Documentation
¶
Overview ¶
Package fleet manages the remote agents of the hub: the single-use tokens that let a new agent enroll, the registry of the agents that did, and the revocation of an agent. The certificates themselves come from package pki.
Index ¶
- Constants
- Variables
- type Agent
- type Auditor
- type Enrolled
- type NameError
- type RequestError
- type Service
- func (s *Service) Agents(ctx context.Context) ([]Agent, error)
- func (s *Service) Authorize(ctx context.Context, id, serial string) error
- func (s *Service) CA() *pki.CA
- func (s *Service) CreateToken(ctx context.Context, by, name string) (token string, expires time.Time, err error)
- func (s *Service) Enroll(ctx context.Context, remote, token string, csrDER []byte, hostname string) (Enrolled, error)
- func (s *Service) Rename(ctx context.Context, by, id, name string) error
- func (s *Service) Revoke(ctx context.Context, by, id string) error
- func (s *Service) Seen(ctx context.Context, id, version, hostname, osVersion string, at time.Time) error
Constants ¶
const ( EventTokenCreated = "enroll_token_created" EventAgentEnrolled = "agent_enrolled" EventEnrollFailed = "agent_enroll_failed" EventAgentRevoked = "agent_revoked" EventAgentRenamed = "agent_renamed" )
Audit events recorded by the fleet.
const ( // TokenTTL is how long an enrollment token can be used. TokenTTL = time.Hour )
Variables ¶
var ( // ErrInvalidToken is the one answer for a token that is unknown, expired or // already used. ErrInvalidToken = errors.New("this enrollment token is invalid or has expired") ErrRateLimited = errors.New("too many failed attempts, try again later") ErrNotFound = errors.New("agent not found") // ErrRevoked is returned for an agent that was revoked, or whose // certificate is not the one the hub issued last. ErrRevoked = errors.New("this agent is revoked") )
Errors returned by the service.
Functions ¶
This section is empty.
Types ¶
type Agent ¶
type Agent struct {
ID string
Name string
Hostname string
Version string
OSVersion string
CreatedAt time.Time
EnrolledAt string // the address it enrolled from
LastSeen time.Time // zero if it never connected
Revoked bool
RevokedAt time.Time
}
Agent is an enrolled agent.
type NameError ¶
type NameError struct {
// contains filtered or unexported fields
}
NameError is a problem with the name chosen for a server.
type RequestError ¶
type RequestError struct{ Err error }
RequestError is a problem with the certificate request of an agent.
func (*RequestError) Error ¶
func (e *RequestError) Error() string
func (*RequestError) Unwrap ¶
func (e *RequestError) Unwrap() error
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service is the registry of remote agents.
func (*Service) Authorize ¶
Authorize checks that the agent may connect with the certificate that has this serial number: the agent exists, is not revoked, and the certificate is the one the hub issued for it.
func (*Service) CreateToken ¶
func (s *Service) CreateToken(ctx context.Context, by, name string) (token string, expires time.Time, err error)
CreateToken makes a single-use enrollment token, valid for TokenTTL. The name, if given, becomes the name of the server that enrolls with it. The token is returned once; only its hash is kept.
func (*Service) Enroll ¶
func (s *Service) Enroll(ctx context.Context, remote, token string, csrDER []byte, hostname string) (Enrolled, error)
Enroll registers a new agent: it uses the token up and signs the agent's certificate request. remote is the address of the agent, for the limit on failed attempts and the audit log.
func (*Service) Rename ¶
Rename sets the name shown for an agent; an empty name goes back to the host name.
Source Files