Solve Issue #63: Add Support for Token Authentication and User/Pass Authentication in BMC Firmware Update by abhashsolanki18 · Pull Request #89 · opiproject/ansible-opi-dpu

abhashsolanki18 · 2024-07-02T07:26:53Z

Issue Addressed: Resolves #63
Changes Made:

Added support for token-based authentication alongside existing user/password authentication in the BMC firmware update process.
Introduced two distinct blocks in roles/bmc_fw_update/tasks/main.yml:
User/Password Authentication Block: For handling authentication using username and password.
Token Authentication Block: For handling authentication using tokens.

Details:
Updated the community.general.redfish_info task to support both authentication methods.
Ensured compatibility with existing configurations and backward compatibility.

@glimchb Please review these changes. Your feedback is appreciated!

glimchb · 2024-07-06T22:00:56Z

@abhashsolanki18 thanks for fixing this
Please see commitlint failure.
Otherwise looks good.
If you rebase, those ansible ci failures should be resolved

Signed-off-by: abhash abhashsolanki18@gmail.com Signed-off-by: root <root@localhost.localdomain>

abhashsolanki18 · 2024-07-09T17:01:36Z

@glimchb i have rebased the commits now it should pass the ci.

roles/bmc_fw_update/tasks/main.yml

glimchb

@abhashsolanki18

looks like linter fails on your changes, please fix
i saw one place at the end when you don;t give neither user/pass nor auth token... looks like a bug...

Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

abhashsolanki18 · 2024-07-11T11:01:41Z

@glimchb
the linters should also exclude ansible 2.17 with python 3.9, fixed that in the latest commit
also fixed the bug you highlighted earlier.

.github/workflows/ansible.yml

glimchb · 2024-07-12T00:38:53Z

roles/bmc_fw_update/tasks/main.yml

  when:
    - bmc_fw_update_reboot is true
-    - not bmc_fw_update_image_file is search(bmc_fw_update_got_fw_version | regex_search('[0-9-.]+'))
+    - not bmc_fw_update_image_file is search(bmc_fw_update_got_fw_version | regex_search('[0-9-.]+'))"


last " is typo?

yes, fixed it

This commit resolves multiple YAML linting issues in the `bmc_fw_update` task file. - Removed extra blank lines - Ensured all tasks are named - Improved task key order - Prefixed variable names appropriately These changes should ensure the playbook passes `yamllint` and `ansible-lint` checks. Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

abhashsolanki18 · 2024-07-12T05:46:27Z

Invalid workflow file: .github/workflows/docker-publish.yml#L13
The workflow is not valid. .github/workflows/docker-publish.yml (Line: 13, Col: 3): Error calling workflow 'opiproject/actions/.github/workflows/docker-publish.yml@main'. The nested job 'build' is requesting 'id-token: write', but is only allowed 'id-token: none'.

@glimchb what is the error about? failing while executing docker workflow as well as openSSF workflow

.github/workflows/ansible.yml

roles/bmc_fw_update/tasks/main.yml

glimchb · 2024-07-14T23:17:25Z

@glimchb what is the error about? failing while executing docker workflow as well as openSSF workflow

will check it

Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

glimchb · 2024-07-15T23:28:55Z

roles/bmc_fw_update/tasks/main.yml

 - name: Store current fw version
  ansible.builtin.set_fact:
-    bmc_fw_update_cur_fw_version: "{{ vars.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"
+    bmc_fw_update_cur_fw_version: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"


this doesn't work in my setup for some reason, let's try to understand why?

TASK [get_bmc_facts : Print all Versions] *************************************************************************************************************************************************** task path: /opt/roles/get_bmc_facts/tasks/main.yml:54 ok: [172.22.4.2] => { "msg": { "6d53cf4d_bmc_firmware": "bf-24.01-5-0-gdd4a6159ce7.1704982350.6715245", "bluefield_fw_erot": "4-15", "dpu_atf": "", "dpu_board": "", "dpu_bsp": "", "dpu_nic": "", "dpu_node": "", "dpu_ofed": "", "dpu_os": "", "dpu_sys_image": "", "dpu_uefi": "" } } TASK [bmc_fw_update : Store current fw version] ********************************************************************************************************************************************* task path: /opt/roles/bmc_fw_update/tasks/main.yml:24 fatal: [172.22.4.2]: FAILED! => { "msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'get_bmc_facts_all_fw_versions'. 'dict object' has no attribute 'get_bmc_facts_all_fw_versions'\n\nThe error appears to be in '/opt/roles/bmc_fw_update/tasks/main.yml': line 24, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Store current fw version\n ^ here\n" }

glimchb · 2024-07-15T23:28:59Z

roles/bmc_fw_update/tasks/main.yml

 - name: Print BMC Version
  ansible.builtin.debug:
-    msg: "{{ get_bmc_facts_all_fw_versions }}"
+    msg: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions }}"


this doesn't work in my setup for some reason, let's try to understand why?

TASK [bmc_fw_update : Store current fw version] ********************************************************************************************************************************************* task path: /opt/roles/bmc_fw_update/tasks/main.yml:24 ok: [172.22.4.2] => { "ansible_facts": { "bmc_fw_update_cur_fw_version": "bf-24.01-5-0-gdd4a6159ce7.1704982350.6715245" }, "changed": false } TASK [bmc_fw_update : Print BMC Version] **************************************************************************************************************************************************** task path: /opt/roles/bmc_fw_update/tasks/main.yml:28 fatal: [172.22.4.2]: FAILED! => { "msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'get_bmc_facts_all_fw_versions'. 'dict object' has no attribute 'get_bmc_facts_all_fw_versions'\n\nThe error appears to be in '/opt/roles/bmc_fw_update/tasks/main.yml': line 28, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Print BMC Version\n ^ here\n" }

glimchb · 2024-07-15T23:29:46Z

@abhashsolanki18 I tested your changes and they fail, please fix

I used for user/pass flow:

docker run --rm -it --entrypoint ansible-playbook -v $(pwd):/opt -w /opt/roles ghcr.io/opiproject/ansible-opi-dpu:main ../playbooks/firmware.yml -vvv -i "172.22.4.2," -e dpu_bmc_username='root' -e dpu_bmc_password='123456' -e bmc_fw_update_inventory_name='6d53cf4d_bmc_firmware' -e bmc_fw_update_image_file='/tmp/bf2-bmc-ota-24.04-5-opn.tar'

I hit errors, so I had to make those changes:

diff --git a/roles/bmc_fw_update/defaults/main.yml b/roles/bmc_fw_update/defaults/main.yml
index ba5ffaf..ba8a611 100644
--- a/roles/bmc_fw_update/defaults/main.yml
+++ b/roles/bmc_fw_update/defaults/main.yml
@@ -8,5 +8,5 @@ bmc_fw_update_reboot: true
 bmc_fw_update_job_wait: true
 bmc_fw_update_inventory_name: bmc_firmware
 bmc_fw_update_image_file: /tmp/bf3-bmc-24.04-5_opn.fwpkg
-bmc_fw_update_image_url: https://content.mellanox.com/BlueField/BMC/24.04-5-Apr-2024/{{ bmc_fw_update_image_file | basename }}
+bmc_fw_update_image_url: https://www.mellanox.com/downloads/BlueField/BMC/24.04-5-Apr-2024/{{ bmc_fw_update_image_file | basename }}
 https_port: 443
diff --git a/roles/bmc_fw_update/tasks/main.yml b/roles/bmc_fw_update/tasks/main.yml
index e37647c..93b8d05 100644
--- a/roles/bmc_fw_update/tasks/main.yml
+++ b/roles/bmc_fw_update/tasks/main.yml
@@ -23,11 +23,11 @@

 - name: Store current fw version
   ansible.builtin.set_fact:
-    bmc_fw_update_cur_fw_version: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"
+    bmc_fw_update_cur_fw_version: "{{ vars.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"

 - name: Print BMC Version
   ansible.builtin.debug:
-    msg: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions }}"
+    msg: "{{ get_bmc_facts_all_fw_versions }}"

 - name: Check if firmware image exists locally {{ bmc_fw_update_image_file }}
   ansible.builtin.stat:

once fixed, I can test the same with token:

curl -k -H "Content-Type: application/json" -X POST https://172.22.4.2/login -d '{"username" : "root", "password" : "123456"}'
docker run --rm -it --entrypoint ansible-playbook -v $(pwd):/opt -w /opt/roles ghcr.io/opiproject/ansible-opi-dpu:main ../playbooks/firmware.yml -vvv -i "172.22.4.2," -e dpu_bmc_token='123456' -e bmc_fw_update_inventory_name='6d53cf4d_bmc_firmware' -e bmc_fw_update_image_file='/tmp/bf2-bmc-ota-24.04-5-opn.tar'

glimchb · 2024-07-15T23:31:32Z

roles/bmc_fw_update/tasks/main.yml


 - name: Store fw version we installed
  ansible.builtin.set_fact:
-    bmc_fw_update_got_fw_version: "{{ vars.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"


this doesn't work in my setup for some reason, let's try to understand why?

abhashsolanki18 · 2024-07-19T08:11:15Z

@abhashsolanki18 I tested your changes and they fail, please fix

I used for user/pass flow:

docker run --rm -it --entrypoint ansible-playbook -v $(pwd):/opt -w /opt/roles ghcr.io/opiproject/ansible-opi-dpu:main ../playbooks/firmware.yml -vvv -i "172.22.4.2," -e dpu_bmc_username='root' -e dpu_bmc_password='123456' -e bmc_fw_update_inventory_name='6d53cf4d_bmc_firmware' -e bmc_fw_update_image_file='/tmp/bf2-bmc-ota-24.04-5-opn.tar'

I hit errors, so I had to make those changes:

diff --git a/roles/bmc_fw_update/defaults/main.yml b/roles/bmc_fw_update/defaults/main.yml
index ba5ffaf..ba8a611 100644
--- a/roles/bmc_fw_update/defaults/main.yml
+++ b/roles/bmc_fw_update/defaults/main.yml
@@ -8,5 +8,5 @@ bmc_fw_update_reboot: true
 bmc_fw_update_job_wait: true
 bmc_fw_update_inventory_name: bmc_firmware
 bmc_fw_update_image_file: /tmp/bf3-bmc-24.04-5_opn.fwpkg
-bmc_fw_update_image_url: https://content.mellanox.com/BlueField/BMC/24.04-5-Apr-2024/{{ bmc_fw_update_image_file | basename }}
+bmc_fw_update_image_url: https://www.mellanox.com/downloads/BlueField/BMC/24.04-5-Apr-2024/{{ bmc_fw_update_image_file | basename }}
 https_port: 443
diff --git a/roles/bmc_fw_update/tasks/main.yml b/roles/bmc_fw_update/tasks/main.yml
index e37647c..93b8d05 100644
--- a/roles/bmc_fw_update/tasks/main.yml
+++ b/roles/bmc_fw_update/tasks/main.yml
@@ -23,11 +23,11 @@

 - name: Store current fw version
   ansible.builtin.set_fact:
-    bmc_fw_update_cur_fw_version: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"
+    bmc_fw_update_cur_fw_version: "{{ vars.get_bmc_facts_all_fw_versions[bmc_fw_update_inventory_name] }}"

 - name: Print BMC Version
   ansible.builtin.debug:
-    msg: "{{ get_bmc_facts_before.get_bmc_facts_all_fw_versions }}"
+    msg: "{{ get_bmc_facts_all_fw_versions }}"

 - name: Check if firmware image exists locally {{ bmc_fw_update_image_file }}
   ansible.builtin.stat:

once fixed, I can test the same with token:

curl -k -H "Content-Type: application/json" -X POST https://172.22.4.2/login -d '{"username" : "root", "password" : "123456"}'
docker run --rm -it --entrypoint ansible-playbook -v $(pwd):/opt -w /opt/roles ghcr.io/opiproject/ansible-opi-dpu:main ../playbooks/firmware.yml -vvv -i "172.22.4.2," -e dpu_bmc_token='123456' -e bmc_fw_update_inventory_name='6d53cf4d_bmc_firmware' -e bmc_fw_update_image_file='/tmp/bf2-bmc-ota-24.04-5-opn.tar'

will find out whats going wrong

abhashsolanki18 requested a review from a team as a code owner July 2, 2024 07:26

abhashsolanki18 force-pushed the main branch from ae1368f to 0b3e4a3 Compare July 2, 2024 08:09

abhashsolanki18 force-pushed the main branch 4 times, most recently from 305b124 to 689cb7e Compare July 9, 2024 12:21

fix: support-token-user/pass

ebc046b

Signed-off-by: abhash abhashsolanki18@gmail.com Signed-off-by: root <root@localhost.localdomain>

abhashsolanki18 force-pushed the main branch from 689cb7e to ebc046b Compare July 9, 2024 12:24

glimchb reviewed Jul 9, 2024

View reviewed changes

roles/bmc_fw_update/tasks/main.yml Show resolved Hide resolved

glimchb requested changes Jul 9, 2024

View reviewed changes

linters fix

61dbf13

Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

glimchb reviewed Jul 11, 2024

View reviewed changes

.github/workflows/ansible.yml Show resolved Hide resolved

glimchb reviewed Jul 12, 2024

View reviewed changes

abhashsolanki18 force-pushed the main branch from 1466b36 to e5fb951 Compare July 12, 2024 05:35

glimchb reviewed Jul 14, 2024

View reviewed changes

.github/workflows/ansible.yml Outdated Show resolved Hide resolved

glimchb reviewed Jul 14, 2024

View reviewed changes

.github/workflows/ansible.yml Outdated Show resolved Hide resolved

glimchb reviewed Jul 14, 2024

View reviewed changes

roles/bmc_fw_update/tasks/main.yml Show resolved Hide resolved

abhashsolanki18 and others added 3 commits July 15, 2024 21:51

Merge branch 'opiproject:main' into main

56967c1

fix(bmc_fw_update): resolve workflow permission errors

caf19dd

Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

fix(bmc_fw_update): resolve workflow permission errors

91dee45

Signed-off-by: Abhash Solanki <abhashsolanki18@gmail.com>

glimchb reviewed Jul 15, 2024

View reviewed changes

glimchb added the Merge Candidate in the open merge window, next candidate for merge label Jul 16, 2024

Conversation

abhashsolanki18 commented Jul 2, 2024

Uh oh!

glimchb commented Jul 6, 2024

Uh oh!

abhashsolanki18 commented Jul 9, 2024

Uh oh!

Uh oh!

glimchb left a comment

Choose a reason for hiding this comment

Uh oh!

abhashsolanki18 commented Jul 11, 2024

Uh oh!

Uh oh!

glimchb Jul 12, 2024

Choose a reason for hiding this comment

Uh oh!

abhashsolanki18 Jul 12, 2024

Choose a reason for hiding this comment

Uh oh!

abhashsolanki18 commented Jul 12, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

glimchb commented Jul 14, 2024

Uh oh!

glimchb Jul 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

glimchb Jul 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

glimchb commented Jul 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

glimchb Jul 15, 2024

Choose a reason for hiding this comment

Uh oh!

abhashsolanki18 commented Jul 19, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

glimchb Jul 15, 2024 •

edited

Loading

glimchb Jul 15, 2024 •

edited

Loading

glimchb commented Jul 15, 2024 •

edited

Loading