Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Secure Boot for Satellite and RHEL #3488

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
+57 −11
Open

Add Secure Boot for Satellite and RHEL #3488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
20048f4
Add Secure Boot for Satellite and RHEL
Lennonka Dec 4, 2024
36d35d0
Add a note about supported architectures
Lennonka Dec 17, 2024
029af2f
Fix SB intro for Satellite
Lennonka Jan 20, 2025
90759c5
Add SB to the new provisioning guide
Lennonka Jan 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions guides/common/assembly_using-network-boot-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,24 @@
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+2]
endif::[]

Check failure on line 69 in guides/common/assembly_using-network-boot-to-provision-hosts.adoc

View workflow job for this annotation

GitHub Actions / linter 

[vale] reported by reviewdog 🐶
[AsciiDoc.ValidConditions] File contains unbalanced if statements. Review the file to ensure it contains matching opening and closing if statements.

Raw Output:
{"message": "[AsciiDoc.ValidConditions] File contains unbalanced if statements. Review the file to ensure it contains matching opening and closing if statements.", "location": {"path": "guides/common/assembly_using-network-boot-to-provision-hosts.adoc", "range": {"start": {"line": 69, "column": 1}}}, "severity": "ERROR"}

:client-os-context: rhel
:client-os: {RHEL}
:client-pkg-ext: rpm
:grub_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:grub_efi_downloaded_package_name: grub2-efi-x64.rpm
:grub_efi_package_name: grub2-efi-x64
:grub_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/grubx64.efi
:shim_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:shim_efi_downloaded_package_name: shim-x64.rpm
:shim_efi_package_name: shim-x64
:shim_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/shimx64.efi
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]

ifndef::satellite[]
:client-os-context: ubuntu
:client-os: Ubuntu
:client-pkg-ext: deb
Expand All @@ -81,6 +98,7 @@
:extract_grub: {extract_deb_prefix}/{grub_efi_downloaded_package_name} {extract_deb_zst_suffix}
:extract_shim: {extract_deb_prefix}/{shim_efi_downloaded_package_name} {extract_deb_xz_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+2]
endif::[]

// reset global attributes
:client-os: {parent-client-os}
Expand Down
21 changes: 19 additions & 2 deletions guides/common/assembly_using-pxe-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ include::modules/proc_creating-hosts-with-pxeless-provisioning.adoc[leveloffset=

include::modules/proc_creating-hosts-with-uefi-http-boot-provisioning.adoc[leveloffset=+1]

ifndef::satellite[]
:extract_deb_prefix: cd /tmp && ar x /tmp
:extract_deb_xz_suffix: && tar -xf data.tar.xz && cd -
:extract_deb_zst_suffix: && tar --use-compress-program=unzstd -xf data.tar.zst && cd -
Expand All @@ -21,6 +20,7 @@ ifndef::satellite[]
:parent-client-pkg-ext: {client-pkg-ext}
:secureboot-os-name: My_Operating_System_In_Lowercase
Lennonka marked this conversation as resolved.
Show resolved Hide resolved

ifndef::satellite[]
:client-os-context: almalinux
:client-os: AlmaLinux
:client-pkg-ext: rpm
Expand Down Expand Up @@ -65,7 +65,24 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]
endif::[]

:client-os-context: rhel
:client-os: {RHEL}
:client-pkg-ext: rpm
:grub_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:grub_efi_downloaded_package_name: grub2-efi-x64.rpm
:grub_efi_package_name: grub2-efi-x64
:grub_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/grubx64.efi
:shim_efi_download_url: https://access.redhat.com/downloads/content/package-browser[Package browser] on the Red{nbsp}Hat Customer Portal
:shim_efi_downloaded_package_name: shim-x64.rpm
:shim_efi_package_name: shim-x64
:shim_efi_tmp_binary_path: /tmp/boot/efi/EFI/{client-os-context}/shimx64.efi
:extract_grub: {extract_rpm_prefix}/{grub_efi_downloaded_package_name} {extract_rpm_suffix}
:extract_shim: {extract_rpm_prefix}/{shim_efi_downloaded_package_name} {extract_rpm_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]

ifndef::satellite[]
:client-os-context: ubuntu
:client-os: Ubuntu
:client-pkg-ext: deb
Expand All @@ -80,6 +97,7 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:extract_grub: {extract_deb_prefix}/{grub_efi_downloaded_package_name} {extract_deb_zst_suffix}
:extract_shim: {extract_deb_prefix}/{shim_efi_downloaded_package_name} {extract_deb_xz_suffix}
include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc[leveloffset=+1]
endif::[]

// reset global attributes
:client-os: {parent-client-os}
Expand All @@ -103,7 +121,6 @@ include::modules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-h
:!shim_efi_downloaded_package_name:
:!shim_efi_package_name:
:!shim_efi_tmp_binary_path:
endif::[]

include::modules/proc_deploying-ssh-keys-during-provisioning.adoc[leveloffset=+1]
:!using-pxe-to-provision-hosts:
13 changes: 7 additions & 6 deletions guides/common/modules/con_using-network-boot-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,22 +43,23 @@ In {Project} provisioning, the PXE loader option defines the DHCP `filename` opt
* For BIOS systems, select the *PXELinux BIOS* option to enable a provisioned host to download the `pxelinux.0` file over TFTP.
* For UEFI systems, select the *Grub2 UEFI* option to enable a TFTP client to download `grubx64.efi` file, or select the *Grub2 UEFI HTTP* option to enable an UEFI HTTP client to download `grubx64.efi` with the HTTP Boot feature.

ifdef::satellite[]
By default, you can provision the RHEL version of your {ProjectServer} on Secure Boot enabled hosts.
To provision other versions of {RHEL}, you have to provide signed shim and GRUB2 binaries of those RHEL versions.
For more information, see xref:configuring-{smart-proxy-context}-to-provision-rhel-on-Secure-Boot-enabled-hosts[].
endif::[]
ifndef::satellite[]
{ProjectName} supports UEFI Secure Boot.
SecureBoot PXE loaders enable a client to download the `shim.efi` bootstrap boot loader that then loads the signed `grubx64.efi`.
Use the *Grub2 UEFI SecureBoot* PXE loader for PXE-boot provisioning or *Grub2 UEFI HTTPS SecureBoot* for HTTP-boot provisioning.

By default, you can provision operating systems from the vendor of the operating system of your {ProjectServer} on Secure Boot enabled hosts.
To provision operating systems on Secure Boot enabled hosts from different vendors, you have to provide signed shim and GRUB2 binaries provided by the vendor of your operating system.
ifndef::orcharhino[]
endif::[]
ifndef::orcharhino,satellite[]
For more information, see:

* xref:configuring-{smart-proxy-context}-to-provision-almalinux-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-debian-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-rocky-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-ubuntu-on-Secure-Boot-enabled-hosts[]
endif::[]
endif::[]

ifdef::satellite[]
For more information about supported workflows, see https://access.redhat.com/solutions/2674001[Supported architectures and provisioning scenarios].
Expand Down
11 changes: 8 additions & 3 deletions guides/common/modules/con_using-pxe-to-provision-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,22 +43,27 @@ In {Project} provisioning, the PXE loader option defines the DHCP `filename` opt
* For BIOS systems, select the *PXELinux BIOS* option to enable a provisioned host to download the `pxelinux.0` file over TFTP.
* For UEFI systems, select the *Grub2 UEFI* option to enable a TFTP client to download `grubx64.efi` file, or select the *Grub2 UEFI HTTP* option to enable an UEFI HTTP client to download `grubx64.efi` with the HTTP Boot feature.

ifndef::satellite[]
{ProjectName} supports UEFI Secure Boot.
SecureBoot PXE loaders enable a client to download the `shim.efi` bootstrap boot loader that then loads the signed `grubx64.efi`.
Use the *Grub2 UEFI SecureBoot* PXE loader for PXE-boot provisioning or *Grub2 UEFI HTTPS SecureBoot* for HTTP-boot provisioning.
Lennonka marked this conversation as resolved.
Show resolved Hide resolved

ifdef::satellite[]
By default, you can provision the RHEL version of your {ProjectServer} on Secure Boot enabled hosts.
To provision other versions of {RHEL}, you have to provide signed shim and GRUB2 binaries of those RHEL versions.
For more information, see xref:configuring-{smart-proxy-context}-to-provision-rhel-on-Secure-Boot-enabled-hosts[].
endif::[]
ifndef::satellite[]
By default, you can provision operating systems from the vendor of the operating system of your {ProjectServer} on Secure Boot enabled hosts.
To provision operating systems on Secure Boot enabled hosts from different vendors, you have to provide signed shim and GRUB2 binaries provided by the vendor of your operating system.
ifndef::orcharhino[]
endif::[]
ifndef::orcharhino,satellite[]
For more information, see:

* xref:configuring-{smart-proxy-context}-to-provision-almalinux-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-debian-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-rocky-on-Secure-Boot-enabled-hosts[]
* xref:configuring-{smart-proxy-context}-to-provision-ubuntu-on-Secure-Boot-enabled-hosts[]
endif::[]
endif::[]

ifdef::satellite[]
For more information about supported workflows, see https://access.redhat.com/solutions/2674001[Supported architectures and provisioning scenarios].
Expand Down
5 changes: 5 additions & 0 deletions ...odules/proc_configuring-smart-proxy-to-provision-secure-boot-enabled-hosts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,12 @@ To provision {client-os} on Secure Boot enabled hosts with the *Grub2 UEFI Secur
You have to perform the following configuration steps on each TFTP {SmartProxy} for a subnet to provision Secure Boot enabled hosts on that subnet.
====

ifdef::satellite[]
{client-os} supports Secure Boot on x86_64 architecture only.
endif::[]
ifndef::satellite[]
The following example works for {client-os} on x86_64 architecture.
endif::[]

.Prerequisites
ifeval::["{client-os}" == "Debian"]
Expand Down
Loading