Skip to content

Commit 7664c06

Browse files
mcanevetmcanevet
committed
feat: add SecureBoot and SecureBootResetKeys BMC actions
Adds SecureBootAction (enable/disable), SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK), SecureBootDatabaseResetKeysAction (reset a single key database, e.g. "db" or "KEK", without touching PK), and SecureBootCertificateImportAction (import a certificate into a single key database, referencing the PEM via a ConfigMap key rather than inlining it - a certificate isn't secret, but is typically too large and too reused across Workflows to put directly into an Action) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ResetSecureBootKeys/ ResetSecureBootDatabaseKeys/ImportSecureBootCertificate. Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there directly - e.g. resetting a node to Setup Mode right before the PXE boot attempt that provisioning depends on, then re-enabling SecureBoot once the OS install is done. That's the motivating use case: enrolling a SecureBoot trust anchor at provisioning time, while the machine is still under Tinkerbell's control, rather than relying on boot-time enrollment which happens after the Workflow has already finished. This depended on bmc-toolbox/bmclib#457 and tinkerbell#460, which add the underlying support to bmclib itself. Both have since merged upstream, so go.mod/go.sum now pin github.com/bmc-toolbox/bmclib/v2 to a pseudo-version of the merged commit rather than a temporary fork replace - the same pattern already used elsewhere in this project's go.mod (e.g. jaypipes/ghw, grpc-ecosystem/go-grpc-prometheus, protobuf). This pin can be swapped for a tagged bmclib release once one is cut. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
1 parent db87a73 commit 7664c06

13 files changed

Lines changed: 794 additions & 19 deletions

File tree

‎api/v1alpha1/bmc/action.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,56 @@ type VirtualMediaAction struct {
4747
Kind VirtualMediaKind `json:"kind"`
4848
}
4949

50+
// SecureBootAction represents enabling or disabling UEFI Secure Boot.
51+
type SecureBootAction struct {
52+
// Enable indicates whether Secure Boot should be enabled or disabled.
53+
Enable bool `json:"enable"`
54+
}
55+
56+
// SecureBootResetKeysAction represents resetting the UEFI Secure Boot key databases.
57+
type SecureBootResetKeysAction struct {
58+
// ResetType is the type of key reset to perform.
59+
// +kubebuilder:validation:Enum=ResetAllKeysToDefault;DeleteAllKeys;DeletePK
60+
ResetType string `json:"resetType"`
61+
}
62+
63+
// SecureBootDatabaseResetKeysAction represents resetting a single UEFI Secure Boot key database,
64+
// as opposed to SecureBootResetKeysAction which resets the whole subsystem (including PK).
65+
type SecureBootDatabaseResetKeysAction struct {
66+
// Database is the UEFI Secure Boot key database to reset (e.g. "db", "KEK").
67+
Database string `json:"database"`
68+
69+
// ResetType is the type of key reset to perform. PK is not a valid target at the
70+
// per-database granularity, so DeletePK is not offered here (see SecureBootResetKeysAction).
71+
// +kubebuilder:validation:Enum=ResetAllKeysToDefault;DeleteAllKeys
72+
ResetType string `json:"resetType"`
73+
}
74+
75+
// ConfigMapKeyReference references a specific key within a ConfigMap.
76+
type ConfigMapKeyReference struct {
77+
// Name of the ConfigMap.
78+
Name string `json:"name"`
79+
80+
// Namespace the ConfigMap resides in.
81+
Namespace string `json:"namespace"`
82+
83+
// Key within the ConfigMap's data.
84+
Key string `json:"key"`
85+
}
86+
87+
// SecureBootCertificateImportAction represents importing a certificate into a single UEFI
88+
// Secure Boot key database, without touching any other database (e.g. leaving PK, and
89+
// therefore Setup Mode, untouched).
90+
type SecureBootCertificateImportAction struct {
91+
// Database is the UEFI Secure Boot key database to import the certificate into (e.g. "db", "KEK").
92+
Database string `json:"database"`
93+
94+
// CertificatePEMConfigMapRef references the ConfigMap key holding the PEM-encoded
95+
// certificate to import - a certificate isn't secret, but is typically too large and
96+
// too reused-across-Workflows to inline directly into an Action.
97+
CertificatePEMConfigMapRef ConfigMapKeyReference `json:"certificatePEMConfigMapRef"`
98+
}
99+
50100
// BootDeviceConfig represents the configuration for setting a boot device.
51101
type BootDeviceConfig struct {
52102
// Device is the name of the device to set as the first boot device.

‎api/v1alpha1/bmc/task.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,18 @@ type Action struct {
5959

6060
// VirtualMediaAction represents a baseboard management virtual media insert/eject.
6161
VirtualMediaAction *VirtualMediaAction `json:"virtualMediaAction,omitempty"`
62+
63+
// SecureBoot represents enabling or disabling UEFI Secure Boot.
64+
SecureBoot *SecureBootAction `json:"secureBoot,omitempty"`
65+
66+
// SecureBootResetKeys represents resetting the UEFI Secure Boot key databases.
67+
SecureBootResetKeys *SecureBootResetKeysAction `json:"secureBootResetKeys,omitempty"`
68+
69+
// SecureBootDatabaseResetKeys represents resetting a single UEFI Secure Boot key database.
70+
SecureBootDatabaseResetKeys *SecureBootDatabaseResetKeysAction `json:"secureBootDatabaseResetKeys,omitempty"`
71+
72+
// SecureBootCertificateImport represents importing a certificate into a single UEFI Secure Boot key database.
73+
SecureBootCertificateImport *SecureBootCertificateImportAction `json:"secureBootCertificateImport,omitempty"`
6274
}
6375

6476
// TaskStatus defines the observed state of Task.

‎api/v1alpha1/bmc/zz_generated.deepcopy.go‎

Lines changed: 96 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎crd/bases/v1alpha1/bmc.tinkerbell.org_jobs.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,83 @@ spec:
120120
- cycle
121121
- reset
122122
type: string
123+
secureBoot:
124+
description: SecureBoot represents enabling or disabling UEFI
125+
Secure Boot.
126+
properties:
127+
enable:
128+
description: Enable indicates whether Secure Boot should
129+
be enabled or disabled.
130+
type: boolean
131+
required:
132+
- enable
133+
type: object
134+
secureBootCertificateImport:
135+
description: SecureBootCertificateImport represents importing
136+
a certificate into a single UEFI Secure Boot key database.
137+
properties:
138+
certificatePEMConfigMapRef:
139+
description: |-
140+
CertificatePEMConfigMapRef references the ConfigMap key holding the PEM-encoded
141+
certificate to import - a certificate isn't secret, but is typically too large and
142+
too reused-across-Workflows to inline directly into an Action.
143+
properties:
144+
key:
145+
description: Key within the ConfigMap's data.
146+
type: string
147+
name:
148+
description: Name of the ConfigMap.
149+
type: string
150+
namespace:
151+
description: Namespace the ConfigMap resides in.
152+
type: string
153+
required:
154+
- key
155+
- name
156+
- namespace
157+
type: object
158+
database:
159+
description: Database is the UEFI Secure Boot key database
160+
to import the certificate into (e.g. "db", "KEK").
161+
type: string
162+
required:
163+
- certificatePEMConfigMapRef
164+
- database
165+
type: object
166+
secureBootDatabaseResetKeys:
167+
description: SecureBootDatabaseResetKeys represents resetting
168+
a single UEFI Secure Boot key database.
169+
properties:
170+
database:
171+
description: Database is the UEFI Secure Boot key database
172+
to reset (e.g. "db", "KEK").
173+
type: string
174+
resetType:
175+
description: |-
176+
ResetType is the type of key reset to perform. PK is not a valid target at the
177+
per-database granularity, so DeletePK is not offered here (see SecureBootResetKeysAction).
178+
enum:
179+
- ResetAllKeysToDefault
180+
- DeleteAllKeys
181+
type: string
182+
required:
183+
- database
184+
- resetType
185+
type: object
186+
secureBootResetKeys:
187+
description: SecureBootResetKeys represents resetting the UEFI
188+
Secure Boot key databases.
189+
properties:
190+
resetType:
191+
description: ResetType is the type of key reset to perform.
192+
enum:
193+
- ResetAllKeysToDefault
194+
- DeleteAllKeys
195+
- DeletePK
196+
type: string
197+
required:
198+
- resetType
199+
type: object
123200
virtualMediaAction:
124201
description: VirtualMediaAction represents a baseboard management
125202
virtual media insert/eject.

‎crd/bases/v1alpha1/bmc.tinkerbell.org_tasks.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,83 @@ spec:
316316
- cycle
317317
- reset
318318
type: string
319+
secureBoot:
320+
description: SecureBoot represents enabling or disabling UEFI
321+
Secure Boot.
322+
properties:
323+
enable:
324+
description: Enable indicates whether Secure Boot should be
325+
enabled or disabled.
326+
type: boolean
327+
required:
328+
- enable
329+
type: object
330+
secureBootCertificateImport:
331+
description: SecureBootCertificateImport represents importing
332+
a certificate into a single UEFI Secure Boot key database.
333+
properties:
334+
certificatePEMConfigMapRef:
335+
description: |-
336+
CertificatePEMConfigMapRef references the ConfigMap key holding the PEM-encoded
337+
certificate to import - a certificate isn't secret, but is typically too large and
338+
too reused-across-Workflows to inline directly into an Action.
339+
properties:
340+
key:
341+
description: Key within the ConfigMap's data.
342+
type: string
343+
name:
344+
description: Name of the ConfigMap.
345+
type: string
346+
namespace:
347+
description: Namespace the ConfigMap resides in.
348+
type: string
349+
required:
350+
- key
351+
- name
352+
- namespace
353+
type: object
354+
database:
355+
description: Database is the UEFI Secure Boot key database
356+
to import the certificate into (e.g. "db", "KEK").
357+
type: string
358+
required:
359+
- certificatePEMConfigMapRef
360+
- database
361+
type: object
362+
secureBootDatabaseResetKeys:
363+
description: SecureBootDatabaseResetKeys represents resetting
364+
a single UEFI Secure Boot key database.
365+
properties:
366+
database:
367+
description: Database is the UEFI Secure Boot key database
368+
to reset (e.g. "db", "KEK").
369+
type: string
370+
resetType:
371+
description: |-
372+
ResetType is the type of key reset to perform. PK is not a valid target at the
373+
per-database granularity, so DeletePK is not offered here (see SecureBootResetKeysAction).
374+
enum:
375+
- ResetAllKeysToDefault
376+
- DeleteAllKeys
377+
type: string
378+
required:
379+
- database
380+
- resetType
381+
type: object
382+
secureBootResetKeys:
383+
description: SecureBootResetKeys represents resetting the UEFI
384+
Secure Boot key databases.
385+
properties:
386+
resetType:
387+
description: ResetType is the type of key reset to perform.
388+
enum:
389+
- ResetAllKeysToDefault
390+
- DeleteAllKeys
391+
- DeletePK
392+
type: string
393+
required:
394+
- resetType
395+
type: object
319396
virtualMediaAction:
320397
description: VirtualMediaAction represents a baseboard management
321398
virtual media insert/eject.

0 commit comments

Comments
 (0)