Great to see the operation center auto-provisioning getting fleshed out since June!
I’ve been repurposing an older HPC cluster and deploying IncusOS / Incus on all the nodes. I’ve had this deployed and working already, but thought I’d give the operation center auto-provisioning a go now that it’s available.
I’ve hit a stumbling block trying to auto-provision some of the TPM-less nodes. It looks like both of the Dell Bios Profile templates that ship with the op-center are matching the servers in question. This match with “has TPM” profile means that the TPMSecurity attribute is being referenced in the Bios configuration steps, but as there is no TPM in the server the attribute is unrecognised. Specifying missing_tpm = true in the install token seed doesn’t prevent this step. Nor (if I understand how the bios profile matching builds the bios changes) would swapping the priority of the two profiles resolve this.
It’s possibly on your roadmap, but would it be possible to add in the following functionality:
The ability to choose the bios profile to apply during deployment
The ability to add/edit/remove bios profiles
Just to make my exact situation even more squiggly: the old hardware are Dell C4140s, which has an optional TPM chip (and naturally, the servers I’ve inherited have a mix of TPM/no-TPM). Optional specs might make the case for choosing bios-profiles, rather than fully relying on the bios profile- matching code alone.
(I fully appreciate that I’m cramming IncusOS on old TPM-less servers and mileage may vary!!)
Otherwise, thanks for all the hard work and great to see the op-center coming along
The BIOS profile feature is still extremely new and we definitely expect to tweak those as we go.
I thought that we had the ability to detect the presence of a TPM and make the relevant BIOS profile be conditional on that but maybe we missed it in the default profiles?
Currently we’re trying to make the built-in profiles work as well as can be. We may eventually open the door to adding/modifying the profiles through the API, but first we want to give a good shot at having OC just “do the right thing” even if that means more code changes needed in some scenarios.
As @stgraber mentioned, the BIOS profile feature is extremely new and heavily work in progress. Basically right now it just covers what we have in our lab. Currently, the work for secure boot certificate enrollment is the main focus. Once this stabilized, I will revisit the BIOS profiles.
If you don’t mind, please open an issue on Github. This way it is less likely that I forget about your request.
Thanks all. Fully appreciate its a very very new feature, and that you’ll be somewhat limited testing-wise to whatever hardware you have in the lab, hence I thought i’d chime in given my stack of older mixed TPM/noTPM hardware.
Seeing the new auto-provisioning coincided with needing to redeploy my cluster from scratch so thought i’d see how it worked out. For the TPM-less machines it’s a miss for now, but it did work well on one of my TPM machines so take that as a data point of it working in the wild*
Happy to raise a Github issue about the BIOS profile stuff (and thanks Geert for giving it some consideration too).
* apart from a network-related issue due to my setup - I have my BMCs and machines on separate physical networks, and while the opcenter API runs on both networks/ports (::8443) you can only specify one server address for both the BMC AND incus-provider to use.
