Werk #19273: Register agent controller and agent updater in one command
| Component | Agent bakery | ||||
| Title | Register agent controller and agent updater in one command | ||||
| Date | Feb 11, 2026 | ||||
| Level | Prominent Change | ||||
| Class | New Feature | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
You can now register both the agent controller and the agent updater with a single command using the new --automatic-updates option:
cmk-agent-ctl register --automatic-updates -s <server> -i <site> -H <hostname> -U <user>
Previously, users had to run cmk-agent-ctl register and cmk-update-agent register separately with mostly the same arguments. This was a common source of confusion, especially for new Checkmk users.
What's included
Unified CLI registration
When --automatic-updates is specified, the agent controller performs its own registration first, then automatically triggers the agent updater registration.
Note: Automatic agent updates are still a separate feature that needs to be activated on the server side. To enable the agent controller to do the agent updater registration, you must ship the agent updater plugin by activating the Automatic agent updates bakery ruleset.
Auto-registration via agent bakery
The Agent Controller auto-registration bakery ruleset - available starting with Checkmk Ultimate - has a new option Register for automatic agent updates. When enabled, auto-registered agents will also register for updates automatically. New rules have this enabled by default; existing rules are migrated with this option disabled.
Agent registration role
The builtin "Agent registration" user role is now authorized to also register for agent updates, so least-privilege setups work with the unified registration without additional configuration. If you need permissions on a finer granularity, or don't want to use the unified registration feature with a single user, please create a separate user role with a subset of the agent controller/agent updater registration permissions.
Further details
Agent updater still acting independently
The agent updater (cmk-update-agent) is still the owner of the agent updater registration. To do the agent updater registration, cmk-agent-ctl calls cmk-update-agent as a subprocess and passes all relevant arguments. The password is passed securely via a temporary file — it never appears in process arguments.
Agent updater running under agent controller user
As a consquence, cmk-update-agent then runs under the Agent Controller User. We have devoted a separate Werk to this topic. See Werk #19274 for details.
Agent updater resources
The agent updater resources - configuration, state, and log, still apply. This means that the values configured in the Automatic agent updates bakery ruleset are still active. Arguments passed by the agent controller take precedence over configured values. Configured HTTPS certificates are still active and considered.
Protocol auto-detection
The -p (protocol) argument for cmk-update-agent is now optional. If omitted, the agent updater tries https first and falls back to http. This also means the unified registration command doesn't need to guess the protocol.
Error handling
If the agent updater is not installed or you're connecting to a Checkmk Community Edition server, the registration completes successfully for the agent controller and logs a note about the skipped updater registration. Same goes for a failed agent updater registration, while the latter can also be traced in the cmk-update-agent.log.