Hi there, I'm wanting to use the grub.cfg "ds=nocloud-net;s=" option to be able to tell the provisioning URL more hardware details: namely TPM and SecureBoot state. Currently it seems restricted to _dmi.XXXXX.
Enterprises will have a range of hardware: from laptops with SecureBoot/TPM2 support, through desktops with SecureBoot only - and obviously virtuals as well. So passing those extra hardware details would allow the provisioning script/URL to return better storage options (I'm thinking of Ubuntu's autoinstall.yaml). eg "name: hybrid" for laptops, "name: lvm\npassword: $LUKSPASSWORD" for laptops without TPM, and plain "name: lvm" for virtuals/etc. Without this extra hardware detail, a provisioning script can only guess what should be in place - and my experience in multi-nationals (full of random computers) is that doesn't work well :-)
To point things in the right direction, maybe something like the following?
- platform.secureboot (a file matching "/sys/firmware/efi/efivars/SecureBoot-*" is evidence of SecureBoot)
- platform.tpm2 ("/dev/tpm0" implies TPM)
- platform.virtualized (looks hard - /proc/cpuinfo references to "hypervisor" might work? Currently I use dmi.system-manufacturer and dmi.system-product-name in the provisioning URL to infer this - maybe that's as good as it gets)
These are simple file checks - and I appreciate they do not perfectly define what I'm implying - but to do better would probably need a range of extra tools installed into initrd - which probably isn't worth it? This would probably do the right thing 99.9% of the time?
Hi there, I'm wanting to use the grub.cfg "ds=nocloud-net;s=" option to be able to tell the provisioning URL more hardware details: namely TPM and SecureBoot state. Currently it seems restricted to _dmi.XXXXX.
Enterprises will have a range of hardware: from laptops with SecureBoot/TPM2 support, through desktops with SecureBoot only - and obviously virtuals as well. So passing those extra hardware details would allow the provisioning script/URL to return better storage options (I'm thinking of Ubuntu's autoinstall.yaml). eg "name: hybrid" for laptops, "name: lvm\npassword: $LUKSPASSWORD" for laptops without TPM, and plain "name: lvm" for virtuals/etc. Without this extra hardware detail, a provisioning script can only guess what should be in place - and my experience in multi-nationals (full of random computers) is that doesn't work well :-)
To point things in the right direction, maybe something like the following?
These are simple file checks - and I appreciate they do not perfectly define what I'm implying - but to do better would probably need a range of extra tools installed into initrd - which probably isn't worth it? This would probably do the right thing 99.9% of the time?