Chapter 6. Using bare metal as a service

Procedure

1. Configure a BMaaS bmadmin user in the identity provider and create a secret in OpenShift:

   1. Create the bmadmin user in the identity provider. For example, if using the htpasswd identity provider, run the following command:

      $ htpasswd -c -B -b ./users_htpasswd <username> <password>

      Copy to Clipboard

      <username>

      The user name for the identity provider. Replace <username> with your preferred user name. This example uses bmadmin.

      <password>

      The password for the user. Replace <password> with a secure password.

   2. Create a secret in the openshift-config namespace to store the identity provider configuration by running the following command:

      $ oc create secret generic <identity_provider_arguments> -n openshift-config

      Copy to Clipboard

      For example, when using the htpasswd identity provider, run the following command:

      $ oc create secret generic htpass-secret --from-file=htpasswd=users_htpasswd -n openshift-config

      Copy to Clipboard

      <identity_provider_arguments>

      The arguments specific to the identity provider secret. Replace <identity_provider_arguments> with the appropriate arguments for your identity provider.

2. Configure OAuth to use the identity provider:

   1. Edit the OAuth resource by running the following command:

      $ oc edit oauth cluster

      Copy to Clipboard

      The editor opens and displays the Oauth resource.

   2. Add the identity provider configuration to the spec.identityProviders list:

      Table 6.1. Identity provider configuration examples

      Type	Example
      htpasswd	# ... - name: my_bmaas_provider mappingMethod: claim type: htpasswd htpasswd: fileData: name: <secret> # ... Copy to Clipboard
      LDAP	# ... - name: my_bmaas_provider mappingMethod: claim type: ldap ldap: attributes: id: - dn email: - mail name: - cn preferredUsername: - uid # ... Copy to Clipboard
      GitHub	# ... - name: my_bmaas_provider mappingMethod: claim type: GitHub github: ca: name: ca-config-map clientID: {...} clientSecret: name: github-secret hostname: ... organizations: - myorganization1 - myorganization2 teams: - myorganization1/team-a - myorganization2/team-b # ... Copy to Clipboard

      For more information about identify providers, see Authentication and authorization.

   3. Save and exit the editor.

3. Create a BMaaS bmadmin user by running the following command:

   $ oc create user <username>

   Copy to Clipboard

   <username>

   The user name. Replace <username> with your username. The following examples use bmadmin as the username.

4. Create a dedicated bmaas namespace for BMaaS hosts by running the following command:

   $ oc new-project <namespace>

   Copy to Clipboard

   <namespace>

   Replace <namespace> with the namespace name that you want to use. This example uses bmaas.

5. Assign the edit role to the BMaaS bmadmin user in the bmaas namespace by running the following command:

   $ oc adm policy add-role-to-user edit <username> -n bmaas

   Copy to Clipboard

6. Clone the baremetal-operator repository to obtain the role-based access control (RBAC) role definitions by running the following command:

   $ git clone -b release-4.19 https://github.com/openshift/baremetal-operator.git

   Copy to Clipboard

7. For each role you want to add, apply the appropriate RBAC role YAML file from the repository by running the following command:

   $ oc apply -f baremetal-operator/config/base/rbac/<role_filename>.yaml

   Copy to Clipboard

8. Assign the custom RBAC roles to the BMaaS bmadmin user in the bmaas namespace by running the following command:

   $ oc adm policy add-role-to-user <role_name> bmadmin -n bmaas

   Copy to Clipboard

9. Login as the bmadmin user by running the following command:

   $ oc login <api_server_url>:6443

   Copy to Clipboard

   <api_server_url>

   The URL to the Kubernetes API.

Procedure

1. Create a BMC secret file by running the following command:

   $ vim bmaas-<name>-bmc-secret.yaml

   Copy to Clipboard

   Replace <name> with the name of the bare-metal host.

2. Edit the secret:

   apiVersion: v1
   kind: Secret
   metadata:
     name: bmaas-<name>-bmc-secret
     namespace: bmaas
   type: Opaque
   data:
     username: <base64_of_uid>
     password: <base64_of_pwd>

   Copy to Clipboard

   <base64_of_uid>

   Replace <base64_of_uid> with the BMC user name as a Base64-encoded string.

   <base64_of_pwd>

   Replace <base64_of_pwd> with the BMC password as a Base64-encoded string.

3. Apply the BMC secret by running the following command:

   $ oc apply -f bmaas-<name>-bmc-secret.yaml

   Copy to Clipboard

Procedure

1. Create a BareMetalHost custom resource (CR) file by running the following command:

   $ vim bmaas-<name>-bmh.yaml

   Copy to Clipboard

   <name>

   Replace <name> with the name of the bare-metal host.

2. Edit the CR:

   apiVersion: metal3.io/v1alpha1
   kind: BareMetalHost
   metadata:
     name: bmaas-<name>
     namespace:  bmaas
   spec:
     online: true
     bootMACAddress: <mac_addr>
     bmc:
       address: redfish-virtualmedia+<address>/redfish/v1/Systems/System.Embedded.1
       credentialsName: bmaas-<num>-bmc-secret

   Copy to Clipboard

   <mac_addr>

   Replace <mac_addr> with the MAC address of the first NIC on the bare-metal host.

   <address>

   Replace <address> with IP address or FQDN of the host.

3. Apply the CR by running the following command:

   $ oc apply -f bmaas-<name>-bmh.yaml

   Copy to Clipboard

Procedure

1. Create a file named <hostname>-user-data.yaml with the following content:

   users:
     - name: <name>
       sudo: [<sudo_config>]
       ssh_authorized_keys:
         - <key_type>
         <key>
       shell: <shell_path>
       groups: [<groups>]
       lock_passwd: true|false

   Copy to Clipboard

   <hostname>

   The name of the bare-metal host.

   <name>

   The user name.

   <sudo_config>

   The sudo configuration for the user.

   <key_type>

   The SSH key type.

   <key>

   The public SSH key to use when accessing this host as the <name> user.

   <shell_path>

   The shell to use when accessing the host.

   <groups>

   The groups the user belongs to.

   lock_passwd

   Whether the user password is locked. If true, the user cannot log in by using the password, but can still use SSH.

   Example user

   users:
     - name: sysadmin
       sudo: ["ALL=(ALL) NOPASSWD:ALL"]
       ssh_authorized_keys:
         - ssh-rsa AAAAB3NzaC1yc2E... sysadmin@workstation.example.com
       shell: /bin/bash
       groups: [adm, sudo]
       lock_passwd: true

   Copy to Clipboard

2. Create a secret from the <hostname>-user-data.yaml file by running the following command:

   $ oc create secret generic <hostname>-user-data \
     --from-file=userData=<hostname>-user-data.yaml -n bmaas

   Copy to Clipboard

   <hostname>

   The name of the bare-metal host.

3. Configure the BareMetalHost to use the <hostname>-user-data.yaml file by running the following command:

   $ oc patch baremetalhost <hostname> -n bmaas \
        --type merge -p '{"spec":{"userData":{"name":"<hostname>-user-data"}}}'

   Copy to Clipboard

   <hostname>

   The name of the bare-metal host.

Procedure

1. Create a file named network-data.yaml with the following content:

   links:
     - id: <interface_id>
       type: phy
       ethernet_mac_address: <mac_address>
   networks:
     - id: <interface_id>
       link: <interface_id>
       type: ipv4_dhcp
   services:
     - type: dns
       address: <dns_server>

   Copy to Clipboard

   <interface_id>

   The ID of the network interface, such as enp2s0.

   <mac_address>

   The MAC address of the network interface.

   <dns_server>

   The IP address of the DNS server.

2. Create a secret from the networkData file by running the following command:

   $ oc create secret generic <hostname>-network-data \
     --from-file=networkData=network-data.yaml -n bmaas

   Copy to Clipboard

   <hostname>

   The hostname of the bare-metal host.

3. Configure the BareMetalHost to use the networkData file by running the following command:

   $ oc patch baremetalhost <hostname> -n bmaas \
     --type merge -p '{"spec":{"networkData":{"name":"<hostname>-network-data"}}}'

   Copy to Clipboard