From 5fee19205167cef618d930ce9d958e6667fc3a1c Mon Sep 17 00:00:00 2001 From: Dmitry Tantsur Date: Tue, 22 Oct 2024 11:45:08 +0200 Subject: [PATCH] User guide: fix missing checksumType in samples I completely forgot that BMO defaults to md5, not auto. These examples don't work because Ironic is trying to match a SHA256 checksum against an MD5 one. Signed-off-by: Dmitry Tantsur --- docs/user-guide/src/bmo/instance_customization.md | 1 + docs/user-guide/src/bmo/provisioning.md | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/docs/user-guide/src/bmo/instance_customization.md b/docs/user-guide/src/bmo/instance_customization.md index f67393f9..43884716 100644 --- a/docs/user-guide/src/bmo/instance_customization.md +++ b/docs/user-guide/src/bmo/instance_customization.md @@ -69,6 +69,7 @@ spec: image: checksum: http://192.168.0.150/SHA256SUMS url: http://192.168.0.150/jammy-server-cloudimg-amd64.img + checksumType: auto networkData: name: host-0-networkdata ``` diff --git a/docs/user-guide/src/bmo/provisioning.md b/docs/user-guide/src/bmo/provisioning.md index 8bd225aa..f761d4c8 100644 --- a/docs/user-guide/src/bmo/provisioning.md +++ b/docs/user-guide/src/bmo/provisioning.md @@ -40,6 +40,7 @@ spec: image: checksum: http://192.168.0.150/SHA256SUMS url: http://192.168.0.150/jammy-server-cloudimg-amd64.img + checksumType: auto ``` In most real cases, you will also want to provide @@ -66,6 +67,7 @@ spec: image: checksum: http://192.168.0.150/SHA256SUMS url: http://192.168.0.150/jammy-server-cloudimg-amd64.img + checksumType: auto format: raw rootDeviceHints: wwn: "0x55cd2e415652abcd" @@ -104,6 +106,19 @@ large raw images with a lot of empty space. **NOTE:** the special format value `live-iso` triggers a [live ISO provisioning](./live-iso.md) that works differently from a normal one. +### Notes on checksums + +Unlike Ironic itself, Metal3 currently assumes the checksum algorithm to be MD5 +when no `checksumType` value is provided. Since more secure algorithms, such as +SHA256 or SHA512, are popular nowadays, care must be taken to provide the +correct `checksumType`. The value of `auto` will make Ironic detect the +checksum type from its length and will become the default in the next version +of the BareMetalHost API. + +The `checksum` value can be provided either as a URL or as the hash value +directly. Providing a URL is more convenient in case of public cloud images, +but it provides a weaker defense against man-in-the-middle attacks. + ## Deprovisioning To remove an instance from the host and make it available for new deployments,