Enroll a Compute Node (bare metal)

1.0 Introduction

This document describes how to enroll a compute node on a bare-metal Intel TDX platform in Fortanix Confidential Computing Manager (CCM).

Ensure Simultaneous Multithreading (SMT) is disabled in BIOS when using Intel TDX. If enabled, the Confidential Virtual Machine (CVM) launch may fail with fw_error=7 'Policy is not allowed' error.
Ensure that you have completed all required CPU, GPU, and system configuration prerequisites as outlined in the NVIDIA Confidential Computing Deployment Guide (TDX), including enabling TEE support (Intel TDX / AMD SEV-SNP), configuring BIOS settings, and using supported NVIDIA GPUs.

Download the Ubuntu Node Agent installer from here.

Perform the following steps to enroll the Ubuntu 25.10 compute node:

Extract the content of the Node-Agent-installer.tar.gz package and open the folder:
```
tar -zxvf Node-Agent-Installer.tar.gz 
cd em-agent-installer-tdx 
```
Open the INSTALLER_README.md file containing the steps to enroll the compute node in Fortanix CCM.
Figure 1: Readme.txt
The INSTALLER_README.md has the steps to enroll a compute node in Fortanix CCM.
Run the installer.sh using the command:
```
sudo bash installer.sh <join-token>
```
Where, <join-token> is the token copied from Fortanix CCM. For more information, refer to Section 3.0: Generate a Join Token.

Perform the following steps to generate a join token in Fortanix CCM:

Log in to https://ccm.fortanix.com/.
Click the Infrastructure → Compute Nodes in the CCM UI left navigation bar and click + ADD NODE on the Compute Nodes page.
In the ENROLL COMPUTE NODE window, a Join Token will be generated in the text box for "Generate Join Token". This Join Token is used by the compute node to authenticate itself.
Figure 2: Copy Join Token
Click COPY to copy the Join Token.

After the compute node is enrolled in Fortanix CCM, you will see it under the Compute Nodes overview table.

Debug:

To view the logs, run the following command:
```
journalctl -xe | grep em-agent
```
To view the status, run the following command or directly check the syslog:
```
systemctl status em-agent
```