Write code to automate device enrollment/key rotation in Google Core IoT.

[vpetersson]

In the "Google Core IoT" example we have the command line items for how to enroll a device. However, due to the fact that we use seven day certs, we need to streamline this process in the form of some simple python code (where the user just specifies what Device IDs to enroll).

[vpetersson]

This ticket is blocked by #277. We also need a new API end-point to list all devices.

[a-martynovich]

@vpetersson Why do we need a new API end-point to list all devices if
a) we already have one (only it's not by API key) and
b) you wrote "the user just specifies what Device IDs to enroll"?

[vpetersson]

I covered this in a 1:1 with @a-martynovich but given that he's AFK for the rest of the sprint, let me post it here.

Picture the following scenario. You have 10 devices in your fleet and you want to make sure they can use Google Core IoT. While we could manually specify every device every seven days, it is not a great UX. A better UX is to:

• Auth against the API
• Get all devices for which the cert has been rotated (i.e. hash the previous and current cert)
• Automatically enroll all updated certs for all devices

This also allows us to automatically enroll any new device.

[eugenosm]

Well, I implemented it as I understand:

1. As i understan we need a script to automatically check:

• New devices claimed in dash
• Certificates that have been updated
  And by the results of check enrolll new and update existent devices in google iot registry

2)For work we use:

• Key token generated from wott dash
• Secret json for service account of google platform project

So, this is a sample of current script work otput:

retrieving device list from wott dashboard...
retrived 9 devices.
                                       device name| cert. state
---------------------------------------------------------------
     d29013546e1e467ea013a1df82696420.d.wott.local|     Expired
     7f40657f6191449a884d87960a370b1c.d.wott.local|     Expired
     836f47c3fc864523a7ca99b7bbab28bb.d.wott.local|     Expired
     880eb16e71e342ba901b4bc872d09724.d.wott.local|     Expired
     45c58612cd924af7b99c4f67ae10589b.d.wott.local|     Expired
     176887d1a10343ac8232fe167263837f.d.wott.local|     Expired
     03bc3a61c3aa43569102a9078a0ba746.d.wott.local|          OK
     47a8925fcf9245a98c9e4f4818f19ca5.d.wott.local|          OK
     072084996bcb47d0a1457ed935be6ddf.d.wott.local|          OK
--------

retrieving device list from google registry...
retrived 2 devices.
                                       device name|cert. expiration
---------------------------------------------------------------------------
   a-072084996bcb47d0a1457ed935be6ddf.d.wott.local|2019-07-14T15:22:00Z
   a-47a8925fcf9245a98c9e4f4818f19ca5.d.wott.local|2019-07-11T13:31:00Z
--------
Enroll 03bc3a61c3aa43569102a9078a0ba746.d.wott.local as a-03bc3a61c3aa43569102a9078a0ba746.d.wott.local...

1 devices updated/enrolled.


retrieving device list from google registry...
retrived 3 devices.
                                       device name|cert. expiration
---------------------------------------------------------------------------
   a-03bc3a61c3aa43569102a9078a0ba746.d.wott.local|2019-07-14T15:41:00Z
   a-072084996bcb47d0a1457ed935be6ddf.d.wott.local|2019-07-14T15:22:00Z
   a-47a8925fcf9245a98c9e4f4818f19ca5.d.wott.local|2019-07-11T13:31:00Z
--------

[eugenosm]

@vpetersson is that right? (previous comment)

[eugenosm]

and also. i imlement it as a sample app in agent doc

[vpetersson]

key tocken generated from wott dash

Assuming you mean API token, yes.

secret json for service account of google platform project

Correct, but we need to specify what permission the service account requires (make sure it's the lowest permission needed).

Other than that it looks sensible.

[eugenosm]

About permissions, I will specify. Currently tested as owner, which is clearly redundant