Documentation
¶
Overview ¶
Package enrollment provides the controller-side enrollment system for accepting or rejecting agent enrollment requests via NATS.
Index ¶
- type KVStore
- type KeyRotationMessage
- type NATSSubscriber
- type PKIProvider
- type PendingAgent
- type Watcher
- func (w *Watcher) AcceptAgent(ctx context.Context, machineID string) error
- func (w *Watcher) AcceptByFingerprint(ctx context.Context, fingerprint string) error
- func (w *Watcher) AcceptByHostname(ctx context.Context, hostname string) error
- func (w *Watcher) ListPending(ctx context.Context) ([]PendingAgent, error)
- func (w *Watcher) RejectAgent(ctx context.Context, machineID string, reason string) error
- func (w *Watcher) RejectByHostname(ctx context.Context, hostname string, reason string) error
- func (w *Watcher) RotateControllerKey() error
- func (w *Watcher) Start(ctx context.Context) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type KeyRotationMessage ¶
type KeyRotationMessage struct {
NewPublicKey []byte `json:"new_public_key"`
}
KeyRotationMessage is published to agents when the controller rotates its keypair.
type NATSSubscriber ¶
type NATSSubscriber interface {
Subscribe(
subj string,
cb nats.MsgHandler,
) (*nats.Subscription, error)
PublishCore(
subj string,
data []byte,
) error
}
NATSSubscriber defines the NATS operations needed by the enrollment watcher for subscribing to enrollment requests and publishing responses. Satisfied by the nats-client's *Client type (Subscribe + PublishCore).
type PKIProvider ¶
PKIProvider defines the PKI operations needed by the enrollment watcher to provide the controller's public key in acceptance responses.
type PendingAgent ¶
type PendingAgent struct {
MachineID string `json:"machine_id"`
Hostname string `json:"hostname"`
PublicKey []byte `json:"public_key"`
Fingerprint string `json:"fingerprint"`
RequestedAt time.Time `json:"requested_at"`
}
PendingAgent represents an agent awaiting enrollment acceptance.
type Watcher ¶
type Watcher struct {
// contains filtered or unexported fields
}
Watcher monitors NATS for agent enrollment requests and manages pending agents in a JetStream KV bucket.
func NewWatcher ¶
func NewWatcher( logger *slog.Logger, nc NATSSubscriber, enrollmentKV KVStore, pkiProvider PKIProvider, autoAccept bool, namespace string, ) *Watcher
NewWatcher creates a new enrollment Watcher.
func (*Watcher) AcceptAgent ¶
AcceptAgent accepts a pending agent by machine ID. It publishes an acceptance response containing the controller's public key to the agent's response subject and deletes the pending entry from KV.
func (*Watcher) AcceptByFingerprint ¶
AcceptByFingerprint scans the pending KV for an agent matching the given fingerprint and accepts it. Returns an error if no matching agent is found.
func (*Watcher) AcceptByHostname ¶
AcceptByHostname scans the pending KV for an agent matching the given hostname and accepts it. Returns an error if no matching agent is found.
func (*Watcher) ListPending ¶
func (w *Watcher) ListPending( ctx context.Context, ) ([]PendingAgent, error)
ListPending returns all pending agents from the enrollment KV bucket.
func (*Watcher) RejectAgent ¶
RejectAgent rejects a pending agent by machine ID. It publishes a rejection response to the agent's response subject and deletes the pending entry from KV.
func (*Watcher) RejectByHostname ¶
RejectByHostname scans the pending KV for an agent matching the given hostname and rejects it. Returns an error if no matching agent is found.
func (*Watcher) RotateControllerKey ¶
RotateControllerKey publishes the controller's current public key to all agents via the pki.rotate subject. Agents receiving this message move their current controller key to previous and store the new key, enabling a grace period where both keys are accepted.
Source Files
Directories