Werk #20072: Agent updater registration now works with one-time tokens
| Component | Agent bakery | ||||
| Title | Agent updater registration now works with one-time tokens | ||||
| Date | Jul 3, 2026 | ||||
| Level | Prominent Change | ||||
| Class | New Feature | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
Previously, when registering the agent controller with a one-time agent registration token (cmk-agent-ctl register --ott ...), the automatic registration of the agent updater (werk #19273) was skipped with a warning, because the agent updater could only register with user credentials. This affected in particular the guided agent registration from the host configuration page, which uses a one-time token: if Automatic agent updates with an automatic Registration mode was configured, the agent updater was left unregistered.
The agent updater can now register with the same one-time token. No configuration change is needed: when the agent controller is registered with a token and updater registration is requested (via the bakery ruleset or the --automatic-updates flag), the controller passes the token on to the agent updater, which uses it to register at the deployment server.
For manual or scripted use, cmk-update-agent register (Windows: check_mk_agent.exe updater register) also accepts the token directly:
cmk-update-agent register -s <server> -i <site> -H <hostname> --ott <token>
Token lifetime
An agent registration token now covers two independent one-time uses: the host (controller) registration and the agent updater registration. Each use can only be consumed once, and the token is revoked as soon as both are consumed. After the first use, the token remains valid for at most 10 minutes, so the follow-up registration can complete; to register again later, issue a new token.
Note that the token authorizes the agent updater registration on its own: the permissions of the issuing user are checked when the token is created, not at registration time.