Join-token enrollment

This guide shows how to register an Airlock process with one or more services in a cluster by presenting a join token.

Prerequisites

• A Linux server for the Airlock process (a Linux-based virtual machine or container).
• This guide enrolls an SSH Service (node); the same approach applies to Kubernetes Service, Database Service, Proxy Service, and other services.
• airctl installed on the administrative machine with cluster access.

Step 1 of 3. Install Airlock

On the Linux host:

curl https://deckhouse.ru/downloads/airlock/install.sh | bash -s

Step 2 of 3. Enroll in the cluster

Generate a token

On the local machine with airctl:

airctl tokens add --ttl=5m --type=node

Example output:

The invite token: abc123...
This token will expire in 5 minutes.

Run this on the new node to join the cluster:

> airlock start \
   --roles=node \
   --token=abc123... \
   --ca-pin=sha256:... \
   --auth-server=192.0.2.0:3025

Supported token types

List active tokens:

airctl tokens ls

Start the process with the token

On the new agent host (replace JOIN_TOKEN and airlock.example.com):

sudo airlock configure \
  --roles=node \
  --token=JOIN_TOKEN \
  --proxy=airlock.example.com:443 \
  -o file

For SSH Service you can use airlock node configure without the --roles=node flag:

sudo airlock node configure \
  --output=file:///etc/airlock.yaml \
  --token=JOIN_TOKEN \
  --proxy=airlock.example.com:443

Start the service:

sudo systemctl enable airlock
sudo systemctl start airlock

Verify node registration:

airctl nodes ls

Direct connection to the Auth Service

If the Proxy Service is unreachable from the agent host, connect directly to the Auth Service only when no other option is available. Minimize inbound traffic to the Auth Service.

Get the CA pin:

airctl status

Configure the agent:

sudo airlock configure \
  --roles=node \
  --token=JOIN_TOKEN \
  --auth-server=airlock.example.com:3025 \
  -o file

Set the CA pin in /etc/airlock.yaml (field airlock.ca_pin):

sudo sed -i 's|  ca_pin: ""|  ca_pin: "sha256:..."|' /etc/airlock.yaml
sudo systemctl restart airlock

Step 3 of 3. Revoke the token

To prevent further use of the token:

airctl tokens rm TOKEN_TO_DELETE

Next steps

• SSH node — complete server access scenario
• Kubernetes agent — connecting a Kubernetes cluster