SupportConsoleDevelopersStart a trialContact

Chapter 1. Red Hat Edge Manager architecture

Red Hat Edge Manager uses an autonomous agent on each device to manage the operating system and workloads, ensuring reliable operation even with limited or intermittent connectivity.

Red Hat Edge Manager supports image-based operating systems. You can include the Red Hat Edge Manager agent and its settings in the image that you distribute to devices.

Image-based operating systems let the agent start a transactional update of the image and roll back to the previous version if an update fails.

Red Hat Edge Manager architecture has the following main features:

  • Agent: A lightweight process on the device that polls the service for updates, applies the desired state, and manages local workloads even during network outages.

  • Service: The central control plane that manages the device inventory and coordinates fleet-wide settings. To support these tasks, the service includes:

    • API server: Handles authenticated communication between the service, administrative tools, and enrolled devices.
    • HTTPS gateway (standalone Red Hat Enterprise Linux only): An nginx reverse proxy on port 443 that handles TLS and routes traffic to internal services by URL path. The gateway forwards agent API and telemetry ports with mutual TLS (mTLS) passthrough. See HTTPS gateway for standalone Red Hat Enterprise Linux deployments.
    • Database: The storage layer that holds the current device registry, enrollment data, and the target state for the fleet.
    • Image Builder (optional): Builds operating system images for devices from the control plane. On Red Hat OpenShift Container Platform, the Image Builder worker requires privileged access scoped to a dedicated ServiceAccount.
  • Image-based operating system: An immutable Linux distribution that uses bootc. This enables transactional, versioned updates that can be safely rolled back if an update fails.
  • Device: A hardware unit or virtual machine that runs the agent. It tracks local state, applies settings, and reports health metrics back to the service.
  • Device fleet: A logical grouping of devices managed as a single unit. Fleets let you roll out updates and policies to thousands of devices at once with detailed visibility.

1.1. Red Hat Edge Manager agent and service
Copy link

The Red Hat Edge Manager agent is a process running on each managed device that periodically communicates with the Red Hat Edge Manager service.

The Red Hat Edge Manager agent is responsible for the following tasks:

  • Enrolling its device into the service.
  • Checking with the service at regular intervals for changes in the device specification, such as updates to the operating system, settings, and applications.
  • Applying any updates independently from the service.
  • Enforcing workload user separation: applications run as root by default when runAs is not set. When set, runAs enables rootless (non-root) execution or privileged execution with elevated capabilities.
  • Validating that the required user exists on the device before starting rootless workloads.
  • Reporting status of the device and the applications.

The Red Hat Edge Manager service is the control plane that connects administrators and automation to the device fleet. It manages each device from enrollment through ongoing health and activity monitoring.

The service uses a database that stores the device inventory and the target device settings. The agent polls the service for changes in the settings. If the agent detects that the current settings differ from the target, it attempts to apply the changes to the device.

When the agent receives a new target configuration from the service, the agent does the following tasks:

  1. Stage resources: The agent pre-downloads all required assets to local storage, including the operating system image and application container images. This step guards against network failure during the update.
  2. Update operating system: The agent delegates the operating system update to bootc, ensuring a transactional image-based transition.
  3. Apply configuration: The agent updates the local file system by overlaying configuration files provided by the service.
  4. Finalize environment: If the update requires it, the agent triggers a system reboot. If no reboot is needed, it signals the relevant system services and applications to reload their settings.
  5. Update workloads: The agent syncs and updates applications that run on Podman or MicroShift. Podman-based applications (quadlet, container) run on Podman. Helm applications are deployed to MicroShift on the device.

If the update fails or the system does not come back online after a reboot, the agent rolls back to the previous operating system image and settings.

Note

You can store fleet definitions in a Git repository. The Red Hat Edge Manager service syncs Git-hosted definitions with the database at regular intervals so that changes you commit are applied to the fleet.

1.2. Red Hat Edge Manager API server
Copy link

The API server acts as the central communication hub, exposing secure endpoints that allow both users and agents to interact with the Red Hat Edge Manager service.

The API server exposes the following endpoints:

User-facing API endpoint

Users can connect to the user-facing API endpoint from the command-line interface (CLI) or the web console. Users must authenticate with the configured external authentication service to obtain a JSON Web Token (JWT) to make HTTPS requests.

On standalone Red Hat Enterprise Linux deployments, users reach the user-facing API through the HTTPS gateway on port 443 at path prefixes /_/flightctl/ and /api/v1/. The gateway also accepts flightctl login https://<baseDomain> without a path suffix. Port 3443 is not required for new installations; the gateway can continue to expose it after upgrade for clients that still target that port. For routing and TLS details, see HTTPS gateway for standalone Red Hat Enterprise Linux deployments.

Agent-facing API endpoint
Agents connect to the agent-facing endpoint, which is mutual TLS (mTLS)-protected. On standalone Red Hat Enterprise Linux, the gateway forwards TCP port 7443 to the agent listener without terminating TLS. The service authenticates devices by using X.509 client certificates.

The Red Hat Edge Manager service also communicates with various external systems to authenticate and authorize users, get mTLS certificates signed, or query configuration for managed devices.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top