Skip to content

Commit 479041e

Browse files
SNiemann15SNiemann15
committed
IBM Z secure boot enablement
1 parent f5d1091 commit 479041e

File tree

2 files changed

+87
-9
lines changed

2 files changed

+87
-9
lines changed

‎modules/installation-complete-user-infra.adoc

Lines changed: 75 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"]
3636
:restricted:
3737
endif::[]
3838
ifeval::["{context}" == "installing-ibm-z-lpar"]
39-
:ibm-z:
39+
:ibm-z-lpar:
4040
endif::[]
4141
ifeval::["{context}" == "installing-restricted-networks-ibm-z-lpar"]
42-
:ibm-z:
42+
:ibm-z-lpar:
4343
:restricted:
4444
endif::[]
4545
ifeval::["{context}" == "installing-ibm-power"]
@@ -177,6 +177,77 @@ ifdef::restricted[]
177177
. Register your cluster on the link:https://console.redhat.com/openshift/register[Cluster registration] page.
178178
endif::restricted[]
179179

180+
ifdef::ibm-z,ibm-z-lpar[]
181+
.Verification
182+
183+
If you have enabled secure boot during the {product-title} bootstrap process, the following verification steps are required:
184+
185+
. Debug the node by running the following command:
186+
+
187+
[source,terminal]
188+
----
189+
$ oc debug node/<node_name>
190+
chroot /host
191+
----
192+
+
193+
. Confirm that secure boot is enabled by running the following command:
194+
+
195+
[source,terminal]
196+
----
197+
$ cat /sys/firmware/ipl/secure
198+
----
199+
+
200+
.Example output
201+
[source,terminal]
202+
----
203+
1 <1>
204+
----
205+
<1> The value is `1` if secure boot is enabled and `0` if secure boot is not enabled.
206+
endif::ibm-z,ibm-z-lpar[]
207+
ifdef::ibm-z-lpar[]
208+
. List the re-IPL configuration by running the following command:
209+
+
210+
[source,terminal]
211+
----
212+
# lsreipl
213+
----
214+
+
215+
.Example output for an FCP disk
216+
[source,terminal]
217+
----
218+
Re-IPL type: fcp
219+
WWPN: 0x500507630400d1e3
220+
LUN: 0x4001400e00000000
221+
Device: 0.0.810e
222+
bootprog: 0
223+
br_lba: 0
224+
Loadparm: ""
225+
Bootparms: ""
226+
clear: 0
227+
----
228+
+
229+
.Example output for a DASD disk
230+
[source,terminal]
231+
----
232+
for DASD output:
233+
Re-IPL type: ccw
234+
Device: 0.0.525d
235+
Loadparm: ""
236+
clear: 0
237+
----
238+
239+
. Shut down the node by running the following command:
240+
+
241+
[source,terminal]
242+
----
243+
sudo shutdown -h
244+
----
245+
246+
. Initiate a boot from LPAR from the Hardware Management Console (HMC). See link:https://www.ibm.com/docs/en/linux-on-systems?topic=boot-lpar[Initiating a secure boot from an LPAR] in IBM documentation.
247+
248+
. When the node is back, check the secure boot status again.
249+
endif::ibm-z-lpar[]
250+
180251
ifeval::["{context}" == "installing-restricted-networks-vsphere"]
181252
:!restricted:
182253
endif::[]
@@ -208,9 +279,9 @@ ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"]
208279
:!restricted:
209280
endif::[]
210281
ifeval::["{context}" == "installing-ibm-z-lpar"]
211-
:!ibm-z:
282+
:!ibm-z-lpar:
212283
endif::[]
213284
ifeval::["{context}" == "installing-restricted-networks-ibm-z-lpar"]
214-
:!ibm-z:
285+
:!ibm-z-lpar:
215286
:!restricted:
216287
endif::[]

‎modules/installation-ibm-z-user-infra-machines-iso.adoc

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Complete the following steps to create the machines.
3535
.Prerequisites
3636

3737
* An HTTP or HTTPS server running on your provisioning machine that is accessible to the machines you create.
38+
* If you want to enable secure boot, you have obtained the appropriate Red Hat Product Signing Key and read link:https://www.ibm.com/docs/en/linux-on-systems?topic=security-secure-boot-linux-onibm-z-linuxone[Secure boot on IBM Z and IBM LinuxONE] in IBM documentation.
3839
3940
.Procedure
4041

@@ -61,6 +62,7 @@ The rootfs image is the same for FCP and DASD.
6162
====
6263
+
6364
. Create parameter files. The following parameters are specific for a particular virtual machine:
65+
6466
** For `ip=`, specify the following seven entries:
6567
... The IP address for the machine.
6668
... An empty string.
@@ -71,6 +73,7 @@ The rootfs image is the same for FCP and DASD.
7173
... If you use static IP addresses, specify `none`.
7274
** For `coreos.inst.ignition_url=`, specify the Ignition file for the machine role. Use `bootstrap.ign`, `master.ign`, or `worker.ign`. Only HTTP and HTTPS protocols are supported.
7375
** For `coreos.live.rootfs_url=`, specify the matching rootfs artifact for the kernel and initramfs you are booting. Only HTTP and HTTPS protocols are supported.
76+
** Optional: To enable secure boot, add `coreos.inst.secure_ipl`
7477

7578
** For installations on DASD-type disks, complete the following tasks:
7679
... For `coreos.inst.install_dev=`, specify `/dev/dasda`.
@@ -84,13 +87,17 @@ Example parameter file, `bootstrap-0.parm`, for the bootstrap machine:
8487
rd.neednet=1 \
8588
console=ttysclp0 \
8689
coreos.inst.install_dev=/dev/dasda \
87-
coreos.live.rootfs_url=http://cl1.provide.example.com:8080/assets/rhcos-live-rootfs.s390x.img \
88-
coreos.inst.ignition_url=http://cl1.provide.example.com:8080/ignition/bootstrap.ign \
90+
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \// <1>
91+
coreos.inst.ignition_url=http://<http_server>/bootstrap.ign \// <2>
92+
coreos.inst.secure_ipl \// <3>
8993
ip=172.18.78.2::172.18.78.1:255.255.255.0:::none nameserver=172.18.78.1 \
9094
rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1,portno=0 \
9195
zfcp.allow_lun_scan=0 \
9296
rd.dasd=0.0.3490
9397
----
98+
<1> Specify the location of the `rootfs` artifact for the `kernel` and `initramfs` you are booting. Only HTTP and HTTPS protocols are supported.
99+
<2> Specify the location of the Ignition config file. Use `bootstrap.ign`, `master.ign`, or `worker.ign`. Only HTTP and HTTPS protocols are supported.
100+
<3> Optional: To enable secure boot, add `coreos.inst.secure_ipl`.
94101
+
95102
Write all options in the parameter file as a single line and make sure you have no newline characters.
96103

@@ -115,15 +122,15 @@ Additional postinstallation steps are required to fully enable multipathing. For
115122
====
116123
// Add xref once it's allowed.
117124
+
118-
The following is an example parameter file `worker-1.parm` for a worker node with multipathing:
125+
The following is an example parameter file `worker-1.parm` for a compute node with multipathing:
119126
+
120127
[source,terminal]
121128
----
122129
rd.neednet=1 \
123130
console=ttysclp0 \
124131
coreos.inst.install_dev=/dev/disk/by-id/scsi-<serial_number> \
125-
coreos.live.rootfs_url=http://cl1.provide.example.com:8080/assets/rhcos-live-rootfs.s390x.img \
126-
coreos.inst.ignition_url=http://cl1.provide.example.com:8080/ignition/worker.ign \
132+
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \
133+
coreos.inst.ignition_url=http://<http_server>/worker.ign \
127134
ip=172.18.78.2::172.18.78.1:255.255.255.0:::none nameserver=172.18.78.1 \
128135
rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1,portno=0 \
129136
zfcp.allow_lun_scan=0 \

0 commit comments

Comments
 (0)