diskless-workstation/files/agent/snapshot.go

// snapshot.go — read-only host health probes → *fleetpb.HealthSnapshot, plus the
// hostapi facts fetch used to build the connect-time Hello.
//
// Every probe degrades gracefully: on any error the field is left at its zero
// value ("" / 0) rather than failing. A probe must NEVER kill the stream — a
// missing thermal zone or an unmounted selinuxfs is normal on some targets/VMs.
// Health METRICS (load/cpu/mem/temp/nvme/auth/selinux) are read straight from
// /proc + /sys; host FACTS (image/kernel/hostname/kiosk) are reused from
// fleet-hostapi (127.0.0.1:9099) so we don't re-probe DMI/GPU.
package main

import (
	"context"
	"encoding/json"
	"net/http"
	"os"
	"os/exec"
	"strconv"
	"strings"
	"syscall"
	"time"

	fleetpb "fleet-agent/proto"
)

// hostFacts is the subset of fleet-hostapi's /v1/host response the agent uses.
type hostFacts struct {
	OS struct {
		Kernel string `json:"kernel"`
		Image  string `json:"image"`
	} `json:"os"`
	Net struct {
		Hostname string `json:"hostname"`
	} `json:"net"`
	Kiosk struct {
		Uptime   string `json:"uptime"`
		Chromium string `json:"chromium"`
	} `json:"kiosk"`
}

// fetchFacts GETs fleet-hostapi over loopback. Best-effort: returns a zero struct
// on any error (the agent still streams; Hello/snapshot fields just stay empty).
func fetchFacts(ctx context.Context, url string) hostFacts {
	var f hostFacts
	if url == "" {
		return f
	}
	rctx, cancel := context.WithTimeout(ctx, 3*time.Second)
	defer cancel()
	req, err := http.NewRequestWithContext(rctx, http.MethodGet, url, nil)
	if err != nil {
		return f
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return f
	}
	defer resp.Body.Close()
	_ = json.NewDecoder(resp.Body).Decode(&f)
	return f
}

// buildHello assembles the connect-time Hello from hostapi facts + the kiosk URL
// + the verity root hash (best-effort). starship_name is advisory (the manager
// already knows it from inventory).
func buildHello(f hostFacts, kioskURL string) *fleetpb.Hello {
	return &fleetpb.Hello{
		ImageVersion: f.OS.Image,
		RootfsDigest: rootfsDigest(),
		Kernel:       f.OS.Kernel,
		KioskUrl:     kioskURL,
		StarshipName: f.Net.Hostname,
	}
}

// prober carries the small state needed for rate metrics (the CPU busy delta
// between two /proc/stat samples). One prober is reused across the connection.
type prober struct {
	hostapiURL string
	prevTotal  uint64
	prevIdle   uint64
	hasPrev    bool
}

// snapshot gathers one HealthSnapshot. at_unix is left 0 so the manager stamps
// receive-time (matches agent.go's snapshotToHealth path).
func (p *prober) snapshot(ctx context.Context) *fleetpb.HealthSnapshot {
	f := fetchFacts(ctx, p.hostapiURL)
	s := &fleetpb.HealthSnapshot{
		LoadAvg:       loadAvg(),
		CpuPct:        p.cpuPct(),
		TempC:         tempC(),
		MemUsedPct:    memUsedPct(),
		TmpfsUsedPct:  fsUsedPct("/"),
		NvmeRoot:      nvmeRoot(),
		Auth:          authState(),
		Selinux:       selinuxState(),
		Chrony:        chronyState(),
		KioskActive:   unitActive("kiosk.service"),
		SessionUptime: f.Kiosk.Uptime,
		UptimeSeconds: uptimeSeconds(),
	}
	return s
}

// uptimeSeconds returns host uptime (seconds since boot) from /proc/uptime. The
// manager derives boot_time = receive-time - this to tell whether a scheduled
// reboot has been actioned yet.
func uptimeSeconds() int64 {
	b, err := os.ReadFile("/proc/uptime")
	if err != nil {
		return 0
	}
	return parseUptime(b)
}

func parseUptime(b []byte) int64 {
	fields := strings.Fields(string(b))
	if len(fields) == 0 {
		return 0
	}
	f, _ := strconv.ParseFloat(fields[0], 64)
	if f < 0 {
		return 0
	}
	return int64(f)
}

// ---- individual probes (all best-effort) ----------------------------------

func loadAvg() float64 {
	b, err := os.ReadFile("/proc/loadavg")
	if err != nil {
		return 0
	}
	return parseLoadAvg(b)
}

// parseLoadAvg extracts the 1-minute load from /proc/loadavg content.
func parseLoadAvg(b []byte) float64 {
	fields := strings.Fields(string(b))
	if len(fields) == 0 {
		return 0
	}
	v, _ := strconv.ParseFloat(fields[0], 64)
	return v
}

// cpuPct returns the busy percentage since the previous sample. The first call
// (no prior sample) returns 0 and primes the delta.
func (p *prober) cpuPct() float64 {
	total, idle, ok := readCPU()
	if !ok {
		return 0
	}
	defer func() { p.prevTotal, p.prevIdle, p.hasPrev = total, idle, true }()
	if !p.hasPrev {
		return 0
	}
	return cpuBusyPct(p.prevTotal, p.prevIdle, total, idle)
}

// cpuBusyPct computes the busy fraction between two /proc/stat samples.
func cpuBusyPct(prevTotal, prevIdle, total, idle uint64) float64 {
	if total <= prevTotal {
		return 0
	}
	dTotal := total - prevTotal
	dIdle := min(idle-prevIdle, dTotal)
	return float64(dTotal-dIdle) / float64(dTotal) * 100
}

// readCPU parses the aggregate "cpu" line of /proc/stat into total + idle jiffies.
func readCPU() (total, idle uint64, ok bool) {
	b, err := os.ReadFile("/proc/stat")
	if err != nil {
		return 0, 0, false
	}
	return parseCPUStat(b)
}

func parseCPUStat(b []byte) (total, idle uint64, ok bool) {
	for line := range strings.SplitSeq(string(b), "\n") {
		if !strings.HasPrefix(line, "cpu ") {
			continue
		}
		fields := strings.Fields(line)[1:] // user nice system idle iowait irq softirq steal ...
		for i, f := range fields {
			v, err := strconv.ParseUint(f, 10, 64)
			if err != nil {
				continue
			}
			total += v
			if i == 3 || i == 4 { // idle + iowait
				idle += v
			}
		}
		return total, idle, true
	}
	return 0, 0, false
}

func memUsedPct() float64 {
	b, err := os.ReadFile("/proc/meminfo")
	if err != nil {
		return 0
	}
	return parseMemUsedPct(b)
}

func parseMemUsedPct(b []byte) float64 {
	var totalKB, availKB float64
	for line := range strings.SplitSeq(string(b), "\n") {
		fields := strings.Fields(line)
		if len(fields) < 2 {
			continue
		}
		v, _ := strconv.ParseFloat(fields[1], 64)
		switch fields[0] {
		case "MemTotal:":
			totalKB = v
		case "MemAvailable:":
			availKB = v
		}
	}
	if totalKB == 0 {
		return 0
	}
	return (totalKB - availKB) / totalKB * 100
}

// fsUsedPct returns used-space percentage of the filesystem at path (the root
// overlay = tmpfs RAM pressure).
func fsUsedPct(path string) float64 {
	var st syscall.Statfs_t
	if err := syscall.Statfs(path, &st); err != nil || st.Blocks == 0 {
		return 0
	}
	used := st.Blocks - st.Bfree
	return float64(used) / float64(st.Blocks) * 100
}

// tempC returns the first readable thermal zone in Celsius (sysfs reports milli-C).
func tempC() float64 {
	for i := range 16 {
		b, err := os.ReadFile("/sys/class/thermal/thermal_zone" + strconv.Itoa(i) + "/temp")
		if err != nil {
			if i == 0 {
				continue // zone0 may be absent; keep scanning a few
			}
			break
		}
		milli, err := strconv.ParseFloat(strings.TrimSpace(string(b)), 64)
		if err == nil && milli > 0 {
			return milli / 1000
		}
	}
	return 0
}

// nvmeRoot reports the verity root device health: ok if /dev/mapper/root exists,
// down otherwise. (A finer degraded state needs nvme-cli; v1 keeps it binary.)
func nvmeRoot() string {
	if _, err := os.Stat("/dev/mapper/root"); err == nil {
		return "ok"
	}
	return "down"
}

// authState reports the 802.1X/MACsec link: up if macsec0 has carrier (secure
// path), "open" when there is no macsec0 (test/open-network path rd.dot1x=0).
func authState() string {
	if _, err := os.Stat("/sys/class/net/macsec0"); err != nil {
		return "open"
	}
	if b, err := os.ReadFile("/sys/class/net/macsec0/carrier"); err == nil && strings.TrimSpace(string(b)) == "1" {
		return "up"
	}
	return "down"
}

// selinuxState reads the enforce node; absent selinuxfs => "" (unknown).
func selinuxState() string {
	b, err := os.ReadFile("/sys/fs/selinux/enforce")
	if err != nil {
		return ""
	}
	if strings.TrimSpace(string(b)) == "1" {
		return "enforcing"
	}
	return "permissive"
}

// chronyState best-effort: "synced" when chronyc tracking reports a Normal leap
// status, "unsynced" otherwise, "" if chronyc is unavailable.
func chronyState() string {
	out, err := runShort("chronyc", "-n", "tracking")
	if err != nil {
		return ""
	}
	for line := range strings.SplitSeq(out, "\n") {
		if strings.HasPrefix(line, "Leap status") {
			if strings.Contains(line, "Normal") {
				return "synced"
			}
			return "unsynced"
		}
	}
	return "unsynced"
}

// unitActive reports whether a systemd unit is active (best-effort).
func unitActive(unit string) bool {
	out, err := runShort("systemctl", "is-active", unit)
	return err == nil && strings.TrimSpace(out) == "active"
}

// rootfsDigest best-effort: the dm-verity root hash from the kernel cmdline (the
// content-address of the running root). Empty if not present in this layout.
func rootfsDigest() string {
	b, err := os.ReadFile("/proc/cmdline")
	if err != nil {
		return ""
	}
	for tok := range strings.FieldsSeq(string(b)) {
		for _, k := range []string{"systemd.verity_root_hash=", "roothash="} {
			if after, ok := strings.CutPrefix(tok, k); ok {
				return after
			}
		}
	}
	return ""
}

// runShort runs a command with a short timeout and returns its stdout. Used only
// for the best-effort chrony/systemd probes; a missing binary is a soft failure.
func runShort(name string, args ...string) (string, error) {
	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
	defer cancel()
	out, err := exec.CommandContext(ctx, name, args...).Output()
	return string(out), err
}