diff --git a/doc/source/drivers/ilo.rst b/doc/source/drivers/ilo.rst index 9c571fd5c4..7d888b9e11 100644 --- a/doc/source/drivers/ilo.rst +++ b/doc/source/drivers/ilo.rst @@ -7,11 +7,12 @@ iLO drivers Overview ======== iLO drivers enable to take advantage of features of iLO management engine in -HP Proliant servers. iLO drivers are targeted for HP Proliant Gen 8 systems -and above which have iLO 4 management engine. [1]_ +HPE ProLiant servers. iLO drivers are targeted for HPE ProLiant Gen 8 systems +and above which have `iLO 4 management engine `_. -For more detailed and up-to-date information (like tested platforms, known -issues, etc), please check the iLO driver wiki page [6]_. +For more detailed iLO driver document of Juno, Kilo and Liberty releases, and +up-to-date information (like tested platforms, known issues, etc), please check the +`iLO driver wiki page `_. Currently there are 3 iLO drivers: @@ -20,34 +21,34 @@ Currently there are 3 iLO drivers: * ``pxe_ilo``. The ``iscsi_ilo`` and ``agent_ilo`` drivers provide security enhanced -PXE-less deployment by using iLO virtual media to boot up the baremetal node. +PXE-less deployment by using iLO virtual media to boot up the bare metal node. These drivers send management info through management channel and separates -it from data channel which is used for deployment. ``iscsi_ilo`` driver uses -deployment ramdisk built from ``diskimage-builder``, deploys from Ironic -conductor node and always does net-boot. ``agent_ilo`` driver uses deployment -ramdisk built from IPA, deploys from baremetal node and always does local boot. +it from data channel which is used for deployment. -``pxe_ilo`` driver uses PXE/iSCSI for deployment (just like normal PXE driver), -but support automatic setting of requested boot mode from nova. This driver -doesn't require iLO Advanced license. +``iscsi_ilo`` and ``agent_ilo`` drivers use deployment ramdisk +built from ``diskimage-builder``. The ``iscsi_ilo`` driver deploys from +ironic conductor and supports both net-boot and local-boot of instance. +``agent_ilo`` deploys from bare metal node and always does local-boot. +``pxe_ilo`` driver uses PXE/iSCSI for deployment (just like normal PXE driver) +and deploys from ironic conductor. Additionally it supports automatic setting of +requested boot mode from nova. This driver doesn't require iLO Advanced license. Prerequisites ============= -* ``proliantutils`` is a python package which contains a set of modules for - managing HP Proliant hardware. +* `proliantutils `_ is a python package + which contains set of modules for managing HPE ProLiant hardware. - Install ``proliantutils`` [2]_ module on the Ironic conductor node. Minimum + Install ``proliantutils`` module on the ironic conductor node. Minimum version required is 2.1.5.:: $ pip install "proliantutils>=2.1.5" * ``ipmitool`` command must be present on the service node(s) where ``ironic-conductor`` is running. On most distros, this is provided as part - of the ``ipmitool`` package. Source code is available at - http://ipmitool.sourceforge.net/. + of the ``ipmitool`` package. Drivers @@ -59,24 +60,23 @@ iscsi_ilo driver Overview ~~~~~~~~ ``iscsi_ilo`` driver was introduced as an alternative to ``pxe_ipmitool`` -and ``pxe_ipminative`` drivers for HP Proliant servers. ``iscsi_ilo`` uses -virtual media feature in iLO to boot up the baremetal node instead of using +and ``pxe_ipminative`` drivers for HPE ProLiant servers. ``iscsi_ilo`` uses +virtual media feature in iLO to boot up the bare metal node instead of using PXE or iPXE. Target Users ~~~~~~~~~~~~ * Users who do not want to use PXE/TFTP protocol on their data centres. -* Current PXE driver passes authentication token in clear-text over - tftp to the baremetal node. ``iscsi_ilo`` driver enhances the security - by passing keystone authtoken and management info over encrypted - management network. This driver may be used by users who have concerns - on PXE drivers security issues and want to have a security enhanced - PXE-less deployment mechanism. +* Current PXE driver passes management info in clear-text to the + bare metal node. ``iscsi_ilo`` driver enhances the security + by passing management info over encrypted management network. This + driver may be used by users who have concerns on PXE drivers security + issues and want to have a security enhanced PXE-less deployment mechanism. Tested Platforms ~~~~~~~~~~~~~~~~ -This driver should work on HP Proliant Gen8 Servers and above with iLO 4. +This driver should work on HPE ProLiant Gen8 Servers and above with iLO 4. It has been tested with the following servers: * ProLiant DL380e Gen8 @@ -86,22 +86,24 @@ It has been tested with the following servers: * ProLiant DL380 Gen9 UEFI For more up-to-date information on server platform support info, refer -iLO driver wiki [6]_. +`iLO driver wiki page `_. Features ~~~~~~~~ -* PXE-less deploy with Virtual Media. +* PXE-less deploy with virtual media. * Automatic detection of current boot mode. -* Automatic setting of the required boot mode if UEFI boot mode is requested +* Automatic setting of the required boot mode, if UEFI boot mode is requested by the nova flavor's extra spec. -* Always boot from network using Virtual Media. +* Supports booting the instance from virtual media (netboot) as well as booting + locally from disk. By default, the instance will always boot from virtual + media for partition images. * UEFI Boot Support * UEFI Secure Boot Support -* Passing authentication token via secure, encrypted management network - (Virtual Media). Provisioning is done using iSCSI over data network - (like PXE driver), so this driver has the benefit of security - enhancement with the same performance. Hence it segregates management info - from data channel. +* Passing management information via secure, encrypted management network + (virtual media) if swift proxy server has an HTTPs endpoint. Provisioning + is done using iSCSI over data network, so this driver has the benefit + of security enhancement with the same performance. It segregates management + info from data channel. * Support for out-of-band cleaning operations. * Remote Console * HW Sensors @@ -112,54 +114,55 @@ Requirements ~~~~~~~~~~~~ * **iLO 4 Advanced License** needs to be installed on iLO to enable Virtual Media feature. -* **Swift Object Storage Service** - iLO driver uses Swift to store temporary +* **Swift Object Storage Service** - iLO driver uses swift to store temporary FAT images as well as boot ISO images. -* **Glance Image Service with Swift configured as its backend** - When using +* **Glance Image Service with swift configured as its backend** - When using ``iscsi_ilo`` driver, the image containing the deploy ramdisk is retrieved - from Swift directly by the iLO. + from swift directly by the iLO. Deploy Process ~~~~~~~~~~~~~~ -* Admin configures the Proliant baremetal node for iscsi_ilo driver. The - Ironic node configured will have the ``ilo_deploy_iso`` property in its - ``driver_info``. This will contain the Glance UUID of the ISO +* Admin configures the ProLiant bare metal node for iscsi_ilo driver. The + ironic node configured will have the ``ilo_deploy_iso`` property in its + ``driver_info``. This will contain the glance UUID of the ISO deploy ramdisk image. -* Ironic gets a request to deploy a Glance image on the baremetal node. -* ``iscsi_ilo`` driver powers off the baremetal node. +* Ironic gets a request to deploy a glance image on the bare metal node. +* ``iscsi_ilo`` driver powers off the bare metal node. * The driver generates a swift-temp-url for the deploy ramdisk image - and attaches it as Virtual Media CDROM on the iLO. + and attaches it as virtual media CDROM on the iLO. * The driver creates a small FAT32 image containing parameters to - the deploy ramdisk. This image is uploaded to Swift and its swift-temp-url - is attached as Virtual Media Floppy on the iLO. + the deploy ramdisk. This image is uploaded to swift and its swift-temp-url + is attached as virtual media Floppy on the iLO. * The driver sets the node to boot one-time from CDROM. -* The driver powers on the baremetal node. -* The deploy kernel/ramdisk is booted on the baremetal node. The ramdisk - exposes the local disk over iSCSI and requests Ironic conductor to complete +* The driver powers on the bare metal node. +* The deploy kernel/ramdisk is booted on the bare metal node. The ramdisk + exposes the local disk over iSCSI and requests ironic conductor to complete the deployment. -* The driver on the Ironic conductor writes the glance image to the - baremetal node's disk. -* The driver bundles the boot kernel/ramdisk for the Glance deploy - image into an ISO and then uploads it to Swift. This ISO image will be used +* The driver on the ironic conductor writes the glance image to the + bare metal node's disk. +* The driver bundles the boot kernel/ramdisk for the glance deploy + image into an ISO and then uploads it to swift. This ISO image will be used for booting the deployed instance. * The driver reboots the node. * On the first and subsequent reboots ``iscsi_ilo`` driver attaches this boot - ISO image in Swift as Virtual Media CDROM and then sets iLO to boot from it. + ISO image in swift as virtual media CDROM and then sets iLO to boot from it. Configuring and Enabling the driver ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. Build a deploy ISO image, see :ref:`BuildingDibBasedDeployRamdisk` -2. Upload this image to Glance.:: +2. Upload this image to glance.:: glance image-create --name deploy-ramdisk.iso --disk-format iso --container-format bare < deploy-ramdisk.iso -3. Configure Glance image service with its storage backend as Swift. See - [4]_ for configuration instructions. +3. Configure glance image service with its storage backend as swift. See + `here `_ + for configuration instructions. -4. Set a temp-url key for Glance user in Swift. For example, if you have - configured Glance with user ``glance-swift`` and tenant as ``service``, +4. Set a temp-url key for glance user in swift. For example, if you have + configured glance with user ``glance-swift`` and tenant as ``service``, then run the below command:: swift --os-username=service:glance-swift post -m temp-url-key:mysecretkeyforglance @@ -183,7 +186,7 @@ Configuring and Enabling the driver 6. Swift must be accessible with the same admin credentials configured in - Ironic. For example, if Ironic is configured with the below credentials in + ironic. For example, if ironic is configured with the below credentials in ``/etc/ironic/ironic.conf``.:: [keystone_authtoken] @@ -214,11 +217,11 @@ Configuring and Enabling the driver enabled_drivers = fake,pxe_ssh,pxe_ipmitool,iscsi_ilo -8. Restart the Ironic conductor service.:: +8. Restart the ironic conductor service.:: $ service ironic-conductor restart -Registering Proliant node in Ironic +Registering ProLiant node in ironic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nodes configured for iLO driver should have the ``driver`` property set to ``iscsi_ilo``. The following configuration values are also required in @@ -227,15 +230,15 @@ Nodes configured for iLO driver should have the ``driver`` property set to - ``ilo_address``: IP address or hostname of the iLO. - ``ilo_username``: Username for the iLO with administrator privileges. - ``ilo_password``: Password for the above iLO user. -- ``ilo_deploy_iso``: The Glance UUID of the deploy ramdisk ISO image. +- ``ilo_deploy_iso``: The glance UUID of the deploy ramdisk ISO image. - ``client_port``: (optional) Port to be used for iLO operations if you are using a custom port on the iLO. Default port used is 443. - ``client_timeout``: (optional) Timeout for iLO operations. Default timeout is 60 seconds. - ``console_port``: (optional) Node's UDP port for console access. Any unused - port on the Ironic conductor node may be used. + port on the ironic conductor node may be used. -For example, you could run a similar command like below to enroll the Proliant +For example, you could run a similar command like below to enroll the ProLiant node:: ironic node-create -d iscsi_ilo -i ilo_address= -i ilo_username= -i ilo_password= -i ilo_deploy_iso= @@ -246,15 +249,15 @@ Refer to `Boot mode support`_ section for more information. UEFI Secure Boot ~~~~~~~~~~~~~~~~ -Refer to `UEFI Secure Boot support`_ section for more information. +Refer to `UEFI Secure Boot Support`_ section for more information. Node cleaning ~~~~~~~~~~~~~ -Refer to ilo_node_cleaning_ for more information. +Refer to `Node Cleaning Support`_ for more information. Hardware Inspection ~~~~~~~~~~~~~~~~~~~ -Refer to hardware_inspection_ for more information. +Refer to `Hardware Inspection Support`_ for more information. agent_ilo driver ^^^^^^^^^^^^^^^^ @@ -262,9 +265,9 @@ agent_ilo driver Overview ~~~~~~~~ ``agent_ilo`` driver was introduced as an alternative to ``agent_ipmitool`` -and ``agent_ipminative`` drivers for HP Proliant servers. ``agent_ilo`` driver -uses virtual media feature in HP Proliant baremetal servers to boot up the -Ironic Python Agent (IPA) on the baremetal node instead of using PXE. For +and ``agent_ipminative`` drivers for HPE ProLiant servers. ``agent_ilo`` driver +uses virtual media feature in HPE ProLiant bare metal servers to boot up the +Ironic Python Agent (IPA) on the bare metal node instead of using PXE. For more information on IPA, refer https://wiki.openstack.org/wiki/Ironic-python-agent. @@ -274,23 +277,25 @@ Target Users Tested Platforms ~~~~~~~~~~~~~~~~ -This driver should work on HP Proliant Gen8 Servers and above with iLO 4. +This driver should work on HPE ProLiant Gen8 Servers and above with iLO 4. It has been tested with the following servers: * ProLiant DL380e Gen8 +* ProLiant DL580e Gen8 * ProLiant DL360 Gen9 UEFI * ProLiant DL380 Gen9 UEFI +* ProLiant DL180 Gen9 UEFI -This driver supports only Gen 8 Class 0 systems (BIOS only). For -more up-to-date information, check the iLO driver wiki [6]_. +For more up-to-date information, check the +`iLO driver wiki page `_. Features ~~~~~~~~ -* PXE-less deploy with Virtual Media using Ironic Python Agent. +* PXE-less deploy with virtual media using Ironic Python Agent(IPA). * Support for out-of-band cleaning operations. * Remote Console * HW Sensors -* IPA runs on the baremetal node and pulls the image directly from Swift. +* IPA runs on the bare metal node and pulls the image directly from swift. * IPA deployed instances always boots from local disk. * Segregates management info from data channel. * UEFI Boot Support @@ -303,47 +308,48 @@ Requirements ~~~~~~~~~~~~ * **iLO 4 Advanced License** needs to be installed on iLO to enable Virtual Media feature. -* **Swift Object Storage Service** - iLO driver uses Swift to store temporary +* **Swift Object Storage Service** - iLO driver uses swift to store temporary FAT images as well as boot ISO images. -* **Glance Image Service with Swift configured as its backend** - When using +* **Glance Image Service with swift configured as its backend** - When using ``agent_ilo`` driver, the image containing the agent is retrieved from - Swift directly by the iLO. + swift directly by the iLO. Deploy Process ~~~~~~~~~~~~~~ -* Admin configures the Proliant baremetal node for ``agent_ilo`` driver. The - Ironic node configured will have the ``ilo_deploy_iso`` property in its - ``driver_info``. This will contain the Glance UUID of the ISO deploy agent +* Admin configures the ProLiant bare metal node for ``agent_ilo`` driver. The + ironic node configured will have the ``ilo_deploy_iso`` property in its + ``driver_info``. This will contain the glance UUID of the ISO deploy agent image containing the agent. -* Ironic gets a request to deploy a Glance image on the baremetal node. -* Driver powers off the baremetal node. +* Ironic gets a request to deploy a glance image on the bare metal node. +* Driver powers off the bare metal node. * Driver generates a swift-temp-url for the deploy agent image - and attaches it as Virtual Media CDROM on the iLO. + and attaches it as virtual media CDROM on the iLO. * Driver creates a small FAT32 image containing parameters to - the agent ramdisk. This image is uploaded to Swift and its swift-temp-url - is attached as Virtual Media Floppy on the iLO. + the agent ramdisk. This image is uploaded to swift and its swift-temp-url + is attached as virtual media Floppy on the iLO. * Driver sets the node to boot one-time from CDROM. -* Driver powers on the baremetal node. -* The deploy kernel/ramdisk containing the agent is booted on the baremetal - node. The agent ramdisk talks to the Ironic conductor, downloads the image - directly from Swift and writes the node's disk. +* Driver powers on the bare metal node. +* The deploy kernel/ramdisk containing the agent is booted on the bare metal + node. The agent ramdisk talks to the ironic conductor, downloads the image + directly from swift and writes the node's disk. * Driver sets the node to permanently boot from disk and then reboots the node. Configuring and Enabling the driver ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -1. Build a deploy ISO image, see :ref:`BuildingCoreOSDeployRamdisk`. +1. Build a deploy ISO image, see :ref:`BuildingDibBasedDeployRamdisk`. -2. Upload the IPA ramdisk image to Glance.:: +2. Upload the IPA ramdisk image to glance.:: glance image-create --name ipa-ramdisk.iso --disk-format iso --container-format bare < ipa-coreos.iso -3. Configure Glance image service with its storage backend as Swift. See - [4]_ for configuration instructions. +3. Configure glance image service with its storage backend as swift. See + `here `_ + for configuration instructions. -4. Set a temp-url key for Glance user in Swift. For example, if you have - configured Glance with user ``glance-swift`` and tenant as ``service``, +4. Set a temp-url key for glance user in swift. For example, if you have + configured glance with user ``glance-swift`` and tenant as ``service``, then run the below command:: swift --os-username=service:glance-swift post -m temp-url-key:mysecretkeyforglance @@ -367,7 +373,7 @@ Configuring and Enabling the driver 6. Swift must be accessible with the same admin credentials configured in - Ironic. For example, if Ironic is configured with the below credentials in + ironic. For example, if Ironic is configured with the below credentials in ``/etc/ironic/ironic.conf``.:: [keystone_authtoken] @@ -398,12 +404,12 @@ Configuring and Enabling the driver enabled_drivers = fake,pxe_ssh,pxe_ipmitool,agent_ilo -8. Restart the Ironic conductor service.:: +8. Restart the ironic conductor service.:: $ service ironic-conductor restart -Registering Proliant node in Ironic +Registering ProLiant node in ironic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nodes configured for iLO driver should have the ``driver`` property set to ``agent_ilo``. The following configuration values are also required in @@ -412,16 +418,15 @@ Nodes configured for iLO driver should have the ``driver`` property set to - ``ilo_address``: IP address or hostname of the iLO. - ``ilo_username``: Username for the iLO with administrator privileges. - ``ilo_password``: Password for the above iLO user. -- ``ilo_deploy_iso``: The Glance UUID of the deploy agent ISO image containing - the agent. +- ``ilo_deploy_iso``: The glance UUID of the deploy ramdisk ISO image. - ``client_port``: (optional) Port to be used for iLO operations if you are - using a custom port on the iLO. Default port used is 443. + using a custom port on the iLO. Default port used is 443. - ``client_timeout``: (optional) Timeout for iLO operations. Default timeout is 60 seconds. - ``console_port``: (optional) Node's UDP port for console access. Any unused - port on the Ironic conductor node may be used. + port on the ironic conductor node may be used. -For example, you could run a similar command like below to enroll the Proliant +For example, you could run a similar command like below to enroll the ProLiant node:: ironic node-create -d agent_ilo -i ilo_address= -i ilo_username= -i ilo_password= -i ilo_deploy_iso= @@ -432,15 +437,15 @@ Refer to `Boot mode support`_ section for more information. UEFI Secure Boot ~~~~~~~~~~~~~~~~ -Refer to `UEFI Secure Boot support`_ section for more information. +Refer to `UEFI Secure Boot Support`_ section for more information. Node Cleaning ~~~~~~~~~~~~~ -Refer to ilo_node_cleaning_ for more information. +Refer to `Node Cleaning Support`_ for more information. Hardware Inspection ~~~~~~~~~~~~~~~~~~~ -Refer to hardware_inspection_ for more information. +Refer to `Hardware Inspection Support`_ for more information. pxe_ilo driver ^^^^^^^^^^^^^^ @@ -448,18 +453,18 @@ pxe_ilo driver Overview ~~~~~~~~ ``pxe_ilo`` driver uses PXE/iSCSI (just like ``pxe_ipmitool`` driver) to -deploy the image and uses iLO to do all management operations on the baremetal -node(instead of using IPMI). +deploy the image and uses iLO to do power and management operations on the +bare metal node(instead of using IPMI). Target Users ~~~~~~~~~~~~ * Users who want to use PXE/iSCSI for deployment in their environment or who don't have Advanced License in their iLO. -* Users who don't want to configure boot mode manually on the baremetal node. +* Users who don't want to configure boot mode manually on the bare metal node. Tested Platforms ~~~~~~~~~~~~~~~~ -This driver should work on HP Proliant Gen8 Servers and above with iLO 4. +This driver should work on HPE ProLiant Gen8 Servers and above with iLO 4. It has been tested with the following servers: * ProLiant DL380e Gen8 @@ -468,16 +473,13 @@ It has been tested with the following servers: * ProLiant DL360 Gen9 UEFI * ProLiant DL380 Gen9 UEFI -The driver doesn't work on BIOS mode on DL580 Gen8 and Gen9 systems due to -an issue in the firmware. For information on this, refer iLO driver -wiki [6]_. - -For more up-to-date information, check the iLO driver wiki [6]_. +For more up-to-date information, check the +`iLO driver wiki page `_. Features ~~~~~~~~ * Automatic detection of current boot mode. -* Automatic setting of the required boot mode if UEFI boot mode is requested +* Automatic setting of the required boot mode, if UEFI boot mode is requested by the nova flavor's extra spec. * Support for out-of-band cleaning operations. * Support for out-of-band hardware inspection. @@ -493,7 +495,7 @@ Configuring and Enabling the driver 1. Build a deploy image, see :ref:`BuildingDibBasedDeployRamdisk` -2. Upload this image to Glance.:: +2. Upload this image to glance.:: glance image-create --name deploy-ramdisk.kernel --disk-format aki --container-format aki < deploy-ramdisk.kernel glance image-create --name deploy-ramdisk.initramfs --disk-format ari --container-format ari < deploy-ramdisk.initramfs @@ -503,11 +505,11 @@ Configuring and Enabling the driver enabled_drivers = fake,pxe_ssh,pxe_ipmitool,pxe_ilo -8. Restart the Ironic conductor service.:: +8. Restart the ironic conductor service.:: service ironic-conductor restart -Registering Proliant node in Ironic +Registering ProLiant node in ironic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nodes configured for iLO driver should have the ``driver`` property set to ``pxe_ilo``. The following configuration values are also required in @@ -516,16 +518,16 @@ Nodes configured for iLO driver should have the ``driver`` property set to - ``ilo_address``: IP address or hostname of the iLO. - ``ilo_username``: Username for the iLO with administrator privileges. - ``ilo_password``: Password for the above iLO user. -- ``deploy_kernel``: The Glance UUID of the deployment kernel. -- ``deploy_ramdisk``: The Glance UUID of the deployment ramdisk. +- ``deploy_kernel``: The glance UUID of the deployment kernel. +- ``deploy_ramdisk``: The glance UUID of the deployment ramdisk. - ``client_port``: (optional) Port to be used for iLO operations if you are using a custom port on the iLO. Default port used is 443. - ``client_timeout``: (optional) Timeout for iLO operations. Default timeout is 60 seconds. - ``console_port``: (optional) Node's UDP port for console access. Any unused - port on the Ironic conductor node may be used. + port on the ironic conductor node may be used. -For example, you could run a similar command like below to enroll the Proliant +For example, you could run a similar command like below to enroll the ProLiant node:: ironic node-create -d pxe_ilo -i ilo_address= -i ilo_username= -i ilo_password= -i deploy_kernel= -i deploy_ramdisk= @@ -536,15 +538,15 @@ Refer to `Boot mode support`_ section for more information. UEFI Secure Boot ~~~~~~~~~~~~~~~~ -Refer to `UEFI Secure Boot support`_ section for more information. +Refer to `UEFI Secure Boot Support`_ section for more information. Node Cleaning ~~~~~~~~~~~~~ -Refer to ilo_node_cleaning_ for more information. +Refer to `Node Cleaning Support`_ for more information. Hardware Inspection ~~~~~~~~~~~~~~~~~~~ -Refer to hardware_inspection_ for more information. +Refer to `Hardware Inspection Support`_ for more information. Functionalities across drivers ============================== @@ -558,10 +560,10 @@ mode (Legacy BIOS or UEFI). * ``iscsi_ilo`` * ``agent_ilo`` -The boot modes can be configured in Ironic in the following way: +The boot modes can be configured in ironic in the following way: * When boot mode capability is not configured, these drivers preserve the - current boot mode of the baremetal Proliant server. If operator/user + current boot mode of the bare metal ProLiant server. If operator/user doesn't care about boot modes for servers, then the boot mode capability need not be configured. @@ -570,27 +572,27 @@ The boot modes can be configured in Ironic in the following way: * If the operator wants a node to boot always in ``uefi`` mode or ``bios`` mode, then they may use ``capabilities`` parameter within ``properties`` - field of an Ironic node. + field of an ironic node. To configure a node in ``uefi`` mode, then set ``capabilities`` as below:: ironic node-update add properties/capabilities='boot_mode:uefi' Nodes having ``boot_mode`` set to ``uefi`` may be requested by adding an - ``extra_spec`` to the Nova flavor:: + ``extra_spec`` to the nova flavor:: nova flavor-key ironic-test-3 set capabilities:boot_mode="uefi" nova boot --flavor ironic-test-3 --image test-image instance-1 - If ``capabilities`` is used in ``extra_spec`` as above, Nova scheduler - (``ComputeCapabilitiesFilter``) will match only Ironic nodes which have + If ``capabilities`` is used in ``extra_spec`` as above, nova scheduler + (``ComputeCapabilitiesFilter``) will match only ironic nodes which have the ``boot_mode`` set appropriately in ``properties/capabilities``. It will filter out rest of the nodes. - The above facility for matching in Nova can be used in heterogeneous + The above facility for matching in nova can be used in heterogeneous environments where there is a mix of ``uefi`` and ``bios`` machines, and operator wants to provide a choice to the user regarding boot modes. If the - flavor doesn't contain ``boot_mode`` then Nova scheduler will not consider + flavor doesn't contain ``boot_mode`` then nova scheduler will not consider boot mode as a placement criteria, hence user may get either a BIOS or UEFI machine that matches with user specified flavors. @@ -598,13 +600,13 @@ The boot modes can be configured in Ironic in the following way: The automatic boot ISO creation for UEFI boot mode has been enabled in Kilo. The manual creation of boot ISO for UEFI boot mode is also supported. For the latter, the boot ISO for the deploy image needs to be built -separately and the deploy image's ``boot_iso`` property in Glance should -contain the Glance UUID of the boot ISO. For building boot ISO, add ``iso`` +separately and the deploy image's ``boot_iso`` property in glance should +contain the glance UUID of the boot ISO. For building boot ISO, add ``iso`` element to the diskimage-builder command to build the image. For example:: disk-image-create ubuntu baremetal iso -UEFI Secure Boot support +UEFI Secure Boot Support ^^^^^^^^^^^^^^^^^^^^^^^^ The following drivers support UEFI secure boot deploy: @@ -612,9 +614,9 @@ The following drivers support UEFI secure boot deploy: * ``iscsi_ilo`` * ``agent_ilo`` -The UEFI secure boot mode can be configured in Ironic by adding +The UEFI secure boot can be configured in ironic by adding ``secure_boot`` parameter in the ``capabilities`` parameter within -``properties`` field of an Ironic node. +``properties`` field of an ironic node. ``secure_boot`` is a boolean parameter and takes value as ``true`` or ``false``. @@ -623,38 +625,34 @@ To enable ``secure_boot`` on a node add it to ``capabilities`` as below:: ironic node-update add properties/capabilities='secure_boot:true' -Alternatively use hardware_inspection_ to populate the secure boot capability. +Alternatively use `Hardware Inspection`_ to populate the secure boot capability. Nodes having ``secure_boot`` set to ``true`` may be requested by adding an -``extra_spec`` to the Nova flavor:: +``extra_spec`` to the nova flavor:: nova flavor-key ironic-test-3 set capabilities:secure_boot="true" nova boot --flavor ironic-test-3 --image test-image instance-1 -If ``capabilities`` is used in ``extra_spec`` as above, Nova scheduler -(``ComputeCapabilitiesFilter``) will match only Ironic nodes which have +If ``capabilities`` is used in ``extra_spec`` as above, nova scheduler +(``ComputeCapabilitiesFilter``) will match only ironic nodes which have the ``secure_boot`` set appropriately in ``properties/capabilities``. It will filter out rest of the nodes. -The above facility for matching in Nova can be used in heterogeneous +The above facility for matching in nova can be used in heterogeneous environments where there is a mix of machines supporting and not supporting UEFI secure boot, and operator wants to provide a choice to the user regarding secure boot. If the flavor doesn't contain ``secure_boot`` then -Nova scheduler will not consider secure boot mode as a placement criteria, +nova scheduler will not consider secure boot mode as a placement criteria, hence user may get a secure boot capable machine that matches with user specified flavors but deployment would not use its secure boot capability. Secure boot deploy would happen only when it is explicitly specified through flavor. Use element ``ubuntu-signed`` or ``fedora`` to build signed deploy iso and -user images from ``diskimage-builder`` [3]_. - -The below command creates files named ``deploy-ramdisk.kernel``, -``deploy-ramdisk.initramfs`` and ``deploy-ramdisk.iso`` in the current -working directory.:: - - cd - ./bin/ramdisk-image-create -o deploy-ramdisk ubuntu-signed deploy-ironic iso +user images from +`diskimage-builder `_. +Refer :ref:`BuildingDibBasedDeployRamdisk` for more information on building +deploy ramdisk. The below command creates files named cloud-image-boot.iso, cloud-image.initrd, cloud-image.vmlinuz and cloud-image.qcow2 in the current working directory.:: @@ -667,28 +665,29 @@ cloud-image.vmlinuz and cloud-image.qcow2 in the current working directory.:: digital signatures of kernel during boot process. This requires that the bootloader contains the digital signatures of the kernel. For ``iscsi_ilo`` driver, it is recommended that ``boot_iso`` property for - user image contains the Glance UUID of the boot ISO. - If ``boot_iso`` property is not updated in Glance for the user image, it + user image contains the glance UUID of the boot ISO. + If ``boot_iso`` property is not updated in glance for the user image, it would create the ``boot_iso`` using bootloader from the deploy iso. This ``boot_iso`` will be able to boot the user image in UEFI secure boot environment only if the bootloader is signed and can validate digital signatures of user image kernel. -Ensure the public key of the signed image is loaded into baremetal to deploy +Ensure the public key of the signed image is loaded into bare metal to deploy signed images. -For HP Proliant Gen9 servers, one can enroll public key using iLO System +For HPE ProLiant Gen9 servers, one can enroll public key using iLO System Utilities UI. Please refer to section ``Accessing Secure Boot options`` in -HP UEFI System Utilities User Guide. [7]_ -One can also refer to white paper on Secure Boot for Linux on HP Proliant -servers for additional details. [8]_ +`HP UEFI System Utilities User Guide `_. +One can also refer to white paper on `Secure Boot for Linux on HP ProLiant +servers `_ for +additional details. -For more up-to-date information, refer to the ``UEFI Secure Boot support`` -section in the iLO driver (Kilo release) wiki [10]_. +For more up-to-date information, refer +`iLO driver wiki page `_ .. _ilo_node_cleaning: -Node Cleaning -^^^^^^^^^^^^^ +Node Cleaning Support +^^^^^^^^^^^^^^^^^^^^^ The following iLO drivers support node cleaning - * ``pxe_ilo`` @@ -703,13 +702,13 @@ Supported Cleaning Operations -``reset_ilo``: Resets the iLO. By default, enabled with priority 1. -``reset_bios_to_default``: - Resets BIOS Settings to default. By default, enabled with priority 10. + Resets system ROM sttings to default. By default, enabled with priority 10. This clean step is supported only on Gen9 and above servers. -``reset_secure_boot_keys_to_default``: Resets secure boot keys to manufacturer's defaults. This step is supported only on Gen9 and above servers. By default, enabled with priority 20 . -``reset_ilo_credential``: - Resets the iLO password, if 'ilo_change_password' is specified as part of + Resets the iLO password, if ``ilo_change_password`` is specified as part of node's driver_info. By default, enabled with priority 30. -``clear_secure_boot_keys``: Clears all secure boot keys. This step is supported only on Gen9 and above @@ -725,7 +724,7 @@ Supported Cleaning Operations * Updating clean step priority to 0, will disable that particular clean step and will not run during cleaning. -* Configuration Options for the clean steps are listed under [ilo] section in +* Configuration Options for the clean steps are listed under ``[ilo]`` section in ironic.conf :: - clean_priority_reset_ilo=1 @@ -735,12 +734,10 @@ Supported Cleaning Operations - clean_priority_reset_ilo_credential=30 - clean_priority_erase_devices=10 -For more information on node cleaning, see [9]_. +For more information on node cleaning, see :ref:`cleaning` -.. _hardware_inspection: - -Hardware Inspection -^^^^^^^^^^^^^^^^^^^ +Hardware Inspection Support +^^^^^^^^^^^^^^^^^^^^^^^^^^^ The following iLO drivers support hardware inspection: @@ -778,7 +775,7 @@ Inspection can also discover the following extra capabilities for iLO drivers: * ``server_model``: server model -* ``pci_gpu_devices``: number of gpu devices connected to the baremetal. +* ``pci_gpu_devices``: number of gpu devices connected to the bare metal. * ``nic_capacity``: the max speed of the embedded NIC adapter. @@ -794,16 +791,3 @@ for scheduling:: nova flavor-key my-baremetal-flavor set capabilities:ilo_firmware_version=" 2.10" nova flavor-key my-baremetal-flavor set capabilities:secure_boot="true" - -References -========== -.. [1] HP iLO 4 User Guide - http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03334051-11.pdf -.. [2] Proliantutils module - https://pypi.python.org/pypi/proliantutils -.. [3] DiskImage-Builder - https://github.com/openstack/diskimage-builder -.. [4] http://docs.openstack.org/developer/glance/configuring.html#configuring-the-swift-storage-backend -.. [5] Ironic Python Agent - https://github.com/openstack/ironic-python-agent -.. [6] https://wiki.openstack.org/wiki/Ironic/Drivers/iLODrivers -.. [7] HP UEFI System Utilities User Guide - http://www.hp.com/ctg/Manual/c04398276.pdf -.. [8] Secure Boot for Linux on HP Proliant servers http://h20195.www2.hp.com/V2/getpdf.aspx/4AA5-4496ENW.pdf -.. [9] http://docs.openstack.org/developer/ironic/deploy/cleaning.html -.. [10] https://wiki.openstack.org/wiki/Ironic/Drivers/iLODrivers/Kilo