mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
3cfe583ea0
for #21381 # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
package update
|
|
|
|
import (
|
|
"errors"
|
|
"sync/atomic"
|
|
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/useraction"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/rs/zerolog/log"
|
|
)
|
|
|
|
const maxRetries = 2
|
|
|
|
type DiskEncryptionRunner struct {
|
|
isRunning atomic.Bool
|
|
capabilitiesFetcher func() fleet.CapabilityMap
|
|
triggerOrbitRestart func(reason string)
|
|
}
|
|
|
|
func ApplyDiskEncryptionRunnerMiddleware(
|
|
capabilitiesFetcher func() fleet.CapabilityMap,
|
|
triggerOrbitRestart func(reason string),
|
|
) fleet.OrbitConfigReceiver {
|
|
return &DiskEncryptionRunner{
|
|
capabilitiesFetcher: capabilitiesFetcher,
|
|
triggerOrbitRestart: triggerOrbitRestart,
|
|
}
|
|
}
|
|
|
|
func (d *DiskEncryptionRunner) Run(cfg *fleet.OrbitConfig) error {
|
|
log.Debug().Msgf("running disk encryption fetcher middleware, notification: %v, isIdle: %v", cfg.Notifications.RotateDiskEncryptionKey, d.isRunning.Load())
|
|
|
|
if d.capabilitiesFetcher == nil {
|
|
return errors.New("disk encryption runner needs a capabilitites fetcher configured")
|
|
}
|
|
|
|
if d.triggerOrbitRestart == nil {
|
|
return errors.New("disk encryption runner needs a function to trigger orbit restarts configured")
|
|
}
|
|
|
|
if d.capabilitiesFetcher().Has(fleet.CapabilityEscrowBuddy) {
|
|
d.triggerOrbitRestart("server has Escrow Buddy capability but old disk encryption fetcher was running")
|
|
return nil
|
|
}
|
|
|
|
if cfg.Notifications.RotateDiskEncryptionKey && !d.isRunning.Swap(true) {
|
|
go func() {
|
|
defer d.isRunning.Store(false)
|
|
if err := useraction.RotateDiskEncryptionKey(maxRetries); err != nil {
|
|
log.Error().Err(err).Msg("rotating encryption key")
|
|
}
|
|
}()
|
|
}
|
|
|
|
return nil
|
|
}
|