feat: secure managed agent bootstrap flow

config/install_agent.tpl

@@ -220,28 +220,42 @@ function install_config() {
   echo "[agent] waiting generate config"
   port={{port}}
   console_endpoint="{{console_endpoint}}"
-
-  location_ep=$(echo "$console_endpoint" | sed -nE 's/(.*):\/\/([^/:]*):?([0-9]*).*/\1:\/\/\2:\3/p')
-  server=${register_server:-$location_ep}
+
+  # Keep the console base path in managed server URLs so register/sync/exchange
+  # requests still work when Console is deployed under a non-root path prefix.
+  server=${register_server:-$console_endpoint}
   echo "[agent] agent listening port $port, will register to console endpoint [ $server ]"
   cat <<EOF > ${install_dir}/agent.yml
 configs.auto_reload: true
 
 env:
-  API_BINDING: "0.0.0.0:${port}"
+  WEB_BINDING: "0.0.0.0:${port}"
+  MANAGED: true
+  REMOTE_CONFIG_SERVERS: ["${server}"]
+  REMOTE_CONFIG_INTERVAL: "10s"
+  SECURITY_ENABLED: true
+  SECURITY_MANAGED_ENABLED: false
 
 path.data: data
 path.logs: log
-path.configs: config
+path.configs: "config"
 
 resource_limit.cpu.max_num_of_cpus: 1
-resource_limit.memory.max_in_bytes: 533708800
+
+resource_limit:
+  memory:
+    max_in_bytes: 533708800 #50MB
+
+task:
+  max_concurrent_tasks: 3
 
 stats:
   include_storage_stats_in_api: false
 
 elastic:
   skip_init_metadata_on_start: true
+  metadata_refresh:
+    enabled: false
   health_check:
     enabled: true
     interval: 60s
@@ -252,24 +266,33 @@ elastic:
 disk_queue:
   max_msg_size: 20485760
   max_bytes_per_file: 20485760
-  max_used_bytes: 524288000
+  max_used_bytes: 524288000 #500MB
   retention.max_num_of_local_files: 1
   compress:
-    idle_threshold: 0
+    idle_threshold: 1
     num_of_files_decompress_ahead: 0
     segment:
       enabled: true
 
 api:
+  disable_api_directory: true
+  enabled: false
+
+web:
+  embedding_api: false
   enabled: true
-  tls:
-    enabled: false
-    cert_file: "config/client.crt"
-    key_file: "config/client.key"
-    ca_file: "config/ca.crt"
-    skip_insecure_verify: false
   network:
-    binding: \$[[env.API_BINDING]]
+    binding: \$[[env.WEB_BINDING]]
+  ui:
+    vfs: true
+  security:
+    enabled: \$[[env.SECURITY_ENABLED]]
+    managed: \$[[env.SECURITY_MANAGED_ENABLED]]
+
+agent:
+
+metrics:
+  enabled: true
 
 badger:
   value_threshold: 1024
@@ -279,11 +302,13 @@ badger:
 
 configs:
   #for managed client's setting
-  managed: true # managed by remote servers
+  managed: \$[[env.MANAGED]] # managed by remote servers
   panic_on_config_error: false #ignore config error
-  interval: "10s"
-  servers: # config servers
-    - "${server}"
+  allow_generated_metrics_tasks: false # allow auto-generated metrics tasks (e.g. k8s)
+  interval: \$[[env.REMOTE_CONFIG_INTERVAL]]
+  servers: \$[[env.REMOTE_CONFIG_SERVERS]] # config servers
+  manager:
+    access_token: '$[[keystore.CONFIGS_MANAGER_ACCESS_TOKEN]]'
   soft_delete: false
   max_backup_files: 5
   tls: #for mTLS connection with config servers
@@ -298,6 +323,22 @@ node:
 EOF
 }
 
+function install_keystore() {
+  access_token="{{access_token}}"
+  agent_svc=${install_dir}/${program_name}-${file_ext%%.*}
+
+  if [[ -z "${access_token}" ]]; then
+    echo "Error: access token is empty." >&2
+    exit 1
+  fi
+
+  echo "[agent] waiting write access token to keystore"
+  (
+    cd "${install_dir}"
+    printf '%s' "${access_token}" | "./$(basename "${agent_svc}")" keystore add CONFIGS_MANAGER_ACCESS_TOKEN --stdin --force >/dev/null
+  )
+}
+
 function uninstall_service() {
   agent_svc=${install_dir}/${program_name}-${file_ext%%.*}
   chmod 755 $agent_svc
@@ -351,6 +392,7 @@ function main() {
   install_binary
   install_certs
   install_config
+  install_keystore
   uninstall_service
   install_service
 

docs/content.en/docs/release-notes/_index.md

@@ -11,7 +11,9 @@ Information about release notes of INFINI Console is provided here.
 ### ❌ Breaking changes  
 ### 🚀 Features  
 ### 🐛 Bug fix  
+- fix: secure managed Agent install, registration, token exchange, and config sync with scoped API tokens instead of the previous unauthenticated path
 ### ✈️ Improvements  
+- chore: align managed Agent bootstrap with the web endpoint and simplify the post-register token exchange flow and credential naming
 - chore: add native Go modules support for Console build and PR checks
 
 ## 1.30.2 (2026-03-16)

go.mod

@@ -9,7 +9,6 @@ replace github.com/cihub/seelog => ../framework/lib/seelog
 require (
 	github.com/Knetic/govaluate v3.0.0+incompatible
 	github.com/buger/jsonparser v1.2.0
-	github.com/cihub/seelog v0.0.0-00010101000000-000000000000
 	github.com/crewjam/saml v0.5.1
 	github.com/emirpasic/gods v1.18.1
 	github.com/golang-jwt/jwt/v4 v4.5.2
@@ -23,103 +22,24 @@ require (
 	golang.org/x/oauth2 v0.36.0
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/yaml.v2 v2.4.0
-	infini.sh/framework v0.0.0-00010101000000-000000000000
 )
 
 require (
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
-	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/RoaringBitmap/roaring v1.9.4 // indirect
-	github.com/andybalholm/brotli v1.1.1 // indirect
-	github.com/arl/statsviz v0.6.0 // indirect
 	github.com/beevik/etree v1.5.0 // indirect
-	github.com/bits-and-blooms/bitset v1.12.0 // indirect
-	github.com/bkaradzic/go-lz4 v1.0.0 // indirect
-	github.com/caddyserver/certmagic v0.25.3 // indirect
-	github.com/caddyserver/zerossl v0.1.5 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dgraph-io/badger/v4 v4.7.0 // indirect
-	github.com/dgraph-io/ristretto v0.2.0 // indirect
-	github.com/dgraph-io/ristretto/v2 v2.2.0 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
-	github.com/go-ldap/ldap/v3 v3.4.13 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-redis/redis/v8 v8.11.5 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/flatbuffers v25.2.10+incompatible // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/gookit/filter v1.2.3 // indirect
-	github.com/gookit/goutil v0.7.1 // indirect
-	github.com/gookit/validate v1.5.6 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.4.0 // indirect
-	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/hashicorp/go-version v1.7.0 // indirect
-	github.com/jmoiron/jsonq v0.0.0-20150511023944-e874b168d07e // indirect
 	github.com/jonboulle/clockwork v0.2.2 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
-	github.com/kardianos/service v1.2.2 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/libdns/libdns v1.1.1 // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mholt/acmez/v3 v3.1.6 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
-	github.com/mschoch/smat v0.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.22 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
-	github.com/rs/cors v1.11.1 // indirect
-	github.com/rs/xid v1.6.0 // indirect
 	github.com/russellhaering/goxmldsig v1.4.0 // indirect
-	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/savsgio/gotils v0.0.0-20250408102913-196191ec6287 // indirect
 	github.com/segmentio/asm v1.1.3 // indirect
-	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
-	github.com/twmb/franz-go v1.18.1 // indirect
-	github.com/twmb/franz-go/pkg/kadm v1.16.0 // indirect
-	github.com/twmb/franz-go/pkg/kmsg v1.11.2 // indirect
-	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.1 // indirect
-	go.uber.org/zap/exp v0.3.0 // indirect
-	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/appengine v1.6.6 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
-	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )