Android certs: non-critical issues

[getvictor]

Android agent gets enroll secrets

Address undefined enroll secret selection and inconsistent error handling.

• Error handling: The code fails hard if no enroll secrets exist, but this pattern is inconsistent across the codebase. In server/service/microsoft_mdm.go:1358, missing secrets are logged as a warning and execution continues. Decide whether this should halt processing or continue gracefully for the Android agent flow.

  • We will document behavior: Android certificates: guide #36592

• Line 144 (secret selection): GetEnrollSecrets (in server/datastore/mysql/app_configs.go:231) has no ORDER BY clause, so enrollSecrets[0] returns an arbitrary/undefined secret, not a deterministic "first" one.

  • Guarantee order of GetEnrollSecrets to prevent subtle bugs. #36515

Migration for our base Android profile

• Our base profile should include the app so that it is installed right away when user enrolls the Android device. This means the app will be installed without any configs, and configs will be pushed down loater.
  • The migration means going through all enterprises via AMAPI and adding the Android app to them.
  • NO plan to do this right now

Resending certs

• If a fleet variable is modified, like IDP USER, the certificate template using that variable needs to be resend to Android host.
  • Filed new subtask for this: #36681

node_key security

• node_key should be in Authorization header. gitops, basic apis, and table for android certificate templates #35788 (comment)
  • android certificates crud: Move node_key to authentication header #36287

Dev experience

• Add a slack notification if Android tests fail in nightly run
  • Improving Android CI (Slack notification, coverage) #36518

Consistency

• If server goes down while policies are being sent to Google, then we will not resend them.
  • Included the fix in this issue: #36684

[sharon-fdm]

@getvictor, looks like a new sub task.
I assigned you so it's not dropped. Feel free to reassign.

[fleet-release]

Android secrets seek,
In cloud city, errors speak,
Fleet's safety, we tweak.

Enroll patterns mend,
In glass towers, codes ascend,
A secure message send.

Android apps install,
In the breeze, data enthrall,
Fleet's call does not stall.

Certs resend with care,
In the sky, assurance flare,
Trust in Fleet we share.

Node_key hides from sight,
In the fog, a guarded light,
Fleet secures the night.

Tests fail, bells do ring,
In the storm, improvements bring,
Fleet's strength in full swing.

Consistent, we stand,
In the wind, commands withstand,
Fleet's future is grand.