1.0 Introduction
Fortanix Confidential Computing Manager (CCM) SaaS has been migrated to Fortanix Armor. Existing Fortanix CCM SaaS customers must update their clients, agents, and integrations that communicate with CCM to use the new Armor endpoints.
2.0 Before you Begin
Review the following before starting the migration:
Ensure that you have access to the systems running Fortanix CCM attestation clients or node agents.
Identify any scripts, applications, automation, or integrations that communicate with CCM using
ccm.fortanix.com.Review any customer-managed configuration that contains the CCM endpoint.
Ensure that you can install or upgrade the latest versions of the Fortanix CCM node agents and attestation clients released with CCM 5.0 release.
NOTE
Any CLI commands, scripts, applications, or other software that you have created and that calls the CCM API through
ccm.fortanix.commust be updated to use the corresponding Armor API endpoint.For example, CCM API requests that previously used:
https://ccm.fortanix.com/v1/...must use the corresponding Armor API path:
https://armor.fortanix.com/api/v1/...
The API path can also change as part of the migration. For example, the authentication API changes from /v1/sys/auth to /api/v1/iam/session/auth, while confidential computing APIs use the /api/v1/confidential_computing/ path.
3.0 Migrate Existing CCM Node Agent
For existing Fortanix CCM SaaS users, install the latest CCM node agent to update the ccm.fortanix.com endpoint to api.armor.fortanix.com.
For SGX, AMD SEV-SNP, and Intel TDX nodes, run the following commands:
sudo apt update
sudo apt upgrade em-agentFor AWS Nitro nodes, run the following commands:
sudo yum update
sudo yum upgrade em-agent-nitroFor Nitro nodes, after upgrading the node agent, update the EM_HOST_NAME setting in the /etc/em-agent-nitro/em-agent-nitro.conf file from api.armor.fortanix.com to api.eu.armor.fortanix.com, and then restart the em-agent-nitro service:
sudo systemctl restart em-agent-nitroFor detailed node enrollment instructions, refer to the Fortanix Node Agent Software and the applicable compute-node enrollment guides.
4.0 Migrate the Fortanix Attestation Client
If you use the Fortanix Attestation Client with an Azure CVM, update the manager endpoint to the Armor endpoint before requesting a new application certificate.
4.1 Azure CVM Linux
For existing Fortanix CCM SaaS users, update the MANAGER_ENDPOINT environment variable to the following Armor endpoint and rerun the Fortanix Attestation Client to obtain a new certificate:
export MANAGER_ENDPOINT=https://api.armor.fortanix.com4.2 Azure CVM Windows
For existing Fortanix CCM SaaS users, update the MANAGER_ENDPOINT environment variable to the following Armor endpoint and rerun the Fortanix Attestation Client:
export MANAGER_ENDPOINT=http://api.eu.armor.fortanix.comRun the attestation client again to obtain a new certificate.
NOTE
Existing application certificates remain valid after the migration. You do not need to reissue certificates solely because of the migration.
For detailed instructions, refer to the applicable Azure CVM attestation guide.
5.0 Update Customer-managed Scripts and API Integrations
If you use curl, scripts, or automation to call the CCM API, update the endpoint and API path to the corresponding Armor API endpoint.
For example:
Old:
https://ccm.fortanix.com/v1/apps
New:
https://armor.fortanix.com/api/v1/confidential_computing/apps
Similarly, authentication and session APIs use the Armor IAM API paths.
Review the relevant CCM documentation for updated CLI commands and API examples.
6.0 Update Deployment Configurations - AKS
If your Azure Kubernetes Service (AKS) deployment configuration contains MANAGER_ENDPOINT, update it from the CCM endpoint to the Armor endpoint.
For example:
Old:
MANAGER_ENDPOINT=ccm.fortanix.com:443
New:
MANAGER_ENDPOINT=api.armor.fortanix.com:443
The same update may be required in launch hints, deployment templates, scripts, or other customer-managed configuration.
NOTE
For existing ACI deployments, updating the
MANAGER_ENDPOINTin the launch hint has no impact. You must reconvert the image and deploy it again.
7.0 Verify the Migration
After updating the applicable clients and agents, verify that:
Node agents can successfully enroll with the Armor environment.
Applications can be run successfully.
Existing workflows continue to execute successfully.
New applications and workflows use the Armor endpoint.
Customer-managed scripts and API integrations no longer depend on the old CCM SaaS endpoint.