idrac and ldms enable and disable with automation - #5147
Closed
Kratika-P wants to merge 22 commits into
Closed
Conversation
Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com>
priti-parate
approved these changes
Sep 4, 2026
…odernization Signed-off-by: priti-parate <140157516+priti-parate@users.noreply.github.com>
…ter automation (dell#5149) * refactor(pipeline): restructure Omnia CI/CD pipeline docs and harden setup script - Rewrite test/pipeline/README.md as a concise overview with a link to the full guide in test/pipeline/docs/README.md. - Move complete OpenBao installation and GitLab JWT integration documentation into the docs/README.md guide and expand pipeline mode/domain examples. - Add OpenBao/vault configuration section to pipeline_config.yml. - Harden setup_gitlab_project.py against common security findings: * Validate local file paths and repo paths to prevent directory traversal * Sanitize GitLab API response text before logging * Validate cluster names before using them in variable names and YAML * Only suppress SSL warnings when --no-verify-ssl is explicitly passed * Warn when API tokens are supplied via --token command line argument * Prompt for SSH passwords instead of setting a hardcoded placeholder * Remove unused suffix variable in apply_config_variables Signed-off-by: Rohith Ravut <rohith.ravut@dellteam.com> * pipeline: Update .gitlab-ci-cluster.yml Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> --------- Signed-off-by: Rohith Ravut <rohith.ravut@dellteam.com> Signed-off-by: Abhishek S A <abhishek.sa3@dell.com> Co-authored-by: Abhishek S A <abhishek.sa3@dell.com>
* fix(security): remediate telemetry Checkmarx findings Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * test(telemetry): remove input security regression tests Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(security): harden omnia-auto credential handling Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * test(plugins): remove security remediation suite Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * test(image-build-manager): strengthen lifecycle validation Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * test(image-build-manager): adopt IMGBM test IDs Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(test-plugin): retain documentation in wheel Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(catalog): isolate Thrillhouse image group Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * test(main): align lifecycle validation automation Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> --------- Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com>
…tional groups are defined (dell#5151) * Add kube vip group in inventory only when kubernetes cluster is defined Signed-off-by: priti_parate <priti_parate@dell.com> * simplify condition to add kube vip in inventory Signed-off-by: priti_parate <priti_parate@dell.com> --------- Signed-off-by: priti_parate <priti_parate@dell.com>
…#5153) * Update omnia_auth container tag from 1.1 to 1.2 Updated auth container tag references across the codebase to use version 1.2: - Updated default auth tag in build_images.sh - Updated auth tag in deploy_openldap role variables - Updated upgrade playbook to target 1.2 from 1.1 - Updated documentation comments to reflect new upgrade path Signed-off-by: sayuri <sayuri.kamble@dell.com> * Fix security issue: Add no_log to sensitive credential tasks Added no_log: true to tasks that handle sensitive information to prevent credentials from being exposed in logs during high-verbosity playbook execution. Fixed vulnerabilities: - Access token generation and storage in deploy_openchami and orchestrator_common roles - Metadata-service group fetching that may contain SSH keys and hashed passwords - Mapping file reading that may contain infrastructure-sensitive details This prevents sensitive data from being logged in CI/CD pipelines and terminal output. Signed-off-by: sayuri <sayuri.kamble@dell.com> --------- Signed-off-by: sayuri <sayuri.kamble@dell.com>
checkmarx fix - Add _sanitize_input() to validate interactive prompts against regex patterns - Validate IP addresses, usernames, yes/no responses, file paths, and delete confirmation - Remove empty string fallback for password to eliminate hardcoded password finding - Add path traversal check for credential file paths Signed-off-by: Rohith Ravut <rohith.ravut@dellteam.com>
…ell#5152) * fix(orchestrator): remove obsolete OIM BMC network property Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(orchestrator): retain OIM BMC group configuration Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(orchestrator): resolve admin network by key Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(orchestrator): honor configured data path Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(orchestrator): centralize runtime data paths Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * fix(orchestrator): validate upstream output contracts Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> * docs(orchestrator): correct runtime path references Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com> --------- Signed-off-by: balajikumaran-c-s <balajikumaran.cs@dell.com>
…ture support and modularized repository management. (dell#5158) * Adds a dedicated credentials tag to collect, update, and securely encrypt Repo Manager credentials without deploying Pulp or running repository operations. Signed-off-by: Narthan_S <narthan.s@dell.com> * feat(repo-manager): modernize catalog-driven repository orchestration Signed-off-by: Narthan_S <narthan.s@dell.com> * feat(repo-manager): add user registry support and context-aware Pulp repository lifecycle Signed-off-by: Narthan_S <narthan.s@dell.com> * feat(repo-manager): align subscription and non-subscription repository workflows Signed-off-by: Narthan_S <narthan.s@dell.com> * feat(repo-manager): align subscription and non-subscription and doc dir update Signed-off-by: Narthan_S <narthan.s@dell.com> --------- Signed-off-by: Narthan_S <narthan.s@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
Signed-off-by: Abhishek S A <abhishek.sa3@dell.com>
This commit addresses seven identified defects and completes the terminology rename from "phone-home" to "node-registration" across the PXE provisioning workflow to avoid confusion with Dell Phone Home functionality. ## Defects Fixed - dell#461: Stale phone-home detection — verify node boot time via /proc/uptime to reject nodes that have been up for days before PXE boot. - dell#460: failed_nodes.json wrong count — fix race condition in PXE failure collection by using localhost loop instead of delegate_to. - dell#459: kube_vip_group in slurm-only inventory — reverted to original behavior (unconditionally include when kube_vip is set). - dell#458: Provision report wrong FG count — use xnames from mapping file instead of functional group names for expected_nodes comparison. - dell#450: Missing configs_vars.yaml — add pre-check with clear error message. - dell#449: Galaxy version 2.3.0 — updated across all domains with changelogs. - dell#432: Custom inventory support for pxeboot.yml — add -i option for retry/resume. ## Terminology Rename Renamed "phone_home" to "node_registration" throughout PXE provisioning: ### Orchestrator Domain - Role: verify_phone_home → verify_node_registration - Variables: enable_phone_home → enable_node_registration, phone_home_pause_minutes → node_registration_pause_minutes, etc. - SMD group: phone_home → node_registration - Playbook references, task names, comments, and user-facing messages updated - Backward compatibility: legacy phone_home_* variables supported with deprecation warning - Cloud-init standard phone_home directive and /phone-home/ endpoint unchanged ### Utils Domain (pxe_buildstream_manager) - Task file: cloudinit_phone_home.yml → cloudinit_node_registration.yml - Variables: phone_home_* → node_registration_* in vars/main.yml - Task names, comments, and user-facing messages updated across all task files - README and CHANGELOG updated ## Additional Fixes - Fixed select('extract') runtime error in pxeboot.yml by replacing with loop - Wired up node_registration_log_pattern variable in verification shell script - Updated default fallback for node_registration_log_pattern to 'phone-home' - Added OS-versioned FG name normalization for metadata-service template lookup Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
feat(orchestrator): implement tag-based cleanup framework with NFS server cleanup
… (dell#5166) * Fix K8s PXE IP assignment and --tags provision crash (dell#463, dell#472) Defect 463: K8s nodes receive random DHCP IPs instead of ADMIN_IPs from PXE mapping file when both K8s and Slurm catalogs are provisioned. Root cause: delete_smd_endpoints.yml used --all to delete ALL SMD entries before each category's re-registration. When categories are provisioned sequentially (K8s first, then Slurm), the Slurm provision step wiped K8s node registrations from SMD. At PXE boot time, only Slurm nodes were in SMD, so coreDHCP's coresmd plugin couldn't find K8s MACs and fell through to the bootloop plugin which assigned random IPs. Fix: Scope all deletions in delete_smd_endpoints.yml to the target category only (xnames, MACs, FG names) instead of --all. The initial deploy path (delete_smd_config.yml) still uses --all for clean slate. Defect 472: Orchestrator fails with symmetric_difference NoneType error when running --tags provision standalone. Root cause: provision_preamble.yml reads the original CSV but skips the first-control-plane rename (service_kube_control_plane_x86_64 -> service_kube_control_plane_first_x86_64) that validate_mapping_file.yml performs during precheck. The groups.yaml.j2 template then produces ids: null for this FG, and symmetric_difference crashes on None. Fix: Add the first-control-plane rename step to provision_preamble.yml and add defensive | default([]) to update_smd_groups.yaml. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> * Remove pandas dependency from generate_xname_in_mapping_file (dell#473) The generate_xname_in_mapping_file Ansible module imported pandas for simple CSV read/write operations. pandas is not available on the OIM host, causing the orchestrator to fail at the xname generation step with 'No module named pandas'. Replace pandas with Python's standard library csv module which provides the same functionality without any external dependency. Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com> --------- Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com>
…ments - Check if kustomization.yaml has resources before applying - Skip kubectl apply when no resources are present - Add warning message when all sources are disabled - Prevents errors when telemetry is fully disabled Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com>
…nia-modernization
…nia-modernization
…nia-modernization
Signed-off-by: Kratika_Patidar <Kratika.Patidar@dell.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the Solution
Suggested Reviewers