Skip to main content
Redhat Developers  Logo
  • Products

    Featured

    • Red Hat Enterprise Linux
      Red Hat Enterprise Linux Icon
    • Red Hat OpenShift AI
      Red Hat OpenShift AI
    • Red Hat Enterprise Linux AI
      Linux icon inside of a brain
    • Image mode for Red Hat Enterprise Linux
      RHEL image mode
    • Red Hat OpenShift
      Openshift icon
    • Red Hat Ansible Automation Platform
      Ansible icon
    • Red Hat Developer Hub
      Developer Hub
    • View All Red Hat Products
    • Linux

      • Red Hat Enterprise Linux
      • Image mode for Red Hat Enterprise Linux
      • Red Hat Universal Base Images (UBI)
    • Java runtimes & frameworks

      • JBoss Enterprise Application Platform
      • Red Hat build of OpenJDK
    • Kubernetes

      • Red Hat OpenShift
      • Microsoft Azure Red Hat OpenShift
      • Red Hat OpenShift Virtualization
      • Red Hat OpenShift Lightspeed
    • Integration & App Connectivity

      • Red Hat Build of Apache Camel
      • Red Hat Service Interconnect
      • Red Hat Connectivity Link
    • AI/ML

      • Red Hat OpenShift AI
      • Red Hat Enterprise Linux AI
    • Automation

      • Red Hat Ansible Automation Platform
      • Red Hat Ansible Lightspeed
    • Developer tools

      • Red Hat Trusted Software Supply Chain
      • Podman Desktop
      • Red Hat OpenShift Dev Spaces
    • Developer Sandbox

      Developer Sandbox
      Try Red Hat products and technologies without setup or configuration fees for 30 days with this shared Openshift and Kubernetes cluster.
    • Try at no cost
  • Technologies

    Featured

    • AI/ML
      AI/ML Icon
    • Linux
      Linux Icon
    • Kubernetes
      Cloud icon
    • Automation
      Automation Icon showing arrows moving in a circle around a gear
    • View All Technologies
    • Programming Languages & Frameworks

      • Java
      • Python
      • JavaScript
    • System Design & Architecture

      • Red Hat architecture and design patterns
      • Microservices
      • Event-Driven Architecture
      • Databases
    • Developer Productivity

      • Developer productivity
      • Developer Tools
      • GitOps
    • Secure Development & Architectures

      • Security
      • Secure coding
    • Platform Engineering

      • DevOps
      • DevSecOps
      • Ansible automation for applications and services
    • Automated Data Processing

      • AI/ML
      • Data Science
      • Apache Kafka on Kubernetes
      • View All Technologies
    • Start exploring in the Developer Sandbox for free

      sandbox graphic
      Try Red Hat's products and technologies without setup or configuration.
    • Try at no cost
  • Learn

    Featured

    • Kubernetes & Cloud Native
      Openshift icon
    • Linux
      Rhel icon
    • Automation
      Ansible cloud icon
    • Java
      Java icon
    • AI/ML
      AI/ML Icon
    • View All Learning Resources

    E-Books

    • GitOps Cookbook
    • Podman in Action
    • Kubernetes Operators
    • The Path to GitOps
    • View All E-books

    Cheat Sheets

    • Linux Commands
    • Bash Commands
    • Git
    • systemd Commands
    • View All Cheat Sheets

    Documentation

    • API Catalog
    • Product Documentation
    • Legacy Documentation
    • Red Hat Learning

      Learning image
      Boost your technical skills to expert-level with the help of interactive lessons offered by various Red Hat Learning programs.
    • Explore Red Hat Learning
  • Developer Sandbox

    Developer Sandbox

    • Access Red Hat’s products and technologies without setup or configuration, and start developing quicker than ever before with our new, no-cost sandbox environments.
    • Explore Developer Sandbox

    Featured Developer Sandbox activities

    • Get started with your Developer Sandbox
    • OpenShift virtualization and application modernization using the Developer Sandbox
    • Explore all Developer Sandbox activities

    Ready to start developing apps?

    • Try at no cost
  • Blog
  • Events
  • Videos

Automate edge device onboarding with Ansible FDO collection

July 10, 2023
Vitaliy Emporopulo
Related topics:
Automation and managementEdge computing
Related products:
Red Hat Ansible Automation Platform for EdgeRed Hat Ansible Automation PlatformRed Hat Enterprise Linux for Edge

Share:

    Onboarding devices at the edge differs from doing so in a data center and presents some unique challenges. Among other requirements, the device onboarding process must:

    • Be secure and reduce the risk of a malicious party tempering with a device or a rogue device being connected to the system.
    • Minimize manual intervention in order to make the process cheaper, faster, more scalable, and more secure. A zero-touch or low-touch approach also allows personnel without specialized skills to onboard devices.

    The FIDO Device Onboard (FDO) specification addresses both of these requirements. Red Hat Enterprise Linux (RHEL) offers FDO packages starting with version 8.6, based on the Fedora IoT implementation of FDO. You can follow How to onboard edge devices at scale with FDO and Linux to set up an FDO environment manually.

    However, as with any manual procedure, it is error prone and not scalable. This article, on the other hand, introduces the Ansible Community FDO collection, which allows you to automate setting up FDO servers and device onboarding with ease.

    The flow

    We will be using virtual machines (VMs) to simulate a typical FDO flow (Figure 1), but as far as FDO goes, the sequence and technology is no different from onboarding a physical device. 

    This diagram shows the FIDO Device Onboard (FDO) components and relationships between them.
    Figure 1: FDO flow overview.

    Note: Ideally, you will need two networks to isolate the device manufacturer from the device owner, as will be the case in a real-life scenario. You will also need enough disk and compute power to run multiple VMs. Although it is possible to host all of the FDO servers on a single VM, separating them can help you better understand their roles and responsibilities.

    Let us outline the steps and then show each step's commands and Ansible code:

    1. Deploy an FDO manufacturing server.
    2. Deploy an OSBuild server.
    3. Build an FDO-enabled installer image.
    4. Boot and initialize a device.
    5. Deploy an FDO rendezvous server.
    6. Deploy an FDO owner server.
    7. Move the device from the manufacturer to the owner.
    8. Transfer the device's ownership voucher from the manufacturer to the owner.
    9. Boot the device and watch it being automatically onboarded.

    Keys and certificates

    But first, you will need a set of cryptographic keys and CA certificates. FDO uses a set of certificates and private keys to sign and verify documents exchanged between the parties to establish mutual trust. You can easily generate FDO key-certificate pairs using an Ansible role. You can either run it locally or delegate generating the certificates to a remote host if it is not possible to install FDO packages on your local system.

    Specify a destination directory from where the keys and certificates can be easily transferred to the respective FDO servers:

    ---
    - name: Generate FDO keys and certificates
      hosts: localhost
      become: true
      gather_facts: true
    
      tasks:
        - name: Generate FDO keys and certificates on localhost
          ansible.builtin.import_role:
            name: community.fdo.generate_keys_and_certificates
          vars:
            generated_certs_dir: "{{ playbook_dir }}/keys/"
    

    Here, we will create all the required cryptographic files in a single command for the sake of simplicity. In reality, though,:

    • The owner will share their certificate with the manufacturer while keeping the private key to themselves.
    • The manufacturer will share their manufacturer certificate with the rendezvous server and the device CA certificate with the owner.

    Types of the key-certificate pairs that will be generated, depending on the role (owner or manufacturer), can be controlled via the generate_certificate_types variable.

    generate_certificate_types:
      - manufacturer
      - device-ca
      - diun

    or

    generate_certificate_types:
      - owner

    Manufacturing server

    Next, deploy and configure an FDO manufacturing server on a RHEL host in the manufacturing network. The server will be used to initialize devices.

    Note: As already mentioned, we are using the Ansible Community FDO collection for setting up FDO servers. Although the collection is functional, it is still in development and breaking changes are possible.

    - name: Deploy the manufacturing server
      hosts: manufacturing_server
      become: true
      gather_facts: true
    
      tasks:
        - name: Set up the manufacturing server
          ansible.builtin.import_role:
             name:  community.fdo.setup_manufacturing_server
          vars:
            manufacturing_server_generate_keys_and_certificates: false

    This will prepare the manufacturing server software for running—install the required packages, open firewall ports, create directories, etc.

    Next, copy all required keys and certificates to the manufacturing host:

        - name: Copy manufacturing server certificates
          ansible.builtin.import_role:
            name:  community.fdo.copy_manufacturing_server_certs_to_manufacturing_server
          vars:
            localhost_manufacturing_server_certs_dir: "{{ playbook_dir }}/keys"

    Finally, generate configuration files and start the server:

        - name: Configure the manufacturing server
          ansible.builtin.include_role:
            name:  community.fdo.configure_manufacturing_server
          vars:
            manufacturing_server_rendezvous_info_ip_address: "{{ rendezvous_server_ip_address }}" 

    Device initialization

    Now it is time to initialize a device against the manufacturing server.

    In order to do that, install an FDO-enabled operating system on the device. During the installation, a special client will automatically contact the manufacturing server and initialize the device. As mentioned, RHEL already includes an FDO initialization client by default, so we will use an RHEL for Edge Simplified Installer as an .iso image.

    There are multiple ways to tell the FDO client where to find the manufacturing server (e.g., via kickstart). Still, as you will likely customize the OS image anyway, we will include the required FDO configuration while building that image.

    You can build an image using osbuild manually, or better yet, use the specialized Ansible collection for that. In order to do that, create an image builder VM in the manufacturing network, or use the same host that runs the FDO manufacturing server.

    ---
    - name: Generate an FDO-enabled RHEL for Edge simplified installer
      hosts: image_builder
      become: true
      gather_facts: true
    
      tasks:
        - name: Set up osbuild server
          ansible.builtin.import_role:
            name: infra.osbuild.setup_server
    
        - name: Build FDO-enabled simplified installer image
          ansible.builtin.include_role:
            name: infra.osbuild.builder
          vars:
            builder_compose_type: edge-simplified-installer
            builder_blueprint_name: fdo-demo
            builder_compose_customizations:
              installation_device: /dev/vda
              fdo:
                manufacturing_server_url: "http://{{ manufacturing_server_host }}:8080"
                diun_pub_key_insecure: true
            builder_compose_pkgs: []

    As we will use the demo image with a VM, the installation device is /dev/vda. Refer to the documentation for applying additional customizations. 

    Note: Keep in mind that building an installer image might take a while.

    When finished, the installer image (fdo-demo_edge-simplified-installer.iso in our case) can be found at {{ builder_image_path }} on the image builder host, and used to boot a VM, e.g., on KVM:

    sudo virt-install \
      --boot uefi --network <fdo-manufacturing-net> \
      --name fdo-device --memory 2048 --vcpus 2 \
      --disk size=20,path=fdo-demo-device.qcow2 \
      --os-variant rhel9.2 \
      --tpm backend.type=emulator,backend.version=2.0,model=tpm-tis \
      --cdrom fdo-demo_edge-simplified-installer.iso

    Let the RHEL installer do its job and shut down the VM. It is ready to be "shipped."

    Rendezvous server

    A rendezvous server is a mediator between a device and its owner—it serves as a meeting point and performs primary verification of the device, checking its manufacturer's CA. The location of the rendezvous server is embedded by a manufacturing server (see above) in a credentials file on the device and in an ownership voucher intended for the owner onboarding server. We deploy the rendezvous server to a host in the owner network. You should now be familiar with the steps, as they follow the manufacturing server pattern.

    - name: Deploy the rendezvous server
      hosts: rendezvous_server
      become: true
      gather_facts: true
    
      tasks:
        - name: Set up the rendezvous sever
          ansible.builtin.import_role:
            name: community.fdo.setup_rendezvous_server
          vars:
            copy_manufacturer_certs: false
    
        - name: Copy rendezvous server certificates
          ansible.builtin.import_role:
            name: community.fdo.copy_manufacturing_server_certs_to_rendezvous_server
          vars:
            localhost_manufacturing_server_certs_dir: "{{ playbook_dir }}/keys"
    
        - name: Configure the rendezvous server
          ansible.builtin.import_role:
            - name: community.fdo.configure_rendezvous_server
          vars:
            update_cert: false

    Owner server

    Finally, we will deploy the owner server that will claim ownership of the device, create a secure communication channel with it (or rather with its FDO onboarding client), and use the channel to send custom onboarding steps to the device:

    - name: Deploy the owner server
      hosts: owner_server
      become: true
      gather_facts: true
    
      tasks:
        - name: Set up the owner server
          ansible.builtin.import_role:
            name: community.fdo.setup_owner_server
          vars:
            copy_manufacturer_certs: false
    
        - name: Copy manufacturing certificates to the owner server
          ansible.builtin.import_role:
            name: community.fdo.copy_manufacturing_server_certs_to_owner_server
          vars:
            localhost_manufacturing_server_certs_dir: "{{ playbook_dir }}/keys"
    
        - name: Configure the owner server
          ansible.builtin.import_role:
            name: community.fdo.configure_owner_server
          vars:
            update_keys_certs: false
            owner_onboarding_server_owner_addresses_ip_address: "{{ owner_server_ip_address }}"
            serviceinfo_api_server_config: |-
              initial_user:
                username: admin
                password: "{{ fdo_admin_password }}"
                sshkeys:
                - "{{ fdo_admin_ssh_key }}"
              commands:
              - command: touch
                args:
                - /var/tmp/fdo-onboard-success
                return_stdout: true
                return_stderr: true
              diskencryption_clevis:
              - disk_label: /dev/vda4
                binding:
                  pin: tpm2
                  config: "{}"
                reencrypt: true
              additional_serviceinfo: ~

    Here, the onboarding will create an initial admin user with SSH access, run the touch command and re-encrypt the disk with the label /dev/vda4. However, serviceinfo_api_server_config is fully customizable. Refer to the FDO implementation documentation for a full list of supported onboarding directives.

    Device onboarding

    Finally, everything is (almost) ready for device onboarding. "Ship" the device from the manufacturer to the owner by detaching the device VM from the manufacturing network and attaching it to the owner network.

    Then, transfer the device's ownership voucher from the manufacturing server to the owner server and boot the VM. It does not matter which you do first. An Ansible role will help you copy the ownership vouchers between the servers via localhost (the Ansible controller):

    ---
    - name: Fetch Ownership Vouchers from Manufacturer server to localhost
      hosts: manufacturing_server
      become: true
      gather_facts: true
      tasks:
        - ansible.builtin.import_role:
            name: community.fdo.fetch_ownership_vouchers_to_localhost
    
    - name: Copy Ownership Vouchers from localhost to Owner server
      hosts: owner_server
      become: true
      gather_facts: true
      tasks:
        - ansible.builtin.import_role:
            name: community.fdo.copy_ownership_vouchers_from_localhost

    Note: In reality, you will probably use a different mechanism for transferring ownership vouchers from the manufacturer to an owner.

    Conclusion

    In this article, we have shown the most basic but common usage of the Ansible Community FDO Collection. However, the collection's roles allow for a great deal of flexibility and customization. We encourage you to take a closer look at the collection and the FDO specification and discover how to use them to meet your edge onboarding needs. For instance, FDO supports transfer of ownership so that you do not need to know the final owner of a device in advance and can bind it to a distributor instead.

    Try it yourself!

    Whether you are beginning your automation journey or are a seasoned veteran, there are a variety of resources to enhance your automation knowledge:

    • Explore resources at Using Red Hat Ansible Automation Platform for edge computing.
    • Trial subscription: Are you ready to install on-premises? Get your own trial subscription for unlimited access to all the components of Red Hat Ansible Automation Platform.
    • The full playbooks of this demo can be found at https://github.com/empovit/fido-device-onboard-demo/tree/official-collections. 
    • The FDO collection lives at https://github.com/ansible-collections/community.fdo, where you might find the examples page especially useful.
    Last updated: November 28, 2023

    Related Posts

    • How to build RHEL images for edge deployments

    • Edge computing: From 30 tons to 30 grams

    • 5 things developers should know about edge computing

    • Bring your Kubernetes workloads to the edge

    • Connect IoT devices with Drogue IoT and OpenShift Streams for Apache Kafka

    Recent Posts

    • Alternatives to creating bootc images from scratch

    • How to update OpenStack Services on OpenShift

    • How to integrate vLLM inference into your macOS and iOS apps

    • How Insights events enhance system life cycle management

    • Meet the Red Hat Node.js team at PowerUP 2025

    What’s up next?

    Automation at the edge

    Discover how automation at the edge can help your organization improve scalability, security, agility, and overall efficiency. This e-book describes seven use cases and examples demonstrating automation at the edge of the network.

    Get the e-book
    Red Hat Developers logo LinkedIn YouTube Twitter Facebook

    Products

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform

    Build

    • Developer Sandbox
    • Developer Tools
    • Interactive Tutorials
    • API Catalog

    Quicklinks

    • Learning Resources
    • E-books
    • Cheat Sheets
    • Blog
    • Events
    • Newsletter

    Communicate

    • About us
    • Contact sales
    • Find a partner
    • Report a website issue
    • Site Status Dashboard
    • Report a security problem

    RED HAT DEVELOPER

    Build here. Go anywhere.

    We serve the builders. The problem solvers who create careers with code.

    Join us if you’re a developer, software engineer, web designer, front-end designer, UX designer, computer scientist, architect, tester, product manager, project manager or team lead.

    Sign me up

    Red Hat legal and privacy links

    • About Red Hat
    • Jobs
    • Events
    • Locations
    • Contact Red Hat
    • Red Hat Blog
    • Inclusion at Red Hat
    • Cool Stuff Store
    • Red Hat Summit

    Red Hat legal and privacy links

    • Privacy statement
    • Terms of use
    • All policies and guidelines
    • Digital accessibility

    Report a website issue