topic Re: checking firmware compliance with REST API in HPE OneView

checking firmware compliance with REST API

BradV — Tue, 20 Oct 2020 15:16:51 GMT

The REST API for checking firmware compliance says to supply:

{ "firmwareBaselineId": "SPP2017101_2017_1027_10", "serverUUID": "36343537-3338-4E43-3735-31373034308" }

I'm just not sure what it means by firmwareBaseLineId? I know I can retrieve the current SPP bundles loaded to OneView with:

curl --insecure \ --header "auth: ${sessionID}" \ --header "X-API-Version: ${currentVersion}" \ --output firmware \ --request GET ${OneView}/rest/firmware-drivers

and if I look at the output of that, I do not see firmwareBaselineId anywhere. Is this possibly just the leaf part of the URI?

Re: checking firmware compliance with REST API

BradV — Tue, 20 Oct 2020 16:32:11 GMT

OK, ran some tests and confirmed it is the basename of the bundle uri. This is my process:

Get session credentials. Store those in some variables.

Download the current SPP bundle listing.

Download a list of hardware from OneView.

# Get the SPP basename: SPP=\"$(/usr/bin/basename $(jq '.members[] | .uri' firmware-bundles)) SERVER=my-server-ilo UUID=$(jq -r .members[] | select(.name == "'${SERVER}'") | "\(.uuid)"' ${HARDW}) DATA='{"firmwareBaselineId":'${SPP}',"serverUUID":"'${UUID}'"}' # Make sure there aren't any errors in the data: echo ${DATA} | jq -r '.' curl --insecure \ --header "content-type: aplication/json" \ --header "auth: ${sessionID}" \ --header "X-API-Version: ${currentVersion}" \ --data "${DATA}" \ --request POST ${OneView}/rest/server-hardware/firmware-compliance | jq -r '.'

Re: checking firmware compliance with REST API

tkonto — Mon, 21 Nov 2022 17:05:18 GMT

Thank you for this solution.

Where do we get the applicable and current SPP bundle listing?

Cheers,
Theo

PS: Is there an alternative solution, solely based on a REST API call and filtering its output?

Re: checking firmware compliance with REST API

BradV — Mon, 21 Nov 2022 17:31:07 GMT

Looks like there might be a typo or two in the above. Here is current code:

# Display a listing of all SPP bundles in OneView: curl --insecure --silent \ --header "auth: ${sessionID}" \ --header "X-API-Version: ${currentVersion}" \ --request GET ${OneView}/rest/firmware-drivers | jq -r '.members[] | { "uuid":.uuid,"baselineShortName":.baselineShortName,"releaseDate":.releaseDate,"uri":.uri }' # # Pick the baselineShortName that corresponds to the SPP bundle you wish to use and set it to a variable: SRTNM="SPP 2022.03.0" # # Get the URI of that SPP bundle: SPPURI=$(basename $(curl --insecure --silent --header "auth: ${sessionID}" --header "X-API-Version: ${currentVersion}" --request GET ${OneView}/rest/firmware-drivers | jq -r '.members[] | select(.baselineShortName=="'"${SRTNM}"'") |.uri')) # # Get Server UUID SERVER=my-server.com ACTV=$(python -c "import urllib, sys; print urllib.quote(sys.argv[1])" "\"'serverName' = '${SERVER}'\"") UUID=$(curl --insecure --silent --header "auth: ${sessionID}" --header "X-API-Version: ${currentVersion}" --request GET ${OneView}/rest/server-hardware?filter=${ACTV} | jq -r '.members[] |.uuid') # DATA='{"firmwareBaseLineId":"'${SPPURI}'","serverUUID":"'${UUID}'"}' # Make sure there are no errors in the DATA variable: echo ${DATA} | jq -r '.' # # Get the firmware compliance for this server: curl --insecure --silent \ --header "auth: ${sessionID}" \ --header "X-API-Version: ${currentVersion}" \ --header "content-type: application/json" \ --data ${DATA} \ --request GET ${OneView}/rest/server-hardware/firmware-compliance | jq -r --arg SRV ${SERVER} '. | { "Server":$SRV,"serverFirmwareUpdateRequired":.serverFirmwareUpdateRequired,"componentMappingList":.componentMappingList[] | {"componentLocation":.componentLocation,"componentName":.componentName,"componentType":.componentType,"installedVersion":.installedVersion,"baselineVersion":.baselineVersion,"componentFirmwareUpdateRequired":.componentFirmwareUpdateRequired }}'

Re: checking firmware compliance with REST API

tkonto — Thu, 24 Nov 2022 17:40:52 GMT

Your code gave me a great starting point to work with, toward an ansible playbook which will be published here later.

However, I do have questions, and forgive my lack of experience with OneView.

Trying to test the playbook, I had the server profile changed in Oneview and I was expecting to see this changing either "componentFirmwareUpdateRequired" or "serverFirmwareUpdateRequired" to true.

This was not the case. All returned variables remained false.

What actions in OneView would make either variable return true, following a REST API call?

Cheers,

Theo

Re: checking firmware compliance with REST API

tkonto — Sat, 26 Nov 2022 09:51:46 GMT

Following up with more details.

First, we created an incompatibility from Oneview WebUI between firmware and profile.
Profile was left to 2021.05.01 and server was set to 2021.05.02.

Oneview WebUI reported the incompatibility.

But unless there are no differences between the two SPPs, for the specific hardware, the following is what OneView reported back:

{ "componentMappingList":[ { "componentKey":" ", "componentLocation":" ", "componentName":"Agentless Management Service for Gen9", "componentType":"Software", "installedVersion":"670.11.7.0.10-1.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Native ixgben network driver for VMware ESXi", "componentType":"Software", "installedVersion":"1.8.7-1OEM.670.0.0.8169922", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Channel Interface Kernel Module for vSphere ESXi 6.7", "componentType":"Software", "installedVersion":"670.10.7.0.4-1OEM.670.0.0.75355", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Lights-Out Configuration Utility for ESXi", "componentType":"Software", "installedVersion":"6.7.0.5.5-0.18.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"000000000000000000000000000000f4", "componentLocation":"System Board", "componentName":"System Programmable Logic Device", "componentType":"Firmware", "installedVersion":"Version 0x17", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"HPSA LSU Management Plugin", "componentType":"Software", "installedVersion":"2.0.0-16vmw.670.1.28.10302608", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Command line tool for interacting with the iLO RESTful Interfac", "componentType":"Software", "installedVersion":"650.3.1.0.35-4240417", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":null, "componentLocation":"System Board", "componentName":"Power Management Controller FW Bootloader", "componentType":"Firmware", "installedVersion":"1.0", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Event Utility for ESXi", "componentType":"Software", "installedVersion":"6.7.0.02-01.00.12.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Integrated Smart Update Tools ESXCLI Plug-In", "componentType":"Software", "installedVersion":"6.7.0.2.8.0.0-9", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":null, "componentLocation":"System Board", "componentName":"Intelligent Platform Abstraction Data", "componentType":"Firmware", "installedVersion":"25.00", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"47a4b1a62a384f5a808610f8103c17d2", "componentLocation":"Slot 2", "componentName":"HP Ethernet 10Gb 2-port 560M Adapter", "componentType":"Firmware", "installedVersion":"1.2836.0", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"CRU Kernel Module for vSphere ESXi 6.7", "componentType":"Software", "installedVersion":"670.6.7.10.14-1OEM.670.0.0.7535", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Fiber Channel Enablement Package for ESXi 6.7.0", "componentType":"Software", "installedVersion":"670.3.70.5-7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"47a4b1a62a384f5a808610f8103c17d2", "componentLocation":"Slot 1", "componentName":"HP Ethernet 10Gb 2-port 560M Adapter", "componentType":"Firmware", "installedVersion":"1.2836.0", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Boot Configuration Utility for ESXi", "componentType":"Software", "installedVersion":"6.7.0.02-06.00.14.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"00000000000000000000000001493336", "componentLocation":"System Board", "componentName":"System ROM", "componentType":"Firmware", "installedVersion":"I36 v2.80 (10/16/2020)", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"47a4b1a62a384f5a10df0720103c1935", "componentLocation":"Embedded FlexibleLOM 1", "componentName":"HP FlexFabric 20Gb 2-port 650FLB Adapter", "componentType":"Firmware", "installedVersion":"12.0.1336.0", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"00000000000000000000000001493336", "componentLocation":"System Board", "componentName":"Redundant System ROM", "componentType":"Firmware", "installedVersion":"I36 v2.80 (10/16/2020)", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Emulex OneConnect Network Driver", "componentType":"Software", "installedVersion":"12.0.1216.4-1OEM.670.0.0.816992", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Custom Image Build Information for ESXi 6.7.0", "componentType":"Software", "installedVersion":"670.U3.10.7.0.4-7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Integrated Smart Update Tools for ESXi", "componentType":"Software", "installedVersion":"6.7.0.2.8.0.0-19", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"WBEM Providers for ESXi 6.7", "componentType":"Software", "installedVersion":"670.03.16.00.3-7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Emulex FCoE Driver", "componentType":"Software", "installedVersion":"12.0.1278.0-1OEM.670.0.0.816992", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Emulex OneConnect IMA-Plugin", "componentType":"Software", "installedVersion":"12.0.1188.0-03", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"2932ecaecc69d843bd0e61dc3406f71b", "componentLocation":"System Board", "componentName":"iLO", "componentType":"Firmware", "installedVersion":"2.77 Dec 07 2020", "baselineVersion":"2.74", "componentFirmwareUpdateRequired":false, "hpsumManaged":true }, { "componentKey":" ", "componentLocation":" ", "componentName":"Configuration Utility CONREP for ESXi", "componentType":"Software", "installedVersion":"670.10.7.0.1-6.7.0.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":null, "componentLocation":"System Board", "componentName":"Server Platform Services (SPS) Firmware", "componentType":"Firmware", "installedVersion":"3.1.3.21.4", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Agentless Management Service for Gen10", "componentType":"Software", "installedVersion":"670.11.7.1.2-1.7535516", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":" ", "componentLocation":" ", "componentName":"Smart Storage Administrator CLI for ESXi", "componentType":"Software", "installedVersion":"5.10.45.1-6.7.0.7535516.oem", "baselineVersion":"unknown", "componentFirmwareUpdateRequired":false, "hpsumManaged":false }, { "componentKey":"00000000000000000000000000504d14", "componentLocation":"System Board", "componentName":"Power Management Controller Firmware", "componentType":"Firmware", "installedVersion":"1.0.9", "baselineVersion":"1.0.9", "componentFirmwareUpdateRequired":false, "hpsumManaged":true } ], "serverFirmwareUpdateRequired":false }

Re: checking firmware compliance with REST API

BradV — Mon, 28 Nov 2022 10:36:23 GMT

I'm pretty sure the message that a firmware update is required is only triggered when the SPP bundle associated with a server profile template is changed? I'm not sure. I downgraded the iLO firmware on one unit and OneView never reported a firmware update was required. In its database, it had already been updated. I guess the programmers did not think we admins would be so stupid as to downgrade a firmware? In any case, have only seen a firmware update is required after changing the SPP bundle in the server profile template. We would need the OneView experts at HPE to verify for us.

Re: checking firmware compliance with REST API

TKop — Wed, 30 Nov 2022 15:30:32 GMT

Was there an alert on the profile for the downgraded component (saying doesn't match baseline)? That eventually would be expected.

Re: checking firmware compliance with REST API

BradV — Wed, 30 Nov 2022 15:34:27 GMT

No. I opened a support case and was told it would not update that discrepancy.

Re: checking firmware compliance with REST API

TKop — Mon, 05 Dec 2022 16:42:04 GMT

Any screenshots still available that could be shared? Just to be clear, you are referring to the compliance reporting and if you downgrade a component outside of OV, the compliance reporting view was not showing an update is needed for the baseline after the downgrade to the version below it?

On a related note, OV is expected to alert on the server profile if you have a baseline applied there, and a component is downgrade outside of OV -> OV should alert to say the installed version does not match the applied baseline.

Re: checking firmware compliance with REST API

BradV — Tue, 06 Dec 2022 15:23:46 GMT

I do not have any screenshots. I spefically reduced the iLO firmware version. OneView never picked up on that.

Re: checking firmware compliance with REST API

tkonto — Sun, 11 Dec 2022 18:05:11 GMT

The following part of a more extensive playbook has been tested to check the compliance of the server, using sollely OneView info.

It is complete in relation to SPP actions but will require some adaptation as it includes variables whose values get evaluated from other parts (like wf_spp)

It was inspired by the original posting of BradV and his next posting with extensive corrections, made all the difference.

Hope it will be of help to someone, as the original curl code was of great help to me.

--- - hosts: all gather_facts: no collections: - ansible.builtin vars: oneview_base_url: "{{oneview_base_url}}" oneview_user: "{{oneview_user_name}}" oneview_pass: "{{oneview_password}}" connection: local tasks: - name: Get Session Key delegate_to: localhost uri: url: "{{ oneview_base_url }}/login-sessions" method: POST validate_certs: False force_basic_auth: yes body_format: json body: userName: "{{ oneview_user }}" password: "{{ oneview_pass }}" headers: Content-type: "application/json" register: output tags: always - name: OneView Key set_fact: oneview_key: "{{ output.json.sessionID }}" tags: always - name: Get all server hardware details delegate_to: localhost uri: url: "{{ oneview_base_url }}/server-hardware" method: GET validate_certs: False body_format: json headers: X-Api-Version: 1200 Auth: "{{ oneview_key }}" register: output tags: provision - name: Set fact for UUID of server set_fact: fact_server_uuid: "{{ (output.json.members | flatten | selectattr('name', 'equalto', wf_blade_id) | first).uuid }}" tags: provision - name: Get all server firmware details delegate_to: localhost uri: url: "{{ oneview_base_url }}/firmware-drivers" method: GET validate_certs: False body_format: json headers: X-Api-Version: 1200 Auth: "{{ oneview_key }}" register: output tags: [provision, survey_update] - name: Set fact for SPP UUID set_fact: fact_spp_uuid: "{{ (output.json.members | flatten | selectattr('baselineShortName', 'equalto', wf_spp)) | map(attribute='uuid') | first }}" tags: provision - name: Stat the list of all SPP versions loaded into OneView delegate_to: localhost set_stats: data: wf_spp_versions: "{{ output.json.members | map(attribute='baselineShortName') | list }}" #| join('\n') }}" tags: survey_update - name: Get server compliance delegate_to: localhost uri: url: "{{ oneview_base_url }}/server-hardware/firmware-compliance" method: POST validate_certs: False body_format: json body: firmwareBaselineId: "{{ fact_spp_uuid }}" serverUUID: "{{ fact_server_uuid }}" headers: X-Api-Version: 1200 Auth: "{{ oneview_key }}" register: output tags: provision - name: Print update state delegate_to: localhost debug: msg: "{{ output.json.serverFirmwareUpdateRequired }}" tags: provision - name: Check if server requires update set_fact: update_required: "{{ output.json.serverFirmwareUpdateRequired }}" tags: provision - name: Fail if server requires update delegate_to: localhost fail: msg: "Server requires update" when: update_required == "true" # when: output.json.serverFirmwareUpdateRequired == "true" tags: provision