Skip to content

OCPEDGE-1891: Add redfish_verify_ca support #1757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 20, 2025
Merged

OCPEDGE-1891: Add redfish_verify_ca support #1757

merged 1 commit into from
May 20, 2025

Conversation

slintes
Copy link
Contributor

@slintes slintes commented May 5, 2025 •
edited
Loading

This is a follow up to metal3-io/metal3-dev-env#1528

For TNF we need to have a SSL secured redfish endpoint. The PR mentioned above adds support for creation of private key and certificate, configuration of sushy, and configuration of ironic's redfish driver.

This PR adds setting certificate verification for the BMH, based on the redfish_verify_ca option in ironic nodes json.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 5, 2025
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented May 5, 2025

Hi @slintes. Thanks for your PR.

I'm waiting for a openshift-metal3 member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 5, 2025
@slintes slintes mentioned this pull request May 8, 2025
Merged
5 tasks
@slintes slintes force-pushed the ssl branch 2 times, most recently from 8625810 to eb5b2bf Compare May 12, 2025 06:22
@slintes
Copy link
Contributor Author

slintes commented May 12, 2025

rebased on top of #1751 for easier testing

@slintes slintes changed the title [WIP] Add redfish SSL support Add redfish SSL support May 15, 2025
@slintes slintes marked this pull request as ready for review May 15, 2025 15:53
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 15, 2025
@openshift-ci openshift-ci bot requested review from andfasano and lranjbar May 15, 2025 15:53
@slintes
Disable cert validation if needed
96aa21e 
With the updated version of metal3-dev-env, the redfish endpoint will be TLS secured,
with a self signed certificate. This will be indicated by the https protocol in the
redfish address, and a redfish_verify_ca field set to False. We need to configure BMHs
with disableCertificateVerification = true in this case.

Signed-off-by: Marc Sluiter <[email protected]>
@slintes
Copy link
Contributor Author

slintes commented May 15, 2025

Rebased on master and ready for review. Tested successfully with a TNF cluster with fence_redfish setup 🙂

@slintes slintes changed the title Add redfish SSL support Add redfish_verify_ca support May 15, 2025
@elfosardo
Copy link
Member

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 15, 2025
@elfosardo
Copy link
Member

/retest

@slintes slintes changed the title Add redfish_verify_ca support OCPEDGE-1891: Add redfish_verify_ca support May 16, 2025
@elfosardo
Copy link
Member

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 19, 2025
@dtantsur
Copy link
Member

/approve

@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented May 20, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dtantsur

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 20, 2025
@slintes
Copy link
Contributor Author

slintes commented May 20, 2025

/retest

@openshift-merge-bot openshift-merge-bot bot merged commit 657f2f5 into openshift-metal3:master May 20, 2025
14 checks passed
mgencur added a commit to mgencur/release that referenced this pull request Jun 18, 2025
@mgencur
Use disableCertificateVerification: true in BareMetalHost
956f6ec 
This is required after merging
openshift-metal3/dev-scripts#1757
mgencur added a commit to mgencur/release that referenced this pull request Jun 18, 2025
@mgencur
Use disableCertificateVerification: true in BareMetalHost
53200b2 
This is required after merging
openshift-metal3/dev-scripts#1757
mgencur added a commit to mgencur/release that referenced this pull request Jun 18, 2025
@mgencur
Use disableCertificateVerification: true in BareMetalHost
01e0473 
This is required after merging
openshift-metal3/dev-scripts#1757
openshift-merge-bot bot pushed a commit to openshift/release that referenced this pull request Jun 19, 2025
@mgencur
OCPBUGS-57516: Disable certificate verification for BareMetalHost (#6…
0727580 
…6230)

* Gather BareMetalHost and InfraEnv on both error and success

* Use disableCertificateVerification: true in BareMetalHost

This is required after merging
openshift-metal3/dev-scripts#1757

* Catch SIGTERM properly
@bfournie
Copy link
Contributor

Note that this line https://github.com/openshift-metal3/dev-scripts/pull/1757/files#diff-c5e795042845913905126f98aa1813bf9b03fab8f94b38a39ea52b91be930000R84 has broken the agent-based installer when using BMC configuration, i.e. when
AGENT_BM_HOSTS_IN_INSTALL_CONFIG=true

It causes the generated install-config.yaml to have improper formatting

   bmc:
       address: redfish+https://192.168.111.1:8000/redfish/v1/Systems/b155087e-ec87-4e31-8417-6e5e2ae79e51
       username: admin
       password: password
       disableCertificateVerification: true      networkConfig:

bfournie added a commit to bfournie/dev-scripts that referenced this pull request Jun 25, 2025
@bfournie
Fix regression in agent installer with BMC verify_ca
1fcbfc3 
PR openshift-metal3#1757 introduced
a formatting problem when using the agent-based installer with BMC
configuration.
@bfournie bfournie mentioned this pull request Jun 25, 2025
Merged
openshift-merge-bot bot pushed a commit that referenced this pull request Jul 8, 2025
@bfournie
Fix regression in agent installer with BMC verify_ca (#1774)
3f070cf 
PR #1757 introduced
a formatting problem when using the agent-based installer with BMC
configuration.
liweinan pushed a commit to liweinan/release that referenced this pull request Aug 5, 2025
@mgencur @liweinan
OCPBUGS-57516: Disable certificate verification for BareMetalHost (op…
b11f0a0 
…enshift#66230)

* Gather BareMetalHost and InfraEnv on both error and success

* Use disableCertificateVerification: true in BareMetalHost

This is required after merging
openshift-metal3/dev-scripts#1757

* Catch SIGTERM properly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andfasano andfasano Awaiting requested review from andfasano

@lranjbar lranjbar Awaiting requested review from lranjbar

Assignees

@elfosardo elfosardo

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@slintes @elfosardo @dtantsur @bfournie