metalman: add HTTPS support for PXE boot - #544
Draft
Jordan Olshevski (jveski) wants to merge 2 commits into
Draft
Conversation
Jordan Olshevski (jveski)
commented
Jul 23, 2026
Jordan Olshevski (jveski)
commented
Contributor
- Add --tls-cert-file, --tls-private-key-file, and --tls-ca-file flags to the PXE HTTP server
- Serve HTTPS when TLS flags are provided, otherwise fall back to plain HTTP
- Validate TLS flag combinations and certificate/key pairing at startup
- Install trust certificates into BMC UEFI HTTPS boot store before setting boot overrides
- Best-effort certificate installation: failures are logged but do not block repave operations
- Add parseTrustCertificate helper for PEM-encoded CA certificate validation
- Remove dead-code branch in validateTLSFlags
The all && none condition can never be true - if any flag is set, none is false, and vice versa. Simplify to just check if all flags are empty and return early.
Add a comment explaining that cert installation is best-effort: the certificate may already be present from a prior run, and returning an error would block the entire repave operation.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds initial plumbing for HTTPS-based HTTP boot in metalman by threading TLS-related configuration into the serve-pxe command and the MachineOperation reconciliation flow, with the intent to install a trust CA into the BMC UEFI HTTPS boot store before setting HTTP boot overrides.
Changes:
- Extends MachineOperation power client interactions to (best-effort) ensure an HTTPS boot trust certificate is present before setting an HTTPS HTTP-boot override.
- Adds
--tls-cert-file,--tls-private-key-file, and--tls-ca-fileflags and uses them to select anhttp://vshttps://serve URL and pass TLS inputs through to the HTTP artifact server and reconciler. - Adds TLS flag validation and a PEM certificate parsing helper for the trust CA file.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| internal/metalman/machineops/controller.go | Adds trust-certificate plumbing into the repave HTTP-boot path and extends the PowerClient interface. |
| internal/metalman/commands/serve_pxe.go | Adds TLS CLI flags, TLS validation, trust CA parsing, and wires TLS/trust config into the server and reconciler. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
336
to
+340
| httpServer := &netboot.HTTPServer{ | ||
| BindAddr: bindAddress, | ||
| Port: httpPort, | ||
| TLSCertFile: tlsCertFile, | ||
| TLSKeyFile: tlsPrivateKeyFile, |
| SetHTTPBootOverride(ctx context.Context, bootURL string) error | ||
| SetBIOSStaticIPv4(ctx context.Context, config redfish.StaticIPv4Config) error | ||
| SetBIOSHTTPBootURI(ctx context.Context, bootURL string) error | ||
| EnsureHTTPBootCertificate(ctx context.Context, trustCertPEM []byte) error |
Comment on lines
+456
to
+468
| func parseTrustCertificate(pemData []byte) (*x509.Certificate, error) { | ||
| block, _ := pem.Decode(pemData) | ||
| if block == nil { | ||
| return nil, fmt.Errorf("no PEM block found") | ||
| } | ||
|
|
||
| switch block.Type { | ||
| case "CERTIFICATE": | ||
| return x509.ParseCertificate(block.Bytes) | ||
| default: | ||
| return nil, fmt.Errorf("expected PEM type CERTIFICATE, got %s", block.Type) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.