kelvin/warewulf
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Refactor boot-management and clarify grub tech preview status

Browse Source 
Signed-off-by: Jonathon Anderson <janderson@ciq.com>
This commit is contained in:
Jonathon Anderson
2024-01-17 15:50:01 -07:00
parent 72d56e4e56
commit 3efa812b5c
1 changed files with 83 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

161
userdocs/contents/boot-management.rst
View File

@@ -2,10 +2,65 @@
Boot Management
===============
Instead of the iPXE starter a combination of `shim and GRUB <https://www.suse.com/c/uefi-secure-boot-details/>`_
can be used with the advantage that secure boot can be used. That means
that only the signed kernel of a distribution can be booted. This can
be a huge security benefit for some scenarios.
Warewulf uses iPXE to for network boot by default. As a tech preview, support
for GRUB is also available, which adds support for secure boot.
Booting with iPXE
=================
.. graphviz::
digraph G{
node [shape=box];
compound=true;
edge [label2node=true]
bios [shape=record label="{BIOS | boots from DHCP/next-server via TFTP}"]
subgraph cluster0 {
label="iPXE boot"
iPXE;
ipxe_cfg [shape=record label="{ipxe.cfg|generated for each node}"];
iPXE -> ipxe_cfg [label="http"];
}
bios->iPXE [lhead=cluster0,label="iPXE.efi"];
kernel [shape=record label="{kernel|ramdisk (root fs)|wwinit overlay}|extracted from node container"];
ipxe_cfg->kernel[ltail=cluster0,label="http"];
}
Booting with GRUB
=================
Support for GRUB as a network bootloader (replacing iPXE) is available in
Warewulf as a technology preview.
.. graphviz::
digraph G{
node [shape=box];
compound=true;
edge [label2node=true]
bios [shape=record label="{BIOS | boots from DHCP/next-server via TFTP}"]
bios->shim [lhead=cluster1,label="shim.efi"];
subgraph cluster1{
label="Grub boot"
shim[shape=record label="{shim.efi|from ww4 host}"];
grub[shape=record label="{grubx64.efi | name hardcoded in shim.efi|from ww4 host}"]
shim->grub[label="TFTP"];
grubcfg[shape=record label="{grub.cfg|static under TFTP root}"];
grub->grubcfg[label="TFTP"];
}
kernel [shape=record label="{kernel|ramdisk (root fs)|wwinit overlay}|extracted from node container"];
grubcfg->kernel[ltail=cluster1,label="http"];
}
Instead of the iPXE starter a combination of `shim and GRUB
<https://www.suse.com/c/uefi-secure-boot-details/>`_ can be used with the
advantage that secure boot can be used. That means that only the signed kernel
of a distribution can be booted. This can be a huge security benefit for some
scenarios.
In order to enable the grub boot method it has to be enabled in `warewulf.conf`.
@@ -14,14 +69,11 @@ In order to enable the grub boot method it has to be enabled in `warewulf.conf`.
warewulf:
grubboot: true
Nodes which are not known to warewulf will then booted with the shim/grub from
the host on which warewulf is installed.
Nodes which are not known to Warewulf are booted with the shim/grub from the
Warewulf server host.
Boot process
============
The boot process can be summarized with following diagram
Secure boot
-----------
.. graphviz::
@@ -38,54 +90,30 @@ The boot process can be summarized with following diagram
}
}
If secure boot is enabled at every step a signature is checked and the boot process
will fail if this check fails. Also at moment a Shim only includes the key
of one Distribution, which means that every Distribution needs a separate
`shim` and `grub` executable and warewulf extracts these binaries from
the containers.
If secure boot is enabled at every step a signature is checked and the boot
process fails if this check fails. The shim typically only includes the key for
a single operating system, which means that each distribution needs separate
`shim` and `grub` executables. Warewulf extracts these binaries from the
containers. If the node is unknown to Warewulf or can't be identified during
the TFTP boot phase, the shim/grub binaries of the host in which Warewulf is
running are used.
For the case when the node is unknown to warewulf or
can't be identified during the `tFTP`` boot phase, the shim/grub binaries of
the host in which warewulf is running will be used.
Install shim and efi
--------------------
PXE/tFTP boot
-------------
`shim.efi` and `grub.efi` must be installed in the container for it to be
booted by GRUB.
The standard network boot process with `grub` and `iPXE` has following steps
.. code-block:: console
.. graphviz::
# wwctl container shell leap15.5
[leap15.5] Warewulf> zypper install grub2 shim
digraph G{
node [shape=box];
compound=true;
edge [label2node=true]
bios [shape=record label="{Bios | boots filename from nextboot per tFTP}"]
subgraph cluster0 {
label="iPXE boot"
iPXE;
ipxe_cfg [shape=record label="{ipxe.cfg|generated for indivdual node}"];
iPXE -> ipxe_cfg [label="http"];
}
bios->iPXE [lhead=cluster0,label="filename=iPXE.efi"];
bios->shim [lhead=cluster1,label="filename=shim.efi"];
subgraph cluster1{
label="Grub boot"
shim[shape=record label="{shim.efi|from ww4 host}"];
grub[shape=record label="{grubx64.efi | name hardcoded in shim.efi|from ww4 host}"]
shim->grub[label="tFTP"];
grubcfg[shape=record label="{grub.cfg|static under tFTP root}"];
grub->grubcfg[label="tFTP"];
}
kernel [shape=record label="{kernel|ramdisk (root fs)|wwinit overlay}|extracted from node container"];
grubcfg->kernel[ltail=cluster1,label="http"];
ipxe_cfg->kernel[ltail=cluster0,label="http"];
}
# wwctl container shell rocky9
[rocky9] Warewulf> dnf install shim-x64.x86_64 grub2-pc.x86_64
As the tFTP server is independent of warewulf, the `shim` and `grub` EFI binaries
for the tFTP server are copied from the host on which warewulf is running.
This means that for secure boot the distributor e.g. SUSE of the container in
the `default` profile must match the distributor of the container which then
also must be signed by the SUSE key.
These packages must also be installed on the Warewulf server host to enable
node discovery using GRUB.
http boot
---------
@@ -106,28 +134,5 @@ is the following:
grub->kernel [label="http"];
}
The main difference is that the initial `shim.efi` and `grub.efi` are delivered by http with warewulf
and are taken directly from the container assigned to the node. This means that secure boot will work
for containers from different distributors.
Install shim and efi
--------------------
The `shim.efi` and `grub.efi` must be installed via the package manager directly into the container.
Install on SUSE systems
^^^^^^^^^^^^^^^^^^^^^^^
.. code-block:: console
# wwctl container shell leap15.5
[leap15.5] Warewulf> zypper install grub2 shim
Install on EL system
^^^^^^^^^^^^^^^^^^^^
.. code-block:: console
# wwctl container shell rocky9
[rocky9] Warewulf> dnf install shim-x64.x86_64 grub2-pc.x86_64
Warewulf delivers the initial `shim.efi` and `grub.efi` via http as taken
directly from the node's assigned container.