Repository navigation
[PR:28276] [redfish] Stage provisioned certificates for bmcweb and fail closed once provisioned - #3406
Merged
Ying Xie (yxieca) merged 1 commit intoOct 21, 2026
Conversation
…nce provisioned (#28276) What: Adds certificate staging, startup guarding and credential watching to docker-sonic-redfish, and removes the local bmcweb account and password. Why: Converts externally delivered certificates into bmcweb's fixed certificate layout, reloads rotated credentials and prevents self-signed fallback once provisioning has been recorded. How: Reads explicit REDFISH|certs paths from CONFIG_DB, checks certificate/key correspondence, and atomically replaces the combined server PEM and CA file with a hashed truststore link. Uses a provisioning marker to gate startup, reconciles through inotify and periodic checks, and publishes certificate status to STATE_DB. Retains bmcweb's default authentication settings, orders Redfish after the database, and tracks Dockerfile macros in the image cache dependencies. Testing: All 32 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep, plus impacted-area KVM checks. The author reports hardware exercises covering rotation, bmcweb restart, container recreation, corrupt and partial input, deleted source files, fail-closed behavior and recovery; automated coverage is described as a companion sonic-mgmt change. No tested image version is supplied. The reviewer approved with a non-blocking caveat that the CONFIG_DB schema convention and sonic-dbus-bridge handling of trusted client common names were not independently confirmed. Signed-off-by: Shreyansh Jain <shreyansh@nexthop.ai> (cherry picked from commit 89ac685)
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Ying Xie (yxieca)
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Manual cherry-pick of sonic-net/sonic-buildimage#28276 to 202608. The automatic cherry-pick failed with a conflict.
Work item tracking
How I did it
git cherry-pick -x 89ac6853eb. The only conflict wasrules/docker-sonic-redfish.dep, which the original change modified to adddockers/dockerfile-macros.j2to the image cache dependencies. That file does not exist on 202608 (the redfish docker is not cache tracked here), so the change to it is dropped.Dockerfile.j2,stage-credentials.sh,supervisord.confandredfish.service.j2merged cleanly and are identical to master after #28276. 202608 already carries #29747 (host networking) and pinssrc/sonic-redfishat the sonic-net/sonic-redfish#34 merge, which this change depends on.See sonic-net/sonic-buildimage#28276 for the full description.
How to verify it
Same as sonic-net/sonic-buildimage#28276.
Which release branch to backport (provide reason below if selected)
Description for the changelog
[redfish] Stage provisioned certificates for bmcweb and fail closed once provisioned