[YAML/API] Deploy certificates on Android hosts via GitOps - #35270
Conversation
Added certificates section under android_settings with details on certificate name, authority, and subject name.
GitHub Actions
Inactive
marko-lisica
changed the title
GitHub Actions
Error
GitHub Actions
Inactive
| - name: wifi-certificate | ||
| certificate_authority_name: EST_WIFI | ||
| subject_name: /CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL | ||
| macos_setup: # Available in Fleet Premium |
There was a problem hiding this comment.
Dev note:
Errors:
- If user specified
namethat is already taken by another certificate:- Couldn't edit "<file_name>" at "<full_path>": "<cert_name>" name is already used by another certificate. Please choose a different name and try again.
- If the user specified
namewith characters that are not supported:- Couldn't edit "<file_name>" at "<full_path>": Invalid characters in "name" field. Only letters, numbers, spaces, dashes, and underscores allowed.
- If the user didn't specify the required field:
- Couldn't edit "<file_name>" at "<full_path>": "<field_name>" is required.
There was a problem hiding this comment.
@marko-lisica If user specified invalid Fleet variable, like $FLEET_VAR_BOZO?
There was a problem hiding this comment.
@marko-lisica If user specified $FLEET_SECRET_SOMETHING?
There was a problem hiding this comment.
@getvictor If IdP variable is empty, we should return an error on the host details on the OS settings modal. I think we should be consistent with any invalid variable and secret.
There was a problem hiding this comment.
If user specify CA other than custom SCEP proxy, throw an error:
Couldn't edit "<file_name>" at "<full_path>": Currently, only the custom_scep_proxy` certificate authority is supported.
There was a problem hiding this comment.
@marko-lisica What about these:
- If user specified invalid Fleet variable, like $FLEET_VAR_BOZO?
- If user specified $FLEET_SECRET_SOMETHING?
There was a problem hiding this comment.
@getvictor What do we do for configuration profiles in that case? We should do the same.
There was a problem hiding this comment.
@marko-lisica configuration profiles support secrets, while the Android certificates do not (we do not have secrets support coded).
configuration profiles return an error on unsupported Fleet variables.
There was a problem hiding this comment.
Let's show this error message if variable is not supported or doesn't exist:
Couldn’t add. Variable "$FLEET_VAR_BOZO" doesn’t exist.
For secrets:
Couldn’t add. Secret variables (prefixed with "$FLEET_SCERET_") are not supported in the certificates.
GitHub Actions
Error
GitHub Actions
Inactive
rachaelshaw
left a comment
rachaelshaw
left a comment
There was a problem hiding this comment.
@marko-lisica LGTM, other than pending review comments! Will approve once those are addressed
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
GitHub Actions
Error
GitHub Actions
Error
GitHub Actions
Inactive
GitHub Actions
Inactive
|
Hey @ksykulev, commenting here because this API PR is related to GitOps story that we're working on. I documented API you listed in the comment here:
Where do we use "List certificates" (GET /api/latest/fleet/certificates)? And a few questions re contributor endpoints:
|
This is used in the gitops flow. We get all the team's certificates, do a delta, delete the ones not present in the yaml and create update the ones that are. This is the way queries work for example. |
|
|
||
| ## Certificates | ||
|
|
||
| ### Batch-apply certificate templates |
There was a problem hiding this comment.
@ksykulev TODO change to DELETE /api/latest/fleet/certificates/
| #### Request headers | ||
|
|
||
| This endpoint accepts the node key from Fleet's Android agent for authentication in addition to [default authentication](#retrieve-your-api-token) with a Bearer token. | ||
|
|
||
| The `Authorization` header must be formatted as follows: | ||
|
|
||
| ``` | ||
| Authorization: Node key <node_key> | ||
| ``` |
There was a problem hiding this comment.
@ksykulev, do we need this? Does the agent call this endpoint? If I remember correctly, we added a new contributor endpoint (/fleetd) for the agent to get cert information?
There was a problem hiding this comment.
@marko-lisica, the parameter for the team should be team_id instead of team, right?
There was a problem hiding this comment.
@AndreyKizimenko, that's righ,t it should be team_id, that's consistent with other endpoints. Not sure if this is implemented.
Do we need this? Does the agent call this endpoint? If I remember correctly, we added a new contributor endpoint (/fleetd) for the agent to get cert information?
@ksykulev can you confirm if the agent is using this endpoint and if we support node key authentication for this endpoint?
|
|
||
| Get details of the certificate added to Fleet. | ||
|
|
||
| `GET /api/v1/fleet/certificates/:id` |
There was a problem hiding this comment.
@ksykulev, is this one used by GitOps? Did we end up implementing this one? Now, when we returnsubject_name in the list endpoint, can we remove this one?
GitHub Actions
Inactive
GitHub Actions
Inactive
| | --------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | specs | array | body | **Required**. An array of objects with the certificate templates. Each item must contain `name` with the certificate template name, a `team` with a team name, `certificate_authority_id` with the certificate authority id, and `subject_name` with the certificate's subject name. | | ||
|
|
||
| > Any existing certificate template that is not included in the list will be removed, and existing templates with the same name as the new template will be edited. Providing an empty list of certificate templates will remove existing scripts. |
There was a problem hiding this comment.
| > Any existing certificate template that is not included in the list will be removed, and existing templates with the same name as the new template will be edited. Providing an empty list of certificate templates will remove existing scripts. | |
| > Any existing certificate template that is not included in the list will be removed, and existing templates with the same name as the new template will be edited. Providing an empty list of certificate templates will remove existing templates. |
I think "scripts" might have been a typo? Or are there scripts involved? cc @marko-lisica
(Will approve anyway since this is a contributor endpoint)
8 participants
Related to: