Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-3546

Option to Enable UEFISecureBoot for VMs for OSD in GCP


    • Icon: Feature Request Feature Request
    • Resolution: Done
    • Icon: Major Major
    • None
    • openshift-4.13, openshift-4.14, openshift-4.15
    • Installer
    • False
    • None
    • False
    • Not Selected
    • Product

      Summary of the issue: 

      The customer has the ShieldVM GCP Policy (https://cloud.google.com/compute/shielded-vm/docs/shielded-vm) in place and it's blocking the installation to succeed.

      ShieldVM GCP Policy must be relaxed by the customer as prerequisite before the OSD in GCP installation, because the OSD in GCP OpenShift installer (though Hive) will use the UEFI boot mode, and not the UEFISecureBoot as in the ShieldVM policy requests. 

      For the RFE, the customer is requesting to have an option to enable the UEFISecureBoot in the installation, to fulfill the correct ShieldVM GCP Policy constraints and not to be disabled during (or after) the installation.

      • What triage steps have been taken so far?:

      In a cluster of OSD in GCP the boot is UEFI instead of UEFISecureBoot, as we can see in the GCP VM Console dashboard in the section of ShieldVM (attached gcp-vm1 pic):

      Secure Boot: Off - (UEFISecureBoot)

      vTPM: On

      Integrity Monitoring: On


      In BareMetal we have this feature enabled:



      GCP has not UEFISecureBoot - https://github.com/openshift/installer/blob/master/pkg/types/gcp/platform.go

      OpenShift Installer is capable now to launch the UEFISecureBoot - https://github.com/openshift/installer/blob/master/data/data/gcp/cluster/main.tf#L82

      through this PR that enables the UEFISecureBoot - https://github.com/openshift/installer/issues/2546

      • What logs have been reviewed (attach them?):

      [root@mobb-infra-gcp-mn4j6-master-2 /]# ls -lrht /sys/firmware/efi/

      total 0

      dr-xr-xr-x.  2 root root    0 May 24 19:28 efivars

      drwxr-xr-x. 33 root root    0 Jun 22 09:10 vars

      r-------.  1 root root 4.0K Jun 22 09:10 systab

      drwxr-xr-x.  6 root root    0 Jun 22 09:10 runtime-map

      rrr-.  1 root root 4.0K Jun 22 09:10 runtime

      drwxr-xr-x.  2 root root    0 Jun 22 09:10 mok-variables

      rrr-.  1 root root 4.0K Jun 22 09:10 fw_vendor

      rrr-.  1 root root 4.0K Jun 22 09:10 fw_platform_size

      rrr-.  1 root root 4.0K Jun 22 09:10 config_table

            acathrow@redhat.com Andrew Cathrow
            rcarrata+mobb Roberto Carratala (Inactive)
            4 Vote for this issue
            11 Start watching this issue