Concept
Zero-Touch Tenant Onboarding
A single request provisions and configures a provider-owned tenant appliance, with durable steps and auto-enrollment that fails closed to manual review.
Overview
Zero-touch onboarding is an optional automation layer for CSP provider-owned appliances. For those appliances a single request provisions and configures a tenant Sendense Hub Appliance (SHA) almost end to end.
The manual path is unchanged
For customer-administered appliances the manual enroll-and-consent path remains the only path. Zero-touch onboarding adds automation for provider-owned appliances; it does not replace or change the manual path.
Onboarding Flow
A single API request drives a durable, resumable sequence that carries a provider-owned appliance almost end to end. The run provisions or attaches the appliance, brings up its tunnel and enrolls it, creates a site, adds source (CloudStack) credentials, provisions a source agent, and runs a discovery.
The run is resumable and can be cancelled or retried. Each step is idempotent, so a resumed run continues from where it stopped rather than repeating completed work.
The onboarding run, driven by a single API request
Appliance
Provision Or Attach
The run provisions a new provider-owned appliance, or attaches one that is already enrolled.
Connectivity
Tunnel And Enroll
The appliance brings up its secure tunnel and enrolls so the run can continue.
Topology
Create Site
The run creates the site that groups the tenant's protected estate.
CloudStack
Add Source Credentials
The run adds the tenant's source (CloudStack) credentials to the appliance.
Source estate
Provision Source Agent
The run provisions a source agent into the tenant's source estate, enrolled to the tenant's own appliance.
Inventory
Run Discovery
The run triggers a discovery so the tenant's protected inventory is populated.
Wizard covers attach-mode configuration
A GUI onboarding wizard drives attach-mode configuration on an already-enrolled appliance — creating a site, adding sources, and running a discovery — while provisioning a new appliance and provisioning a source agent are driven through the single API request.
Auto-Enrollment
Provider-owned appliances self-enroll and are approved automatically, so onboarding scales to a large tenant fleet without an operator approving each appliance by hand.
Fails closed to manual review
Auto-enrollment uses cryptographic device identity plus a provider-verified network binding, and fails closed to manual review.
Minimal Networks
The enrollment payload is delivered on a seed CD-ROM, so provisioning works on flat L2 or bring-your-own-gateway networks with no virtual router or DHCP metadata service.
The enrollment endpoint is operator-overridable for published or NAT addresses. An unreachable configuration fails closed rather than silently breaking.
Source-Agent Provisioning
A source agent, an SNA (Sendense Node Appliance), is auto-provisioned into the tenant's source estate and enrolled to the tenant's own appliance rather than to any provider-shared appliance.
The appliance is deployed into the tenant's own cloud account, with account-scoped networks, templates, offerings, and quotas.
What It Is Not
- Onboarding is not required for customer-administered appliances; the manual enroll-and-consent path remains for those appliances.
- Onboarding moves no backup data; it provisions and configures the appliance and its inventory, and backup data movement is a separate function.
- Teardown of a failed or never-enrolled provisioned VM is manual; onboarding does not automatically tear it down.
Related Docs