dellemc.openmanage.idrac_secure_boot module – Import secure boot certificate.

Note

This module is part of the dellemc.openmanage collection (version 9.6.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install dellemc.openmanage. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: dellemc.openmanage.idrac_secure_boot.

New in dellemc.openmanage 9.6.0

Synopsis

  • This module allows to import the secure boot certificate.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.9.6

Parameters

Parameter

Comments

ca_path

path

added in dellemc.openmanage 5.0.0

The Privacy Enhanced Mail (PEM) file that contains a CA certificate to be used for the validation.

database

list / elements=path

A list of absolute paths of the Database certificate file for UEFI secure boot.

disallow_database

list / elements=path

A list of absolute paths of the Disallow Database certificate file for UEFI secure boot.

idrac_ip

string / required

iDRAC IP Address.

idrac_password

aliases: idrac_pwd

string

iDRAC user password.

If the password is not provided, then the environment variable IDRAC_PASSWORD is used.

Example: export IDRAC_PASSWORD=password

idrac_port

integer

iDRAC port.

Default: 443

idrac_user

string

iDRAC username.

If the username is not provided, then the environment variable IDRAC_USERNAME is used.

Example: export IDRAC_USERNAME=username

import_certificates

boolean

Import all the specified key certificates.

When import_certificates is true, then either platform_key, KEK, database, or disallow_database is required.

Choices:

  • false

  • true

job_wait

boolean

Whether to wait till completion of the secure boot certificate operation. This is applicable when restart is true.

Choices:

  • false

  • true ← (default)

job_wait_timeout

integer

The maximum wait time of job_wait in seconds. The job is tracked only for this duration.

This option is applicable when job_wait is true.

Default: 1200

KEK

list / elements=path

A list of absolute paths of the Key Exchange Key (KEK) certificate file for UEFI secure boot.

platform_key

path

The absolute path of the Platform key certificate file for UEFI secure boot.

restart

boolean

Secure boot certificate import operation requires a server restart. This parameter provides an option to restart the server.

true restarts the server.

false does not restart the server.

restart is applicable when import_certificates is true.

Choices:

  • false ← (default)

  • true

restart_type

string

Restart type of the server.

ForceRestart forcefully restarts the server.

GracefulRestart gracefully restarts the server.

restart_type is applicable when restart is true.

Choices:

  • "GracefulRestart" ← (default)

  • "ForceRestart"

timeout

integer

added in dellemc.openmanage 5.0.0

The socket level timeout in seconds.

Default: 30

validate_certs

boolean

added in dellemc.openmanage 5.0.0

If false, the SSL certificates will not be validated.

Configure false only on personally controlled sites where self-signed certificates are used.

Prior to collection version 5.0.0, the validate_certs is false by default.

Choices:

  • false

  • true ← (default)

x_auth_token

string

added in dellemc.openmanage 9.3.0

Authentication token.

If the x_auth_token is not provided, then the environment variable IDRAC_X_AUTH_TOKEN is used.

Example: export IDRAC_X_AUTH_TOKEN=x_auth_token

Attributes

Attribute

Support

Description

check_mode

Support: full

Runs task to validate without performing action on the target machine.

diff_mode

Support: none

Runs the task to report the changes made or to be made.

Notes

Note

  • This module will always report changes found to be applied when run in check mode.

  • This module does not support idempotency when import_certificates is provided.

  • This module supports IPv4 and IPv6 addresses.

Examples

---
- name: Import multiple SecureBoot certificate without applying to iDRAC.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    KEK:
      - /user/name/certificates/kek1.pem
      - /user/name/certificates/kek2.pem
    database:
      - /user/name/certificates/db1.pem
      - /user/name/certificates/db2.pem
    disallow_database:
      - /user/name/certificates/dbx1.pem
      - /user/name/certificates/dbx2.pem

- name: Import a SecureBoot certificate and restart the server to apply it.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    restart: true
    job_wait_timeout: 600

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

error_info

dictionary

Details of the HTTP Error.

Returned: on HTTP error

Sample: {"error": {"@Message.ExtendedInfo": [{"Message": "Unable to process the request because an error occurred.", "MessageArgs": [], "MessageId": "GEN1234", "RelatedProperties": [], "Resolution": "Retry the operation. If the issue persists, contact your system administrator.", "Severity": "Critical"}], "code": "Base.1.0.GeneralError", "message": "A general error has occurred. See ExtendedInfo for more information."}}

msg

string

Status of the secure boot operation.

Returned: always

Sample: "Successfully imported the SecureBoot certificate."

Authors

  • Abhishek Sinha(@ABHISHEK-SINHA10)