Provisioning · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Redfish (curl)
curl -sku user:pass https://<bmc>/redfish/v1/Systems | List systems (IDs vary by vendor: 1, System.Embedded.1, …) |
PATCH …/Systems/<id> {"Boot":{"BootSourceOverrideTarget":"Pxe","BootSourceOverrideEnabled":"Once"}} | Boot from network once |
POST …/Systems/<id>/Actions/ComputerSystem.Reset {"ResetType":"ForceRestart"} | Power cycle |
POST …/Managers/<id>/VirtualMedia/<cd>/Actions/VirtualMedia.InsertMedia {"Image":"http://…/boot.iso"} | Mount an ISO remotely |
IPMI & PXE
ipmitool -I lanplus -H <bmc> -U user -P pass chassis bootdev pxe options=efiboot | Legacy: boot from network (UEFI) |
ipmitool -I lanplus -H <bmc> -U user -P pass power cycle | Legacy: power cycle |
DHCP option 93 (client arch) → ipxe.efi vs undionly.kpxe | Serve the right iPXE binary |
Tinkerbell
Smee | DHCP, TFTP and iPXE scripts (formerly Boots) |
HookOS | In-memory OS that runs workflow actions (formerly Hook) |
Tink server/controller + worker | Workflow engine; workers run actions as containers |
Tootles | Metadata service for cloud-init (formerly Hegel) |
Rufio | BMC control as Kubernetes resources (Machine, Job, Task) |
kubectl get hardware,templates,workflows -A | Inspect provisioning state |
Metal3
Bare Metal Operator + Ironic | Manage hosts through BareMetalHost resources |
kubectl get baremetalhosts -A | States: registering → inspecting → available → provisioning → provisioned |
bmc.address: redfish-virtualmedia://<bmc>/redfish/v1/Systems/1 | BMC driver + address |
CAPM3 | Cluster API provider for Metal3 |
Formats
RAW (.raw.gz / .raw.xz) | Streamed straight onto the disk (e.g. image2disk); bare metal |
QCOW2 | VMs, and Ironic can convert/write it |
ISO | Installer or live boot via virtual media/USB |
qemu-img convert -f qcow2 -O raw in.qcow2 out.raw | Convert between formats |
Build & first boot
image-builder (kubernetes-sigs) / Packer | Reproducible node images with Kubernetes components |
cloud-init NoCloud: user-data, meta-data, network-config | First-boot configuration |
Ignition (Flatcar, Fedora CoreOS) | First-boot provisioning for those OSes |
sha256sum image.raw.gz > image.raw.gz.sha256; cosign sign-blob … | Checksum and sign images |
Moving artifacts
skopeo copy --all docker://registry.k8s.io/pause:3.10 docker://harbor.local/mirror/pause:3.10 | Copy an image (all architectures) |
skopeo copy --all docker://… oci-archive:bundle/pause.tar | Image to a file for transfer |
helm pull oci://… --version X && helm push chart-X.tgz oci://harbor.local/charts | Mirror a Helm chart |
oras copy <src> <dst> | Copy any OCI artifact (SBOMs, signatures, files) |
Pointing nodes at mirrors
/etc/rancher/rke2/registries.yaml (mirrors + configs) | RKE2/K3s mirror configuration |
registryMirrorConfiguration (EKS Anywhere cluster spec) | EKS-A mirror + CA |
containerd: /etc/containerd/certs.d/<registry>/hosts.toml | Plain containerd mirror config |
