Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1799219

Summary: [IPI baremetal]: Add an option to disable CA verification for Redfish
Product: OpenShift Container Platform Reporter: Stephen Benjamin <stbenjam>
Component: Cloud ComputeAssignee: Steven Hardy <shardy>
Cloud Compute sub component: BareMetal Provider QA Contact: Amit Ugol <augol>
Status: CLOSED ERRATA Docs Contact:
Severity: unspecified    
Priority: unspecified CC: rbartal, shardy, stbenjam, vlaad
Version: 4.4   
Target Milestone: ---   
Target Release: 4.4.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1799255 1799927 1801228 (view as bug list) Environment:
Last Closed: 2020-05-15 16:03:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1799255, 1799927, 1801228    

Description Stephen Benjamin 2020-02-06 16:13:10 UTC
When provisioning baremetal IPI using Redfish with virtual media or PXE, the default is for Ironic to verify the CA certificates, however it is typical for the CA certs to be self-signed. We should expose the option for disabling certificate verification so in lab or other environments where they have not replaced BMC certs with trusted ones, they can still test Redfish deployments.

Comment 1 Stephen Benjamin 2020-02-06 16:15:26 UTC
Upstream PR: https://github.com/metal3-io/baremetal-operator/pull/396

Once merged, we need to cherry-pick it to openshift/baremetal-operator

Comment 3 Steven Hardy 2020-02-10 13:12:40 UTC
Note this will also require changes to the installer to update the vendored BMO

https://github.com/openshift/installer/pull/3072

And to the MAO which includes a copy of the BMH CRD

https://github.com/openshift/machine-api-operator/blob/master/install/0000_30_machine-api-operator_08_baremetalhost.crd.yaml

Comment 4 Steven Hardy 2020-02-10 13:14:52 UTC
Moving back to assigned as we still need the MAO part for worker deployment I think

Comment 5 Steven Hardy 2020-02-10 13:21:56 UTC
Ok my mistake https://bugzilla.redhat.com/show_bug.cgi?id=1799927 tracks the installer change and we need another bz for the MAO fix