checking firmware compliance with REST API

[BradV]

The REST API for checking firmware compliance says to supply: 

{
   "firmwareBaselineId": "SPP2017101_2017_1027_10",
   "serverUUID": "36343537-3338-4E43-3735-31373034308"
}

I'm just not sure what it means by firmwareBaseLineId?  I know I can retrieve the current SPP bundles loaded to OneView with: 

curl --insecure \
     --header "auth: ${sessionID}" \
     --header "X-API-Version: ${currentVersion}" \
     --output firmware \
     --request GET ${OneView}/rest/firmware-drivers

and if I look at the output of that, I do not see firmwareBaselineId anywhere.  Is this possibly just the leaf part of the URI?

[BradV · Accepted solution]

OK, ran some tests and confirmed it is the basename of the bundle uri.  This is my process:

Get session credentials.  Store those in some variables.

Download the current SPP bundle listing.

Download a list of hardware from OneView.

# Get the  SPP basename:
SPP=\"$(/usr/bin/basename $(jq '.members[] | .uri' firmware-bundles))
SERVER=my-server-ilo
UUID=$(jq -r .members[] | select(.name == "'${SERVER}'") | "\(.uuid)"' ${HARDW})
DATA='{"firmwareBaselineId":'${SPP}',"serverUUID":"'${UUID}'"}'
# Make sure there aren't any errors in the data:
echo ${DATA} | jq -r '.'
curl --insecure \
      --header "content-type: aplication/json" \
      --header "auth: ${sessionID}" \
      --header "X-API-Version: ${currentVersion}" \
      --data "${DATA}" \
      --request POST ${OneView}/rest/server-hardware/firmware-compliance | jq -r '.'

[tkonto]

Thank you for this solution.

Where do we get the applicable and current SPP bundle listing?

Cheers,
Theo

PS: Is there an alternative solution, solely based on a REST API call and filtering its output?

[BradV]

Looks like there might be a typo or two in the above.  Here is current code:

# Display a listing of all SPP bundles in OneView:
curl --insecure --silent \
     --header "auth: ${sessionID}" \
     --header "X-API-Version: ${currentVersion}" \
     --request GET ${OneView}/rest/firmware-drivers | jq -r '.members[] | { "uuid":.uuid,"baselineShortName":.baselineShortName,"releaseDate":.releaseDate,"uri":.uri }'
#
# Pick the baselineShortName that corresponds to the SPP bundle you wish to use and set it to a variable:
SRTNM="SPP 2022.03.0"
#
# Get the URI of that SPP bundle:
SPPURI=$(basename $(curl --insecure --silent --header "auth: ${sessionID}" --header "X-API-Version: ${currentVersion}" --request GET ${OneView}/rest/firmware-drivers | jq -r '.members[] | select(.baselineShortName=="'"${SRTNM}"'") |.uri'))
#
# Get Server UUID
SERVER=my-server.com
ACTV=$(python -c "import urllib, sys; print urllib.quote(sys.argv[1])" "\"'serverName' = '${SERVER}'\"")
UUID=$(curl --insecure --silent --header "auth: ${sessionID}" --header "X-API-Version: ${currentVersion}" --request GET ${OneView}/rest/server-hardware?filter=${ACTV} | jq -r '.members[] |.uuid')
#
DATA='{"firmwareBaseLineId":"'${SPPURI}'","serverUUID":"'${UUID}'"}'
# Make sure there are no errors in the DATA variable:
echo ${DATA} | jq -r '.'
#
# Get the firmware compliance for this server:
curl --insecure --silent \
   --header "auth: ${sessionID}" \
   --header "X-API-Version: ${currentVersion}" \
   --header "content-type: application/json" \
   --data ${DATA} \
   --request GET ${OneView}/rest/server-hardware/firmware-compliance | jq -r --arg SRV ${SERVER} '. | { "Server":$SRV,"serverFirmwareUpdateRequired":.serverFirmwareUpdateRequired,"componentMappingList":.componentMappingList[] | {"componentLocation":.componentLocation,"componentName":.componentName,"componentType":.componentType,"installedVersion":.installedVersion,"baselineVersion":.baselineVersion,"componentFirmwareUpdateRequired":.componentFirmwareUpdateRequired }}'

[tkonto]

Your code gave me a great starting point to work with, toward an ansible playbook which will be published here later.

However, I do have questions, and forgive my lack of experience with OneView.

Trying to test the playbook, I had the server profile changed in Oneview and I was expecting to see this changing either "componentFirmwareUpdateRequired" or "serverFirmwareUpdateRequired" to true.

This was not the case. All returned variables remained false.

What actions in OneView would make either variable return true, following a REST API call?

Cheers,

Theo

[tkonto]

Following up with more details.

First, we created an incompatibility from Oneview WebUI between firmware and profile.
Profile was left to 2021.05.01 and server was set to 2021.05.02.

Oneview WebUI reported the incompatibility.

But unless there are no differences between the two SPPs, for the specific hardware, the following is what OneView reported back:

{
"componentMappingList":[
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Agentless Management Service for Gen9",
"componentType":"Software",
"installedVersion":"670.11.7.0.10-1.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Native ixgben network driver for VMware ESXi",
"componentType":"Software",
"installedVersion":"1.8.7-1OEM.670.0.0.8169922",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Channel Interface Kernel Module for vSphere ESXi 6.7",
"componentType":"Software",
"installedVersion":"670.10.7.0.4-1OEM.670.0.0.75355",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Lights-Out Configuration Utility for ESXi",
"componentType":"Software",
"installedVersion":"6.7.0.5.5-0.18.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"000000000000000000000000000000f4",
"componentLocation":"System Board",
"componentName":"System Programmable Logic Device",
"componentType":"Firmware",
"installedVersion":"Version 0x17",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"HPSA LSU Management Plugin",
"componentType":"Software",
"installedVersion":"2.0.0-16vmw.670.1.28.10302608",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Command line tool for interacting with the iLO RESTful Interfac",
"componentType":"Software",
"installedVersion":"650.3.1.0.35-4240417",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":null,
"componentLocation":"System Board",
"componentName":"Power Management Controller FW Bootloader",
"componentType":"Firmware",
"installedVersion":"1.0",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Event Utility for ESXi",
"componentType":"Software",
"installedVersion":"6.7.0.02-01.00.12.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Integrated Smart Update Tools ESXCLI Plug-In",
"componentType":"Software",
"installedVersion":"6.7.0.2.8.0.0-9",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":null,
"componentLocation":"System Board",
"componentName":"Intelligent Platform Abstraction Data",
"componentType":"Firmware",
"installedVersion":"25.00",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"47a4b1a62a384f5a808610f8103c17d2",
"componentLocation":"Slot 2",
"componentName":"HP Ethernet 10Gb 2-port 560M Adapter",
"componentType":"Firmware",
"installedVersion":"1.2836.0",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"CRU Kernel Module for vSphere ESXi 6.7",
"componentType":"Software",
"installedVersion":"670.6.7.10.14-1OEM.670.0.0.7535",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Fiber Channel Enablement Package for ESXi 6.7.0",
"componentType":"Software",
"installedVersion":"670.3.70.5-7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"47a4b1a62a384f5a808610f8103c17d2",
"componentLocation":"Slot 1",
"componentName":"HP Ethernet 10Gb 2-port 560M Adapter",
"componentType":"Firmware",
"installedVersion":"1.2836.0",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Boot Configuration Utility for ESXi",
"componentType":"Software",
"installedVersion":"6.7.0.02-06.00.14.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"00000000000000000000000001493336",
"componentLocation":"System Board",
"componentName":"System ROM",
"componentType":"Firmware",
"installedVersion":"I36 v2.80 (10/16/2020)",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"47a4b1a62a384f5a10df0720103c1935",
"componentLocation":"Embedded FlexibleLOM 1",
"componentName":"HP FlexFabric 20Gb 2-port 650FLB Adapter",
"componentType":"Firmware",
"installedVersion":"12.0.1336.0",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"00000000000000000000000001493336",
"componentLocation":"System Board",
"componentName":"Redundant System ROM",
"componentType":"Firmware",
"installedVersion":"I36 v2.80 (10/16/2020)",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Emulex OneConnect Network Driver",
"componentType":"Software",
"installedVersion":"12.0.1216.4-1OEM.670.0.0.816992",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Custom Image Build Information for ESXi 6.7.0",
"componentType":"Software",
"installedVersion":"670.U3.10.7.0.4-7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Integrated Smart Update Tools for ESXi",
"componentType":"Software",
"installedVersion":"6.7.0.2.8.0.0-19",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"WBEM Providers for ESXi 6.7",
"componentType":"Software",
"installedVersion":"670.03.16.00.3-7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Emulex FCoE Driver",
"componentType":"Software",
"installedVersion":"12.0.1278.0-1OEM.670.0.0.816992",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Emulex OneConnect IMA-Plugin",
"componentType":"Software",
"installedVersion":"12.0.1188.0-03",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"2932ecaecc69d843bd0e61dc3406f71b",
"componentLocation":"System Board",
"componentName":"iLO",
"componentType":"Firmware",
"installedVersion":"2.77 Dec 07 2020",
"baselineVersion":"2.74",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":true
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Configuration Utility CONREP for ESXi",
"componentType":"Software",
"installedVersion":"670.10.7.0.1-6.7.0.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":null,
"componentLocation":"System Board",
"componentName":"Server Platform Services (SPS) Firmware",
"componentType":"Firmware",
"installedVersion":"3.1.3.21.4",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Agentless Management Service for Gen10",
"componentType":"Software",
"installedVersion":"670.11.7.1.2-1.7535516",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":" ",
"componentLocation":" ",
"componentName":"Smart Storage Administrator CLI for ESXi",
"componentType":"Software",
"installedVersion":"5.10.45.1-6.7.0.7535516.oem",
"baselineVersion":"unknown",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":false
},
{
"componentKey":"00000000000000000000000000504d14",
"componentLocation":"System Board",
"componentName":"Power Management Controller Firmware",
"componentType":"Firmware",
"installedVersion":"1.0.9",
"baselineVersion":"1.0.9",
"componentFirmwareUpdateRequired":false,
"hpsumManaged":true
}
],
"serverFirmwareUpdateRequired":false
}

[BradV]

I'm pretty sure the message that a firmware update is required is only triggered when the SPP bundle associated with a server profile template is changed?  I'm not sure.  I downgraded the iLO firmware on one unit and OneView never reported a firmware update was required.  In its database, it had already been updated.  I guess the programmers did not think we admins would be so stupid as to downgrade a firmware?    In any case, have only seen a firmware update is required after changing the SPP bundle in the server profile template.  We would need the OneView experts at HPE to verify for us.

[TKop]

Was there an alert on the profile for the downgraded component (saying doesn't match baseline)?  That eventually would be expected.

[BradV]

No.  I opened a support case and was told it would not update that discrepancy.

[TKop]

Any screenshots still available that could be shared?  Just to be clear, you are referring to the compliance reporting and if you downgrade a component outside of OV, the compliance reporting view was not showing an update is needed for the baseline after the downgrade to the version below it? 

On a related note, OV is expected to alert on the server profile if you have a baseline applied there, and a component is downgrade outside of OV -> OV should alert to say the installed version does not match the applied baseline.

[BradV]

I do not have any screenshots.  I spefically reduced the iLO firmware version.  OneView never picked up on that. 

[tkonto]

The following part of a more extensive playbook has been tested to check the compliance of the server, using sollely OneView info.

It is complete in relation to SPP actions but will require some adaptation as it includes variables whose values get evaluated from other parts (like wf_spp)

It was inspired by the original posting of BradV and his next posting with extensive corrections, made all the difference.

Hope it will be of help to someone, as the original curl code was of great help to me.

---
- hosts: all
  gather_facts: no
  collections:
   - ansible.builtin
  vars:
    oneview_base_url: "{{oneview_base_url}}"
    oneview_user: "{{oneview_user_name}}"
    oneview_pass: "{{oneview_password}}"
  connection: local

  tasks:

    - name: Get Session Key
      delegate_to: localhost
      uri:
        url: "{{ oneview_base_url }}/login-sessions"
        method: POST
        validate_certs: False
        force_basic_auth: yes
        body_format: json
        body:
          userName: "{{ oneview_user }}"
          password: "{{ oneview_pass }}"
        headers:
          Content-type: "application/json"
      register: output
      tags: always

    - name: OneView Key
      set_fact:
        oneview_key: "{{ output.json.sessionID }}"
      tags: always

    - name: Get all server hardware details
      delegate_to: localhost
      uri:
        url: "{{ oneview_base_url }}/server-hardware"
        method: GET
        validate_certs: False
        body_format: json
        headers:
          X-Api-Version: 1200
          Auth: "{{ oneview_key }}"
      register: output
      tags: provision

    - name: Set fact for UUID of server
      set_fact:
        fact_server_uuid: "{{ (output.json.members | flatten | selectattr('name', 'equalto', wf_blade_id) | first).uuid }}"
      tags: provision

    - name: Get all server firmware details
      delegate_to: localhost
      uri:
        url: "{{ oneview_base_url }}/firmware-drivers"
        method: GET
        validate_certs: False
        body_format: json
        headers:
          X-Api-Version: 1200
          Auth: "{{ oneview_key }}"
      register: output
      tags: [provision, survey_update]

    - name: Set fact for SPP UUID
      set_fact:
        fact_spp_uuid: "{{ (output.json.members | flatten |  selectattr('baselineShortName', 'equalto', wf_spp)) | map(attribute='uuid') | first }}"
      tags: provision

    - name: Stat the list of all SPP versions loaded into OneView
      delegate_to: localhost
      set_stats:
        data:
          wf_spp_versions: "{{ output.json.members | map(attribute='baselineShortName') | list }}" #| join('\n') }}"
      tags: survey_update


    - name: Get server compliance
      delegate_to: localhost
      uri:
        url: "{{ oneview_base_url }}/server-hardware/firmware-compliance"
        method: POST
        validate_certs: False
        body_format: json
        body:
          firmwareBaselineId: "{{ fact_spp_uuid }}"
          serverUUID: "{{ fact_server_uuid }}"
        headers:
          X-Api-Version: 1200
          Auth: "{{ oneview_key }}"
      register: output
      tags: provision

    - name: Print update state
      delegate_to: localhost
      debug:
        msg: "{{ output.json.serverFirmwareUpdateRequired }}"
      tags: provision

    - name: Check if server requires update
      set_fact:
        update_required: "{{ output.json.serverFirmwareUpdateRequired }}"
      tags: provision

    - name: Fail if server requires update
      delegate_to: localhost
      fail:
        msg: "Server requires update"
      when: update_required == "true"
#      when: output.json.serverFirmwareUpdateRequired  == "true"
      tags: provision