dellemc.openmanage.idrac_secure_boot module – Import secure boot certificate.

Note

This module is part of the dellemc.openmanage collection (version 9.6.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install dellemc.openmanage. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: dellemc.openmanage.idrac_secure_boot.

New in dellemc.openmanage 9.6.0

Synopsis 

This module allows to import the secure boot certificate.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 3.9.6

Parameters 

Parameter	Comments
ca_path path added in dellemc.openmanage 5.0.0	The Privacy Enhanced Mail (PEM) file that contains a CA certificate to be used for the validation.
database list / elements=path	A list of absolute paths of the Database certificate file for UEFI secure boot.
disallow_database list / elements=path	A list of absolute paths of the Disallow Database certificate file for UEFI secure boot.
idrac_ip string / required	iDRAC IP Address.
idrac_password aliases: idrac_pwd string	iDRAC user password. If the password is not provided, then the environment variable `IDRAC_PASSWORD` is used. Example: export IDRAC_PASSWORD=password
idrac_port integer	iDRAC port. Default: `443`
idrac_user string	iDRAC username. If the username is not provided, then the environment variable `IDRAC_USERNAME` is used. Example: export IDRAC_USERNAME=username
import_certificates boolean	Import all the specified key certificates. When import_certificates is `true`, then either platform_key, KEK, database, or disallow_database is required. Choices: `false` `true`
job_wait boolean	Whether to wait till completion of the secure boot certificate operation. This is applicable when restart is `true`. Choices: `false` `true` ← (default)
job_wait_timeout integer	The maximum wait time of job_wait in seconds. The job is tracked only for this duration. This option is applicable when job_wait is `true`. Default: `1200`
KEK list / elements=path	A list of absolute paths of the Key Exchange Key (KEK) certificate file for UEFI secure boot.
platform_key path	The absolute path of the Platform key certificate file for UEFI secure boot.
restart boolean	Secure boot certificate import operation requires a server restart. This parameter provides an option to restart the server. `true` restarts the server. `false` does not restart the server. restart is applicable when import_certificates is `true`. Choices: `false` ← (default) `true`
restart_type string	Restart type of the server. `ForceRestart` forcefully restarts the server. `GracefulRestart` gracefully restarts the server. restart_type is applicable when restart is `true`. Choices: `"GracefulRestart"` ← (default) `"ForceRestart"`
timeout integer added in dellemc.openmanage 5.0.0	The socket level timeout in seconds. Default: `30`
validate_certs boolean added in dellemc.openmanage 5.0.0	If `false`, the SSL certificates will not be validated. Configure `false` only on personally controlled sites where self-signed certificates are used. Prior to collection version `5.0.0`, the validate_certs is `false` by default. Choices: `false` `true` ← (default)
x_auth_token string added in dellemc.openmanage 9.3.0	Authentication token. If the x_auth_token is not provided, then the environment variable `IDRAC_X_AUTH_TOKEN` is used. Example: export IDRAC_X_AUTH_TOKEN=x_auth_token

Attributes 

Attribute	Support	Description
check_mode	Support: full	Runs task to validate without performing action on the target machine.
diff_mode	Support: none	Runs the task to report the changes made or to be made.

Notes 

Note

This module will always report changes found to be applied when run in check mode.
This module does not support idempotency when import_certificates is provided.
This module supports IPv4 and IPv6 addresses.

Examples 

---
- name: Import multiple SecureBoot certificate without applying to iDRAC.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    KEK:
      - /user/name/certificates/kek1.pem
      - /user/name/certificates/kek2.pem
    database:
      - /user/name/certificates/db1.pem
      - /user/name/certificates/db2.pem
    disallow_database:
      - /user/name/certificates/dbx1.pem
      - /user/name/certificates/dbx2.pem

- name: Import a SecureBoot certificate and restart the server to apply it.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    restart: true
    job_wait_timeout: 600

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key

Description

error_info

dictionary

Details of the HTTP Error.

Returned: on HTTP error

Sample: {"error": {"@Message.ExtendedInfo": [{"Message": "Unable to process the request because an error occurred.", "MessageArgs": [], "MessageId": "GEN1234", "RelatedProperties": [], "Resolution": "Retry the operation. If the issue persists, contact your system administrator.", "Severity": "Critical"}], "code": "Base.1.0.GeneralError", "message": "A general error has occurred. See ExtendedInfo for more information."}}

msg

string

Status of the secure boot operation.

Returned: always

Sample: "Successfully imported the SecureBoot certificate."

Authors

Abhishek Sinha(@ABHISHEK-SINHA10)

dellemc.openmanage.idrac_secure_boot module – Import secure boot certificate.

Synopsis

Requirements

Parameters

Attributes

Notes

Examples

Return Values