Documentation to rotate enroll secrets appears incorrect

[getvictor]

UPDATE: @noahtalerman: Opened a PR to remove the outdated docs here: #26999

---

https://fleetdm.com/docs/configuration/agent-configuration#options-and-command-line-flags:~:text=How%20to%20rotate%20enroll%20secrets%3A

The documentation states to run SELECT * FROM orbit_info WHERE enrolled = false to see if enroll secret is stale.

Looking at the code, Orbit is enrolled as long as it has a valid secret-orbit-node-key.txt file, which is created at original enrollment. If that file is deleted or corrupted, Orbit will need to re-enroll. There is no way to tell whether the original enroll secret has expired. But we could add logic to check and/or update it.

Also, that brings up the question of whether we should be rotating the orbit node key.

[noahtalerman]

Thanks @getvictor!

Looking at the code, Orbit is enrolled as long as it has a valid secret-orbit-node-key.txt file, which is created at original enrollment. If that file is deleted or corrupted, Orbit will need to re-enroll. There is no way to tell whether the original enroll secret has expired. But we could add logic to check and/or update it.

Today, how can I tell that a host won't get updated command_line_flags? (because it enrolled using an old enroll secret)

[noahtalerman]

FYI @rachaelshaw I assigned myself this bug and the following related bug:

• Documentation for rotating enroll secret is broken #24309

[getvictor]

command_line_flags

@noahtalerman I'm not seeing the command_line_flags dependency on enroll secret in the code. I recommend trying this to confirm it works as documented (or not).

[fleet-release]

Docs corrected, bright,
Secrets rotate in the light,
No more shadowed night.