Related user story

#34856

Task

• Android agent needs to get a node key from Fleet server using a normal enroll secret
  • The host should already exist (enrolled via Android MDM)
• Android stores node key in Android keychain
• If host tries to get a node key a second time, we do the same thing we do when orbit tries to enroll a 2nd time

Old scope. We will not use a one-time enroll secret for this version

• Create DB table for one-time enroll secrets
• Create an API endpoint for using one-time enroll secret to get/set a node_key on the Android host (or orbit_node_key?)
• Revoke the one-time enroll secret after Android agent acknowledges receipt of the node_key (for network issues or device disconnecting)
• Update Android app to use the API to get the node key
  • app retries 5x; server logs unsuccessful attempts