mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 08:55:24 +00:00
2fcb27ed3f
This adds a new mechanism to allow us to handle compatibility issues between Orbit, Fleet Server and Fleet Desktop.
The general idea is to _always_ send a custom header of the form:
```
fleet-capabilities-header = "X-Fleet-Capabilities:" capabilities
capabilities = capability * (,)
capability = string
```
Both from the server to the clients (Orbit, Fleet Desktop) and vice-versa. For an example, see: 8c0bbdd291
Also, the following applies:
- Backwards compat: if the header is not present, assume that orbit/fleet doesn't have the capability
- The current capabilities endpoint will be removed
### Motivation
This solution is trying to solve the following problems:
- We have three independent processes communicating with each other (Fleet Desktop, Orbit and Fleet Server). Each process can be updated independently, and therefore we need a way for each process to know what features are supported by its peers.
- We originally implemented a dedicated API endpoint in the server that returned a list of the capabilities (or "features") enabled, we found this, and any other server-only solution (like API versioning) to be insufficient because:
- There are cases in which the server also needs to know which features are supported by its clients
- Clients needed to poll for changes to detect if the capabilities supported by the server change, by sending the capabilities on each request we have a much cleaner way to handling different responses.
- We are also introducing an unauthenticated endpoint to get the server features, this gives us flexibility if we need to implement different authentication mechanisms, and was one of the pitfalls of the first implementation.
Related to https://github.com/fleetdm/fleet/issues/7929
81 lines
1.9 KiB
Go
81 lines
1.9 KiB
Go
package service
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
)
|
|
|
|
type OrbitClient struct {
|
|
*baseClient
|
|
enrollSecret string
|
|
hardwareUUID string
|
|
}
|
|
|
|
func (oc *OrbitClient) request(verb string, path string, params interface{}, resp interface{}) error {
|
|
var bodyBytes []byte
|
|
var err error
|
|
if params != nil {
|
|
bodyBytes, err = json.Marshal(params)
|
|
if err != nil {
|
|
return fmt.Errorf("making requst json marshalling : %w", err)
|
|
}
|
|
}
|
|
|
|
request, err := http.NewRequest(
|
|
verb,
|
|
oc.url(path, "").String(),
|
|
bytes.NewBuffer(bodyBytes),
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
oc.setClientCapabilitiesHeader(request)
|
|
response, err := oc.http.Do(request)
|
|
if err != nil {
|
|
return fmt.Errorf("%s %s: %w", verb, path, err)
|
|
}
|
|
defer response.Body.Close()
|
|
|
|
return oc.parseResponse(verb, path, response, resp)
|
|
}
|
|
|
|
func NewOrbitClient(addr string, rootCA string, insecureSkipVerify bool, enrollSecret, hardwareUUID string, capabilities fleet.CapabilityMap) (*OrbitClient, error) {
|
|
bc, err := newBaseClient(addr, insecureSkipVerify, rootCA, "", capabilities)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &OrbitClient{
|
|
baseClient: bc,
|
|
enrollSecret: enrollSecret,
|
|
hardwareUUID: hardwareUUID,
|
|
}, nil
|
|
}
|
|
|
|
func (oc *OrbitClient) DoEnroll() (string, error) {
|
|
verb, path := "POST", "/api/fleet/orbit/enroll"
|
|
params := enrollOrbitRequest{EnrollSecret: oc.enrollSecret, HardwareUUID: oc.hardwareUUID}
|
|
var resp enrollOrbitResponse
|
|
err := oc.request(verb, path, params, &resp)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return resp.OrbitNodeKey, nil
|
|
}
|
|
|
|
func (oc *OrbitClient) GetConfig(orbitNodeKey string) (json.RawMessage, error) {
|
|
verb, path := "POST", "/api/fleet/orbit/config"
|
|
params := orbitGetConfigRequest{OrbitNodeKey: orbitNodeKey}
|
|
var resp orbitGetConfigResponse
|
|
err := oc.request(verb, path, params, &resp)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return resp.Flags, nil
|
|
}
|