86 lines
4.0 KiB
C#
86 lines
4.0 KiB
C#
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using System.Text.Json;
|
|
using System.Text.Json.Nodes;
|
|
using Fleet.Core;
|
|
using Fleet.Hosting;
|
|
using Fleet.Identity;
|
|
|
|
namespace Fleet.Enrollment.Client;
|
|
|
|
public sealed record EnrollmentResult(string NodeId, string Status, string IdentityDirectory);
|
|
|
|
/// <summary>
|
|
/// 用加入令牌注册（供 <c>fleet-enroll</c> 使用，也可以嵌入产品自己的安装工具）：
|
|
/// 生成身份密钥和 TLS 证书 → 用身份私钥签名持有证明 → 调用注册端点 → 写入身份目录。
|
|
/// 注册逻辑只存在于这里，常驻的业务进程不包含注册代码，也不使用 HttpClient。
|
|
/// </summary>
|
|
public static class EnrollmentClient
|
|
{
|
|
public static async Task<Result<EnrollmentResult>> EnrollAsync(
|
|
HttpClient http, Uri server, string joinToken, string name, string identityDirectory, string nodeVersion, JsonNode? productMeta, TimeProvider time, CancellationToken ct)
|
|
{
|
|
string nodeFile = Path.Combine(identityDirectory, LoadedNodeIdentity.NodeFileName);
|
|
if (File.Exists(nodeFile))
|
|
{
|
|
return Result<EnrollmentResult>.Fail(FleetErrors.NameConflict, $"{nodeFile} already exists: this node is already enrolled (remove the directory to enroll again)");
|
|
}
|
|
|
|
using NodeIdentity identity = NodeIdentity.Generate();
|
|
byte[] pfx = NodeCertificate.CreateSelfSignedPfx(name, TimeSpan.FromDays(3650), time);
|
|
byte[] spki;
|
|
byte[] tlsPublicKey;
|
|
using (var certificate = NodeCertificate.LoadPfx(pfx))
|
|
{
|
|
spki = NodeCertificate.SpkiFingerprint(certificate);
|
|
tlsPublicKey = certificate.PublicKey.ExportSubjectPublicKeyInfo();
|
|
}
|
|
|
|
string pubkey = Convert.ToBase64String(identity.PublicKeySpki);
|
|
string tokenHash = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(joinToken)));
|
|
var body = new JsonObject
|
|
{
|
|
["join_token"] = joinToken,
|
|
["name"] = name,
|
|
["pubkey"] = pubkey,
|
|
["tls_spki"] = Convert.ToBase64String(spki),
|
|
["tls_pubkey"] = Convert.ToBase64String(tlsPublicKey),
|
|
["proof"] = Convert.ToBase64String(identity.Sign(SignaturePurpose.Enroll, tokenHash, pubkey)),
|
|
["node_version"] = nodeVersion,
|
|
["meta"] = productMeta,
|
|
};
|
|
|
|
using var content = new StringContent(body.ToJsonString(), Encoding.UTF8, "application/json");
|
|
using HttpResponseMessage response = await http.PostAsync(new Uri(server, "/api/agent/v1/enroll"), content, ct);
|
|
string text = await response.Content.ReadAsStringAsync(ct);
|
|
if (!response.IsSuccessStatusCode)
|
|
{
|
|
string code = "fleet_internal";
|
|
string detail = text;
|
|
try
|
|
{
|
|
JsonNode? problem = JsonNode.Parse(text);
|
|
code = problem?["code"]?.GetValue<string>() ?? code;
|
|
detail = problem?["detail"]?.GetValue<string>() ?? detail;
|
|
}
|
|
catch (JsonException)
|
|
{
|
|
// 不是 problem+json：原样返回
|
|
}
|
|
|
|
return Result<EnrollmentResult>.Fail(new ErrorCode(code), $"{(int)response.StatusCode}: {detail}");
|
|
}
|
|
|
|
JsonNode result = JsonNode.Parse(text)!;
|
|
string nodeId = result["node_id"]!.GetValue<string>();
|
|
var store = new ConfigStore(identityDirectory);
|
|
store.Write(LoadedNodeIdentity.KeyFileName, identity.ExportPkcs8());
|
|
store.Write(LoadedNodeIdentity.TlsFileName, pfx);
|
|
// node.json 最后写：它存在就表示注册完整完成
|
|
store.Write(
|
|
LoadedNodeIdentity.NodeFileName,
|
|
JsonSerializer.SerializeToUtf8Bytes(new NodeFile { NodeId = nodeId, Server = server.ToString().TrimEnd('/'), TlsSpki = Convert.ToBase64String(spki) }, NodeFileContext.Default.NodeFile));
|
|
return Result<EnrollmentResult>.Ok(new EnrollmentResult(nodeId, result["status"]!.GetValue<string>(), identityDirectory));
|
|
}
|
|
}
|