Enroll devices in disconnected environments

Prepare enrollment credentials and agent configuration at a disconnected site. Approval, device lobby behavior, and post-enrollment management use the same workflow as a connected deployment.

Before you begin

  • Red Hat Edge Manager is installed and services are running at the disconnected site. See Installing Red Hat Edge Manager on Red Hat Enterprise Linux in disconnected environments or Installing Red Hat Edge Manager on Red Hat OpenShift Container Platform in disconnected environments in the Additional resources section.
  • DNS inside the site resolves the management host name you configured as global.baseDomain (for example edge.example.com).
  • Edge devices can reach TCP port 7443 on that management host name or IP address. See Agent API and telemetry on dedicated ports in the Additional resources section.
  • The flightctl-agent package is installed on each edge device. For hosts that receive the agent RPM outside an OS image build, see Install the agent and CLI on air-gapped edge devices in the Additional resources section.
  • You can authenticate to the local Red Hat Edge Manager API with the Flight Control CLI or web console from a workstation on the internal network.

Procedure

  1. Authenticate the Flight Control CLI on a workstation that can reach the management host inside the site. Administrators run enrollment commands against the local user API on port 443.

    If Red Hat Edge Manager uses certificates from the built-in generator or a private CA, trust the deployment CA on the workstation, or use --insecure-skip-tls-verify only for non-production testing. On standalone Red Hat Enterprise Linux deployments, the CA file is /etc/flightctl/pki/ca.crt on the management host. See Installing the Red Hat Edge Manager RPM package in the Additional resources section.

    sudo cp ca.crt /etc/pki/ca-trust/source/anchors/rhem-ca.crt
sudo update-ca-trust
  2. Log in to the local Red Hat Edge Manager instance: 
    flightctl login https://<baseDomain> --username <user_name> --password <password>

    Replace <baseDomain> with the same value as global.baseDomain in /etc/flightctl/service-config.yaml.

  3. Request an enrollment configuration file from the local Red Hat Edge Manager service: 
    flightctl certificate request \
  --signer=enrollment \
  --expiration=365d \
  --output=embedded > config.yaml

    The command returns a complete agent configuration. The enrollment-service.service.server field points at the agent API on port 7443 using your local management host name. The file also embeds the certificate authority bundle and a short-lived enrollment client certificate and key.

  4. Review the generated file. The structure matches the following example (values are truncated): 
    enrollment-service:
  authentication:
    client-certificate-data: LS0tLS1CRUdJTiBD...
    client-key-data: LS0tLS1CRUdJTiBF...
  service:
    certificate-authority-data: LS0tLS1CRUdJTiBD...
    server: https://<baseDomain>:7443
  enrollment-ui-endpoint: https://<baseDomain>/

    The agent uses certificate-authority-data to verify the management server during enrollment mTLS. The enrollment client certificate in authentication secures the initial connection only; after approval, Red Hat Edge Manager issues a device-specific management certificate.

  5. Copy config.yaml to the edge device by using your internal transfer method (for example scp on the site network or USB). For transfer options, see the Additional resources section.
  6. Install the configuration and restrict permissions because the file contains a private key: 
    sudo install -m 600 -o root -g root config.yaml /etc/flightctl/config.yaml
  7. Restart the agent so it loads the configuration: 
    sudo systemctl restart flightctl-agent

    The agent connects to https://<baseDomain>:7443, establishes an mTLS session, and submits an enrollment request. The device remains in the enrollment lobby until an administrator approves the request.

    Note

    To enroll many devices, embed config.yaml in an operating system image (early binding) or inject it at provisioning time (late binding) instead of copying the file manually. For image-based workflows in disconnected sites, see Build a bootc operating system image for the Red Hat Edge Manager and Provisioning devices in the Additional resources section.
  8. Approve the pending request on your local Red Hat Edge Manager instance by using the same CLI or web console workflow as a connected deployment. See Enrolling devices using the Flight Control CLI and Approving with the Flight Control web console in the Additional resources section.

Results

  • flightctl get devices shows the device with status Online and the expected alias in the ALIAS column.
  • On the edge device, sudo systemctl status flightctl-agent reports active (running).

Agent logs show connection or certificate errors

  1. Verify the device can reach the management host on port 7443: 
    curl -k https://<baseDomain>:7443/
  2. Verify the CA embedded in /etc/flightctl/config.yaml matches the server CA for your deployment.
  3. Review agent logs on the device: 
    sudo journalctl -u flightctl-agent --no-pager | tail -30