Enroll a Compute Node (bare metal) - AMD SEV-SNP

1.0 Introduction

This article describes how to enroll a compute node using bare metal on an Advanced Micro Devices (AMD) Secure Encrypted Virtualization (SEV) - Secure Nested Paging (SNP) platform in Fortanix Confidential Computing Manager (CCM).

2.0 Enroll a Compute Node (Bare Metal) - AMD SEV-SNP

2.1 Prerequisites

• Ensure Simultaneous Multithreading (SMT) is disabled in BIOS when using AMD SEV-SNP. If enabled, the Confidential Virtual Machine (CVM) launch may fail with fw_error=7 'Policy is not allowed' error.

2.1 Ubuntu 25.10 Node Agent

Download the Ubuntu Node Agent installer from here.

Perform the following steps to enroll the Ubuntu 25.10 compute node:

1. Extract the content of the Node-Agent-Installer.tar.gz package and open the folder.

   tar -zxvf Node-Agent-Installer.tar.gz
                   cd em-agent-snp-installer

2. Open the INSTALLER_README.md file containing the steps to enroll the compute node in Fortanix CCM.

   

   The INSTALLER_README.md has the steps to enroll a compute node in Fortanix CCM.

3. Run the installer.sh using the command:

   sudo bash installer.sh <join_token>

   NOTE

   • Where <join-token> is the token copied from Fortanix CCM. For more details, refer to Section 3.0: Generating Join Token.

4. Update ccm.fortanix.com to ccm.test.fortanix.com in /etc/em-agent/em-agent.conf.

5. Run the following command to restart the em-agent to ensure the new version is applied:

   sudo systemctl restart em-agent

3.0 Generating Join Token

Perform the following steps to generate a join token in Fortanix CCM:

1. Log in to https://ccm.fortanix.com.

2. Click the Infrastructure → Compute Nodes in the CCM UI left navigation bar and click + ADD NODE on the Compute Nodes page.  

3. In the ENROLL COMPUTE NODE window, a Join Token will be generated in the text box for "Generate Join Token". This Join Token is used by the compute node to authenticate itself.

   

4. Click COPY to copy the Join Token.

4.0 Validating the Enrolled Compute Node

After the compute node is enrolled in Fortanix CCM, you will see it under the Compute Nodes overview table.