Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Secure Boot for Satellite and RHEL #3488

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+28 −5
Open

Add Secure Boot for Satellite and RHEL #3488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3a27ad4
Add Secure Boot for Satellite and RHEL
Lennonka Dec 4, 2024
a7b41a3
Add a note about supported architectures
Lennonka Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions guides/common/assembly_using-pxe-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ include::modules/proc_creating-hosts-with-pxeless-provisioning.adoc[leveloffset=

include::modules/proc_creating-hosts-with-uefi-http-boot-provisioning.adoc[leveloffset=+1]

ifndef::satellite[]
:extract_deb_prefix: cd /tmp && ar x /tmp
:extract_deb_xz_suffix: && tar -xf data.tar.xz && cd -
:extract_deb_zst_suffix: && tar --use-compress-program=unzstd -xf data.tar.zst && cd -
Expand All @@ -21,6 +20,7 @@ ifndef::satellite[]
:parent-client-pkg-ext: {client-pkg-ext}
:secureboot-os-name: My_Operating_System_In_Lowercase
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maximiliankolb There actually is an attribute for that but it isn't being modified anywhere 😆
Perhaps it's a good idea to request a PR to do that for the other OSs.
I'm not sure what the value is supposed to be, e.g. is rhel good enough? Does the directory name even matter as long as it's consistent in the whole procedure?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, let's keep it consistent for now, and then think/ask if we can overwrite this attribute for each OS in a follow-up PR.


ifndef::satellite[]
:client-os-context: almalinux
:client-os: AlmaLinux
:client-pkg-ext: rpm
Expand Down Expand Up @@ -65,7 +65,24 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]
endif::[]

:client-os-context: rhel
:client-os: {RHEL}
:client-pkg-ext: rpm
:grub_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:grub_efi_downloaded_package_name: grub2-efi-x64.rpm
:grub_efi_package_name: grub2-efi-x64
:grub_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/grubx64.efi
:shim_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:shim_efi_downloaded_package_name: shim-x64.rpm
:shim_efi_package_name: shim-x64
:shim_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/shimx64.efi
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]

ifndef::satellite[]
:client-os-context: ubuntu
:client-os: Ubuntu
:client-pkg-ext: deb
Expand All @@ -80,6 +97,7 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:extract_grub: {extract_deb_prefix}/{grub_efi_downloaded_package_name} {extract_deb_zst_suffix}
:extract_shim: {extract_deb_prefix}/{shim_efi_downloaded_package_name} {extract_deb_xz_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]
endif::[]

// reset global attributes
:client-os: {parent-client-os}
Expand All @@ -103,7 +121,6 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:!shim_efi_downloaded_package_name:
:!shim_efi_package_name:
:!shim_efi_tmp_binary_path:
endif::[]

include::modules/proc_deploying-ssh-keys-during-provisioning.adoc[leveloffset=+1]
:!using-pxe-to-provision-hosts:
7 changes: 4 additions & 3 deletions guides/common/modules/con_using-pxe-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,22 +43,23 @@ In {Project} provisioning, the PXE loader option defines the DHCP `filename` opt
* For BIOS systems, select the *PXELinux BIOS* option to enable a provisioned host to download the `pxelinux.0` file over TFTP.
* For UEFI systems, select the *Grub2 UEFI* option to enable a TFTP client to download `grubx64.efi` file, or select the *Grub2 UEFI HTTP* option to enable an UEFI HTTP client to download `grubx64.efi` with the HTTP Boot feature.

ifndef::satellite[]
{ProjectName} supports UEFI Secure Boot.
SecureBoot PXE loaders enable a client to download the `shim.efi` bootstrap boot loader that then loads the signed `grubx64.efi`.
Use the *Grub2 UEFI SecureBoot* PXE loader for PXE-boot provisioning or *Grub2 UEFI HTTPS SecureBoot* for HTTP-boot provisioning.

By default, you can provision operating systems from the vendor of the operating system of your {ProjectServer} on Secure Boot enabled hosts.
To provision operating systems on Secure Boot enabled hosts from different vendors, you have to provide signed shim and GRUB2 binaries provided by the vendor of your operating system.
ifndef::orcharhino[]
ifdef::satellite[]
For more information, see xref:configuring-{smart-proxy-context}-to-provision-rhel-on-Secure-Boot-enabled-hosts[].
endif::[]
ifndef::orcharhino,satellite[]
For more information, see:

* xref:configuring-{smart-proxy-context}-to-provision-almalinux-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-debian-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-rocky-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-ubuntu-on-Secure-Boot-enabled-hosts[]
endif::[]
endif::[]

ifdef::satellite[]
For more information about supported workflows, see https://access.redhat.com/solutions/2674001[Supported architectures and provisioning scenarios].
Expand Down
5 changes: 5 additions & 0 deletions ...odules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,12 @@ To provision {client-os} on Secure Boot enabled hosts with the *Grub2 UEFI Secur
You have to perform the following configuration steps on each TFTP {SmartProxy} for a subnet to provision Secure Boot enabled hosts on that subnet.
====

ifdef::satellite[]
{client-os} supports Secure Boot on x86_64 architecture only.
endif::[]
ifndef::satellite[]
The following example works for {client-os} on x86_64 architecture.
endif::[]

.Prerequisites
ifeval::["{client-os}" == "Debian"]
Expand Down
Loading