foreman_bootdisk 16.1.0 → 17.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f4504c1358b4e4a789bf50d8eeac0e61b5097039694039e77151e47980b2f14
-  data.tar.gz: e46dffaf3739195d4f5988458e2eaa6b38d3eac66ede08c77c07034f8a77d40a
+  metadata.gz: cc43113465fd89f890f9606fb04af3e948b96ac1bd6c1943211a452e38c4cb2a
+  data.tar.gz: 9db1069085f706df776576fc0df25f49a7d09ae71555ea15397d57656ddd0da5
 SHA512:
-  metadata.gz: '09868d38c5adb714d029fe6ffc554bf3469204343d14d77f789b5c2bbb8badc1bdc760be477ffa69fb1cf3850a6854ae257165e2baba2a7d28373d58b4b9a5b5'
-  data.tar.gz: 4d25edcd1342b1b619d7001a7a4b82f282da9aaed4561e4b8deb85ddccad3df09100ff038f8782a45f4f04b75a8a8403554b3378a6344ea5424047d80d3efec5
+  metadata.gz: 115bddba362f7c53b78d06ca78a1f120babae76cc2f922447cd0e05b1f322f189e30b186e6cb0718b7d9a24bfca67bf2287283fd9495eba4193a9b6bb560ec29
+  data.tar.gz: 1cd764fdc0a939d45934070d6b34e2619870c8c206afd4915cae93f68f7553cfcc9b18d3c04770aba9f4b6f45d62bbd779563798b7175595ee8c2b991f03b660

data/AUTHORS

@@ -1,4 +1,5 @@
 Adam Ruzicka
+Bernhard Suttner
 Bryan Kearney
 crito
 Damon Maria

data/README.md

@@ -50,6 +50,10 @@ gPXE images are unsupported due to lack of initrd support.
 | >= 1.19         | ~> 13.0        |
 | >= 1.20         | ~> 14.0        |
 | >= 1.21         | ~> 15.0        |
+| >= 1.23         | ~> 16.0        |
+| >= 1.24         | ~> 16.1        |
+| >= 2.0          | ~> 16.1        |
+| >= 2.1          | ~> 17.0        |
 
 # Usage
 
@@ -119,6 +123,7 @@ TFTP settings are needed.
     <th>DHCP reservation</th>
     <th>Pre-register host</th>
     <th>OS-specific</th>
+    <th>EFI supported</th>
   </tr>
   <tr>
     <td>Per-host image</td>
@@ -127,6 +132,7 @@ TFTP settings are needed.
     <td>No</td>
     <td>Yes</td>
     <td>No</td>
+    <td>No</td>
   </tr>
   <tr>
     <td>Full host image</td>
@@ -135,6 +141,7 @@ TFTP settings are needed.
     <td>No</td>
     <td>Yes</td>
     <td>Yes</td>
+    <td>Yes</td>
   </tr>
   <tr>
     <td>Generic image</td>
@@ -143,6 +150,7 @@ TFTP settings are needed.
     <td>No</td>
     <td>Yes</td>
     <td>No</td>
+    <td>No</td>
   </tr>
   <tr>
     <td>Subnet image</td>
@@ -151,6 +159,7 @@ TFTP settings are needed.
     <td>No</td>
     <td>Yes</td>
     <td>No</td>
+    <td>Yes</td>
   </tr>
 </table>
 

data/app/controllers/foreman_bootdisk/api/v2/disks_controller.rb

@@ -21,9 +21,10 @@ module ForemanBootdisk
 
         api :GET, '/generic', N_('Download generic image')
         def generic
+          # EFI not supported for iPXE generic bootdisk
           tmpl = ForemanBootdisk::Renderer.new.generic_template_render
           ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-            send_data read_file(iso), filename: "bootdisk_#{URI.parse(Setting[:foreman_url]).host}.iso"
+            send_file(iso, filename: "bootdisk_#{URI.parse(Setting[:foreman_url]).host}.iso")
           end
         end
 
@@ -34,22 +35,19 @@ module ForemanBootdisk
           host = @disk
           if params[:full]
             ForemanBootdisk::ISOGenerator.generate_full_host(host) do |iso|
-              send_data read_file(iso), filename: "#{host.name}#{ForemanBootdisk::ISOGenerator.token_expiry(host)}.iso"
+              send_file(iso, filename: "#{host.name}#{ForemanBootdisk::ISOGenerator.token_expiry(host)}.iso")
             end
           else
+            # EFI not supported for iPXE host bootdisk
             tmpl = host.bootdisk_template_render
             ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-              send_data read_file(iso), filename: "#{host.name}.iso"
+              send_file(iso, filename: "#{host.name}.iso")
             end
           end
         end
 
         private
 
-        def read_file(filename)
-          File.read(filename)
-        end
-
         def resource_scope
           Host::Managed.authorized('view_hosts')
         end

data/app/controllers/foreman_bootdisk/api/v2/subnet_disks_controller.rb

@@ -25,10 +25,15 @@ module ForemanBootdisk
         def subnet
           subnet = @subnet_disk
           subnet.tftp || raise(::Foreman::Exception.new(N_('TFTP feature not enabled for subnet %s'), subnet.name))
-          tmpl = ForemanBootdisk::Renderer.new.generic_template_render(subnet)
-          ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-            name = subnet.name
-            send_data File.read(iso), filename: "bootdisk_subnet_#{name}.iso"
+          tmpl_bios = ForemanBootdisk::Renderer.new.generic_template_render(subnet)
+          tmpl_efi = nil
+          if subnet.httpboot
+            tmpl_efi = ForemanBootdisk::Renderer.new.generic_efi_template_render(subnet)
+          else
+            ForemanBootdisk.logger.warn('HTTPBOOT feature is not enabled for subnet %s, UEFI may not be available for bootdisk' % subnet.name)
+          end
+          ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl_bios, grub: tmpl_efi) do |temp_iso_filename|
+            send_file(temp_iso_filename, filename: subnet.name)
           end
         end
 

data/app/controllers/foreman_bootdisk/disks_controller.rb

@@ -12,6 +12,7 @@ module ForemanBootdisk
 
     def generic
       begin
+        # EFI not supported for iPXE generic bootdisk
         tmpl = ForemanBootdisk::Renderer.new.generic_template_render
       rescue StandardError => e
         error_rendering(e)
@@ -20,13 +21,14 @@ module ForemanBootdisk
       end
 
       ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-        send_data read_file(iso), filename: "bootdisk_#{URI.parse(Setting[:foreman_url]).host}.iso"
+        send_file(iso, filename: "bootdisk_#{URI.parse(Setting[:foreman_url]).host}.iso")
       end
     end
 
     def host
       host = @disk
       begin
+        # EFI not supported for iPXE host bootdisk
         tmpl = host.bootdisk_template_render
       rescue StandardError => e
         error_rendering(e)
@@ -35,14 +37,14 @@ module ForemanBootdisk
       end
 
       ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-        send_data read_file(iso), filename: "#{host.name}.iso"
+        send_file(iso, filename: "#{host.name}.iso")
       end
     end
 
     def full_host
       host = @disk
       ForemanBootdisk::ISOGenerator.generate_full_host(host) do |iso|
-        send_data read_file(iso), filename: "#{host.name}#{ForemanBootdisk::ISOGenerator.token_expiry(host)}.iso"
+        send_file(iso, filename: "#{host.name}#{ForemanBootdisk::ISOGenerator.token_expiry(host)}.iso")
       end
     end
 
@@ -51,15 +53,18 @@ module ForemanBootdisk
       begin
         subnet = host.try(:subnet) || raise(::Foreman::Exception.new(N_('Subnet is not assigned to the host %s'), host.name))
         subnet.tftp || raise(::Foreman::Exception.new(N_('TFTP feature not enabled for subnet %s'), subnet.name))
-        tmpl = ForemanBootdisk::Renderer.new.generic_template_render(subnet)
+        subnet.httpboot || ForemanBootdisk.logger.warn('HTTPBOOT feature is not enabled for subnet %s, UEFI may not be available for bootdisk' % subnet.name)
+
+        tmpl_bios = ForemanBootdisk::Renderer.new.generic_template_render(subnet)
+        tmpl_efi = ForemanBootdisk::Renderer.new.generic_efi_template_render(subnet)
       rescue StandardError => e
         error_rendering(e)
         redirect_back(fallback_location: '/')
         return
       end
 
-      ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl) do |iso|
-        send_data read_file(iso), filename: "bootdisk_subnet_#{subnet.name}.iso"
+      ForemanBootdisk::ISOGenerator.generate(ipxe: tmpl_bios, grub: tmpl_efi) do |iso|
+        send_file(iso, filename: "bootdisk_subnet_#{subnet.name}.iso")
       end
     end
 
@@ -67,10 +72,6 @@ module ForemanBootdisk
 
     private
 
-    def read_file(filename)
-      File.read(filename)
-    end
-
     def resource_scope(_controller = controller_name)
       Host::Managed.authorized(:view_hosts)
     end

data/app/helpers/concerns/foreman_bootdisk/hosts_helper_ext.rb

@@ -65,7 +65,7 @@ module ForemanBootdisk
 
     # need to wrap this one in a test for template proxy presence
     def display_bootdisk_for_subnet(host)
-      if (proxy = host.try(:subnet).try(:tftp)) && proxy.has_feature?('Templates')
+      if (proxy = host.try(:subnet).try(:tftp) || host.try(:subnet).try(:httpboot)) && proxy.has_feature?('Templates')
         display_bootdisk_link_if_authorized(
           _("Subnet '%s' generic image") % host.subnet.name, {
             controller: 'foreman_bootdisk/disks',

data/app/lib/foreman_bootdisk/scope/bootdisk.rb

@@ -6,7 +6,6 @@ module ForemanBootdisk
       def bootdisk_chain_url(mac = host.try(:mac), action = 'iPXE')
         url = foreman_url(action)
         u = URI.parse(url)
-        ForemanBootdisk.logger.warn("Foreman or proxy is configured with HTTPS, probably not supported by iPXE: #{u}") if u.scheme == 'https'
         new_query_data = URI.decode_www_form(u.query || '') << ['mac', mac || '']
         new_querystring = URI.encode_www_form(new_query_data)
         u.query = nil
@@ -18,6 +17,10 @@ module ForemanBootdisk
       def bootdisk_raise(*args)
         raise ::Foreman::Exception.new(*args)
       end
+
+      def template_name
+        "Foreman Bootdisk"
+      end
     end
   end
 end

data/app/lib/foreman_bootdisk/scope/full_host_bootdisk_efi.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module ForemanBootdisk
+  module Scope
+    class FullHostBootdiskEfi < Bootdisk
+      def kernel(medium_provider)
+        '/' + ForemanBootdisk::ISOGenerator.iso9660_filename(super)
+      end
+
+      def initrd(medium_provider)
+        '/' + ForemanBootdisk::ISOGenerator.iso9660_filename(super)
+      end
+    end
+  end
+end

data/app/models/concerns/foreman_bootdisk/compute_resources/vmware.rb

@@ -36,12 +36,21 @@ module ForemanBootdisk
           'instance_uuid' => vm_uuid,
           'iso' => "foreman_isos/#{iso}",
           'datastore' => bootdisk_datastore(vm_uuid),
-          'start_connected' => false,
+          'start_connected' => true,
           'connected' => true,
           'allow_guest_control' => true
         }
         client.vm_reconfig_cdrom options
       end
+
+      def iso_detach(vm_uuid)
+        options = {
+          'instance_uuid' => vm_uuid,
+          'start_connected' => false,
+          'connected' => false,
+        }
+        client.vm_reconfig_cdrom options
+      end
     end
   end
 end

data/app/models/concerns/foreman_bootdisk/host_ext.rb

@@ -5,14 +5,11 @@ require 'uri'
 module ForemanBootdisk
   module HostExt
     def bootdisk_template
-      template = ProvisioningTemplate.unscoped.find_by(
-        name: Setting[:bootdisk_host_template]
-      )
+      template = ProvisioningTemplate.unscoped.find_by(name: Setting[:bootdisk_host_template])
       unless template
-        raise ::Foreman::Exception.new(
-          N_('Unable to find template specified by %s setting'), 'bootdisk_host_template'
-        )
+        raise ::Foreman::Exception.new(N_('Unable to find template specified by %s setting'), 'bootdisk_host_template')
       end
+
       template
     end
 

data/app/models/concerns/foreman_bootdisk/orchestration/compute.rb

@@ -9,7 +9,6 @@ module ForemanBootdisk
 
       included do
         after_validation :queue_bootdisk_compute
-        after_build :rebuild_with_bootdisk
       end
 
       def bootdisk_isodir
@@ -21,15 +20,25 @@ module ForemanBootdisk
       end
 
       def queue_bootdisk_compute
-        return unless compute? && errors.empty? && new_record?
+        return unless compute? && errors.empty?
         return unless provision_method == 'bootdisk'
 
-        queue.create(name: _('Generating ISO image for %s') % self, priority: 5,
-                     action: [self, :setGenerateIsoImage])
-        queue.create(name: _('Upload ISO image to datastore for %s') % self, priority: 6,
-                     action: [self, :setIsoImage])
-        queue.create(name: _('Attach ISO image to CDROM drive for %s') % self, priority: 1001,
-                     action: [self, :setAttachIsoImage])
+        # We want to add our queue jobs only if really necessary:
+        #   - in case of starting to create a new host
+        #   - in case of a rebuild
+        if (old.nil? || !old.build?) && build?
+          queue.create(name: _('Generating ISO image for %s') % self, priority: 5,
+                       action: [self, :setGenerateIsoImage])
+          queue.create(name: _('Upload ISO image to datastore for %s') % self, priority: 6,
+                       action: [self, :setIsoImage])
+          queue.create(name: _('Attach ISO image to CDROM drive for %s') % self, priority: 1001,
+                       action: [self, :setAttachIsoImage])
+        # Detach ISO image when host sends 'built' HTTP POST request
+        elsif old&.build? && !build?
+          queue.create(name: _('Detach ISO image from CDROM drive for %s') % self, priority: 52,
+                       action: [self, :setDetachIsoImage])
+        end
+        true
       end
 
       def bootdisk_generate_iso_image
@@ -46,6 +55,10 @@ module ForemanBootdisk
         compute_resource.iso_attach(File.basename(bootdisk_isofile), uuid)
       end
 
+      def bootdisk_detach_iso
+        compute_resource.iso_detach(uuid)
+      end
+
       def setGenerateIsoImage
         logger.info format('Generating ISO image for %s', name)
         bootdisk_generate_iso_image
@@ -73,18 +86,14 @@ module ForemanBootdisk
 
       def delAttachIsoImage; end
 
-      def rebuild_with_bootdisk
-        return true unless bootdisk?
-
-        begin
-          bootdisk_generate_iso_image
-          bootdisk_upload_iso
-          bootdisk_attach_iso
-        rescue StandardError => e
-          Foreman::Logging.exception "Failed to rebuild Bootdisk image for #{name}", e, level: :error
-          return false
-        end
+      def setDetachIsoImage
+        logger.info format('Detaching ISO image from CDROM drive for %s', name)
+        bootdisk_detach_iso
+      rescue StandardError => e
+        failure format(_('Failed to detach ISO image from CDROM drive of instance %{name}: %{message}'), name: name, message: e.message), e
       end
+
+      def delDetachIsoImage; end
     end
   end
 end

data/app/models/setting/bootdisk.rb

@@ -6,16 +6,20 @@ class Setting
       ipxe = ['/usr/lib/ipxe'].find { |p| File.exist?(p) } || '/usr/share/ipxe'
       isolinux = ['/usr/lib/ISOLINUX'].find { |p| File.exist?(p) } || '/usr/share/syslinux'
       syslinux = ['/usr/lib/syslinux/modules/bios', '/usr/lib/syslinux'].find { |p| File.exist?(p) } || '/usr/share/syslinux'
+      grub2 = ['/var/lib/tftpboot/grub2'].find { |p| File.exist?(p) } || '/var/lib/foreman/bootdisk'
       templates = -> { Hash[ProvisioningTemplate.where(template_kind: TemplateKind.where(name: 'Bootdisk')).map { |temp| [temp[:name], temp[:name]] }] }
 
       [
         set('bootdisk_ipxe_dir', N_('Path to directory containing iPXE images'), ipxe, N_('iPXE directory')),
         set('bootdisk_isolinux_dir', N_('Path to directory containing isolinux images'), isolinux, N_('ISOLINUX directory')),
         set('bootdisk_syslinux_dir', N_('Path to directory containing syslinux images'), syslinux, N_('SYSLINUX directory')),
+        set('bootdisk_grub2_dir', N_('Path to directory containing grubx64.efi and shimx64.efi'), grub2, N_('Grub2 directory')),
         set('bootdisk_host_template', N_('iPXE template to use for host-specific boot disks'),
             'Boot disk iPXE - host', N_('Host image template'), nil, collection: templates),
         set('bootdisk_generic_host_template', N_('iPXE template to use for generic host boot disks'),
             'Boot disk iPXE - generic host', N_('Generic image template'), nil, collection: templates),
+        set('bootdisk_generic_efi_host_template', N_('Grub2 template to use for generic EFI host boot disks'),
+            'Boot disk Grub2 EFI - generic host', N_('Generic Grub2 EFI image template'), nil, collection: templates),
         set('bootdisk_mkiso_command', N_('Command to generate ISO image, use genisoimage or mkisofs'), 'genisoimage', N_('ISO generation command')),
         set('bootdisk_cache_media', N_('Installation media files will be cached for full host images'), true, N_('Installation media caching'))
       ]

data/app/services/foreman_bootdisk/iso_generator.rb

@@ -11,9 +11,10 @@ require 'uri'
 module ForemanBootdisk
   class ISOGenerator
     def self.generate_full_host(host, opts = {}, &block)
-      raise(Foreman::Exception, N_('Host is not in build mode, so the template cannot be rendered')) unless host.build?
+      raise Foreman::Exception.new(N_('Host is not in build mode, so the template cannot be rendered')) unless host.build?
 
-      tmpl = render_pxelinux_template(host)
+      isolinux_template = render_template(host, :PXELinux, ForemanBootdisk::Scope::FullHostBootdisk)
+      grub_template = render_template(host, :PXEGrub2, ForemanBootdisk::Scope::FullHostBootdiskEfi)
 
       # pxe_files and filename conversion is utterly bizarre
       # aim to convert filenames to something usable under ISO 9660, to match as rendered in the template
@@ -24,87 +25,145 @@ module ForemanBootdisk
         hash[iso_filename] = host.url_for_boot(type)
       end
 
-      generate(opts.merge(isolinux: tmpl, files: files), &block)
+      generate(opts.merge(isolinux: isolinux_template, grub: grub_template, files: files), &block)
+    rescue ::Foreman::Exception => e
+      if e.code == 'ERF42-0067'
+        ForemanBootdisk.logger.warn e
+      else
+        raise e
+      end
     end
 
-    def self.render_pxelinux_template(host)
-      pxelinux_template = host.provisioning_template(kind: :PXELinux)
+    def self.render_template(host, kind, scope_class)
+      template = host.provisioning_template(kind: kind)
 
-      raise(Foreman::Exception, N_('Unable to generate disk template, PXELinux template not found.')) unless pxelinux_template
+      raise Foreman::Exception.new(N_('Unable to generate disk template, %{kind} template not found.'), kind: kind) unless template
 
       template = ForemanBootdisk::Renderer.new.render_template(
-        template: pxelinux_template,
+        template: template,
         host: host,
-        scope_class: ForemanBootdisk::Scope::FullHostBootdisk
+        scope_class: scope_class
       )
 
       unless template
         err = host.errors.full_messages.to_sentence
-        raise(::Foreman::Exception.new(N_('Unable to generate disk PXELinux template: %s'), err))
+        raise Foreman::Exception.new(N_('Unable to generate disk %{kind} template: %{error}'), kind: kind, error: err)
       end
 
       template
     end
 
+    def self.system_or_exception(command, error)
+      unless system(command)
+        ForemanBootdisk.logger.debug "Bootdisk command failed: #{command}"
+        raise Foreman::Exception.new(N_(error))
+      end
+    end
+
     def self.generate(opts = {})
-      opts[:isolinux] = <<~ISOLINUX if opts[:isolinux].nil? && opts[:ipxe]
-        default ipxe
-        label ipxe
-        kernel /ipxe
-        initrd /script
-      ISOLINUX
-
-      Dir.mktmpdir('bootdisk') do |wd|
-        Dir.mkdir(File.join(wd, 'build'))
-
-        if opts[:isolinux]
-          isolinux_source_file = File.join(Setting[:bootdisk_isolinux_dir], 'isolinux.bin')
-          raise(Foreman::Exception, N_('Please ensure the isolinux/syslinux package(s) are installed.')) unless File.exist?(isolinux_source_file)
-
-          FileUtils.cp(isolinux_source_file, File.join(wd, 'build', 'isolinux.bin'))
-
-          source_files = ['ldlinux.c32', 'menu.c32']
-          source_files.each do |source_file|
-            full_path = File.join(Setting[:bootdisk_syslinux_dir], source_file)
-            FileUtils.cp(full_path, File.join(wd, 'build', source_file)) if File.exist?(full_path)
-          end
+      # isolinux template not provided for generic BIOS bootdisks
+      if opts[:isolinux].nil? && opts[:ipxe]
+        opts[:isolinux] = <<~EOT
+          default ipxe
+          label ipxe
+          kernel /ipxe
+          initrd /script
+        EOT
+      end
 
-          File.open(File.join(wd, 'build', 'isolinux.cfg'), 'w') do |file|
-            file.write(opts[:isolinux])
-          end
+      if opts[:grub].nil? && opts[:ipxe]
+        opts[:grub] = <<~EOT
+          echo "Grub2 template not associated and/or unsupported bootdisk type."
+          echo "The following bootdisks are supported for EFI systems:"
+          echo " * FULL HOST BOOTDISK"
+          echo " * SUBNET GENERIC BOOTDISK"
+          echo "The system will poweroff in few minutes..."
+          sleep 500
+          poweroff
+        EOT
+      end
+
+      # Temporary directory cannot be cleaned inprocess due to send_file offloaded to web server
+      wd = Dir.mktmpdir('bootdisk-iso-')
+      Dir.mkdir(File.join(wd, 'build'))
+
+      if opts[:isolinux]
+        isolinux_source_file = File.join(Setting[:bootdisk_isolinux_dir], 'isolinux.bin')
+        raise Foreman::Exception.new(N_('Please ensure the isolinux/syslinux package(s) are installed.')) unless File.exist?(isolinux_source_file)
+
+        FileUtils.cp(isolinux_source_file, File.join(wd, 'build', 'isolinux.bin'))
+
+        source_files = ['ldlinux.c32', 'menu.c32', 'libutil.c32']
+        source_files.each do |source_file|
+          full_path = File.join(Setting[:bootdisk_syslinux_dir], source_file)
+          FileUtils.cp(full_path, File.join(wd, 'build', source_file)) if File.exist?(full_path)
         end
 
-        if opts[:ipxe]
-          ipxe_source_file = File.join(Setting[:bootdisk_ipxe_dir], 'ipxe.lkrn')
-          raise(Foreman::Exception, N_('Please ensure the ipxe-bootimgs package is installed.')) unless File.exist?(ipxe_source_file)
+        File.open(File.join(wd, 'build', 'isolinux.cfg'), 'w') do |file|
+          file.write(opts[:isolinux])
+        end
+      end
+
+      if opts[:ipxe]
+        ipxe_source_file = File.join(Setting[:bootdisk_ipxe_dir], 'ipxe.lkrn')
+        raise Foreman::Exception.new(N_('Please ensure the ipxe-bootimgs package is installed.')) unless File.exist?(ipxe_source_file)
+
+        FileUtils.cp(ipxe_source_file, File.join(wd, 'build', 'ipxe'))
+        File.open(File.join(wd, 'build', 'script'), 'w') { |file| file.write(opts[:ipxe]) }
+      end
 
-          FileUtils.cp(ipxe_source_file, File.join(wd, 'build', 'ipxe'))
-          File.open(File.join(wd, 'build', 'script'), 'w') { |file| file.write(opts[:ipxe]) }
+      if opts[:grub]
+        FileUtils.mkdir_p(File.join(wd, 'build', 'EFI', 'BOOT'))
+        # a copy when using CDROM directly
+        File.open(File.join(wd, 'build', 'EFI', 'BOOT', 'grub.cfg'), 'w') { |file| file.write(opts[:grub]) }
+        # a copy when using USB/HDD (copied into EFI image as well)
+        File.open(File.join(wd, 'build', 'grub-hdd.cfg'), 'w') do |f|
+          # set root to (cd0) or similar when booting via disk
+          f.write("search --file /ISOLINUX.BIN --set root\n")
+          f.write(opts[:grub])
+        end
+        efibootimg = File.join(wd, 'build', 'efiboot.img')
+        system_or_exception("truncate -s 4M #{efibootimg}", N_('Creating new image failed, install truncate utility'))
+        system_or_exception("mkfs.msdos #{efibootimg}", N_('Failed to format the ESP image via mkfs.msdos'))
+        system_or_exception("mmd -i #{efibootimg} '::/EFI'", N_('Failed to create a directory within the ESP image'))
+        system_or_exception("mmd -i #{efibootimg} '::/EFI/BOOT'", N_('Failed to create a directory within the ESP image'))
+        {
+          File.join(wd, 'build', 'grub-hdd.cfg').to_s => 'GRUB.CFG',
+          File.join(Setting[:bootdisk_grub2_dir], 'grubx64.efi').to_s => 'GRUBX64.EFI',
+          File.join(Setting[:bootdisk_grub2_dir], 'shimx64.efi').to_s => 'BOOTX64.EFI',
+        }.each do |src, dest|
+          raise(Foreman::Exception.new(N_('Ensure %{path} contains grubx64.efi and shimx64.efi: install TFTP module or copy those files into /var/lib/foreman/bootdisk (Grub2 directory setting)'), path: src)) unless File.exist?(src)
+          raise(Foreman::Exception.new(N_('Unable to mcopy %{path}'), path: src)) unless system("mcopy -m -i #{efibootimg} '#{src}' '#{"::/EFI/BOOT/#{dest}"}'")
         end
+        mkiso_args = "-eltorito-alt-boot -e efiboot.img -no-emul-boot"
+        isohybrod_args = ["--uefi"]
+      else
+        mkiso_args = ''
+        isohybrod_args = []
+      end
 
-        if opts[:files]
-          if opts[:files].respond_to?(:each)
-            opts[:files].each do |file, source|
-              fetch(File.join(wd, 'build', file), source)
-            end
+      if opts[:files]
+        if opts[:files].respond_to?(:each)
+          opts[:files].each do |file, source|
+            fetch(File.join(wd, 'build', file), source)
           end
         end
+      end
 
-        iso = if opts[:dir]
-                Tempfile.new(['bootdisk', '.iso'], opts[:dir]).path
-              else
-                File.join(wd, 'output.iso')
-              end
-        raise(Foreman::Exception, N_('ISO build failed')) unless system(build_mkiso_command(output_file: iso, source_directory: File.join(wd, 'build')))
+      iso = if opts[:dir]
+              Tempfile.new(['bootdisk', '.iso'], opts[:dir]).path
+            else
+              File.join(wd, 'output.iso')
+            end
+      raise Foreman::Exception.new(N_('ISO build failed')) unless system(build_mkiso_command(output_file: iso, extra_commands: mkiso_args, source_directory: File.join(wd, 'build')))
 
-        # Make the ISO bootable as a HDD/USB disk too
-        raise(Foreman::Exception, N_('ISO hybrid conversion failed')) unless system('isohybrid', iso)
+      # Make the ISO bootable as a HDD/USB disk too
+      raise Foreman::Exception.new(N_('ISO hybrid conversion failed: %s'), $?) unless system(*["isohybrid", isohybrod_args, iso].flatten.compact)
 
-        yield iso
-      end
+      yield iso
     end
 
-    def self.build_mkiso_command(output_file:, source_directory:)
+    def self.build_mkiso_command(output_file:, source_directory:, extra_commands:)
       arguments = [
         "-o #{output_file}",
         '-iso-level 2',
@@ -114,6 +173,7 @@ module ForemanBootdisk
         '-boot-load-size 4',
         '-boot-info-table'
       ]
+      arguments.push(extra_commands) unless extra_commands.nil?
       [Setting[:bootdisk_mkiso_command], arguments, source_directory].flatten.join(' ')
     end