User's Guide: Enroll a Compute Node Using Azure Marketplace

1.0 Enroll Compute Node Using Azure Marketplace

  1. First, generate a Join Token using Fortanix CCM UI. To generate your Join Token, log in to https://ccm.fortanix.com.

  2. Navigate to the InfrastructureCompute Nodes menu item in the CCM UI left navigation bar and click the + ENROLL NODE on the Compute Nodes page. 

    compute-nodes-AzureMarketplace.png

    Figure 1: Enroll Compute Node

  3. Click COPY to copy the Join Token. This Join Token is used by the compute node to authenticate itself.  

    NitroJoinToken.png

    Figure 2: Copy Join Token

  4. Visit https://azuremarketplace.microsoft.com/en-us/marketplace/apps/fortanix.rte_node_agent to create the Node Agent VM to register the compute node.

    NOTE

    Alternatively, you can also download the latest node agent software from fortanix-node-agent-software-intel-sgx-platform and install it on your own machine.

  5. Click the GET IT NOW button on the “Fortanix Confidential Computing Node Agent” page.

    azure_1.png

    Figure 3: Get the Node Agent

  6. Click Continue in the Node Agent wizard.  

    azure_2.png

    Figure 4: Confirm Creating App in Azure

  7. In the Node Agent preview page, click Create.  

    azure_3.png

    Figure 5: Proceed to Create a Node Agent

  8. In the Create Fortanix Confidential Computing Node Agent form (Figure 6), fill in all the necessary details.

    1. Information about the available regions can be found here.

    2. Information about the supported VMs can be found here.

    3. In the Join Token field, paste the join token that you generated using the Fortanix CCM UI.

    4. It is strongly recommended to use DCAP attestation as the Attestation Protocol while installing the node agent on azure VM.

  9. Click the Review + create button to validate the node agent details.  

    Createnodeagent.png

    Createnodeagent1.png

    Createnodeagent3.png

    Figure 6: Validate Node Agent

  10. Wait for the validation to pass.

  11. After the validation is successful, click Create to create the node agent.  

    Createnodeagent4.png

    Figure 7: Create Node Agent

    CCM_54.png

    Figure 8: Node Agent Created

  12. After the node agent is created, the compute node will be enrolled in the Fortanix CCM, you will see it under the Compute Nodes overview table.  

    ENROLLED NODE.png

    Figure 9: Enrolled Node

    NOTE

    To know the attestation type of the node, hover on the certificate icon. The attestation type is either "DCAP" or "EPID"

  13. Add Labels: To control which applications are allowed to run on which nodes, we add Labels for applications and nodes in the form of “Key:Value” pairs. Refer to Application and Compute Node Policy Enforcement for more details.

    1. Suggested Labels – This field will show the top 10 labels that are frequently used by users of an account.

    2. Add Labels – Enter the Key and Value pair and click the LABEL button to save the label. The newly created label will appear in the Labels Added field. A user can also choose an existing label from the Suggested Labels field.

      NOTE

      • A label's key and value can have a maximum of 256 characters and is case-sensitive.

      • Some keys are reserved for internal use which are called system-defined labels.

        • Such as: 'Fortanix', 'fortanix', ‘CCM’, ‘ccm’, confidentialcomputingmanager. Or

        • {Fortanix|Fortanix|CCM|ccm|confidentialcomputingmanager|  Confidentialcomputingmanager}. <Any_Non-Alphanumeric-Char><Any-Char>.

    3. If we are adding labels for an application then it is mandatory to add the same labels on the node on which the application will run.

    4. A node can have different labels that belong to multiple applications. For example:
      App1’s label => Location1: Value1
      App2’s label => Location2: Value2
      Then the Node can have labels => Location1: Value1 , Location2: Value2.

      NODE LABEL.png

      Figure 10: Node Label