Add BMCSettingsApplyResultEntry type to BMCSettings status for ETag-based drift detection

Add the BMCSettingsApplyResultEntry struct to api/v1alpha1/bmcsettings_types.go
and the AppliedETags field to BMCSettingsStatus:

  type BMCSettingsApplyResultEntry struct {
      URI       string `json:"uri,omitempty"`
      ETag      string `json:"etag,omitempty"`
      ValueHash string `json:"valueHash,omitempty"`
  }

  AppliedETags map[string]BMCSettingsApplyResultEntry `json:"appliedETags,omitempty"`

- URI: the Redfish resource URI from the apply response (Location header for
  POST-created resources; request URI for PATCH)
- ETag: drift-detection token after the last successful apply — either a real
  ETag returned by the BMC (e.g. W/"20B77DA6") or a SHA-256 hash of the GET
  response prefixed with "hash:sha256:" for BMCs that do not return ETag headers
- ValueHash: SHA-256 of the effective (resolved) value at apply time, used to
  detect desired-state changes from ConfigMap/Secret rotation without relying
  on metadata.generation

The type is named BMCSettingsApplyResultEntry (rather than ApplyResultEntry) to
follow the existing sub-type naming convention (BMCSettingsSpec, BMCSettingsStatus,
BMCSettingsSetStatus, etc.) and to scope it clearly to the BMCSettings resource.

Regenerate CRD manifests and deepcopy/applyconfiguration code via
`make manifests generate`. No controller logic changes in this commit.

Fixes #915
Part of #858

Signed-off-by: Andrew Dodds <andrew.dodds@sap.com>

Author: atd9876

BMC-AD-Config.md

@@ -0,0 +1,312 @@
+# BMC Directory Service Configuration - Requirements Definition - Extracted from sap.baremetal - deve-_role - bmc_directory
+
+## Overview
+This document defines the functional requirements for BMC (Baseboard Management Controller) Active Directory/LDAP integration, based on existing automation for Dell iDRAC, HPE iLO, Lenovo XCC, and Lenovo IMM systems.
+
+## Functional Requirements
+
+### 1. Multi-Vendor BMC Support
+The solution must configure Active Directory integration for:
+- Dell iDRAC (versions < 10 and iDRAC 10)
+- HPE iLO 
+- Lenovo XCC (XCC, XCC2, XCC3 variants)
+- Lenovo IMM (legacy systems)
+
+### 2. Active Directory/LDAP Integration
+
+#### 2.1 LDAP Server Configuration
+The solution must configure:
+- Domain controller hostname/IP address
+- LDAPS port (636)
+- Base Distinguished Name derived from domain (e.g., `DC=ad,DC=region,DC=cloud,DC=sap`)
+- Search username attribute: `sAMAccountName`
+- Authentication type: Username/Password
+
+**Current Implementation:**
+- **Dell iDRAC**: PATCH to `/redfish/v1/Managers/iDRAC.Embedded.1/Oem/Dell/DellAttributes/iDRAC.Embedded.1` with attributes:
+  - `ActiveDirectory.1.DomainController1`: `<dc-hostname>`
+  - `UserDomain.1.Name`: `<domain-name>`
+  - `ActiveDirectory.1.AuthTimeout`: `120`
+- **HPE iLO**: PATCH to `/redfish/v1/AccountService/` with body:
+  ```json
+  {
+    "LDAP": {
+      "ServiceAddresses": ["<dc-hostname>"],
+      "Authentication": {
+        "Username": "DC=<DN>"
+      }
+    }
+  }
+  ```
+- **Lenovo XCC**: PATCH to `/redfish/v1/AccountService` with:
+  ```json
+  {
+    "LDAP": {
+      "ServiceAddresses": ["<dc-hostname>:636"],
+      "LDAPService": {
+        "SearchSettings": {
+          "BaseDistinguishedNames": ["DC=<DN>"],
+          "UsernameAttribute": "sAMAccountName"
+        }
+      }
+    }
+  }
+  ```
+- **Lenovo IMM**: Raw CLI command: `ldap -s1ip <dc-hostname> -s1pn 636 -r <DN> -u sAMAccountName`
+
+#### 2.2 Authentication Mode Configuration
+The solution must:
+- Enable local account authentication as fallback
+- Enable LDAP/Active Directory authentication
+- Configure hybrid authentication mode (LDAP + local)
+
+**Current Implementation:**
+- **Dell iDRAC**: Sets `ActiveDirectory.1.Enable: "Enabled"` via manager attributes
+- **HPE iLO**: Sets `LocalAccountAuth: "Enabled"` in AccountService
+- **Lenovo XCC**: Sets `LocalAccountAuth: Fallback` in AccountService
+- **Lenovo IMM**: Raw CLI: `accseccfg -am ldaplocal`
+
+#### 2.3 AD Group to Role Mapping
+The solution must:
+- Map multiple Active Directory groups to BMC administrator roles
+- Support region-specific group mappings (production vs QA/lab)
+- Clear existing group mappings before applying new configuration
+- Support vendor-specific slot/privilege models
+
+**Current Implementation:**
+
+**Dell iDRAC** (15 slots):
+- PATCH manager attributes with combined group data:
+  ```json
+  {
+    "ADGroup.1.Name": "<group-name>",
+    "ADGroup.1.Privilege": 511,  // full admin
+    "ADGroup.1.Domain": "<domain>",
+    "ADGroup.2.Name": "",
+    "ADGroup.2.Privilege": 000,  // empty slot
+    ...
+  }
+  ```
+- iDRAC 10 uses `ADGroup.X.Role: "Administrator"` instead of Privilege
+
+**HPE iLO** (dynamic):
+- PATCH to `/redfish/v1/AccountService/`:
+  ```json
+  {
+    "ActiveDirectory": {
+      "RemoteRoleMapping": [
+        {"LocalRole": "Administrator", "RemoteGroup": "<group1>"},
+        {"LocalRole": "Administrator", "RemoteGroup": "<group2>"}
+      ]
+    }
+  }
+  ```
+
+**Lenovo XCC2/XCC3** (dynamic):
+- PATCH to `/redfish/v1/AccountService`:
+  ```json
+  {
+    "LDAP": {
+      "RemoteRoleMapping": [
+        {"LocalRole": "Administrator", "RemoteGroup": "CP_CONV_BMAAS"}
+      ]
+    }
+  }
+  ```
+
+**Lenovo XCC** (16 slots - legacy):
+- First, create empty mapping array, then update group profiles:
+- PATCH to `/redfish/v1/AccountService/Oem/Lenovo/GroupProfiles/Group<N>`:
+  ```json
+  {
+    "Privilege": ["Supervisor"],
+    "GroupName": "<ad-group>"
+  }
+  ```
+
+**Lenovo IMM** (16 slots):
+- Get existing: `gprofile`
+- Delete all: `gprofile -<N> -clear`
+- Create new: `gprofile -<N> -n <group-name> -a super`
+
+#### 2.4 DNS Configuration (Dell only)
+The solution must configure DNS servers for name resolution.
+
+**Current Implementation:**
+- **Dell iDRAC < 10**: Manager attributes `IPv4Static.1.DNS1`, `IPv4Static.1.DNS2`
+- **Dell iDRAC 10**: Manager attributes `IPv4.1.StaticDNS1`, `IPv4.1.StaticDNS2`
+
+### 3. SSL/TLS Certificate Management
+
+#### 3.1 CA Certificate Installation
+The solution must:
+- Download CA certificate from specified URL
+- Install CA certificate on BMC for LDAPS validation
+- Enable certificate validation after installation
+
+**Current Implementation:**
+
+**Dell iDRAC**:
+- Download certificate via HTTP GET
+- POST to certificate endpoint with certificate content:
+  - iDRAC < 10: `/redfish/v1/Dell/Managers/iDRAC.Embedded.1/DelliDRACCardService/Actions/DelliDRACCardService.ImportSSLCertificate`
+  - iDRAC 10: Different path (version-specific)
+  - Body: `{"CertificateType": "CA", "SSLCertificateFile": "<pem-content>"}`
+- Sets `ActiveDirectory.1.CertValidationEnable: "Enabled"`
+
+**HPE iLO**:
+- Download certificate via HTTP GET
+- POST to `/redfish/v1/AccountService/ExternalAccountProviders/LDAP/Certificates/`:
+  ```json
+  {
+    "CertificateType": "PEM",
+    "CertificateString": "<pem-content>"
+  }
+  ```
+
+**Lenovo XCC**:
+1. GET existing certificates: `/redfish/v1/AccountService/LDAP/Certificates`
+2. Disable LDAPS: PATCH `/redfish/v1/Managers/1/Oem/Lenovo/Security` with `{"SSLSettings": {"EnableLDAPS": false}}`
+3. Wait 5 seconds
+4. DELETE each existing certificate via returned `@odata.id`
+5. POST new certificate to `/redfish/v1/AccountService/LDAP/Certificates`:
+   ```json
+   {
+     "CertificateType": "PEM",
+     "CertificateString": "<pem-content>"
+   }
+   ```
+6. Wait 5 seconds
+7. Enable LDAPS: PATCH Security endpoint with `{"SSLSettings": {"EnableLDAPS": true}}`
+
+**Lenovo IMM**:
+1. Disable SSL: `sslcfg -client disabled`
+2. Delete existing: `sslcfg -tc1 remove`, `sslcfg -tc2 remove`, etc. (4 slots)
+3. Import new: `sslcfg -tc1 import -i <tftp-server> -l <cert-path>`
+4. Check for self-signed cert: `sslcfg`
+5. Create if missing: `sslcfg -cert client -c DE -sp "BW" -cl "St. Leon Rot" -on "SAP SE" -hn <hostname>`
+6. Enable SSL: `sslcfg -client enabled`
+
+#### 3.2 Certificate Validation
+The solution must enable LDAPS certificate validation after certificate installation.
+
+**Current Implementation:**
+- **Dell**: Sets manager attribute `ActiveDirectory.1.CertValidationEnable: "Enabled"`
+- **HPE**: Automatic when certificate is installed
+- **Lenovo XCC**: Enables via `EnableLDAPS: true` in Security settings
+- **Lenovo IMM**: Enables via `sslcfg -client enabled`
+
+### 4. Session Management
+
+#### 4.1 Authentication Session Lifecycle
+The solution must:
+- Create authenticated session before configuration operations
+- Use session token for subsequent API calls
+- Delete session after operations complete
+
+**Current Implementation (Redfish BMCs):**
+- **Session Creation**: POST to `/redfish/v1/SessionService/Sessions` with credentials, returns token
+- **Token Usage**: Include `X-Auth-Token: <token>` in all request headers
+- **Session Deletion**: DELETE to session URI after completion
+
+**Lenovo IMM**: Uses SSH connection with username/password for raw CLI commands
+
+### 5. Region-Specific Configuration
+
+#### 5.1 Environment-Based Group Selection
+The solution must:
+- Identify deployment region (production, QA, lab)
+- Select appropriate AD groups based on region
+- Override production groups with QA-specific groups in test environments
+
+**Current Implementation:**
+- Checks if `region in qa_regions` or `region in lab_regions`
+- Overrides `ad_group` variable with `ad_group_qa` when condition is true
+- Applies overridden groups to role mapping configuration
+
+### 6. Vendor-Specific Requirements
+
+#### 6.1 Dell iDRAC Version Detection
+The solution must detect iDRAC version and adjust configuration accordingly.
+
+**Current Implementation:**
+- Checks if `model in idrac10_models` 
+- Uses different manager attributes and API endpoints for iDRAC 10:
+  - GC Root Domain setting: `ActiveDirectory.1.GCRootDomain: "<domain>"`
+  - GC Lookup: `ActiveDirectory.1.GCLookupEnable: "Enabled"`
+  - Different DNS attributes: `IPv4.1.StaticDNS1` vs `IPv4Static.1.DNS1`
+  - Role-based privileges: `ADGroup.X.Role` vs `ADGroup.X.Privilege`
+
+#### 6.2 Lenovo XCC Variant Detection
+The solution must detect XCC variant (XCC, XCC2, XCC3) and use appropriate API structure.
+
+**Current Implementation:**
+- Checks `lenovo_xcc_type` variable
+- XCC2/XCC3: Use LDAP configuration in AccountService directly
+- XCC (legacy): Use separate GroupProfiles endpoint for privilege mapping
+- PATCH to `/redfish/v1/Managers/1/NetworkProtocol/Oem/Lenovo/LDAPClient` for initial LDAP client setup (all versions)
+
+#### 6.3 HPE-Specific Settings
+The solution must configure HPE OEM-specific directory settings.
+
+**Current Implementation:**
+- PATCH to `/redfish/v1/AccountService/` includes:
+  ```json
+  {
+    "Oem": {
+      "Hpe": {
+        "DirectorySettings": {
+          "LdapAuthenticationMode": "DefaultSchema"
+        }
+      }
+    }
+  }
+  ```
+
+### 7. Error Handling and Validation
+
+#### 7.1 Operation Verification
+The solution must:
+- Verify successful HTTP status codes (200, 201, 202, 204)
+- Validate command output for CLI-based operations (check for "ok" in stdout)
+- Detect and report errors (import failures, authentication errors)
+
+**Current Implementation:**
+- Ansible URI module: `status_code: [200, 201, 202, 204]`
+- Ansible raw CLI: `changed_when: '"ok" in stdout'` and `failed_when: '"Error" in stdout'`
+
+#### 7.2 Timeout Configuration
+The solution must handle long-running operations with appropriate timeouts.
+
+**Current Implementation:**
+- API timeouts range from 15 to 360 seconds depending on operation
+- Certificate operations: 120-300 seconds
+- Standard configuration: 120-360 seconds
+
+### 8. Operational Requirements
+
+#### 8.1 Wait Periods
+The solution must respect vendor timing requirements between operations.
+
+**Current Implementation:**
+- Lenovo XCC: 5-second pause after disabling LDAPS and after certificate import
+- Implemented via: `ansible.builtin.pause: seconds: 5`
+
+#### 8.2 Idempotency
+The solution must:
+- Clear existing configurations before applying new settings
+- Support re-running without creating duplicate entries
+- Only modify configurations that differ from desired state
+
+**Current Implementation:**
+- Dell: Overwrites all 15 slots (populated and empty)
+- Lenovo IMM: Deletes all existing gprofiles before creating new ones
+- Lenovo XCC: Deletes all existing LDAP certificates before importing new one
+- HPE: Replaces entire RemoteRoleMapping array
+
+#### 8.3 Certificate Validation Bypass
+The solution must disable SSL certificate validation when communicating with BMCs (self-signed certificates).
+
+**Current Implementation:**
+- All Redfish API calls: `validate_certs: false`
+- Allows connection to BMCs with self-signed certificates