Inspection allows Bare Metal service to discover required node properties
driver_info fields (for example, IPMI credentials) are set
by an operator. Inspection will also create the Bare Metal service ports for the
discovered ethernet MACs. Operators will have to manually delete the Bare Metal
service ports for which physical media is not connected. This is required due
to the bug 1405131.
There are two kinds of inspection supported by Bare Metal service:
Out-of-band inspection is currently implemented by several hardware types, including
The node should be in the
manageable state before inspection is initiated.
If it is in the
available state, move it to
baremetal node manage <node_UUID>
Then inspection can be initiated using the following command:
baremetal node inspect <node_UUID>
This is an incomplete list of capabilities we want to discover during inspection. The exact support is hardware and hardware type specific though, the most complete list is provided by the iLO Hardware Inspection Support.
whether secure boot is supported for the node
the boot mode the node is using
whether the CPU virtualization is enabled
whether the AES CPU extensions are enabled
maximum RAID level supported by the node
number of GPU devices on the node
The operator can specify these capabilities in nova flavor for node to be selected for scheduling:
openstack flavor set my-baremetal-flavor --property capabilities:pci_gpu_devices="> 0"
openstack flavor set my-baremetal-flavor --property capabilities:secure_boot="true"
Please see a specific hardware type page for the exact list of capabilities this hardware type can discover.
In-band inspection involves booting a ramdisk on the target node and fetching information directly from it. This process is more fragile and time-consuming than the out-of-band inspection, but it is not vendor-specific and works across a wide range of hardware. In-band inspection is using the ironic-inspector project.
It is supported by all hardware types, and used by default, if enabled, by the
ipmi hardware type. The
inspector inspect interface has to be
enabled to use it:
enabled_inspect_interfaces = inspector,no-inspect
If the ironic-inspector service is not registered in the service catalog, set the following option:
endpoint_override = http://inspector.example.com:5050
In order to ensure that ports in Bare Metal service are synchronized with NIC ports on the node, the following settings in the ironic-inspector configuration file must be set:
add_ports = all
keep_ports = present
Inspection is managed when the Bare Metal conductor fully configures the node for inspection, including setting boot device, boot mode and power state. This is the only way to conduct inspection using Virtual media boot or with Layer 3 or DHCP-less ramdisk booting. This mode is engaged automatically when the node has sufficient information to configure boot (e.g. ports in case of iPXE).
There are a few configuration options that tune managed inspection, the most
extra_kernel_params, which allows adding kernel parameters for
inspection specifically. This is where you can configure
inspection collectors and other parameters, for example:
extra_kernel_params = ipa-inspection-collectors=default,logs ipa-collect-lldp=1
For the callback URL the ironic-inspector endpoint from the service catalog is used. If you want to override the endpoint for callback only, set the following option:
callback_endpoint_override = https://example.com/baremetal-introspection/v1/continue
Under unmanaged inspection we understand in-band inspection orchestrated by ironic-inspector or a third party. This was the only inspection mode before the Ussuri release, and it is still used when the node’s boot cannot be configured by the conductor. The options described above do not affect unmanaged inspection. See ironic-inspector installation guide for more information.
If you want to prevent unmanaged inspection from working, set this option:
require_managed_boot = True