Configure Edge View (Advanced Method)

​

Introduction

​

Prerequisites

• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
• Docker installed on your laptop. On Windows, Docker Desktop or WSL v2 is required.
• ZCLI installed and authenticated. See Get Started With ZCLI for setup instructions.
• A project with an Edge View policy assigned to the target node.

​

Set Up the Edge View Policy

​

Generate SSH Keys

1. Open a terminal and run ssh-keygen to generate a key pair.
2. Navigate to your .ssh directory. The public key has .pub in the filename. The private key has no extension.

​

Enable SSH on the Node

zcli edge-node update EDGE_NODE_NAME --config=debug.enable.ssh:"YOUR_PUBLIC_KEY"

​

Activate the Session

1. In the Edge Infrastructure Services console sidebar, click Infrastructure > Fleet > Nodes.
2. Click the name of the target node.
3. On the node details page, click the Remote Console button in the hero bar.
4. In the Remote Access notice dialog, click Continue to activate the Edge View session. Wait 30 to 60 seconds for the session status to show as activated.
5. Click the Download Script icon (shown near the Remote Console button when the session is active). The script is saved to your Downloads folder with a name similar to the following.
   run.first_edge_node.1734146779.edgeview.sh
   
   Alternative — download via ZCLI: If you prefer a command-line workflow, start your ZCLI session with a local directory mounted, then enable Edge View on the node. ZCLI automatically copies the script into the mounted directory.
   docker run -it zededa/zcli:latest
   

​

Run the Edge View Script

1. Open a terminal and navigate to the directory where the script was downloaded.
2. Make the script executable.
   chmod 755 run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh
   
3. Run the script.
   ./run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh
   
   The script pulls the lfedge/eve-edgeview:latest Docker image and connects to the dispatcher. When the connection succeeds, output similar to the following appears.
   ZED-MBP connecting to wss://zedcloud.gmwtus.zededa.net/api/v1/edge-view
   connect success to websocket server
   Client endpoint IP: 76.158.71.195
   Device IPs: [172.16.8.124]; Endpoint IP 12.203.60.163
     UUID: c3b9be50-d039-4957-8e0f-c258fdb9dc9f
     Device: first_edge_node, Enterprise: TestSetup-9603
     Controller: zedcloud.gmwtus.zededa.net  EVE-OS release 12.0.4-lts-kvm-amd64
     Edge-View Ver: 0.8.4, JWT expires at 2024-12-13T22:09:34Z
   
4. Note the device IP address shown in the Device IPs field (for example, 172.16.8.124).
5. Run the script again, appending the device IP and port 22 to open an SSH tunnel.
   ./run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh tcp/172.16.8.124:22
   
   The output confirms the tunnel is active and shows the local port mapping.
   tcp mapping locally listening 1 ports to remote:
    0.0.0.0:9001 - 172.16.8.124:22
   connect success to websocket server
   

​

Establish an SSH Session

ssh -i id_ed25519 root@0.0.0.0 -p 9001

EVE is Edge Virtualization Engine
Take a look around and don't forget to use eve(1).
c3b9be50-d039-4957-8e0f-c258fdb9dc9f:~#

​

Re-Establish a Session After Token Expiry

1. In the Edge Infrastructure Services console, open the node details page.
2. Click Remote Console and then Continue to activate a new session.
3. Download the new run-script from the download icon.
4. In your terminal, find the latest script file.
   ls -lrt run.*
   
5. Run the new script with the device IP and port.
6. Open a new SSH session using the port mapping from the output.

​

Restrict Access with SSH Key Authentication

zcli edge-node update EDGE_NODE_NAME --config=keyedgeview.authen.publickey:"YOUR_PUBLIC_KEY"

EdgeviewSshKeyPath: /path/to/your/private/key

export EdgeviewSshKeyPath=/path/to/your/private/key

​

How the Edge View Script Works

1. Docker image launch: The script pulls lfedge/eve-edgeview:latest from Docker Hub. This image contains the Edge View client, which handles authentication and tunneling.
2. JWT authentication: The script injects a short-lived JWT token that proves your identity to Edge Infrastructure Services and confirms your access permissions.
3. WebSocket tunnel: The container opens a WSS connection to the Edge Infrastructure Services dispatcher. This firewall-friendly approach works in networks with strict outbound filtering.
4. Remote access provisioning: Depending on the session type, you receive an SSH terminal into the node or a local port mapping to a service running on the node.

​

Verify the Configuration

1. Run a simple EVE-OS command in the SSH terminal (for example, uname -a) to confirm the connection is live.
2. Go to the node details page in Edge Infrastructure Services and select the View Events button in the page header. An event entry appears for the Edge View session, confirming the session is logged.

​

Next Steps