Chapter 4. Device enrollment

The agent starts enrollment by connecting to the Red Hat Edge Manager service at the enrollment endpoint defined in the configuration file.

After establishing a secure, mutual TLS (mTLS)-protected network connection with the service, the agent submits an enrollment request to the service.

The request includes a description of the device hardware and operating system, an X.509 certificate signing request, the cryptographic identity of the device, and agent-proposed labels.

An authorized user must approve the enrollment request. After approval, the Red Hat Edge Manager service trusts and manages the device.

Devices get their enrollment endpoint and certificate in one of two ways: early binding (baked into the operating system image) or late binding (set at provisioning time).

Early binding: You can build an operating system image that includes the enrollment endpoint and certificate. Devices that use an early binding image can connect to the defined Red Hat Edge Manager service to request enrollment without any additional provisioning configuration.

The devices share the same long-lived X.509 client certificate. However, this binds the devices to a specific service and owner.

Late binding: You can set the enrollment endpoint and certificate at provisioning time instead of including them in the operating system image. Devices that use a late binding image are not tied to a single owner or service and can have per-device, short-lived X.509 client certificates.

However, late binding requires tools that can request per-device enrollment endpoints and certificates from the Red Hat Edge Manager service. The tools inject them into the system by using cloud-init, Ignition, or kickstart.