve births the inventory row) — else the manager returns PermissionDenied, the correct "not enrolled yet" signal.
This commit is contained in:
Audiobuzz
@@ -0,0 +1,318 @@
|
||||
// snapshot.go — read-only host health probes → *fleetpb.HealthSnapshot, plus the
|
||||
// hostapi facts fetch used to build the connect-time Hello.
|
||||
//
|
||||
// Every probe degrades gracefully: on any error the field is left at its zero
|
||||
// value ("" / 0) rather than failing. A probe must NEVER kill the stream — a
|
||||
// missing thermal zone or an unmounted selinuxfs is normal on some targets/VMs.
|
||||
// Health METRICS (load/cpu/mem/temp/nvme/auth/selinux) are read straight from
|
||||
// /proc + /sys; host FACTS (image/kernel/hostname/kiosk) are reused from
|
||||
// fleet-hostapi (127.0.0.1:9099) so we don't re-probe DMI/GPU.
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/exec"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
fleetpb "fleet-agent/proto"
|
||||
)
|
||||
|
||||
// hostFacts is the subset of fleet-hostapi's /v1/host response the agent uses.
|
||||
type hostFacts struct {
|
||||
OS struct {
|
||||
Kernel string `json:"kernel"`
|
||||
Image string `json:"image"`
|
||||
} `json:"os"`
|
||||
Net struct {
|
||||
Hostname string `json:"hostname"`
|
||||
} `json:"net"`
|
||||
Kiosk struct {
|
||||
Uptime string `json:"uptime"`
|
||||
Chromium string `json:"chromium"`
|
||||
} `json:"kiosk"`
|
||||
}
|
||||
|
||||
// fetchFacts GETs fleet-hostapi over loopback. Best-effort: returns a zero struct
|
||||
// on any error (the agent still streams; Hello/snapshot fields just stay empty).
|
||||
func fetchFacts(ctx context.Context, url string) hostFacts {
|
||||
var f hostFacts
|
||||
if url == "" {
|
||||
return f
|
||||
}
|
||||
rctx, cancel := context.WithTimeout(ctx, 3*time.Second)
|
||||
defer cancel()
|
||||
req, err := http.NewRequestWithContext(rctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return f
|
||||
}
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return f
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
_ = json.NewDecoder(resp.Body).Decode(&f)
|
||||
return f
|
||||
}
|
||||
|
||||
// buildHello assembles the connect-time Hello from hostapi facts + the kiosk URL
|
||||
// + the verity root hash (best-effort). starship_name is advisory (the manager
|
||||
// already knows it from inventory).
|
||||
func buildHello(f hostFacts, kioskURL string) *fleetpb.Hello {
|
||||
return &fleetpb.Hello{
|
||||
ImageVersion: f.OS.Image,
|
||||
RootfsDigest: rootfsDigest(),
|
||||
Kernel: f.OS.Kernel,
|
||||
KioskUrl: kioskURL,
|
||||
StarshipName: f.Net.Hostname,
|
||||
}
|
||||
}
|
||||
|
||||
// prober carries the small state needed for rate metrics (the CPU busy delta
|
||||
// between two /proc/stat samples). One prober is reused across the connection.
|
||||
type prober struct {
|
||||
hostapiURL string
|
||||
prevTotal uint64
|
||||
prevIdle uint64
|
||||
hasPrev bool
|
||||
}
|
||||
|
||||
// snapshot gathers one HealthSnapshot. at_unix is left 0 so the manager stamps
|
||||
// receive-time (matches agent.go's snapshotToHealth path).
|
||||
func (p *prober) snapshot(ctx context.Context) *fleetpb.HealthSnapshot {
|
||||
f := fetchFacts(ctx, p.hostapiURL)
|
||||
s := &fleetpb.HealthSnapshot{
|
||||
LoadAvg: loadAvg(),
|
||||
CpuPct: p.cpuPct(),
|
||||
TempC: tempC(),
|
||||
MemUsedPct: memUsedPct(),
|
||||
TmpfsUsedPct: fsUsedPct("/"),
|
||||
NvmeRoot: nvmeRoot(),
|
||||
Auth: authState(),
|
||||
Selinux: selinuxState(),
|
||||
Chrony: chronyState(),
|
||||
KioskActive: unitActive("kiosk.service"),
|
||||
SessionUptime: f.Kiosk.Uptime,
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// ---- individual probes (all best-effort) ----------------------------------
|
||||
|
||||
func loadAvg() float64 {
|
||||
b, err := os.ReadFile("/proc/loadavg")
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
return parseLoadAvg(b)
|
||||
}
|
||||
|
||||
// parseLoadAvg extracts the 1-minute load from /proc/loadavg content.
|
||||
func parseLoadAvg(b []byte) float64 {
|
||||
fields := strings.Fields(string(b))
|
||||
if len(fields) == 0 {
|
||||
return 0
|
||||
}
|
||||
v, _ := strconv.ParseFloat(fields[0], 64)
|
||||
return v
|
||||
}
|
||||
|
||||
// cpuPct returns the busy percentage since the previous sample. The first call
|
||||
// (no prior sample) returns 0 and primes the delta.
|
||||
func (p *prober) cpuPct() float64 {
|
||||
total, idle, ok := readCPU()
|
||||
if !ok {
|
||||
return 0
|
||||
}
|
||||
defer func() { p.prevTotal, p.prevIdle, p.hasPrev = total, idle, true }()
|
||||
if !p.hasPrev {
|
||||
return 0
|
||||
}
|
||||
return cpuBusyPct(p.prevTotal, p.prevIdle, total, idle)
|
||||
}
|
||||
|
||||
// cpuBusyPct computes the busy fraction between two /proc/stat samples.
|
||||
func cpuBusyPct(prevTotal, prevIdle, total, idle uint64) float64 {
|
||||
if total <= prevTotal {
|
||||
return 0
|
||||
}
|
||||
dTotal := total - prevTotal
|
||||
dIdle := min(idle-prevIdle, dTotal)
|
||||
return float64(dTotal-dIdle) / float64(dTotal) * 100
|
||||
}
|
||||
|
||||
// readCPU parses the aggregate "cpu" line of /proc/stat into total + idle jiffies.
|
||||
func readCPU() (total, idle uint64, ok bool) {
|
||||
b, err := os.ReadFile("/proc/stat")
|
||||
if err != nil {
|
||||
return 0, 0, false
|
||||
}
|
||||
return parseCPUStat(b)
|
||||
}
|
||||
|
||||
func parseCPUStat(b []byte) (total, idle uint64, ok bool) {
|
||||
for line := range strings.SplitSeq(string(b), "\n") {
|
||||
if !strings.HasPrefix(line, "cpu ") {
|
||||
continue
|
||||
}
|
||||
fields := strings.Fields(line)[1:] // user nice system idle iowait irq softirq steal ...
|
||||
for i, f := range fields {
|
||||
v, err := strconv.ParseUint(f, 10, 64)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
total += v
|
||||
if i == 3 || i == 4 { // idle + iowait
|
||||
idle += v
|
||||
}
|
||||
}
|
||||
return total, idle, true
|
||||
}
|
||||
return 0, 0, false
|
||||
}
|
||||
|
||||
func memUsedPct() float64 {
|
||||
b, err := os.ReadFile("/proc/meminfo")
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
return parseMemUsedPct(b)
|
||||
}
|
||||
|
||||
func parseMemUsedPct(b []byte) float64 {
|
||||
var totalKB, availKB float64
|
||||
for line := range strings.SplitSeq(string(b), "\n") {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) < 2 {
|
||||
continue
|
||||
}
|
||||
v, _ := strconv.ParseFloat(fields[1], 64)
|
||||
switch fields[0] {
|
||||
case "MemTotal:":
|
||||
totalKB = v
|
||||
case "MemAvailable:":
|
||||
availKB = v
|
||||
}
|
||||
}
|
||||
if totalKB == 0 {
|
||||
return 0
|
||||
}
|
||||
return (totalKB - availKB) / totalKB * 100
|
||||
}
|
||||
|
||||
// fsUsedPct returns used-space percentage of the filesystem at path (the root
|
||||
// overlay = tmpfs RAM pressure).
|
||||
func fsUsedPct(path string) float64 {
|
||||
var st syscall.Statfs_t
|
||||
if err := syscall.Statfs(path, &st); err != nil || st.Blocks == 0 {
|
||||
return 0
|
||||
}
|
||||
used := st.Blocks - st.Bfree
|
||||
return float64(used) / float64(st.Blocks) * 100
|
||||
}
|
||||
|
||||
// tempC returns the first readable thermal zone in Celsius (sysfs reports milli-C).
|
||||
func tempC() float64 {
|
||||
for i := range 16 {
|
||||
b, err := os.ReadFile("/sys/class/thermal/thermal_zone" + strconv.Itoa(i) + "/temp")
|
||||
if err != nil {
|
||||
if i == 0 {
|
||||
continue // zone0 may be absent; keep scanning a few
|
||||
}
|
||||
break
|
||||
}
|
||||
milli, err := strconv.ParseFloat(strings.TrimSpace(string(b)), 64)
|
||||
if err == nil && milli > 0 {
|
||||
return milli / 1000
|
||||
}
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
// nvmeRoot reports the verity root device health: ok if /dev/mapper/root exists,
|
||||
// down otherwise. (A finer degraded state needs nvme-cli; v1 keeps it binary.)
|
||||
func nvmeRoot() string {
|
||||
if _, err := os.Stat("/dev/mapper/root"); err == nil {
|
||||
return "ok"
|
||||
}
|
||||
return "down"
|
||||
}
|
||||
|
||||
// authState reports the 802.1X/MACsec link: up if macsec0 has carrier (secure
|
||||
// path), "open" when there is no macsec0 (test/open-network path rd.dot1x=0).
|
||||
func authState() string {
|
||||
if _, err := os.Stat("/sys/class/net/macsec0"); err != nil {
|
||||
return "open"
|
||||
}
|
||||
if b, err := os.ReadFile("/sys/class/net/macsec0/carrier"); err == nil && strings.TrimSpace(string(b)) == "1" {
|
||||
return "up"
|
||||
}
|
||||
return "down"
|
||||
}
|
||||
|
||||
// selinuxState reads the enforce node; absent selinuxfs => "" (unknown).
|
||||
func selinuxState() string {
|
||||
b, err := os.ReadFile("/sys/fs/selinux/enforce")
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
if strings.TrimSpace(string(b)) == "1" {
|
||||
return "enforcing"
|
||||
}
|
||||
return "permissive"
|
||||
}
|
||||
|
||||
// chronyState best-effort: "synced" when chronyc tracking reports a Normal leap
|
||||
// status, "unsynced" otherwise, "" if chronyc is unavailable.
|
||||
func chronyState() string {
|
||||
out, err := runShort("chronyc", "-n", "tracking")
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
for line := range strings.SplitSeq(out, "\n") {
|
||||
if strings.HasPrefix(line, "Leap status") {
|
||||
if strings.Contains(line, "Normal") {
|
||||
return "synced"
|
||||
}
|
||||
return "unsynced"
|
||||
}
|
||||
}
|
||||
return "unsynced"
|
||||
}
|
||||
|
||||
// unitActive reports whether a systemd unit is active (best-effort).
|
||||
func unitActive(unit string) bool {
|
||||
out, err := runShort("systemctl", "is-active", unit)
|
||||
return err == nil && strings.TrimSpace(out) == "active"
|
||||
}
|
||||
|
||||
// rootfsDigest best-effort: the dm-verity root hash from the kernel cmdline (the
|
||||
// content-address of the running root). Empty if not present in this layout.
|
||||
func rootfsDigest() string {
|
||||
b, err := os.ReadFile("/proc/cmdline")
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
for tok := range strings.FieldsSeq(string(b)) {
|
||||
for _, k := range []string{"systemd.verity_root_hash=", "roothash="} {
|
||||
if after, ok := strings.CutPrefix(tok, k); ok {
|
||||
return after
|
||||
}
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// runShort runs a command with a short timeout and returns its stdout. Used only
|
||||
// for the best-effort chrony/systemd probes; a missing binary is a soft failure.
|
||||
func runShort(name string, args ...string) (string, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
|
||||
defer cancel()
|
||||
out, err := exec.CommandContext(ctx, name, args...).Output()
|
||||
return string(out), err
|
||||
}
|
||||
Reference in New Issue
Block a user