Enrollment code

An enrollment code is a single-use token that enrolls one machine as a host you’ve already created in Managed Nebula. You run it on the machine with DNClient, for example sudo dnclient enroll -code XXXX, enter it in DNClient Desktop, or use it in Mobile Nebula through a QR code or enrollment link.

When a machine enrolls, DNClient generates the host’s key pair on the machine and sends Defined Networking only the public key. Defined Networking signs a Nebula certificate for the host and returns it with the host’s configuration. The private key never leaves the machine.

• Single use: a code is used up as soon as a machine tries to enroll with it, even if that enrollment fails.
• Expires after 24 hours: codes from the admin panel always last 24 hours. Through the API you can set a lifetime from 60 seconds to 7 days.
• A new code each time: each time you open a host’s setup screen you get a new code. Earlier codes keep working until they’re used or expire.
• Not for every host: a blocked host must be unblocked first, and hosts enrolled by an endpoint user through SSO can’t use codes at all.

In the admin panel, you get a code when you click Add host on the Hosts page and save. To get a new code for an existing host, for example to move it to a rebuilt machine, choose Enroll from the host’s More menu. Creating a code and enrolling with it are both recorded in the audit log.

An enrollment code enrolls one machine as one host you named ahead of time. To let any number of machines enroll with the same token, each as a new host, use a join key instead. See Managing hosts and enrollment codes for the full lifecycle, and Automating host creation for creating hosts and codes with an API key.