Advanced features¶

Local boot with partition images¶

Starting with the Kilo release, Bare Metal service supports local boot with partition images, meaning that after the deployment the node’s subsequent reboots won’t happen via PXE or Virtual Media. Instead, it will boot from a local boot loader installed on the disk.

It’s important to note that in order for this to work the image being deployed with Bare Metal service must contain grub2 installed within it.

Enabling the local boot is different when Bare Metal service is used with Compute service and without it. The following sections will describe both methods.

ironic node-update <node-uuid> add properties/capabilities="boot_option:local"

nova flavor-key baremetal set capabilities:boot_option="local"

ironic node-update <node-uuid> add instance_info/capabilities='{"boot_option": "local"}'

Specifying the disk for deployment (root device hints)¶

Starting with the Kilo release, Bare Metal service supports passing hints to the deploy ramdisk about which disk it should pick for the deployment. The list of support hints is:

• model (STRING): device identifier

• vendor (STRING): device vendor

• serial (STRING): disk serial number

• size (INT): size of the device in GiB

  Note

  A node’s ‘local_gb’ property is often set to a value 1 GiB less than the actual disk size to account for partitioning (this is how DevStack, TripleO and Ironic Inspector work, to name a few). However, in this case size should be the actual size. For example, for a 128 GiB disk local_gb will be 127, but size hint will be 128.

• wwn (STRING): unique storage identifier

• wwn_with_extension (STRING): unique storage identifier with the vendor extension appended

• wwn_vendor_extension (STRING): unique vendor storage identifier

• rotational (BOOLEAN): whether it’s a rotational device or not. This hint makes it easier to distinguish HDDs (rotational) and SSDs (not rotational) when choosing which disk Ironic should deploy the image onto.

• name (STRING): the device name, e.g /dev/md0

  Warning

  The root device hint name should only be used for devices with constant names (e.g RAID volumes). For SATA, SCSI and IDE disk controllers this hint is not recommended because the order in which the device nodes are added in Linux is arbitrary, resulting in devices like /dev/sda and /dev/sdb switching around at boot time.

To associate one or more hints with a node, update the node’s properties with a root_device key, for example:

ironic node-update <node-uuid> add properties/root_device='{"wwn": "0x4000cca77fc4dba1"}'

That will guarantee that Bare Metal service will pick the disk device that has the wwn equal to the specified wwn value, or fail the deployment if it can not be found.

Appending kernel parameters to boot instances¶

The Bare Metal service supports passing custom kernel parameters to boot instances to fit users’ requirements. The way to append the kernel parameters is depending on how to boot instances.

Trusted boot with partition image¶

Starting with the Liberty release, Ironic supports trusted boot with partition image. This means at the end of the deployment process, when the node is rebooted with the new user image, trusted boot will be performed. It will measure the node’s BIOS, boot loader, Option ROM and the Kernel/Ramdisk, to determine whether a bare metal node deployed by Ironic should be trusted.

It’s important to note that in order for this to work the node being deployed must have Intel TXT hardware support. The image being deployed with Ironic must have oat-client installed within it.

The following will describe how to enable trusted boot and boot with PXE and Nova:

1. Create a customized user image with oat-client installed:

   disk-image-create -u fedora baremetal oat-client -o $TRUST_IMG
   

   For more information on creating customized images, see Create and add images to the Image service.

2. Enable VT-x, VT-d, TXT and TPM on the node. This can be done manually through the BIOS. Depending on the platform, several reboots may be needed.

3. Enroll the node and update the node capability value:

   ironic node-create -d pxe_ipmitool
   
   ironic node-update $NODE_UUID add properties/capabilities={'trusted_boot':true}
   

4. Create a special flavor:

   nova flavor-key $TRUST_FLAVOR_UUID set 'capabilities:trusted_boot'=true
   

5. Prepare tboot and mboot.c32 and put them into tftp_root or http_root directory on all nodes with the ironic-conductor processes:

   Ubuntu:
       cp /usr/lib/syslinux/mboot.c32 /tftpboot/
   
   Fedora:
       cp /usr/share/syslinux/mboot.c32 /tftpboot/
   

   Note: The actual location of mboot.c32 varies among different distribution versions.

   tboot can be downloaded from https://sourceforge.net/projects/tboot/files/latest/download

6. Install an OAT Server. An OAT Server should be running and configured correctly.

7. Boot an instance with Nova:

   nova boot --flavor $TRUST_FLAVOR_UUID --image $TRUST_IMG --user-data $TRUST_SCRIPT trusted_instance
   

   Note that the node will be measured during trusted boot and the hash values saved into TPM. An example of TRUST_SCRIPT can be found in trust script example.

8. Verify the result via OAT Server.

   This is outside the scope of Ironic. At the moment, users can manually verify the result by following the manual verify steps.