Replacing Update-HPEiLOFirmware with Redfish restapi calls

[Cederberg]

Hi.
I'm looking to change my configure ILO script to only use redfish to get rid of the dependency of HPEiLOCmdlets, its an easy install but it needs to be there on any computer trying to configure an iLO.

But i got stuck on iLO firmware update and can't really find any exampler for powershell
With HPEiLOCmdlets i use the following line to update and it works fine but

Update-HPEiLOFirmware -Connection $connection -Location $ilofwFilename.fullname -TPMEnabled -UploadTimeout 700 -Confirm:$false
When i try to find the redfish alternative it seems to me there are two options
POST /redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate/ Where the ILO-fw file needs to på on a webserver While the Update-HPEiLOFirmware can point to a local file (UNC-Path)
The other is HttpPushUri which i can only find limited information about so i can't figure out how to use it.

Does anyone have any tips for me or examples they are using without the HPEiLOCmdlets or any other dependancies to Installable applications?

Best regards
//Mattias

[TVVJ]

Hello,

You may review the "Scripting Tools for Windows PowerShell User Guide" and see if this document provides any help.

Regards,

[Cederberg]

Thanks for replying.
I'm sorry but using the ILO CMDlets is what i'm trying to avoid doing. I'm trying to get rid of all dependencies and use pure redfish/restapi.

The redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate/ URI works but i can't define the TPMoverride flag in the body for that request even though the examples on this link says it should. i don't have a TPM equiped server to test with at the moment but maybe the TPM must be enabled to use the flag and setting it to false is not supported when no TPM is present or the TPM is disabled.
I'll have to test that later when i get a TPM enabled server to test on.

[Cederberg]

I got it to work on a server with no TPM chip so the TPMOverrideFlag did not need to be defined. I still need to verify that the TPMOverrideFlag works on servers that are equiped with a TPM chip.

The simplest way to update with redfish from Powershell i found was using UpdateService.SimpleUpdate (As mentioned above still a quiestionmark on how it works with TPM enabled servers)
I'll leave the powershell code here if someone else is looking for the same.
You obviosly need to create a login session but i leave that out and only paste the update part

$ilo = "FQDN to ILO"
$body = @{

            ImageURI = "http://PathOnWebserver/ilo5_307.bin"

            TransferProtocol = "HTTP"

        } | ConvertTo-Json

        $headers = @{'X-Auth-Token' = $token }

        $bmcuri = "Https://$ilo/redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate/"

        $r = invoke-webrequest -uri $bmcuri -method 'POST' -body $body -headers $headers -erroraction Stop -ContentType "application/json"

There is also a way to upload the firmware to ILO repository with 

/redfish/v1/UpdateService/Actions/Oem/Hpe/HpeiLOUpdateServiceExt.AddFromUri and then start a task installing the firmware with 

/redfish/v1/UpdateService/UpdateTaskQueue/ but i will leave that out aswell as the above code seems to work.

//Cederberg

[Rakesh0404]

Hi Good day! We have very fewer examples on the query raised. Here is the documentation of the redfish with examples that might help. Link - https://servermanagementportal.ext.hpe.com/docs/redfishclients/python-redfish-library/examples/#update-ilo-firmware

[Cederberg]

@Rakesh0404  @TVVJ Had a chance to try out some code on a ILO5 with TPM (DL380 gen10 plus) with fw3.07 and tried to update to 3.08

The examples url for python seems to be wrong. SimpleUpdate action of Updateservice /redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate/ does not seem to work with TPMOverrideFlag = true discribed by the examples link in above post. Also tried to change it to TPMOverride which works with UpdateTaskQueue.

The above code i posted works with a server that has a TPM chip active and i can't find any errors after the firmware update goes through. Maybe they have changed the SimpleUpdate action in newer firmware versions and you don't need the flag it's automatic? I'm unsure on how to proceed as the documentation is so lacking. I think I'm gonna use UpdateTaskQueue on Servers/iLOs with active TPM Chip as it allows me to define the TPMOverride flag.

[Mr_Techie]

Hi @Cederberg,

It sounds like your decision to proceed with UpdateTaskQueue and the TPMOverride flag is a good approach, especially since it seems to work consistently with servers that have active TPM chips. It's possible that the behavior of the SimpleUpdate action has changed in recent firmware versions, making the explicit use of TPMOverrideFlag unnecessary. Since the documentation isn't clear, it's reasonable to stick with what works.

If you're managing multiple systems and want to ensure future compatibility, testing both methods across various firmware versions and documenting the results might help identify any patterns or changes in behavior across updates. 

Hope this gives some insights. 

[Cederberg · Accepted solution]

Thank you for all your answers. As stated i'm gonna use two diffrent approaches depending on if a TPM Chip is present and active or not. I'm pasting my code here so it could help anyone looking for the same answer. The code is provided as is and use it at your own risk

For servers without TPM chip
$body = @{
ImageURI = "http://urltowebserverhostingILOFWFile/ilo5_307.bin"
TransferProtocol = "HTTP"
} | ConvertTo-Json
$headers = @{'X-Auth-Token' = $token }
$bmcuri = "Https://$ilo/redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate/"
$r = invoke-webrequest -uri $bmcuri -method 'POST' -body $body -headers $headers -erroraction Stop -ContentType "application/json"

For servers with TPM Active
#Upload Firmware to ilo
$body = @{
ImageURI = "http://urltowebserverhostingILOFWFile/ilo5_307.bin"
UpdateTarget = $False
UpdateRecoverySet = $False
UpdateRepository = $true
} | ConvertTo-Json -Depth 5
$headers = @{'X-Auth-Token' = $token }
$bmcuri = "Https://$ilo/redfish/v1/UpdateService/Actions/Oem/Hpe/HpeiLOUpdateServiceExt.AddFromUri"
$r = invoke-webrequest -uri $bmcuri -method 'POST' -Body $body -headers $headers -erroraction Stop -ContentType "application/json"
$TMUpload = (ConvertFrom-Json $r.Content).Taskmonitor
Write-host ""
Write-host "Waiting for upload"
DO
{
$headers = @{'X-Auth-Token' = $token }
$bmcuri = "Https://$ilo$TMUpload"
$rUpload = invoke-webrequest -uri $bmcuri -method 'GET' -headers $headers -erroraction Stop -ContentType "application/json"
$TMStatus = (ConvertFrom-Json $Rupload.content).error.'@Message.ExtendedInfo'.Messageid
Write-host "." -NoNewline
start-sleep -Seconds 5
} while ($TMStatus -notmatch "Success")
Write-host ""
Write-host "Upload Complete"
Write-host ""
start-sleep -Seconds 10
#Start firmware update TPM Active - create task
Write-host ""
Write-host "iLO kommer uppdateras och sedan resetas. Scriptet väntar inte på att det är klart."
Write-host "Vänta tills den nya versionen syns på första sidan innan du använder iLO:t"
start-sleep -Seconds 10
$body = @{
Name = "Update ILO FW 3.07"
Filename = ilo5_307.bin
Command = "ApplyUpdate"
TPMOverride = $true
UpdatableBy = @("Bmc")
} | ConvertTo-Json -Depth 5
$headers = @{'X-Auth-Token' = $token }
$bmcuri = "Https://$ilo/redfish/v1/UpdateService/UpdateTaskQueue/"
$r = invoke-webrequest -uri $bmcuri -method 'POST' -body $body -headers $headers -erroraction Stop -ContentType "application/json"