Zero-touch enrollment for company-owned Android

[noahtalerman]

Goal

User story
As an IT admin managing Android devices used by my Android app dev team,
I want to ship new Android devices to devs and have them automatically enroll in Fleet when they're first booted
so that I can make sure these devices are managed.

Changes

Product

• UI changes: Figma wireframes
• CLI (fleetctl) usage changes: No changes.
• YAML changes: No changes.
• REST API changes:
  - GET /api/v1/fleet/android_enterprise/zero_touch/configurations/:team_id — returns the team's zero-touch state, including the DPC provisioning-extras JSON to copy into Google's zero-touch portal
  - PUT /api/v1/fleet/android_enterprise/zero_touch/configurations/:team_id — enable/configure zero-touch for a team, mints the long-lived enrollment token
  - DELETE /api/v1/fleet/android_enterprise/zero_touch/configurations/:team_id
  - POST .../configurations/:team_id/rotate_token — force token rotation
• Fleet's agent (fleetd) changes: No changes.
• Fleet server configuration changes: No changes.
• Exposed, public API endpoint changes: No changes.
• fleetdm.com changes: No changes.
• GitOps mode UI changes: No changes.
• GitOps generation changes: No changes.
• Activity changes: No changes.
• Permissions changes: No changes.
• Changes to paid features or tiers: Leaning Premium, consistent with ABM.
• My device and fleetdm.com/better changes: No changes.
• Usage statistics: No changes.
• Other reference documentation changes:
  - New guide in articles/, following the guide format
  - Extend articles/android-mdm-setup.md
  - REST API reference for the new endpoints
  - New architecture doc under docs/Contributing/architecture/mdm/, parallel to automated-device-enrollment.md
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Pre-QA load test: TODO
• Load testing/osquery-perf improvements: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: TODO
• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

• Only for fully-managed (company-owned) Android, not BYOD.
• Android hosts enrolled via zero-touch enrollment will not be able to expire - verify that "expired" zero-touch Android hosts have not been removed.

Core flow

• TODO

Edge cases

• TODO

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":