Build the on-host agent that pairs with fleet-hostapi and feeds the fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the workstation talked to the manager before this; Monitor + InfluxDB stayed empty. Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello + periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk, probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot, drain) are deferred until the telemetry half is bench-verified. - files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi. Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1 proto so it stays self-contained without importing the initramfs enrol module. - files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth handshake (RequireAndVerifyClientCert) against the go-tpm software simulator. - files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state. - fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress). - CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test. - Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust. Post-switch-root only, so no dracut/initramfs changes. - docs: TODO #14 + fleet-management-design as-built updated. Requires the host already enrolled (broker approve births the inventory row) — else the manager returns PermissionDenied, the correct "not enrolled yet" signal.
131 lines
5.4 KiB
Go
131 lines
5.4 KiB
Go
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
|
// versions:
|
|
// - protoc-gen-go-grpc v1.6.2
|
|
// - protoc v3.21.12
|
|
// source: proto/fleet_agent.proto
|
|
|
|
// The steady-state contract between the on-host fleet agent and the
|
|
// fleet-manager. ONE long-lived, host-dialed, mTLS bidi stream (health/metrics
|
|
// up, desired-state down) — the design's resolved transport fork (bespoke gRPC,
|
|
// not OTLP+Wazuh). See docs/fleet-management-design.md + tpm-enrolment-design.md.
|
|
//
|
|
// Identity is the mTLS peer cert (the host's reused TPM identity cert, fleet CA);
|
|
// the manager derives the cert serial (= inventory key) from it, so AgentUp
|
|
// messages carry NO self-asserted identity — a host can only ever be itself.
|
|
|
|
package fleetpb
|
|
|
|
import (
|
|
context "context"
|
|
grpc "google.golang.org/grpc"
|
|
codes "google.golang.org/grpc/codes"
|
|
status "google.golang.org/grpc/status"
|
|
)
|
|
|
|
// This is a compile-time assertion to ensure that this generated file
|
|
// is compatible with the grpc package it is being compiled against.
|
|
// Requires gRPC-Go v1.64.0 or later.
|
|
const _ = grpc.SupportPackageIsVersion9
|
|
|
|
const (
|
|
FleetAgent_Session_FullMethodName = "/fleet.agent.v1.FleetAgent/Session"
|
|
)
|
|
|
|
// FleetAgentClient is the client API for FleetAgent service.
|
|
//
|
|
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
|
type FleetAgentClient interface {
|
|
// Session: the single bidirectional stream. The host opens it (dials out, no
|
|
// inbound host port); the manager pushes desired-state/commands back over the
|
|
// same connection. Closing/keepalive-timeout = the host's offline signal.
|
|
Session(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[AgentUp, ManagerDown], error)
|
|
}
|
|
|
|
type fleetAgentClient struct {
|
|
cc grpc.ClientConnInterface
|
|
}
|
|
|
|
func NewFleetAgentClient(cc grpc.ClientConnInterface) FleetAgentClient {
|
|
return &fleetAgentClient{cc}
|
|
}
|
|
|
|
func (c *fleetAgentClient) Session(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[AgentUp, ManagerDown], error) {
|
|
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
|
stream, err := c.cc.NewStream(ctx, &FleetAgent_ServiceDesc.Streams[0], FleetAgent_Session_FullMethodName, cOpts...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
x := &grpc.GenericClientStream[AgentUp, ManagerDown]{ClientStream: stream}
|
|
return x, nil
|
|
}
|
|
|
|
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
|
|
type FleetAgent_SessionClient = grpc.BidiStreamingClient[AgentUp, ManagerDown]
|
|
|
|
// FleetAgentServer is the server API for FleetAgent service.
|
|
// All implementations must embed UnimplementedFleetAgentServer
|
|
// for forward compatibility.
|
|
type FleetAgentServer interface {
|
|
// Session: the single bidirectional stream. The host opens it (dials out, no
|
|
// inbound host port); the manager pushes desired-state/commands back over the
|
|
// same connection. Closing/keepalive-timeout = the host's offline signal.
|
|
Session(grpc.BidiStreamingServer[AgentUp, ManagerDown]) error
|
|
mustEmbedUnimplementedFleetAgentServer()
|
|
}
|
|
|
|
// UnimplementedFleetAgentServer must be embedded to have
|
|
// forward compatible implementations.
|
|
//
|
|
// NOTE: this should be embedded by value instead of pointer to avoid a nil
|
|
// pointer dereference when methods are called.
|
|
type UnimplementedFleetAgentServer struct{}
|
|
|
|
func (UnimplementedFleetAgentServer) Session(grpc.BidiStreamingServer[AgentUp, ManagerDown]) error {
|
|
return status.Error(codes.Unimplemented, "method Session not implemented")
|
|
}
|
|
func (UnimplementedFleetAgentServer) mustEmbedUnimplementedFleetAgentServer() {}
|
|
func (UnimplementedFleetAgentServer) testEmbeddedByValue() {}
|
|
|
|
// UnsafeFleetAgentServer may be embedded to opt out of forward compatibility for this service.
|
|
// Use of this interface is not recommended, as added methods to FleetAgentServer will
|
|
// result in compilation errors.
|
|
type UnsafeFleetAgentServer interface {
|
|
mustEmbedUnimplementedFleetAgentServer()
|
|
}
|
|
|
|
func RegisterFleetAgentServer(s grpc.ServiceRegistrar, srv FleetAgentServer) {
|
|
// If the following call panics, it indicates UnimplementedFleetAgentServer was
|
|
// embedded by pointer and is nil. This will cause panics if an
|
|
// unimplemented method is ever invoked, so we test this at initialization
|
|
// time to prevent it from happening at runtime later due to I/O.
|
|
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
|
|
t.testEmbeddedByValue()
|
|
}
|
|
s.RegisterService(&FleetAgent_ServiceDesc, srv)
|
|
}
|
|
|
|
func _FleetAgent_Session_Handler(srv interface{}, stream grpc.ServerStream) error {
|
|
return srv.(FleetAgentServer).Session(&grpc.GenericServerStream[AgentUp, ManagerDown]{ServerStream: stream})
|
|
}
|
|
|
|
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
|
|
type FleetAgent_SessionServer = grpc.BidiStreamingServer[AgentUp, ManagerDown]
|
|
|
|
// FleetAgent_ServiceDesc is the grpc.ServiceDesc for FleetAgent service.
|
|
// It's only intended for direct use with grpc.RegisterService,
|
|
// and not to be introspected or modified (even as a copy)
|
|
var FleetAgent_ServiceDesc = grpc.ServiceDesc{
|
|
ServiceName: "fleet.agent.v1.FleetAgent",
|
|
HandlerType: (*FleetAgentServer)(nil),
|
|
Methods: []grpc.MethodDesc{},
|
|
Streams: []grpc.StreamDesc{
|
|
{
|
|
StreamName: "Session",
|
|
Handler: _FleetAgent_Session_Handler,
|
|
ServerStreams: true,
|
|
ClientStreams: true,
|
|
},
|
|
},
|
|
Metadata: "proto/fleet_agent.proto",
|
|
}
|