allow to configure a default global enroll secret (#6609)

Related to #6365 this adds a new config to set a global enroll token that will be used by the server.
2022-07-12 19:12:10 -03:00
parent a1232ee7a3
commit 6faee84f57
8 changed files with 135 additions and 3 deletions
@@ -2522,3 +2522,34 @@ If not set then the Prometheus `/metrics` endpoint is disabled.
    basic_auth:
      password: "bar"
  ```
+
+#### Packaging
+
+Configurations used to control how Fleet interacts with the (coming soon)
+packaging server.  These features are currently only intended to be used within
+Fleet Sandbox, but this is subject to change.
+
+##### packaging.global_enroll_secret
+
+Enroll secret to use for adding hosts to the global scope. If this value is
+set, the server won't allow changes to the enroll secret via the config
+endpoints.
+
+This value should be treated as a secret, we recommend using a
+cryptographically secure pseudo random string. For example, using `openssl`:
+
+```
+openssl rand -base64 24
+```
+
+This config only takes effect if you don't have a global enroll secret already
+stored in your database.
+
+- Default value: `""`
+- Environment variable: `FLEET_PACKAGING_GLOBAL_ENROLL_SECRET`
+- Config file format:
+
+  ```yaml
+  packaging:
+    global_enroll_secret: "xyz"
+  ```