A new page describes the ipxe and xnba netboot methods: the files of the
upstream loader, UEFI Secure Boot through the shim and its limits, the
client test, the loader of nodes without a definition, the move of
nodes to the ipxe method and back, and the known limits of the upstream
loader.
The node guide, the noderes, node, group and nodeset pages list the ipxe
method, and the value lists mark xnba deprecated. The examples that
define an x86 node use netboot=ipxe. The mixed cluster and uninstall
guides name ipxe-xcat, and the DHCP validation matrix gets the iPXE
loader rows, Secure Boot included.
The global UEFI class of Kea gives only the upstream loader, so each
xnba node carries its own first-stage classes. They existed only with
the local xNBA BIOS file. With the xNBA UEFI file alone, a UEFI client
of an xnba node got the upstream loader and then the discovery script,
not xNBA and its node script.
The UEFI first-stage class of an xnba node now also exists with the
local xNBA UEFI file alone.
_run_omshell stops omshell after 10 seconds, but it read the output a
line at a time. A line read waits for a newline, and omshell writes its
prompt without one. An omshell that stalled after a prompt kept makedhcp
waiting past the deadline. The check of an external ISC server does that
read while it holds the DHCP lock.
_run_omshell now reads the output in chunks.
The cases without an xCAT dhcpd.conf now run the whole request. dhcpd
restarts with the new configuration before omshell starts, and the
configuration written last keeps its declarations. A failed restart
changes no host, and after a run that stopped before the restart, the
next run restarts dhcpd first.
makedhcp builds a new configuration when dhcpd.conf is missing or xCAT
did not write it. It replaced each host over OMAPI before dhcpd loaded
that configuration. A dhcpd that still ran an older one then rejected a
host that tests an iPXE feature option. OMAPI had already removed the
old host, so the node lost its reservation.
makedhcp now writes the new configuration and restarts dhcpd first. It
changes no host when that restart fails. The restart marker of an
upgraded configuration now also covers a new one, so the next run
restarts dhcpd first after a run that stopped before the restart.
A node in state boot or iscsiboot that boots from SAN gets the loader of
its method from its own Kea classes on a client without iSCSI: BIOS for
xnba, BIOS and UEFI for ipxe, and nothing without the local xNBA BIOS
file. The local-boot class holds it for a client with iSCSI only, and
keeps that condition when a later makedhcp writes the class again.
The packet test checks both methods with kea-dhcp4. A firmware PXE
client and an iPXE without iSCSI get the loader, and an iPXE with iSCSI
gets no boot file, though the subnet offers its network scripts.
Kea gave a node in state boot or iscsiboot no classes of its own and
left a node that boots from SAN out of the local-boot class. Its clients
fell to the shared classes, which now skip a client with the iPXE
features of a script. A firmware iPXE without iSCSI then got no loader,
and an iPXE with iSCSI got the discovery script of the network.
Such a node now gets the loader of its method from its own classes on a
client without iSCSI, for BIOS and, with netboot=ipxe, for UEFI, as its
ISC host statements do. A client with iSCSI is in the local-boot class,
so no class names a boot file for it and it boots the root path. Kea
tests the iSCSI feature, which xNBA and iPXE both report, for a node of
any method.
The next change puts a node that boots from SAN in the local-boot class
of Kea for a client that can attach the disk. The local-boot case
checks the class with installed nodes only, which do not change. The
test after the change covers the SAN node.
A host whose longest line has 1023 bytes gets its commands unchanged,
with the removal of the old host before its creation. A 1024-byte line
gives an error that names the node, and makedhcp sends no command of
that host or of its InfiniBand twin.
omshell reads 1023 bytes of a line and parses the rest as a new command.
makedhcp removes the old host of a node before it creates it again, so a
longer "set statements" line, as an iSCSI node with long target and
initiator names can give, left the node without its reservation.
makedhcp now checks every command of a host before it sends any. For a
node whose command is too long, it reports the node and leaves its host
unchanged.
addnode printed the omshell commands of a host one line at a time,
starting with the removal of the old host. _isc_omapi_host_commands now
returns them as one text, so that makedhcp can check them before it
sends any. The commands and their order do not change.
The specs are resolved with rpmspec and the Debian control files with
Dpkg::Deps for each architecture. xCAT and xCATsn require ipxe-xcat
and xnba-undi where they required xnba-undi, and ipxe-xcat alone on the
other architectures. The debs depend on ipxe-xcat and recommend
xnba-undi on every architecture.
The go-xcat install lists name both packages.
Unknown x86 clients and netboot=ipxe nodes boot the upstream iPXE
loader of the ipxe-xcat package, which the xCAT packages did not
install.
The specs require ipxe-xcat where they require xnba-undi: on x86 and
ppc for xCAT, and on x86 for xCATsn. xCAT on riscv64 and xCATsn on ppc
and riscv64 require ipxe-xcat alone, because a POWER or riscv64 server
can serve x86 nodes. The xcat and xcatsn debs depend on ipxe-xcat on
every architecture for the same reason. go-xcat installs and removes
ipxe-xcat with the other packages.
xnba-undi stays a dependency, because netboot=xnba nodes still boot
xNBA.
The next commit adds ipxe-xcat to the riscv64 requirements of xCAT and
xCATsn, and moves the riscv64 block of xCATsn into its ppc block. The
test now finds the block that covers riscv64 and checks that it
requires ipmitool-xcat.
The riscv64 test copied riscv64_install_list out of go-xcat with awk and
ran it on its own copy of the install list. A change to the real lists
did not reach it.
The BATS test sources go-xcat and reads the install, riscv64 and
uninstall lists for the rpm and deb names. It checks that riscv64 drops
only the legacy Genesis, adds the OpenEmbedded Genesis and keeps the
x86 boot loaders, and that the uninstall list covers every package
go-xcat installs.
A sourced go-xcat returns before the main program, which defined
riscv64_install_list, so a test that sources the script could not call
the filter. The function is now defined above the main program. A run of
the script does the same as before.
The network boot script of the upstream loader and of xNBA, and the
pxelinux configuration, start the discovery. A node script, a loader
and a Genesis file do not.
An unknown x86 client now fetches its Genesis script from
xcat/ipxe/nets. xcatprobe discovery checked the scripts of each network
under xcat/xnba/nets, and marked the boot loader stage only for a
download from there. It now checks xcat/ipxe/nets, and marks the stage
for a download from either directory.
The xNBA loaders, the upstream iPXE loaders with the UEFI shim, the
POWER grub2 image and yaboot count as a boot loader download. Genesis
files, pxelinux.0, the POWER grub2 configuration and a similar-looking
name do not.
osdeploy marked a node as loading its boot loader only when it fetched a
file under xcat/xnba, the POWER grub2 image, or yaboot. A node on the
upstream loader fetches xcat/ipxe/..., so osdeploy missed that stage.
Move the match into probe_utils and add xcat/ipxe/.
For each loader file that a TFTP tree can hold, the check accepts an
xnba node or an ipxe node when that file can SAN-boot it: undionly.kpxe
in the root for both, xnba.kpxe for xnba, and the upstream BIOS loader
for ipxe. The upstream UEFI loader alone is not enough.
setdestiny accepted an x86 iscsiboot node without iSCSI boot data only
when undionly.kpxe was in the TFTP root. The check read
-f ("$tftpdir/undionly.kpxe" or -f "$tftpdir/xcat/xnba.kpxe"): the or
was inside the -f argument, so xnba.kpxe never counted.
Accept the node when undionly.kpxe is there, or the BIOS file of the
loader of its netboot method: the upstream loader for netboot=ipxe, and
xNBA for any other method.
A server without x86 network boot scripts gets no warning, and a ready
server gets none. An upgraded server with only the xNBA scripts gets one
warning for each missing upstream loader file, the UEFI shim and the
snponly.efi it loads included, and one for the network scripts. A single
missing file gets its own warning, and a directory under xcat/ipxe/nets
is not a network boot script.
makedhcp -n and -a now warn when a server that serves x86 discovery
lacks an upstream loader file in its local TFTP directory, the
snponly.efi that the UEFI shim loads included, or has no network boot
script under xcat/ipxe/nets, which mknb writes. A server
serves x86 discovery when it has network boot scripts under xcat/ipxe
or xcat/xnba. A node can load from another TFTP server, so the check
warns and does not stop.
A node of an x86_64 or x86 image profile gets netboot=ipxe, and the
ppc64le and riscv64 profiles keep grub2. The x86 node templates, read
with the stanza parser of mkdef, define netboot=ipxe, the ppc64le
template keeps petitboot, and the e1350 noderes table gives the compute
group ipxe.
A profile change keeps netboot=xnba, and gives a node without a method,
a netboot=pxe node and a node of another architecture the method of its
profile.
netboot=xnba is deprecated, but profile-based node definitions, the x86
node templates of mkdef --template, the e1350 noderes table and the
SoftLayer importer still gave new x86 nodes xnba. They now give
netboot=ipxe, as node discovery does. Existing nodes keep their method,
and a profile change keeps netboot=xnba on a node that has it: moving a
node to the upstream loader is the choice of the site.
A discovered x86 node without an x86 method got netboot=xnba, which
names the xNBA loader that xCAT retires. It now gets netboot=ipxe, the
method of the upstream iPXE loader that discovery itself uses. A node
that already has pxe, ipxe or xnba keeps it.
The next change makes discovery set netboot=ipxe on an x86 node, so the
two checks that expect xnba for an x86 node without an x86 method go.
The checks that keep an x86 method that is already set stay.
The packet test runs dhcpd and kea-dhcp4 in a network namespace with the
rules that BootPolicy renders, and sends relayed DHCPDISCOVER packets
from a second namespace. It checks the boot file of firmware PXE, xNBA
and iPXE clients, with each iPXE feature present or missing, for an xnba
node and an ipxe node that install, for both methods with a SAN disk,
and for an unknown node. On ISC it also covers an iSCSI node of each
method in the boot state, and repeats the node rows after a restart,
when dhcpd reads the host statements back from dhcpd.leases. On Kea it
repeats the rows of the ipxe nodes with a configuration that makedhcp
upgraded, which keeps the xNBA global classes of the older makedhcp -n.
It also checks that the UEFI clients of an xnba node get xNBA when the
server lacks the xNBA UEFI file.
The Kea validation test checks the x86 classes of xnba and ipxe nodes
with kea-dhcp4 -t. XCAT::Test::DHCP builds the packets, and the
integration case expects seven files.
The global Kea classes give the upstream loader to an x86 client that
cannot fetch its script, and the Etherboot class gives it the BIOS
loader. The network classes and the ISC x86 lines give the Genesis
script under xcat/ipxe/nets to a client with the iPXE features of its
path, and the Kea subnet lists those classes. Without an upstream loader
file on the server, neither backend names it or the second stage that it
would fetch, and the ISC lines stop such a client before the fallback.
The xNBA files name no global class.
An xnba node gets xNBA from its own first-stage classes when the server
has the xNBA BIOS file, and still xcat/xnba.efi without the local UEFI
file. Without the xNBA BIOS file it has no first-stage classes, as it
has no ISC host statements. An ipxe node without a SAN disk carries the
upstream loader in its own first-stage classes.
The ISC configuration test also checks these lines in configurations
that makedhcp upgraded, one of them with indented declarations.
The DHCP wire cases now expect the upstream loader for an x86 client
with no reservation, and its network script for a second stage that
reports the features in option 175. A second stage without them gets the
loader again, and an xnba node still gets xNBA.
Install rsyslog and create its xCAT log directory before installing xCAT.
Wait for a unique syslog marker before changing test state, including when
the log does not exist yet. Reuse that wait for the completion marker.
Replace the dispatch trace fixture with an installed-node xcattest case.
Check the stored password, masked dispatch output, and absence of the
unmasked password in syslog. Restore the debug setting and remove the
temporary node on exit. Keep the redactor unit checks unchanged.
Secret-absence checks accept missing values and lost command context.
Require the expected masked output for attributes, options, operands
and loaded schema mappings. Production and dispatch fixtures are unchanged.
Vinícius Ferrão
Daniel Hilst