---
title: "Amazon Elastic Kubernetes Service with Fortanix Confidential Computing Manager"
slug: "amazon-elastic-kubernetes-service-with-fortanix-ccm"
updated: 2026-07-22T14:08:30Z
published: 2026-07-22T14:08:30Z
canonical: "support.fortanix.com/amazon-elastic-kubernetes-service-with-fortanix-ccm"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Elastic Kubernetes Service with Fortanix Confidential Computing Manager

## 1.0 Introduction

This article describes how to configure an Amazon Elastic Kubernetes Service (EKS) cluster and enroll its worker nodes in Fortanix Confidential Computing Manager (CCM).

## 2.0 Prerequisites

Ensure that you meet the following requirements:

- You must have an active AWS subscription.
- The EKS cluster worker nodes must use i3en.xlarge instance types or larger.
- An Amazon EKS cluster must already be created.

## 3.0 Set Up Amazon EKS Cluster

Ensure that the Amazon EKS cluster and worker nodes are configured with the Nitro Enclaves Kubernetes device plugin. *For more information on the procedures and steps, refer to the* [*AWS official documentation*](https://docs.aws.amazon.com/enclaves/latest/user/kubernetes.html#create-lt)*.*

You must increase the HugePages memory allocation by updating the value of the `memory_mib` parameter to `2560` in the `/etc/nitro_enclaves/allocator.yaml` file.

```bash
---
# Enclave configuration file.
#
# How much memory to allocate for enclaves (in MiB).
memory_mib: 2560
#
# How many CPUs to reserve for enclaves.
cpu_count: 2
```

> [!NOTE]
> NOTE
> 
> Ensure that a minimum of 512 MB of enclave memory is allocated for the `em-agent` node agent on each node, in addition to the enclave memory required for the application workload.

Run the following command to restart the worker node and apply the configuration changes:

```bash
reboot
```

## 4.0 Get Kubernetes Credentials

Perform the following steps to obtain Kubernetes credentials (`kubeconfig`) for cluster management:

1. Run the following command to get `kubeconfig`:

```bash
eksctl utils write-kubeconfig --cluster=<cluster_name>
```

OR

```bash
aws eks --region us-west-1 update-kubeconfig --name <cluster-name>
```
2. Run the following command to label all the nodes with Nitro Enclave OS capabilities:

```bash
kubectl label node <node-name> smarter-device-manager=enabled
```

> [!NOTE]
> NOTE
> 
> Ensure that you use private IP Domain Name System (DNS) name of the nodes.
3. Run the following command to label all the nodes with `enclave.example.com/type=nitro`:

```bash
kubectl label node <node-name> enclave.example.com/type=nitro
```
4. Run the following command to install the Smarter Device Manager on the Kubernetes cluster:

```bash
kubectl apply -f smarter-device-manager-ds-with-cm.yaml
```

> [!NOTE]
> NOTE
> 
> The Smarter Device Manager YAML configuration file is available in [smarter-device-manager-ds-with-cm.yaml](https://github.com/spkane/aws-nitro-cli-for-k8s/blob/main/k8s/smarter-device-manager-ds-with-cm.yaml). Ensure that the value of the `nummaxdevices` parameter is updated to a value greater than `1`, for example, **10**.

## 5.0 Provide AWS CCM User Access to Your EKS Cluster

Perform the following steps to provide AWS CCM user access to the EKS cluster:

1. Run the following command to update the `aws-auth configmap`:

```bash
 kubectl edit -n kube-system configmap/aws-auth
```
2. Add the following changes into the `configmap` file:

```bash
mapUsers: |
    - userarn: arn:aws:iam::513076507034:user/em-admin@fortanix.com
    username: em-admin@fortanix.com
    groups:
    - system:masters
```

This configuration assumes that the credentials associated with `em-admin@fortanix.com` are configured as `eks_config` in Fortanix CCM clusters.

## 6.0 Create Kubernetes Secrets

Perform the following steps to create a Kubernetes secret for the cluster :

1. Run the following command to create a secret to access the ECR registry:

```bash
kubectl create secret docker-registry regcred   --docker-server=513076507034.dkr.ecr.us-west-1.amazonaws.com   --docker-username=AWS --docker-password=$(aws ecr get-login-password)
```

> [!NOTE]
> NOTE
> 
> Skip this step if the image is stored in a public repository.
2. Retrieve the join token for your Fortanix CCM account from the CCM user interface (UI) and store it as a Kubernetes secret in your cluster. To generate your join token, log in to [https://ccm.fortanix.com/](https://ccm.fortanix.com/) the URL [https://armor.fortanix.com/](https://armor.fortanix.com/) if you are using the Armor SaaS deployment. For on-premises deployments, navigate to the configured Armor domain (**https://<armor-domain>***).*
  1. In the CCM UI left navigation panel, navigate to **Infrastructure** → **COMPUTE NODES** → **Intel SGX**,and then click **ADD NODE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/amazon-elastic-kubernetes-service-with-fortanix-confidential-computing-manager-v2.0-image-dulvdf5q.png)

**Figure 1: Add compute node**
  2. In the **Enroll Compute Node** window, click **COPY** to copy the join token. This Join Token is used by the compute node to authenticate itself.
  3. Run the following command to store the join token as a Kubernetes secret for the cluster. Replace the `&lt;join-token-from-account&gt;` value below with your token.

```bash
kubectl create secret generic em-token --from-literal=token=<join-token-from-account>
```

## 7.0 Install Fortanix CCM Node Agent

Perform the following steps to install the node agent on your Kubernetes cluster:

1. Run the following command to deploy the node agent as a `daemonset`:

```bash
kubectl apply -f agent-daemonset.yaml
```

The following is the content for the `agent-daemonset.yaml` file:

```bash
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: em-agent
  namespace: default
  labels:
    component: em-agent
spec:
  selector:
    matchLabels:
      component: em-agent
  template:
    metadata:
      labels:
        component: em-agent
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      volumes:
      - name: hugepage
        emptyDir:
          medium: HugePages
      - name: log
        hostPath:
          path: /var/log/nitro_enclaves
      - name: socket-path
        emptyDir: {}
      - name: node-data
        hostPath:
          path: /tmp/em-agent-nitro
      containers:
      - name: em-agent
        image: "fortanix/em-agent-nitro:latest"
        resources:
          limits:
            smarter-devices/nitro_enclaves: "1"
            hugepages-2Mi: 512Mi
            memory: 2Gi
            cpu: 250m
          requests:
            smarter-devices/nitro_enclaves: "1"
        volumeMounts:
        - mountPath: /dev/hugepages
          name: hugepage
          readOnly: false
        - name: log
          mountPath: /var/log/nitro_enclaves
        - name: socket-path
          mountPath: /run/nitro_enclaves
        - name: node-data
          mountPath: /tmp/em-agent-nitro
        ports:
        - containerPort: 9092
          name: http
          protocol: TCP
          hostPort: 9092
        env:
        - name: AGENT_MANAGER_AUTH_BASIC_TOKEN
          valueFrom:
            secretKeyRef:
              name: em-token
              key: token
        - name: MANAGER_ENDPOINT
          value: "ccm.test.fortanix.com"
        - name: MALBORK_LOG_DEBUG
          value: "true"
        - name: NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
```
2. Run the following command to verify that the Fortanix CCM Nitro Node Agent pod is running:

```bash
kubectl get pods
NAME             READY   STATUS    RESTARTS   AGE
em-agent-fqp8j   1/1     Running   0          30m
```

> [!NOTE]
> NOTE
> 
> Available node agent image tags are listed at [*https://hub.docker.com/r/fortanix/em-agent-nitro/tags*](https://hub.docker.com/r/fortanix/em-agent-nitro/tags).

## 8.0 Reinstall the Fortanix CCM Node Agent in a Different Account

Perform the following steps to reinstall the node agent in a different Fortanix Armor account:

1. Run the following command to delete the `/tmp/em-agent-nitro` parameter from each worker node:

```bash
# log into the node through debug container.
$ kubectl debug node/<node-name> -it --image=busybox
# inside container now run chroot to access the node.
$ chroot /host bash
# Delete the file
$ rm -rf /tmp/em-agent-nitro
# Exit twice to get out of the container
$ exit
```
2. Run the following command to create a new `em-token` secret:

```bash
$ kubectl delete secret em-token
$ kubectl create secret generic em-token --from-literal=token=<join-token-from-account>
```
3. Run the following command to restart the `em-agent DaemonSet`:

```bash
$ kubectl rollout restart ds em-agent
```

## 9.0 Converting Nitro Enclave OS Application

*For more information on how to create an application in Fortanix CCM, refer to* [*Add Application*](/v1/docs/fortanix-ccm-add-and-edit-an-application)*.*

### 9.1 Creating NGINX Deployment

The following is the content of the `app-deployment.yaml` file:

```bash
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-pod
  labels:
    app: my-pod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-pod
  template:
    metadata:
      labels:
        app: my-pod
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - name: http
          containerPort: 80
        imagePullPolicy: Always
        securityContext:
          privileged: true
        resources:
          limits:
            smarter-devices/nitro_enclaves: "1"
            hugepages-1Gi: 2Gi
            memory: 2Gi
            cpu: 250m
          requests:
            smarter-devices/nitro_enclaves: "1"
            hugepages-1Gi: 2Gi
        volumeMounts:
        - mountPath: /dev/hugepages
          name: hugepage
          readOnly: false
        - name: log
          mountPath: /var/log/nitro_enclaves
        - name: socket-path
          mountPath: /run/nitro_enclaves
        env:
        - name: NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: NODE_AGENT
          value: http://$(NODE_IP):9092/v1/
        - name: RUST_LOG
          value: debug
      volumes:
      - name: hugepage
        emptyDir:
          medium: HugePages
      - name: log
        hostPath:
          path: /var/log/nitro_enclaves
      - name: socket-path
        emptyDir: {}
```

Update the container image details to deploy a different application build. Run the following command to deploy the application:

```bash
kubectl apply -f app-deployment.yaml
```

## Related

- [Create Application Build](/fortanix-ccm-create-application-build.md)
- [Overview and Definitions](/fortanix-ccm-overview-and-definitions.md)
- [Fortanix DSM with Microsoft SQL Server TDE - Advanced](/fortanix-dsm-with-microsoft-sql-server-tde-integration-advanced.md)
- [Deployment Options](/fortanix-data-security-manager-deployment-options.md)
- [Services to be Implemented](/dsm-services-to-be-implemented.md)