feat(os install): AArch64 Unattended OS Installation via iDRAC NFS by Venu-p1 · Pull Request #4894 · dell/omnia

Venu-p1 · 2026-07-26T05:58:02Z

Summary

Adds unattended OS installation support for AArch64 platforms
Uses iDRAC OS Deployment with NFS instead of virtual media
Two-tier architecture: generic utility (install_os) + AArch64 orchestrator (install_os_arm_node)

Key Changes

Kickstart template with architecture-aware defaults
Automate OS installation on target nodes using iDRAC virtual media with NFS-hosted kickstart files
Support both x86_64 and aarch64 architectures with architecture-specific GRUB configuration
Custom kickstart support with automatic rootpw/sshkey injection if missing
Configurable NFS share path for iDRAC virtual media and kickstart hosting
Automated ISO delivery, boot configuration, and installation monitoring via iDRAC Redfish API

Files Changed

utils/install_os/ (new)
utils/install_os_arm_node/ (new)
input/iso_config.yml (new)

Testing

Tested on Dell PowerEdge with iDRAC 9
Verified x86_64 and AArch64 installations

Configuration

Minimal user inputs: ISO path, nfs base path, ISO target directory

…rch64 OS installation Implements unattended OS installation on aarch64 platforms via iDRAC virtual media. Tier 1 — Generic utility (utils/install_os/): - install_os.yml: reusable playbook for any OS/architecture - fetch_iso role: validates source ISO, checks tooling (xorrisofs, isomd5sum) - iso_creation role: renders Kickstart, repacks ISO with embedded KS + GRUB2 - iso_delivery role: iDRAC virtual media mount + one-time boot from CD Tier 2 — AArch64 orchestrator (utils/install_os_arm_node/): - install_os_arm_node.yml: user-facing playbook for admin_aarch64 node - validate_arm_config role: validates iso_config.yml, PXE mapping, SSH key - fetch_arm_params role: extracts BMC IP, admin IP, hashes provision_password - Follows existing patterns: upgrade check, input dir, credential fetch Also adds: - input/iso_config.yml: default configuration template - admin_aarch64.ks.j2: Kickstart template (RHEL 10.x Server with GUI) - grub.cfg.j2: GRUB2 config for AArch64 UEFI boot Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Refactors iso_delivery to use dellemc.openmanage.idrac_os_deployment module with NFS share instead of the multi-step idrac_virtual_media + idrac_boot + redfish_powerstate approach. Benefits: - Single atomic operation (BootToNetworkISO Redfish action) - Built-in job tracking (polls iDRAC job queue for up to 30 min) - Automatic ISO detachment after exposure duration - Simpler integration with Omnia's existing NFS share - No extra HTTP server infrastructure needed Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

- Add NFS-hosted kickstart support with xorriso streaming - Update kickstart for RHEL 10 compatibility and fix syntax errors - Fix iDRAC reachability checks and BMC credentials - Add ISO rebuild check and disk signature cleaning - Rename admin_aarch64 to os_aarch64 Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

…codings - Replace fire-and-forget BootToNetworkISO with full virtual media lifecycle: mount ISO, set one-time CD boot, reboot, wait for SSH, verify, eject. - Wait for OS installation to complete instead of exiting immediately. - Auto-detect NFS share path from container /opt/omnia mount. - Fix NFS kickstart/ISO path construction to match actual NFS export. - Remove hardcoded /opt/omnia-core-shared path and make it configurable. - Make install disk configurable (ks_install_disk) instead of hardcoded sda. - Remove user-provided nfs_share_path/nfs_share_credentials (no longer needed). - Update iso_config.yml template and remove stale hardcoded example values. Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

- Remove unused iso_extract_dir creation from fetch_iso - Replace shell NFS mount detection with ansible_mounts facts - Combine provision_password validation and SHA-512 hashing - Update rhel10 kickstart for GUI install (graphical mode, gdm, graphical.target) Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

…alidation - Replace hardcoded OS/arch titles with generic 'Omnia - Install Operating System' entries - Add silent_install parameter to suppress all prompts in install_os - Add rebuild_iso parameter and prompt to use existing or rebuild custom ISO - Add pre-install confirmation banner with target details and data-loss warning - Validate mandatory parameters at start of generic install_os playbook - Fix recursive variable definitions in role vars/main.yml files - Add silent_install/rebuild_iso options to iso_config.yml template Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

- Verify checksum only when iso_source_checksum is provided - Skip checksum verification with an informative message when empty - Fail with clear message if provided checksum does not match Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Enhances security by encrypting BMC credentials using Ansible Vault and moving the OS installation confirmation banner to the beginning of the workflow for better user experience. Key changes: - ARM playbook now generates an encrypted extra-vars file containing bmc_username and bmc_password using ansible-vault - Generic install_os playbook loads encrypted credentials at the start - Confirmation banner moved from iso_delivery role to install_os.yml, appearing immediately after parameter validation and before any resource-intensive operations - All sensitive credential operations are marked with no_log: true This approach prevents BMC passwords from being exposed in playbook variables, logs, or process listings while maintaining compatibility with the existing credential utility infrastructure. Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Introduces multiple enhancements for secure credential handling and flexible NFS configuration in the OS installation workflow. Key changes: 1. Generic credentials vault with unhashed password handling: - Vault now contains: bmc_username, bmc_password, os_root_password - install_os.yml accepts os_root_password (unhashed) via three methods: * Encrypted vault file (recommended) * Direct extra-vars * Interactive prompt (when silent_install=false) - Playbook internally hashes os_root_password to ks_root_password_hash using SHA-512 before injecting into kickstart files - ARM playbook maps provision_password to os_root_password in vault 2. User-configurable NFS share path: - Added nfs_share_path parameter to iso_config.yml - Format: 'server:/path' (e.g., '192.168.1.100:/mnt/nfs/omnia') - Falls back to auto-detection from /opt/omnia mount if not provided 3. Credential handling improvements: - All sensitive operations marked with no_log: true - Removed hash generation from fetch_arm_params role This design provides maximum flexibility for users while maintaining security best practices. Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

…ion needed) Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

- Add os_arch parameter to iso_config.yml - Pass os_arch from iso_config through ARM orchestrator to install_os - Infer target architecture from ISO filename (if not provided) - Prompt user for architecture if it cannot be inferred and silent_install is false - Fail if architecture is missing or invalid - Update grub_nfs.cfg.j2 to use linuxefi/initrdefi for x86_64 and linux/initrd for aarch64 Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

abhishek-sa1 · 2026-07-27T05:50:49Z

+#
+# This file configures the utils/install_os_arm_node playbook.
+# Copy this file to your input project directory
+# (e.g., /opt/omnia/input/project_default/iso_config.yml)


why all this variables are commented? mandatory variable should not be commented? are having having input validation for the same? instead of keeping this in input directory, can we keep in utils itself?

uncommented mandatory ones.

abhishek-sa1 · 2026-07-27T05:54:15Z

+# ─────────────────────────────────────────────────────────────────────────
+- name: Deliver ISO via iDRAC virtual media
+  hosts: localhost
+  connection: local


we can tags to avoid image creation in 2nd run

It is already handled via the rebuild_iso input, do you want to convert it to a tag?

abhishek-sa1 · 2026-07-27T05:55:38Z

+#
+# Usage:
+#   ansible-playbook utils/install_os_arm_node/install_os_arm_node.yml
+#


why do we need 2 utility, can we have one utility which can control both?

install_os.yml is a generic OS installer that expects all inputs as extra-vars. install_os_arm_node.yml is the Omnia-aware wrapper that reads iso_config.yml, pxe_mapping_file.csv, network_spec.yml, and Omnia credentials, then passes them to install_os.yml. We can rename this wrapper to something like install_os_on_node and make it accept a node name from user (as per PXE mapping).

… ISO tools - Move inline fail/debug messages in fetch_arm_params to vars/main.yml - Add automatic installation of xorriso and isomd5sum if missing - Fix ansible-lint key-order issue in install_os.yml (when before block) Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Replace manual Redfish curl/shell calls with official dellemc.openmanage collection modules: - Use idrac_lifecycle_controller_status_info for iDRAC reachability and LC status checks - Use idrac_virtual_media for ISO mount/eject operations (insert/eject) - Use idrac_boot for one-time boot override to CD - Use redfish_powerstate for server reboot - Fixes ansible-lint issues - More robust error handling and idempotency - Better integration with Dell iDRAC APIs Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

… and add SEL monitoring Replace manual iDRAC operations with idrac_os_deployment module and add robust installation monitoring: Module replacement: - Replace idrac_virtual_media + idrac_boot + redfish_powerstate with idrac_os_deployment - Add proper return status checking with boot_success evaluation SEL log monitoring improvements: - Query iDRAC for current time to ensure accurate timestamp filtering - Client-side timestamp filtering (iDRAC doesn't support Redfish $filter) - Poll for installation start and completion messages in SEL logs - Log warnings for SEL errors instead of failing immediately - SSH connectivity is the ultimate success/failure indicator Error handling: - SEL errors → warning - SSH wait timeout → fail immediately - Passwordless SSH verification → fail if key not working - SSH + OS verification pass → success (even if SEL shows errors) - More reliable monitoring with iDRAC time synchronization - Practical error handling focused on real success indicators Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

…boot sequence The module was failing on second run, and throwing lc not responding issues. Move iso_config.yml validation to begining. Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Signed-off-by: Jagadeesh N V <39791839+jagadeeshnv@users.noreply.github.com>

Venu-p1 added 15 commits July 21, 2026 16:26

Rename kickstart template to rhel10 and update default references

88a4f91

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

ARM orchestrator passes credentials as cacheable facts (no file creat…

1f35410

…ion needed) Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Wire custom kickstart credential injection and show source in banner

8c4eea7

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Remove unused render_kickstart.yml

6bbc7e6

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Simplified ks template

0632cc3

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Venu-p1 requested review from Rajeshkumar-s2, abhishek-sa1 and balajikumaran-c-s July 26, 2026 05:58

Venu-p1 marked this pull request as ready for review July 26, 2026 05:59

snarthan reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/roles/iso_creation/vars/main.yml

abhishek-sa1 reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/roles/fetch_iso/vars/main.yml

abhishek-sa1 reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os_arm_node/roles/fetch_arm_params/tasks/main.yml Outdated

abhishek-sa1 reviewed Jul 27, 2026

View reviewed changes

snarthan reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/roles/iso_delivery/tasks/preflight_checks.yml Outdated

snarthan reviewed Jul 27, 2026

View reviewed changes

Comment thread input/iso_config.yml Outdated

jagadeeshnv reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/roles/iso_creation/tasks/build_nfs_iso.yml

jagadeeshnv reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/install_os.yml

Comment thread utils/install_os/install_os.yml

jagadeeshnv reviewed Jul 27, 2026

View reviewed changes

Comment thread utils/install_os/roles/iso_delivery/tasks/preflight_checks.yml Outdated

Comment thread utils/install_os/roles/iso_delivery/tasks/deploy_os.yml Outdated

Comment thread utils/install_os/roles/iso_delivery/tasks/deploy_os.yml Outdated

Venu-p1 added 6 commits July 27, 2026 23:32

Addresses review comments and lint issues

c7dd9c4

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Make iso_config.yml path configurable as playbook parameter

d5dfa15

Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

Fix: Replace idrac_os_deployment with manual virtual media mount and …

e5e522a

…boot sequence The module was failing on second run, and throwing lc not responding issues. Move iso_config.yml validation to begining. Signed-off-by: venu <236371043+Venu-p1@users.noreply.github.com>

jagadeeshnv approved these changes Jul 28, 2026

View reviewed changes

Update install_os_arm_node.yml

0bf35f1

Signed-off-by: Jagadeesh N V <39791839+jagadeeshnv@users.noreply.github.com>

abhishek-sa1 approved these changes Jul 28, 2026

View reviewed changes

abhishek-sa1 merged commit 3978f83 into dell:staging Jul 28, 2026
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(os install): AArch64 Unattended OS Installation via iDRAC NFS - #4894

feat(os install): AArch64 Unattended OS Installation via iDRAC NFS#4894
abhishek-sa1 merged 22 commits into
dell:stagingfrom
Venu-p1:dev/auto-os-deployment

Venu-p1 commented Jul 26, 2026

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026 •

edited

Loading

Uh oh!

Venu-p1 Jul 28, 2026

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026

Uh oh!

Venu-p1 Jul 27, 2026

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026

Uh oh!

Venu-p1 Jul 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Venu-p1 commented Jul 26, 2026

Summary

Key Changes

Files Changed

Testing

Configuration

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Venu-p1 Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Venu-p1 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abhishek-sa1 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Venu-p1 Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

abhishek-sa1 Jul 27, 2026 •

edited

Loading

Venu-p1 Jul 27, 2026 •

edited

Loading