Enroll a Compute Node (bare metal)

1.0 Introduction

This article describes how to enroll a compute node on a bare-metal Intel TDX platform in Fortanix Confidential Computing Manager (CCM).

Ensure that you have completed all required CPU, GPU, and system configuration prerequisites as outlined in the NVIDIA Deployment Guide for Confidential Computing. In particular, complete the following sections before enrolling the compute node:
- Hardware IT Administrator → Selecting Hardware to verify that the platform hardware is supported.
- Hardware IT Administrator → Setting Up the Hardware and Configuring Your System to configure the BIOS settings for Intel TDX and Confidential Computing.
- Host OS Administrator → Setting Up the Host OS to install and configure the Intel TDX host software, including the required repositories, packages, and kernel.
- Host OS Administrator → Preparing the Host to validate that the host is correctly configured for Intel TDX before deploying Confidential Computing workloads.
Check the Secure AI Compatibility Matrix to view the supported combinations of NVIDIA GPUs, VBIOS versions, CUDA driver versions, and Confidential Computing modes.
Ensure Simultaneous Multithreading (SMT) is disabled in the BIOS when using Intel TDX. If enabled, the Confidential Virtual Machine (CVM) launch may fail with fw_error=7 'Policy is not allowed' error.

Download the Ubuntu Node Agent installer from here.

Perform the following steps to enroll the Ubuntu 26.04 compute node:

Run the following commands to extract the contents of the TDX-Node-Agent-installer.tar.gz package and open the folder:
```
tar -zxvf TDX-Node-Agent-Installer.tar.gz
cd em-agent-installer-tdx
```
Open the INSTALLER_README.md file containing the steps to enroll the compute node in Fortanix CCM.
Figure 1: Readme.txt
Run the following command to execute the installer.sh script:
```
sudo bash installer.sh <join-token>
```
Where, <join-token> is the token copied from Fortanix CCM. For more information, refer to Section 3.0: Generate a Join Token.
NOTE
For existing Fortanix CCM SaaS users, run the following commands to install the latest CCM node agent and update the ccm.fortanix.com endpoint to api.armor.fortanix.com:
```
sudo apt update
sudo apt upgrade em-agent
```

Perform the following steps to generate a join token in Fortanix CCM:

Log in to Fortanix Armor Platform. For more information, refer to Access and Set Up Fortanix Armor.
Navigate to the Fortanix CCM user interface (UI). For more information, refer to Fortanix Armor Solutions.
In the CCM UI left navigation panel, click Infrastructure → COMPUTE NODES → Intel TDX, and then click ADD NODE.
Figure 2: Add node
In the Enroll Compute Node window, click COPY to copy the Join Token. This Join Token is used by the compute node to authenticate itself.

After the compute node is successfully enrolled, it appears in the COMPUTE NODES overview table in Fortanix CCM.

Perform the following steps to debug the em-agent service:

Run the following command to view the logs:
```
journalctl -xe | grep em-agent
```
Run the following command to view the status of the em-agent service or check the system logs directly:
```
systemctl status em-agent
```