Fixes #37566 - Libvirt - UEFI & SecureBoot support #10209

stejskalleos · 2024-06-17T13:27:31Z

Required fog-libvirt PR: fog/fog-libvirt#155

app/models/compute_resources/foreman/model/libvirt.rb

stejskalleos · 2024-06-18T12:10:36Z

Rebased, added @ekohl as author & tested with Fedora 39 UEFI + SecureBoot. Ready for review

stejskalleos · 2024-06-24T09:54:54Z

@ekohl @jloeser Rebased and updated (Together with FOG PR)
Now using

  <firmware>
    <feature enabled='yes' name='secure-boot'/>
    <feature enabled='yes' name='enrolled-keys'/>
  </firmware>

Tested with shimx64.efi & Fedora 39.

davispuh · 2024-07-13T16:15:33Z

Nice work, I'm also interested in this.

nofaralfasi · 2024-07-14T15:04:00Z

app/views/compute_resources_vms/form/libvirt/_base.html.erb

+<%= select_f f, :os_firmware,
+                Foreman::Model::Libvirt.firmware_types,
+                :first,
+                :last,
+                {},
+                { :label => _("Firmware"),
+                  :label_size => "col-md-2",
+                  :onchange => "tfm.computeResource.libvirt.firmwareSelected(this);",
+                }
+%>
+<%
+  feature_attrs = ActiveSupport::HashWithIndifferentAccess.new(f.object.os_firmware_features)
+  is_bios = f.object.os_firmware == 'bios'
+%>
+
+<div id="os_firmware_features">
+<%= f.fields_for :os_firmware_features do |ff|
+    secure_field = checkbox_f(ff, 'secure-boot', { checked: feature_attrs['secure-boot'] == 'yes', label: _("Secure Boot"), disabled: is_bios }, 'yes', 'no')
+    keys_field = checkbox_f(ff, 'enrolled-keys', { checked: feature_attrs['enrolled-keys'] == 'yes', label: _("Enrolled keys"), disabled: is_bios }, 'yes', 'no')
+    secure_field + keys_field
+  end
+%>
+</div>


I think we should hide these options when editing a host and display them only when creating a new host. Since there is no way to edit these fields and we don’t know the actual values (we’re displaying the default ones), I don’t see a reason to include them in the edit form.

ekohl

In #9965 I copied the VMware pattern to automatically detect the firmware based on the PXE loader. That should determine if secure boot it used by default.

ekohl · 2024-07-18T15:18:24Z

app/models/compute_resources/foreman/model/libvirt.rb

@@ -291,7 +313,12 @@ def vm_instance_defaults
        :display    => { :type     => display_type,
                         :listen   => Setting[:libvirt_default_console_address],
                         :password => random_password(console_password_length(display_type)),
-                         :port     => '-1' }
+                         :port     => '-1' },
+        :os_firmware => 'efi',


This uses os_firmware and VMware uses firmware. That's inconsistent.

nofaralfasi · 2024-07-22T15:32:05Z

Requires: fog/fog-libvirt#155.

nofaralfasi · 2024-07-25T10:07:34Z

I have another idea on how to implement this. Moving it to WIP until it's ready.

nofaralfasi · 2024-08-12T12:50:06Z

While determining the firmware type in Libvirt is straightforward when creating a VM, it can be more complex for existing VMs. The firmware can be specified in various places, such as os.firmware, os.loader.type, or it might not be specified at all. Additionally, there are factors to consider, such as the machine returning different values depending on whether it is running or not. For example, the loader attribute may only be available when the machine is running. Similarly, the Secure Boot feature can be enabled using os.firmware.features with secure-boot set to yes, but there are other methods to enable Secure Boot as well (refer to Libvirt Secure Boot and Libvirt BIOS/Bootloader Documentation for more details).

Given these complexities, we have two options: either refrain from displaying the firmware type for existing machines, or display it with the understanding that the information may not always be accurate.

Co-authored-by: Ewoud Kohl van Wijngaarden <[email protected]>

- Updated the Libvirt VM creation form. - Added a new firmware type for Secure Boot. - Enable `enrolled-keys` by default when Secure Boot is activated. - Removed unnecessary methods from the Libvirt model. - Moved firmware-related methods to the ComputeResource model for shared use between VMware and Libvirt.

nofaralfasi · 2024-09-09T10:26:57Z

app/models/compute_resources/foreman/model/libvirt.rb

+    def handle_automatic_firmware(opts)
+      # This value comes from PxeLoaderSupport#firmware_type
+      firmware_type = opts.delete(:firmware_type).to_s
+
+      # Handle automatic firmware setting based on PXE Loader
+      # if no PXE Loader is set, we will set it to bios by default
+      if opts[:firmware] == 'automatic'
+        opts[:firmware] = firmware_type.presence || 'bios'
+      end
+    end


This code is also used in https://github.com/theforeman/foreman/pull/10225/files#diff-be4ac4f95deb530eb0fbcc834a4940573ba45b8d5923433305ac3aa1e0703328R501-R508.
I suggest moving this method into app/models/compute_resource.rb for shared use between VMware and Libvirt.

- Moved firmware logic into dedicated methods. - Updated tests for improved coverage and workflow alignment.

nofaralfasi · 2024-09-15T10:47:43Z

Closing this PR in favor of a new one: #10321. The new PR addresses the same issue with updated changes. Please continue the discussion and review there.

pr-processor bot added the Not yet reviewed label Jun 17, 2024

stejskalleos assigned nofaralfasi and ekohl Jun 18, 2024

stejskalleos commented Jun 18, 2024

View reviewed changes

app/models/compute_resources/foreman/model/libvirt.rb Outdated Show resolved Hide resolved

stejskalleos force-pushed the ls/libvirt_SB branch from 4754942 to 35e8aaa Compare June 18, 2024 12:09

stejskalleos mentioned this pull request Jun 18, 2024

EFI & Secure Boot fog/fog-libvirt#141

Closed

stejskalleos force-pushed the ls/libvirt_SB branch from 35e8aaa to 7f55085 Compare June 24, 2024 09:53

github-actions bot added the UI label Jun 24, 2024

nofaralfasi reviewed Jul 14, 2024

View reviewed changes

ekohl mentioned this pull request Jul 18, 2024

VMware - Secure Boot & Virtual TPM #10225

Closed

ekohl requested changes Jul 18, 2024

View reviewed changes

pr-processor bot added Waiting on contributor Needs re-review and removed Not yet reviewed labels Jul 18, 2024

nofaralfasi changed the title ~~Fixes #37566 - Libvirt - UEFI & SecureBoot support~~ [WIP] Fixes #37566 - Libvirt - UEFI & SecureBoot support Jul 25, 2024

nofaralfasi marked this pull request as draft July 25, 2024 10:07

nofaralfasi mentioned this pull request Jul 28, 2024

Fixes #37692 - Add firmware option for Libvirt hosts creation theforeman/hammer-cli-foreman#631

Open

nofaralfasi force-pushed the ls/libvirt_SB branch from 4da7d3f to fc4b3cf Compare July 28, 2024 17:38

nofaralfasi force-pushed the ls/libvirt_SB branch from fc4b3cf to 1e88c54 Compare August 12, 2024 14:11

stejskalleos closed this Sep 4, 2024

nofaralfasi reopened this Sep 4, 2024

stejskalleos and others added 2 commits September 9, 2024 13:01

Fixes #37566 - Libvirt - UEFI & SecureBoot support

0f128c5

Co-authored-by: Ewoud Kohl van Wijngaarden <[email protected]>

nofaralfasi force-pushed the ls/libvirt_SB branch from 1e88c54 to d93c7dc Compare September 9, 2024 10:02

nofaralfasi reviewed Sep 9, 2024

View reviewed changes

pr-processor bot removed the Needs re-review label Sep 9, 2024

nofaralfasi changed the title ~~[WIP] Fixes #37566 - Libvirt - UEFI & SecureBoot support~~ Fixes #37566 - Libvirt - UEFI & SecureBoot support Sep 9, 2024

nofaralfasi marked this pull request as ready for review September 9, 2024 10:27

nofaralfasi requested a review from a team as a code owner September 9, 2024 10:27

Refactor Libvirt Firmware Handling for Better Testability

81a503a

- Moved firmware logic into dedicated methods. - Updated tests for improved coverage and workflow alignment.

nofaralfasi force-pushed the ls/libvirt_SB branch from d93c7dc to 81a503a Compare September 9, 2024 10:28

pr-processor bot added the Needs re-review label Sep 9, 2024

nofaralfasi marked this pull request as draft September 9, 2024 12:12

nofaralfasi closed this Sep 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #37566 - Libvirt - UEFI & SecureBoot support #10209

Fixes #37566 - Libvirt - UEFI & SecureBoot support #10209

stejskalleos commented Jun 17, 2024 •

edited by nofaralfasi

Loading

stejskalleos commented Jun 18, 2024

stejskalleos commented Jun 24, 2024

davispuh commented Jul 13, 2024

nofaralfasi Jul 14, 2024

ekohl left a comment

ekohl Jul 18, 2024

nofaralfasi commented Jul 22, 2024

nofaralfasi commented Jul 25, 2024

nofaralfasi commented Aug 12, 2024 •

edited

Loading

nofaralfasi Sep 9, 2024

nofaralfasi commented Sep 15, 2024

Fixes #37566 - Libvirt - UEFI & SecureBoot support #10209

Fixes #37566 - Libvirt - UEFI & SecureBoot support #10209

Conversation

stejskalleos commented Jun 17, 2024 • edited by nofaralfasi Loading

stejskalleos commented Jun 18, 2024

stejskalleos commented Jun 24, 2024

davispuh commented Jul 13, 2024

nofaralfasi Jul 14, 2024

Choose a reason for hiding this comment

ekohl left a comment

Choose a reason for hiding this comment

ekohl Jul 18, 2024

Choose a reason for hiding this comment

nofaralfasi commented Jul 22, 2024

nofaralfasi commented Jul 25, 2024

nofaralfasi commented Aug 12, 2024 • edited Loading

nofaralfasi Sep 9, 2024

Choose a reason for hiding this comment

nofaralfasi commented Sep 15, 2024

stejskalleos commented Jun 17, 2024 •

edited by nofaralfasi

Loading

nofaralfasi commented Aug 12, 2024 •

edited

Loading