Bug 1799219 - [IPI baremetal]: Add an option to disable CA verification for Redfish
Summary: [IPI baremetal]: Add an option to disable CA verification for Redfish
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cloud Compute
Version: 4.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 4.4.0
Assignee: Steven Hardy
QA Contact: Amit Ugol
URL:
Whiteboard:
Depends On:
Blocks: 1799255 1799927 1801228
TreeView+ depends on / blocked
 
Reported: 2020-02-06 16:13 UTC by Stephen Benjamin
Modified: 2020-05-15 16:03 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1799255 1799927 1801228 (view as bug list)
Environment:
Last Closed: 2020-05-15 16:03:04 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift baremetal-operator pull 51 None closed Bug 1799219: Verify CA 2020-05-15 14:35:29 UTC

Description Stephen Benjamin 2020-02-06 16:13:10 UTC
When provisioning baremetal IPI using Redfish with virtual media or PXE, the default is for Ironic to verify the CA certificates, however it is typical for the CA certs to be self-signed. We should expose the option for disabling certificate verification so in lab or other environments where they have not replaced BMC certs with trusted ones, they can still test Redfish deployments.

Comment 1 Stephen Benjamin 2020-02-06 16:15:26 UTC
Upstream PR: https://github.com/metal3-io/baremetal-operator/pull/396

Once merged, we need to cherry-pick it to openshift/baremetal-operator

Comment 3 Steven Hardy 2020-02-10 13:12:40 UTC
Note this will also require changes to the installer to update the vendored BMO

https://github.com/openshift/installer/pull/3072

And to the MAO which includes a copy of the BMH CRD

https://github.com/openshift/machine-api-operator/blob/master/install/0000_30_machine-api-operator_08_baremetalhost.crd.yaml

Comment 4 Steven Hardy 2020-02-10 13:14:52 UTC
Moving back to assigned as we still need the MAO part for worker deployment I think

Comment 5 Steven Hardy 2020-02-10 13:21:56 UTC
Ok my mistake https://bugzilla.redhat.com/show_bug.cgi?id=1799927 tracks the installer change and we need another bz for the MAO fix


Note You need to log in before you can comment on or make changes to this bug.