Fix audit/unenroll calls when agent runs fleet-server

changelog/fragments/1732043830-Fix-audit-unenroll-call-when-running-fleet-server.yaml

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# Change summary; a 80ish characters long description of the change.
+summary: Fix audit/unenroll call when running fleet-server
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+description: Fix the call to the audit/unenroll endpoint that occurs on uninstall when the fleet-server is running locally.
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: fleet-server
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+issue: https://github.com/elastic/elastic-agent/issues/5752

internal/pkg/agent/install/uninstall.go

@@ -20,6 +20,7 @@ import (
 	"github.com/schollz/progressbar/v3"
 
 	"github.com/elastic/elastic-agent-libs/logp"
+	"github.com/elastic/elastic-agent-libs/transport/tlscommon"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/info"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/paths"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/secret"
@@ -59,6 +60,48 @@ func Uninstall(ctx context.Context, cfgFile, topPath, uninstallToken string, log
 		return fmt.Errorf("uninstall must be run from outside the installed path '%s'", topPath)
 	}
 
+	// check if the agent was installed using --unprivileged by checking the file vault for the agent secret (needed on darwin to correctly load the vault)
+	unprivileged, err := checkForUnprivilegedVault(ctx)
+	if err != nil {
+		return fmt.Errorf("error checking for unprivileged vault: %w", err)
+	}
+
+	// will only notify fleet of the uninstall command if it can gather config and agentinfo, and is not a stand-alone install
+	localFleet := false
+	notifyFleet := false
+	var ai *info.AgentInfo
+	c, err := operations.LoadFullAgentConfig(ctx, log, cfgFile, false, unprivileged)
+	if err != nil {
+		pt.Describe(fmt.Sprintf("unable to read agent config to determine if notifying Fleet is needed: %v", err))
+	}
+	cfg, err := configuration.NewFromConfig(c)
+	if err != nil {
+		pt.Describe(fmt.Sprintf("notify Fleet: unable to transform *config.Config to *configuration.Configuration: %v", err))
+	}
+
+	if cfg != nil && !configuration.IsStandalone(cfg.Fleet) {
+		ai, err = info.NewAgentInfo(ctx, false)
+		if err != nil {
+			pt.Describe(fmt.Sprintf("unable to read agent info, Fleet will not be notified of uninstall: %v", err))
+		} else {
+			notifyFleet = true
+		}
+		if cfg.Fleet != nil && cfg.Fleet.Server != nil {
+			localFleet = true
+		}
+	}
+
+	// Skip on Windows because of https://github.com/elastic/elastic-agent/issues/5952
+	// Once the root-cause is identified then this can be re-enabled on Windows.
+	// Notify fleet-server while it is still running if it's running locally
+	if notifyFleet && localFleet && runtime.GOOS != "windows" {
+		if cfg.Fleet.Client.Transport.TLS != nil {
+			cfg.Fleet.Client.Transport.TLS.VerificationMode = tlscommon.VerifyCertificate
+		}
+		cfg.Fleet.Client.Hosts = []string{cfg.Fleet.Client.Host}
+		notifyFleetAuditUninstall(ctx, log, pt, cfg, ai) //nolint:errcheck // ignore the error as we can't act on it
+	}
+
 	// ensure service is stopped
 	status, err := EnsureStoppedService(topPath, pt)
 	if err != nil {
@@ -71,12 +114,6 @@ func Uninstall(ctx context.Context, cfgFile, topPath, uninstallToken string, log
 		return fmt.Errorf("failed trying to kill any running watcher: %w", err)
 	}
 
-	// check if the agent was installed using --unprivileged by checking the file vault for the agent secret (needed on darwin to correctly load the vault)
-	unprivileged, err := checkForUnprivilegedVault(ctx)
-	if err != nil {
-		return fmt.Errorf("error checking for unprivileged vault: %w", err)
-	}
-
 	// Uninstall components first
 	if err := uninstallComponents(ctx, cfgFile, uninstallToken, log, pt, unprivileged); err != nil {
 		// If service status was running it was stopped to uninstall the components.
@@ -111,27 +148,6 @@ func Uninstall(ctx context.Context, cfgFile, topPath, uninstallToken string, log
 		}
 	}
 
-	// will only notify fleet of the uninstall command if it can gather config and agentinfo, and is not a stand-alone install
-	notifyFleet := false
-	var ai *info.AgentInfo
-	c, err := operations.LoadFullAgentConfig(ctx, log, cfgFile, false, unprivileged)
-	if err != nil {
-		pt.Describe(fmt.Sprintf("unable to read agent config to determine if notifying Fleet is needed: %v", err))
-	}
-	cfg, err := configuration.NewFromConfig(c)
-	if err != nil {
-		pt.Describe(fmt.Sprintf("notify Fleet: unable to transform *config.Config to *configuration.Configuration: %v", err))
-	}
-
-	if cfg != nil && !configuration.IsStandalone(cfg.Fleet) {
-		ai, err = info.NewAgentInfo(ctx, false)
-		if err != nil {
-			pt.Describe(fmt.Sprintf("unable to read agent info, Fleet will not be notified of uninstall: %v", err))
-		} else {
-			notifyFleet = true
-		}
-	}
-
 	// remove existing directory
 	pt.Describe("Removing install directory")
 	err = RemovePath(topPath)
@@ -146,7 +162,7 @@ func Uninstall(ctx context.Context, cfgFile, topPath, uninstallToken string, log
 
 	// Skip on Windows because of https://github.com/elastic/elastic-agent/issues/5952
 	// Once the root-cause is identified then this can be re-enabled on Windows.
-	if notifyFleet && runtime.GOOS != "windows" {
+	if notifyFleet && !localFleet && runtime.GOOS != "windows" {
 		notifyFleetAuditUninstall(ctx, log, pt, cfg, ai) //nolint:errcheck // ignore the error as we can't act on it
 	}
 

testing/integration/fleetserver_test.go

@@ -47,8 +47,6 @@ func TestInstallFleetServerBootstrap(t *testing.T) {
 		Local: false,
 	})
 
-	t.Skip("Skip until the first 8.16.0-SNAPSHOT is available")
-
 	ctx, cancel := testcontext.WithDeadline(t, context.Background(), time.Now().Add(10*time.Minute))
 	defer cancel()
 
@@ -165,4 +163,6 @@ func TestInstallFleetServerBootstrap(t *testing.T) {
 		require.Error(t, err, "uninstall should have failed")
 		require.Containsf(t, string(out), "uninstall must be run from outside the installed path", "expected error string not found in: %s err: %s", out, err)
 	}
+
+	t.Run("Test audit/unenroll", testUninstallAuditUnenroll(ctx, fixture, info))
 }

testing/integration/install_test.go

@@ -338,32 +338,41 @@ func TestInstallUninstallAudit(t *testing.T) {
 		return waitForAgentAndFleetHealthy(ctx, t, fixture)
 	}, time.Minute, time.Second, "agent never became healthy or connected to Fleet")
 
-	agentID, err := getAgentID(ctx, fixture)
-	require.NoError(t, err, "error getting the agent inspect output")
-	require.NotEmpty(t, agentID, "agent ID empty")
+	t.Run("run uninstall", testUninstallAuditUnenroll(ctx, fixture, info))
+}
 
-	out, err = fixture.Uninstall(ctx, &atesting.UninstallOpts{Force: true})
-	if err != nil {
-		t.Logf("uninstall output: %s", out)
-		require.NoError(t, err)
-	}
+func testUninstallAuditUnenroll(ctx context.Context, fixture *atesting.Fixture, info *define.Info) func(t *testing.T) {
+	return func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("Skip Windows as it has been disabled because of https://github.com/elastic/elastic-agent/issues/5952")
+		}
+		agentID, err := getAgentID(ctx, fixture)
+		require.NoError(t, err, "error getting the agent inspect output")
+		require.NotEmpty(t, agentID, "agent ID empty")
 
-	// TODO: replace direct query to ES index with API call to Fleet
-	// Blocked on https://github.com/elastic/kibana/issues/194884
-	response, err := info.ESClient.Get(".fleet-agents", agentID, info.ESClient.Get.WithContext(ctx))
-	require.NoError(t, err)
-	defer response.Body.Close()
-	p, err := io.ReadAll(response.Body)
-	require.NoError(t, err)
-	require.Equalf(t, http.StatusOK, response.StatusCode, "ES status code expected 200, body: %s", p)
-	var res struct {
-		Source struct {
-			AuditUnenrolledReason string `json:"audit_unenrolled_reason"`
-		} `json:"_source"`
+		out, err := fixture.Uninstall(ctx, &atesting.UninstallOpts{Force: true})
+		if err != nil {
+			t.Logf("uninstall output: %s", out)
+			require.NoError(t, err)
+		}
+
+		// TODO: replace direct query to ES index with API call to Fleet
+		// Blocked on https://github.com/elastic/kibana/issues/194884
+		response, err := info.ESClient.Get(".fleet-agents", agentID, info.ESClient.Get.WithContext(ctx))
+		require.NoError(t, err)
+		defer response.Body.Close()
+		p, err := io.ReadAll(response.Body)
+		require.NoError(t, err)
+		require.Equalf(t, http.StatusOK, response.StatusCode, "ES status code expected 200, body: %s", p)
+		var res struct {
+			Source struct {
+				AuditUnenrolledReason string `json:"audit_unenrolled_reason"`
+			} `json:"_source"`
+		}
+		err = json.Unmarshal(p, &res)
+		require.NoError(t, err)
+		require.Equalf(t, "uninstall", res.Source.AuditUnenrolledReason, "uninstall output: %s", out)
 	}
-	err = json.Unmarshal(p, &res)
-	require.NoError(t, err)
-	require.Equal(t, "uninstall", res.Source.AuditUnenrolledReason)
 }
 
 // TestRepeatedInstallUninstall will install then uninstall the agent