foreman_fog_proxmox 0.25.0 → 0.25.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 329a340fdfd2b5e117a05a227477e29108df61d303a5ce5a5a2dc148ae41ec7c
-  data.tar.gz: '08b9aa3dca59fb2b7a80c2f1e6b0b59c9931f0d974e8d9849a720d6d37a819be'
+  metadata.gz: d59641775e4da477886d59bf332dadd576426ef079d1c6af43ef2e9f70b9c5a5
+  data.tar.gz: 5e24be7c7881de3c05d5a59a06500bd9d35f7c1f06d4c10390df473ec6ef8b01
 SHA512:
-  metadata.gz: '094a19a8592b2ed3ad7a88c637c7859f3bbc631a4f08f2fb781ec21a8b9620789fb701dbab917973ee122fb2ead5a44d6af12a28fe6dd2d99dad2267c8d051a7'
-  data.tar.gz: ce956eaac9a5faf92f2decd8721910dd72fd9a0e7f0ccfbeab40462c1cfc7892897235e7d2fef925405abf993b85f902edac0f4afcb1ec685649d27df0e61168
+  metadata.gz: e04095637c92c2a341043e96f345d4d9ddcd5a3f86b4285fc1ee5199a0e9c36fd542e40a28e748d66d4da56cec743618d144300b907be7c4d82a0a4daac21d82
+  data.tar.gz: 18a1bb26c3d35273d36826012d35c7e5f21a9c65193e86b7ab9babbde49ae5d15dcea828fa37a024e91740bdfb5a29788047f8ad8cd5829215324e21267e4079

data/app/helpers/proxmox_compute_controllers_helper.rb

@@ -18,15 +18,17 @@
 # along with ForemanFogProxmox. If not, see <http://www.gnu.org/licenses/>.
 
 module ProxmoxComputeControllersHelper
+  CONTROLLER_LIMITS = { 'ide' => 3, 'sata' => 5, 'scsi' => 30, 'virtio' => 15 }.freeze
+
   def proxmox_controllers_map
     proxmox_controllers_cloudinit_map << ForemanFogProxmox::OptionsSelect.new(name: 'VirtIO Block', id: 'virtio',
-      range: 15)
+      range: CONTROLLER_LIMITS['virtio'])
   end
 
   def proxmox_controllers_cloudinit_map
-    [ForemanFogProxmox::OptionsSelect.new(id: 'ide', name: 'IDE', range: 3),
-     ForemanFogProxmox::OptionsSelect.new(id: 'sata', name: 'SATA', range: 5),
-     ForemanFogProxmox::OptionsSelect.new(id: 'scsi', name: 'SCSI', range: 13)]
+    [ForemanFogProxmox::OptionsSelect.new(id: 'ide', name: 'IDE', range: CONTROLLER_LIMITS['ide']),
+     ForemanFogProxmox::OptionsSelect.new(id: 'sata', name: 'SATA', range: CONTROLLER_LIMITS['sata']),
+     ForemanFogProxmox::OptionsSelect.new(id: 'scsi', name: 'SCSI', range: CONTROLLER_LIMITS['scsi'])]
   end
 
   def proxmox_scsi_controllers_map

data/app/helpers/proxmox_compute_selectors_helper.rb

@@ -141,6 +141,7 @@ module ProxmoxComputeSelectorsHelper
 
   def proxmox_bios_map
     [OpenStruct.new(id: 'seabios', name: '(Default) Seabios'),
-     OpenStruct.new(id: 'ovmf', name: 'OVMF (UEFI)')]
+     OpenStruct.new(id: 'ovmf', name: 'OVMF (UEFI)'),
+     OpenStruct.new(id: 'uefi_secure_boot', name: 'OVMF (UEFI Secure Boot)')]
   end
 end

data/app/helpers/proxmox_vm_attrs_helper.rb

@@ -132,8 +132,9 @@ module ProxmoxVMAttrsHelper
       ostemplate_file: vms.ostemplate_file,
       start_after_create: vms.start_after_create,
       templated: vms.templated,
+      is_secure_boot: vms.config.secure_boot?,
     }
-    vms_keys = [:cpu_type, :nameserver, :searchdomain, :hostname]
+    vms_keys = [:cpu_type, :nameserver, :searchdomain, :hostname, :is_secure_boot]
     extra_attrs = ActiveSupport::HashWithIndifferentAccess.new
     attributes.each do |key, value|
       camel_key = key.to_s.include?('_') ? snake_to_camel(key.to_s).to_sym : key

data/app/helpers/proxmox_vm_cloudinit_helper.rb

@@ -106,7 +106,6 @@ module ProxmoxVMCloudinitHelper
     configs = filenames.zip(config_data).to_h
 
     iso = create_cloudinit_iso(args[:name], configs, ssh)
-    args[:config_attributes]&.merge!(update_boot_order(args[:image_id]))
     args.merge!(attach_cloudinit_iso(args[:node_id], iso))
   end
 
@@ -126,13 +125,6 @@ module ProxmoxVMCloudinitHelper
     "/var/lib/vz/template/iso"
   end
 
-  def update_boot_order(image_id)
-    vm = find_vm_by_uuid(image_id)
-    return if vm.disks.nil?
-    disks = vm.disks.map { |disk| disk.split(":")[0] }.join(";")
-    { boot: "order=" + disks }
-  end
-
   def vm_ssh
     ssh = Fog::SSH.new(URI.parse(fog_credentials[:proxmox_url]).host, fog_credentials[:proxmox_username].split('@')[0], { password: fog_credentials[:proxmox_password] })
     ssh.run('ls') # test if ssh is successful

data/app/helpers/proxmox_vm_config_helper.rb

@@ -60,7 +60,9 @@ module ProxmoxVMConfigHelper
       cpu_a += ForemanFogProxmox::HashCollection.stringify_keys(Fog::Proxmox::CpuHelper.flags).keys
       memory_a = ['memory', 'balloon', 'shares']
       cloud_init_a = ['ciuser', 'cipassword', 'searchdomain', 'nameserver']
+      firmware_a = ['is_secure_boot']
       keys.store(:cloud_init, cloud_init_a)
+      keys.store(:firmware, firmware_a)
     end
     keys.store(:main, main_a)
     keys.store(:cpu, cpu_a)
@@ -76,7 +78,7 @@ module ProxmoxVMConfigHelper
     config_a = []
     case type
     when 'qemu'
-      [:cpu, :memory, :general, :cloud_init].each { |key| config_a += config_typed_keys(type)[key] }
+      [:cpu, :memory, :general, :cloud_init, :firmware].each { |key| config_a += config_typed_keys(type)[key] }
     when 'lxc'
       [:main].each { |key| config_a += config_typed_keys(type)[key] }
     end

data/app/helpers/proxmox_vm_efidisk_helper.rb

@@ -23,6 +23,70 @@ require 'foreman_fog_proxmox/hash_collection'
 
 # Convert a foreman form server hash into a fog-proxmox server attributes hash
 module ProxmoxVMEfidiskHelper
+  def process_firmware_attributes(args, type)
+    return args unless type == 'qemu'
+    return args unless args
+
+    normalized_args = ActiveSupport::HashWithIndifferentAccess.new(args)
+    config = normalized_args[:config_attributes] || normalized_args
+    return args unless config.key?(:bios) || config.key?(:is_secure_boot)
+
+    args = normalized_args
+
+    bios = config[:bios]
+    secure_boot_value = config[:is_secure_boot]
+    secure_boot = bios == 'uefi_secure_boot' ||
+                  (bios == 'ovmf' && Foreman::Cast.to_bool(secure_boot_value))
+    config[:is_secure_boot] = secure_boot ? '1' : '0'
+
+    unless secure_boot
+      normalize_pre_enrolled_keys(args)
+      return args
+    end
+
+    config[:bios] = 'ovmf'
+    process_secure_boot_efidisk(args, config)
+  end
+
+  def normalize_pre_enrolled_keys(args)
+    efidisk = args[:efidisk_attributes]
+    return args if ForemanFogProxmox::Value.empty?(efidisk)
+
+    efidisk[:pre_enrolled_keys] = '0'
+    args
+  end
+
+  def process_secure_boot_efidisk(args, config)
+    efidisk = args[:efidisk_attributes]
+    unless ForemanFogProxmox::Value.empty?(efidisk)
+      args[:efidisk_attributes] = secure_boot_efidisk_attributes(
+        efidisk.merge('efitype' => '4m', 'pre_enrolled_keys' => '1')
+      )
+      return args
+    end
+
+    volumes = args[:volumes_attributes] || config[:volumes_attributes]
+    storage = volumes&.each_value&.filter_map { |volume| volume[:storage] }&.find(&:present?)
+    return args if ForemanFogProxmox::Value.empty?(storage)
+
+    args[:efidisk_attributes] = secure_boot_efidisk_attributes(storage: storage)
+    args
+  end
+
+  def efidisk_defaults(storage)
+    {
+      'id' => '0',
+      'volid' => "#{storage}:0",
+      'efitype' => '4m',
+      'pre_enrolled_keys' => '1',
+    }
+  end
+
+  def secure_boot_efidisk_attributes(attr = {})
+    attr = attr.to_h.stringify_keys
+    efidisk_defaults(attr['storage']).merge(attr)
+  end
+
   def parsed_typed_efidisk(args, type, parsed_vm)
     attrs = args['efidisk_attributes']
 

data/app/helpers/proxmox_vm_helper.rb

@@ -19,11 +19,13 @@
 
 require 'fog/proxmox/helpers/disk_helper'
 require 'fog/proxmox/helpers/nic_helper'
+require 'foreman_fog_proxmox/hash_collection'
 require 'foreman_fog_proxmox/value'
 
 module ProxmoxVMHelper
   include ProxmoxVMInterfacesHelper
   include ProxmoxVMVolumesHelper
+  include ProxmoxVMImageTemplateHelper
   include ProxmoxVMConfigHelper
   include ProxmoxVMOsTemplateHelper
   include ProxmoxVMEfidiskHelper
@@ -34,8 +36,28 @@ module ProxmoxVMHelper
     collection
   end
 
+  def parse_vm_update_attributes(attributes, type)
+    ForemanFogProxmox::HashCollection.new_hash_reject_keys(
+      attributes, ['volumes_attributes']
+    ).merge(type: type)
+  end
+
+  def update_boot_order(instance, exclude_cdrom: false, include_network: false)
+    return {} unless instance
+
+    disks = Array(instance.disks).map { |disk| disk.split(":")[0] }
+    disks.delete("ide2") if exclude_cdrom
+    network_interfaces = include_network ? Array(instance.interfaces).map(&:id) : []
+    boot_devices = network_interfaces + disks
+
+    return {} if boot_devices.empty?
+
+    { boot: "order=" + boot_devices.join(";") }
+  end
+
   # Convert a foreman form server/container vm hash into a fog-proxmox server/container attributes hash
   def parse_typed_vm(args, type)
+    args = process_firmware_attributes(args, type)
     args = ActiveSupport::HashWithIndifferentAccess.new(args)
     return {} unless args
     return {} if args.empty?

data/app/helpers/proxmox_vm_image_template_helper.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+# This file is part of ForemanFogProxmox.
+
+# ForemanFogProxmox is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# ForemanFogProxmox is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with ForemanFogProxmox. If not, see <http://www.gnu.org/licenses/>.
+
+require 'fog/proxmox/helpers/disk_helper'
+
+module ProxmoxVMImageTemplateHelper
+  def validate_image_template_disk_slots!(image, args)
+    reserved_slots = image.config.disks.select(&:hard_disk?).map(&:id)
+    limits = ProxmoxComputeControllersHelper::CONTROLLER_LIMITS
+    volumes = args['volumes_attributes']&.values || []
+    used_slots = reserved_slots + volumes.filter_map { |volume| hard_disk_slot(volume) }
+
+    volumes.each do |volume_attributes|
+      volume = volume_attributes.with_indifferent_access
+      slot = hard_disk_slot(volume_attributes)
+      next unless slot
+
+      controller = volume[:controller]
+      if reserved_slots.include?(slot)
+        device = (0..limits.fetch(controller, -1)).find do |number|
+          !used_slots.include?("#{controller}#{number}")
+        end
+        unless device
+          raise ::Foreman::Exception,
+            format(_('No free disk device is available for the %<controller>s controller.'), controller: controller)
+        end
+
+        volume_attributes['device'] = device.to_s
+        volume_attributes['id'] = slot = "#{controller}#{device}"
+      end
+      used_slots << slot
+    end
+  end
+
+  def hard_disk_slot(attributes)
+    volume = attributes.with_indifferent_access
+    id = volume[:id]
+    id if volume_type?(volume, 'hard_disk') &&
+          Fog::Proxmox::DiskHelper.server_disk?(id)
+  end
+end

data/app/models/concerns/fog_extensions/proxmox/server_config.rb

@@ -44,6 +44,15 @@ module FogExtensions
       def cloud_init?
         disks.any?(&:cloud_init?)
       end
+
+      def secure_boot?
+        attrs = attributes.with_indifferent_access
+        secure_boot = attrs[:is_secure_boot]
+        return Foreman::Cast.to_bool(secure_boot) ? '1' : '0' if attrs.key?(:is_secure_boot)
+
+        secure_boot = bios == 'ovmf' && Foreman::Cast.to_bool(efidisk&.pre_enrolled_keys)
+        Foreman::Cast.to_bool(secure_boot) ? '1' : '0'
+      end
     end
   end
 end

data/app/models/foreman_fog_proxmox/proxmox_efidisks.rb

@@ -21,9 +21,17 @@ module ForemanFogProxmox
   module ProxmoxEfidisks
     include ProxmoxVMHelper
 
-    def delete_efidisk(vmobj)
-      logger.info("vm #{vmobj.identity} delete efidisk0")
-      vmobj.detach('efidisk0')
+    def delete_efidisk(vm_obj)
+      logger.info("vm #{vm_obj.identity} delete efidisk0")
+      vm_obj.detach('efidisk0')
+    end
+
+    def process_efidisk_removal(vm_obj, attributes)
+      return if vm_obj.config.efidisk.blank?
+      return if attributes['efidisk_attributes'].present?
+
+      logger.debug("Removing efidisk from VM #{vm_obj}")
+      delete_efidisk(vm_obj)
     end
   end
 end

data/app/models/foreman_fog_proxmox/proxmox_images.rb

@@ -70,9 +70,8 @@ module ForemanFogProxmox
       find_vm_by_uuid(uuid)
     end
 
-    def clone_from_image(image_id, vmid)
-      logger.debug("create_vm(): clone #{image_id} in #{vmid}")
-      image = find_vm_by_uuid(image_id)
+    def clone_from_image(image, vmid)
+      logger.debug("create_vm(): clone #{image.identity} in #{vmid}")
       image.clone(vmid)
       find_vm_by_uuid(id.to_s + '_' + vmid.to_s)
     end

data/app/models/foreman_fog_proxmox/proxmox_vm_commands.rb

@@ -39,12 +39,18 @@ module ForemanFogProxmox
       image_id = args[:image_id]
       remove_volume_keys(args)
       if image_id
-        vm = clone_from_image(image_id, vmid)
-        vm.update(compute_clone_attributes(args, vm.container?, type))
+        image = find_vm_by_uuid(image_id)
+        validate_image_template_disk_slots!(image, args) if type == 'qemu'
+        vm = clone_from_image(image, vmid)
+        vm.update(compute_clone_attributes(args, vm.container?, type, image: image))
         update_pool(vm, args[:pool]) if args[:pool]
       else
         logger.warn("create vm: args=#{args}")
         vm = node.send(vm_collection(type)).create(parse_typed_vm(args, type))
+        if type == 'qemu' && vm
+          boot_order = update_boot_order(vm, exclude_cdrom: true, include_network: true)
+          vm.update(boot_order) if boot_order
+        end
       end
       start_on_boot(vm, args)
     rescue StandardError => e
@@ -64,8 +70,9 @@ module ForemanFogProxmox
       vmid
     end
 
-    def compute_clone_attributes(args, container, type)
+    def compute_clone_attributes(args, container, type, image: nil)
       args = parse_cloudinit_config(args) if args[:user_data]
+      args[:config_attributes].merge!(update_boot_order(image)) if image && args[:config_attributes]
       parsed_args = parse_typed_vm(args, type)
       if container
         options = { :hostname => args[:name] }
@@ -110,10 +117,9 @@ module ForemanFogProxmox
       elsif vm.node_id != node_id
         vm.migrate(node_id)
       else
-        parsed_attr = parse_typed_vm(
-          ForemanFogProxmox::HashCollection.new_hash_reject_keys(new_attributes,
-            ['volumes_attributes']).merge(type: vm.type), vm.type
-        )
+        processed_attributes = process_firmware_attributes(new_attributes, vm.type)
+        update_attributes = parse_vm_update_attributes(processed_attributes, vm.type)
+        parsed_attr = parse_typed_vm(update_attributes, vm.type)
         config_attributes = compute_config_attributes(parsed_attr)
 
         volumes_attributes = new_attributes['volumes_attributes']
@@ -123,11 +129,7 @@ module ForemanFogProxmox
           save_volume(vm, volume_attributes)
         end
 
-        efidisk_attributes = new_attributes['efidisk_attributes']
-        if vm.config.efidisk.present? && efidisk_attributes.empty?
-          logger.debug("Removing efidisk from VM #{vm}")
-          delete_efidisk(vm)
-        end
+        process_efidisk_removal(vm, processed_attributes)
 
         vm.update(config_attributes[:config_attributes])
         poolid = new_attributes['pool'] if new_attributes.key?('pool')

data/app/models/foreman_fog_proxmox/proxmox_vm_new.rb

@@ -190,6 +190,11 @@ module ForemanFogProxmox
       new_attr['vmid'] = assign_vmid(new_attr['vmid'].to_i, node, log: false)
     end
 
+    def add_secure_boot_attribute(vm_h, options, type)
+      secure_boot = options.dig('config_attributes', 'is_secure_boot')
+      vm_h[:is_secure_boot] = secure_boot if type == 'qemu' && secure_boot
+    end
+
     def new_typed_vm(new_attr, type)
       convert_config_attributes(new_attr) if new_attr.key?(:config_attributes)
       node_id = new_attr['node_id']
@@ -201,8 +206,10 @@ module ForemanFogProxmox
       logger.debug("new_typed_vm(#{type}): new_attr_type=#{new_attr_type}")
       logger.debug("new_typed_vm(#{type}): new_attr=#{new_attr}'")
       options = (!new_attr.key?('vmid') || ForemanFogProxmox::Value.empty?(new_attr['vmid'])) ? vm_typed_instance_defaults(type).merge(new_attr).merge(type: type) : new_attr
+      options = process_firmware_attributes(options, type)
       logger.debug("new_typed_vm(#{type}): options=#{options}")
       vm_h = parse_typed_vm(options, type).deep_symbolize_keys
+      add_secure_boot_attribute(vm_h, options, type)
       logger.debug("new_typed_vm(#{type}): vm_h=#{vm_h}")
       vm_h = vm_h.merge(vm_typed_instance_defaults(type)) if vm_h.empty?
       logger.debug(format(_('new_typed_vm(%<type>s) with vm_typed_instance_defaults: vm_h=%<vm_h>s'), type: type, vm_h: vm_h))

data/lib/foreman_fog_proxmox/version.rb

@@ -18,5 +18,5 @@
 # along with ForemanFogProxmox. If not, see <http://www.gnu.org/licenses/>.
 
 module ForemanFogProxmox
-  VERSION = '0.25.0'
+  VERSION = '0.25.1'
 end

data/test/unit/foreman_fog_proxmox/helpers/proxmox_vm_helper_test.rb

@@ -137,6 +137,106 @@ module ForemanFogProxmox
         } }
     end
 
+    describe '#parse_vm_update_attributes' do
+      it 'removes volume attributes and adds the VM type without parsing' do
+        attributes = parse_vm_update_attributes(host_server, 'qemu')
+
+        assert_not attributes.key?('volumes_attributes')
+        assert_equal 'qemu', attributes['type']
+        assert_equal host_server['config_attributes'], attributes['config_attributes']
+      end
+    end
+
+    describe '#parse_typed_vm firmware attributes' do
+      it 'maps secure boot to OVMF and adds a default EFI disk' do
+        host_server['config_attributes']['bios'] = 'uefi_secure_boot'
+
+        parsed_vm = parse_typed_vm(host_server, 'qemu')
+
+        assert_equal 'ovmf', parsed_vm['bios']
+        assert_equal 'local-lvm:0,efitype=4m,pre-enrolled-keys=1', parsed_vm['efidisk0']
+      end
+
+      it 'enables secure boot on an explicitly configured EFI disk' do
+        host_server['config_attributes']['bios'] = 'uefi_secure_boot'
+        host_server['efidisk_attributes'] = {
+          'id' => '0',
+          'volid' => 'fast-storage:0',
+          'efitype' => '2m',
+          'pre_enrolled_keys' => '0',
+        }
+
+        parsed_vm = parse_typed_vm(host_server, 'qemu')
+
+        assert_equal 'ovmf', parsed_vm['bios']
+        assert_equal 'fast-storage:0,efitype=4m,pre-enrolled-keys=1', parsed_vm['efidisk0']
+      end
+
+      it 'disables pre-enrolled keys on an existing OVMF EFI disk' do
+        host_server['config_attributes']['bios'] = 'ovmf'
+        host_server['efidisk_attributes'] = {
+          'id' => '0',
+          'volid' => 'fast-storage:0',
+          'efitype' => '4m',
+          'pre_enrolled_keys' => '1',
+        }
+
+        parsed_vm = parse_typed_vm(host_server, 'qemu')
+
+        assert_equal 'ovmf', parsed_vm['bios']
+        assert_equal 'fast-storage:0,efitype=4m,pre-enrolled-keys=0', parsed_vm['efidisk0']
+      end
+
+      it 'disables pre-enrolled keys for another BIOS' do
+        host_server['config_attributes']['bios'] = 'seabios'
+        host_server['efidisk_attributes'] = {
+          'id' => '0',
+          'volid' => 'fast-storage:0',
+          'efitype' => '4m',
+          'pre_enrolled_keys' => '1',
+        }
+
+        parsed_vm = parse_typed_vm(host_server, 'qemu')
+
+        assert_equal 'seabios', parsed_vm['bios']
+        assert_equal 'fast-storage:0,efitype=4m,pre-enrolled-keys=0', parsed_vm['efidisk0']
+      end
+    end
+
+    describe 'update_boot_order' do
+      let(:vm) do
+        vm = mock('vm')
+        vm.stubs(:disks).returns(['scsi0: local-lvm:vm-100-disk-0', 'ide2: none,media=cdrom', 'virtio1: local-lvm:vm-100-disk-1'])
+        net0 = mock('net0')
+        net1 = mock('net1')
+        net0.stubs(:id).returns('net0')
+        net1.stubs(:id).returns('net1')
+        vm.stubs(:interfaces).returns([net0, net1])
+        vm
+      end
+
+      it 'generates the image provisioning boot order from all disks' do
+        assert_equal({ boot: 'order=scsi0;ide2;virtio1' }, update_boot_order(vm))
+      end
+
+      it 'includes network interfaces and excludes the default CD-ROM for network provisioning' do
+        expected_boot_order = { boot: 'order=net0;net1;scsi0;virtio1' }
+
+        assert_equal expected_boot_order, update_boot_order(vm, exclude_cdrom: true, include_network: true)
+      end
+
+      it 'returns an empty hash when the VM is missing' do
+        assert_empty(update_boot_order(nil))
+      end
+
+      it 'returns an empty hash when the VM has no disks' do
+        vm = mock('vm')
+        vm.stubs(:disks).returns(nil)
+
+        assert_empty(update_boot_order(vm))
+      end
+    end
+
     describe 'object_to_config_hash' do
       setup { Fog.mock! }
       teardown { Fog.unmock! }

data/test/unit/foreman_fog_proxmox/proxmox_images_test.rb

@@ -27,22 +27,20 @@ module ForemanFogProxmox
     describe 'clone_from_image' do
       before do
         @cr = FactoryBot.build_stubbed(:proxmox_cr)
-        @image_id = @cr.id.to_s + '_' + 100.to_s
         @vmid = 101
-        @image = mock('vm')
+        @image = mock('vm', identity: '100')
         @image.expects(:clone)
-        @cr.stubs(:find_vm_by_uuid).with(@image_id).returns(@image)
         @clone = mock('vm')
       end
       it 'clones server from image' do
         @clone.stubs(:container?).returns(false)
         @cr.stubs(:find_vm_by_uuid).with(@cr.id.to_s + '_' + @vmid.to_s).returns(@clone)
-        @cr.clone_from_image(@image_id, @vmid)
+        @cr.clone_from_image(@image, @vmid)
       end
       it 'clones container from image' do
         @clone.stubs(:container?).returns(true)
         @cr.stubs(:find_vm_by_uuid).with(@cr.id.to_s + '_' + @vmid.to_s).returns(@clone)
-        @cr.clone_from_image(@image_id, @vmid)
+        @cr.clone_from_image(@image, @vmid)
       end
     end
   end

data/test/unit/foreman_fog_proxmox/proxmox_vm_commands_container_test.rb

@@ -299,7 +299,9 @@ module ForemanFogProxmox
         containers = mock('containers')
         cr = mock_node_servers_containers(ForemanFogProxmox::Proxmox.new, servers, containers)
         vm = mock('vm')
-        cr.expects(:clone_from_image).with('999', 100).returns(vm)
+        image = mock('image')
+        cr.stubs(:find_vm_by_uuid).with('999').returns(image)
+        cr.expects(:clone_from_image).with(image, 100).returns(vm)
         vm.expects(:container?).returns(true)
         expected_args = { :vmid => "100", :type => "lxc" }
         cr.stubs(:parse_typed_vm).with(args, 'lxc').returns(expected_args)

data/test/unit/foreman_fog_proxmox/proxmox_vm_commands_server_create_test.rb

@@ -38,6 +38,7 @@ module ForemanFogProxmox
         servers.expects(:next_id).returns('101')
         cr = mock_node_servers(ForemanFogProxmox::Proxmox.new, servers)
         cr.stubs(:parse_typed_vm).with(args, 'qemu').returns(args)
+        cr.stubs(:update_boot_order).returns(nil)
         vm = mock('vm')
         servers.expects(:create).with(args).returns(vm)
         cr.create_vm(args)
@@ -70,12 +71,27 @@ module ForemanFogProxmox
         cr.create_vm(args)
       end
 
+      it 'updates the boot order after creating a network-provisioned server' do
+        args = { vmid: '100', type: 'qemu', node_id: 'proxmox', start_after_create: '0' }
+        servers = mock('servers')
+        servers.stubs(:id_valid?).returns(true)
+        vm = mock('vm')
+        servers.expects(:create).with(args).returns(vm)
+        cr = mock_node_servers(ForemanFogProxmox::Proxmox.new, servers)
+        cr.stubs(:parse_typed_vm).with(args, 'qemu').returns(args)
+        cr.expects(:update_boot_order).with(vm, exclude_cdrom: true, include_network: true).returns(boot: 'order=net0;scsi0;virtio1')
+        vm.expects(:update).with({ boot: 'order=net0;scsi0;virtio1' })
+
+        cr.create_vm(args)
+      end
+
       it 'creates server with bootstart' do
         args = { vmid: '100', type: 'qemu', node_id: 'proxmox', start_after_create: '1' }
         servers = mock('servers')
         servers.stubs(:id_valid?).returns(true)
         cr = mock_node_servers(ForemanFogProxmox::Proxmox.new, servers)
         cr.stubs(:parse_typed_vm).with(args, 'qemu').returns(args)
+        cr.stubs(:update_boot_order).returns(nil)
         vm = mock('vm')
         servers.stubs(:create).with(args).returns(vm)
         cr.stubs(:find_vm_by_uuid).with((args[:vmid]).to_s).returns(vm)
@@ -89,6 +105,7 @@ module ForemanFogProxmox
         servers.stubs(:id_valid?).returns(true)
         cr = mock_node_servers(ForemanFogProxmox::Proxmox.new, servers)
         cr.stubs(:parse_typed_vm).with(args, 'qemu').returns(args)
+        cr.stubs(:update_boot_order).returns(nil)
         vm = mock('vm')
         servers.stubs(:create).with(args).returns(vm)
         cr.stubs(:find_vm_by_uuid).with((args[:vmid]).to_s).returns(vm)
@@ -103,7 +120,9 @@ module ForemanFogProxmox
         servers.stubs(:id_valid?).returns(true)
         cr = mock_node_servers_containers(ForemanFogProxmox::Proxmox.new, servers, containers)
         vm = mock('vm')
-        cr.expects(:clone_from_image).with('999', 100).returns(vm)
+        image = mock('image', config: mock('config', disks: []))
+        cr.stubs(:find_vm_by_uuid).with('999').returns(image)
+        cr.expects(:clone_from_image).with(image, 100).returns(vm)
         vm.expects(:container?).returns(false)
         expected_args = { :vmid => "100", :type => "qemu", :name => "name" }
         cr.stubs(:parse_typed_vm).with(args, 'qemu').returns(expected_args)
@@ -111,6 +130,26 @@ module ForemanFogProxmox
         cr.create_vm(args)
       end
 
+      it 'updates the boot order when cloning without user data' do
+        args = { vmid: '100', type: 'qemu', image_id: '999', name: 'name', config_attributes: { onboot: '0' } }
+        servers = mock('servers')
+        containers = mock('containers')
+        servers.stubs(:id_valid?).returns(true)
+        cr = mock_node_servers_containers(ForemanFogProxmox::Proxmox.new, servers, containers)
+        image = mock('image', config: mock('config', disks: []))
+        vm = mock('vm')
+        cr.expects(:clone_from_image).with(image, 100).returns(vm)
+        vm.expects(:container?).returns(false)
+        cr.expects(:parse_cloudinit_config).never
+        cr.expects(:find_vm_by_uuid).with('999').once.returns(image)
+        cr.expects(:update_boot_order).with(image).returns(boot: 'order=scsi0;virtio1')
+        expected_args = { vmid: '100', type: 'qemu', name: 'name', config_attributes: { onboot: '0', boot: 'order=scsi0;virtio1' } }
+        cr.expects(:parse_typed_vm).with(args, 'qemu').returns(expected_args)
+        vm.expects(:update).with(expected_args)
+
+        cr.create_vm(args)
+      end
+
       it 'attaches generated cloud-init ISO from a later ISO storage' do
         cr = ForemanFogProxmox::Proxmox.new
         first_storage = mock('first_storage')
@@ -142,5 +181,68 @@ module ForemanFogProxmox
         assert err.message.end_with?('Could not find generated cloud-init ISO name_cloudinit.iso on any ISO storage for node proxmox')
       end
     end
+
+    describe 'validate_image_template_disk_slots!' do
+      it 'moves a disk that conflicts with an image template disk to the next free slot' do
+        cr = ForemanFogProxmox::Proxmox.new
+        disk = mock('disk', hard_disk?: true, id: 'scsi0')
+        image = mock('image', config: mock('config', disks: [disk]))
+        args = {
+          'volumes_attributes' => {
+            '0' => { 'storage_type' => 'hard_disk', 'controller' => 'scsi', 'device' => '0', 'id' => 'scsi0' },
+          },
+        }
+        cr.validate_image_template_disk_slots!(image, args)
+
+        assert_equal '1', args['volumes_attributes']['0']['device']
+        assert_equal 'scsi1', args['volumes_attributes']['0']['id']
+      end
+
+      it 'uses a free slot before the conflicting slot' do
+        cr = ForemanFogProxmox::Proxmox.new
+        disk = mock('disk', hard_disk?: true, id: 'scsi1')
+        image = mock('image', config: mock('config', disks: [disk]))
+        args = {
+          'volumes_attributes' => {
+            '0' => { 'storage_type' => 'hard_disk', 'controller' => 'scsi', 'device' => '1', 'id' => 'scsi1' },
+          },
+        }
+        cr.validate_image_template_disk_slots!(image, args)
+
+        assert_equal '0', args['volumes_attributes']['0']['device']
+        assert_equal 'scsi0', args['volumes_attributes']['0']['id']
+      end
+
+      it 'leaves a disk unchanged when its slot does not conflict with an image template disk' do
+        cr = ForemanFogProxmox::Proxmox.new
+        disk = mock('disk', hard_disk?: true, id: 'scsi0')
+        image = mock('image', config: mock('config', disks: [disk]))
+        args = {
+          'volumes_attributes' => {
+            '0' => { 'storage_type' => 'hard_disk', 'controller' => 'scsi', 'device' => '1', 'id' => 'scsi1' },
+          },
+        }
+        original_args = args.deep_dup
+        cr.validate_image_template_disk_slots!(image, args)
+
+        assert_equal original_args, args
+      end
+
+      it 'raises when no free disk slot is available for the controller' do
+        cr = ForemanFogProxmox::Proxmox.new
+        disks = (0..3).map { |device| mock("disk#{device}", hard_disk?: true, id: "ide#{device}") }
+        image = mock('image', config: mock('config', disks: disks))
+        args = {
+          'volumes_attributes' => {
+            '0' => { 'storage_type' => 'hard_disk', 'controller' => 'ide', 'device' => '3', 'id' => 'ide3' },
+          },
+        }
+        error = assert_raises Foreman::Exception do
+          cr.validate_image_template_disk_slots!(image, args)
+        end
+
+        assert_equal 'No free disk device is available for the ide controller.', error.bare_message
+      end
+    end
   end
 end

data/test/unit/foreman_fog_proxmox/proxmox_vm_new_test.rb

@@ -110,6 +110,36 @@ module ForemanFogProxmox
         @cr.stubs(:new_typed_vm).with(attr, 'lxc').returns(vm)
         assert_equal vm, @cr.new_vm(attr)
       end
+
+      it 'processes secure boot firmware attributes before building profile VM' do
+        attr = {
+          'vmid' => '100',
+          'node_id' => 'proxmox',
+          'type' => 'qemu',
+          'config_attributes' => {
+            'bios' => 'uefi_secure_boot',
+          },
+          'volumes_attributes' => {
+            '0' => { 'storage' => 'local-lvm' },
+          },
+        }.with_indifferent_access
+        servers = mock('servers')
+        vm = mock('vm')
+        mock_node_servers(@cr, servers)
+        servers.stubs(:id_valid?).with(100).returns(true)
+        @cr.expects(:parse_typed_vm).with do |options, type|
+          assert_equal 'qemu', type
+          assert_equal 'ovmf', options['config_attributes']['bios']
+          assert_equal 'local-lvm:0', options['efidisk_attributes']['volid']
+        end.returns('bios' => 'ovmf', 'efidisk0' => 'local-lvm:0,efitype=4m,pre-enrolled-keys=1')
+        servers.expects(:new).with({
+          bios: 'ovmf',
+          efidisk0: 'local-lvm:0,efitype=4m,pre-enrolled-keys=1',
+          is_secure_boot: '1',
+        }).returns(vm)
+
+        assert_equal vm, @cr.new_typed_vm(attr, 'qemu')
+      end
     end
 
     describe 'assign_available_vmid' do

data/webpack/components/ProxmoxBiosContext.js

@@ -3,11 +3,20 @@ import PropTypes from 'prop-types';
 
 const ProxmoxBiosContext = createContext(null);
 
-export function ProxmoxBiosProvider({ children, initialBios = null }) {
+export function ProxmoxBiosProvider({
+  children,
+  initialBios = null,
+  initialEfiDiskSelected = false,
+}) {
   const [bios, setBios] = useState(initialBios);
+  const [efiDiskSelected, setEfiDiskSelected] = useState(
+    initialEfiDiskSelected
+  );
 
-  // memoize so the provider value object changes only when bios changes
-  const value = useMemo(() => ({ bios, setBios }), [bios]);
+  const value = useMemo(
+    () => ({ bios, setBios, efiDiskSelected, setEfiDiskSelected }),
+    [bios, efiDiskSelected]
+  );
 
   return (
     <ProxmoxBiosContext.Provider value={value}>
@@ -26,8 +35,10 @@ export function useBios() {
 ProxmoxBiosProvider.propTypes = {
   children: PropTypes.object.isRequired,
   initialBios: PropTypes.string,
+  initialEfiDiskSelected: PropTypes.bool,
 };
 
 ProxmoxBiosProvider.defaultProps = {
   initialBios: null,
+  initialEfiDiskSelected: false,
 };

data/webpack/components/ProxmoxComputeSelectors.js

@@ -179,6 +179,7 @@ const ProxmoxComputeSelectors = {
   proxmoxBiosMap: [
     { value: 'seabios', label: '(Default) Seabios' },
     { value: 'ovmf', label: 'OVMF (UEFI)' },
+    { value: 'uefi_secure_boot', label: 'OVMF (UEFI Secure Boot)' },
   ],
 };
 

data/webpack/components/ProxmoxServer/ProxmoxServerOptions.js

@@ -4,10 +4,11 @@ import { translate as __ } from 'foremanReact/common/I18n';
 import InputField from '../common/FormInputs';
 import ProxmoxComputeSelectors from '../ProxmoxComputeSelectors';
 import { useBios } from '../ProxmoxBiosContext';
+import SecureBoot, { normalizeFirmwareOptions } from './components/SecureBoot';
 
 const ProxmoxServerOptions = ({ options }) => {
-  const [opts, setOpts] = useState(options);
-  const { setBios } = useBios();
+  const [opts, setOpts] = useState(normalizeFirmwareOptions(options));
+  const { efiDiskSelected, setBios } = useBios();
 
   const handleChange = e => {
     const { name, type, checked, value: targetValue } = e.target;
@@ -18,14 +19,21 @@ const ProxmoxServerOptions = ({ options }) => {
       value = targetValue;
     }
 
+    const updatedKey = Object.keys(opts).find(key => opts[key].name === name);
+    const updates = {
+      [updatedKey]: { ...opts[updatedKey], value },
+    };
     if (name === opts?.bios?.name) {
+      updates.isSecureBoot = {
+        ...opts.isSecureBoot,
+        value: value === 'uefi_secure_boot' ? '1' : '0',
+      };
       setBios(value);
     }
 
-    const updatedKey = Object.keys(opts).find(key => opts[key].name === name);
     setOpts(prevOpts => ({
       ...prevOpts,
-      [updatedKey]: { ...prevOpts[updatedKey], value },
+      ...updates,
     }));
   };
 
@@ -94,6 +102,11 @@ const ProxmoxServerOptions = ({ options }) => {
         value={opts?.bios?.value}
         onChange={handleChange}
       />
+      <SecureBoot
+        bios={opts?.bios}
+        isSecureBoot={opts?.isSecureBoot}
+        efiDiskSelected={efiDiskSelected}
+      />
       <InputField
         name={opts?.ostype?.name}
         label={__('OS Type')}

data/webpack/components/ProxmoxServer/ProxmoxServerStorage.js

@@ -18,6 +18,7 @@ import { sprintf, translate as __ } from 'foremanReact/common/I18n';
 import HardDisk from './components/HardDisk';
 import CDRom from './components/CDRom';
 import EFIDisk from './components/EFIDisk';
+import { useBios } from '../ProxmoxBiosContext';
 
 const ProxmoxServerStorage = ({
   storage,
@@ -75,6 +76,7 @@ const ProxmoxServerStorage = ({
   const [cdRomIsNew, setCdRomIsNew] = useState(false);
   const [efiDisk, setEfiDisk] = useState(false);
   const [efiDiskData, setEfiDiskData] = useState(null);
+  const { setEfiDiskSelected } = useBios();
   const [nextDeviceNumbers, setNextDeviceNumbers] = useState({
     ide: 0,
     sata: 0,
@@ -381,13 +383,15 @@ const ProxmoxServerStorage = ({
       }
 
       setEfiDisk(true);
+      setEfiDiskSelected(true);
       setEfiDiskData(initEfiDisk);
     },
-    [efiDisk, paramScope]
+    [efiDisk, paramScope, setEfiDiskSelected]
   );
 
   const removeEfiDisk = () => {
     setEfiDisk(false);
+    setEfiDiskSelected(false);
   };
 
   if (isLoading) {

data/webpack/components/ProxmoxServer/components/EFIDisk.js

@@ -19,7 +19,8 @@ const EFIDisk = ({ onRemove, data, storages, nodeId, vmId }) => {
   const [efidisk, setEfiDisk] = useState(data);
   const storagesMap = createStoragesMap(storages, null, nodeId);
   const { bios } = useBios();
-  const isBiosOvmf = bios === 'ovmf';
+  const isBiosOvmf = ['ovmf', 'uefi_secure_boot'].includes(bios);
+  const secureBootEnabled = bios === 'uefi_secure_boot';
 
   useEffect(() => {
     if (storagesMap?.length > 0 && !efidisk?.volid?.value) {
@@ -136,12 +137,20 @@ const EFIDisk = ({ onRemove, data, storages, nodeId, vmId }) => {
           onChange={handleChange}
         />
         <InputField
-          name={efidisk?.preEnrolledKeys?.name}
           label={__('Pre-Enrolled Keys')}
+          info={__(
+            'This checkbox is read-only and automatically checked when UEFI Secure Boot is selected'
+          )}
           type="checkbox"
-          value={efidisk?.preEnrolledKeys?.value}
-          checked={String(efidisk?.preEnrolledKeys?.value) === '1'}
+          value={secureBootEnabled ? '1' : '0'}
+          checked={secureBootEnabled}
           onChange={handleChange}
+          disabled
+        />
+        <input
+          name={efidisk?.preEnrolledKeys?.name}
+          type="hidden"
+          value={secureBootEnabled ? '1' : '0'}
         />
       </PageSection>
     </div>

data/webpack/components/ProxmoxServer/components/SecureBoot.js

@@ -0,0 +1,69 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import {
+  FormHelperText,
+  HelperText,
+  HelperTextItem,
+} from '@patternfly/react-core';
+import { translate as __ } from 'foremanReact/common/I18n';
+
+export const secureBootSelected = options =>
+  options?.bios?.value === 'uefi_secure_boot' ||
+  (options?.bios?.value === 'ovmf' &&
+    (String(options?.isSecureBoot?.value) === '1' ||
+      String(options?.efidisk?.preEnrolledKeys?.value) === '1'));
+
+export const normalizeFirmwareOptions = options => {
+  const isSecureBootSelected = secureBootSelected(options);
+
+  return {
+    ...options,
+    bios: {
+      ...options?.bios,
+      value: isSecureBootSelected ? 'uefi_secure_boot' : options?.bios?.value,
+    },
+    isSecureBoot: {
+      ...options?.isSecureBoot,
+      value: isSecureBootSelected ? '1' : '0',
+    },
+  };
+};
+
+const SecureBoot = ({ bios, isSecureBoot, efiDiskSelected }) => (
+  <>
+    {bios?.value === 'uefi_secure_boot' && !efiDiskSelected && (
+      <div className="form-group">
+        <div className="col-md-offset-2 col-md-6">
+          <FormHelperText>
+            <HelperText id="helper-secure-boot-efidisk">
+              <HelperTextItem variant="warning">
+                {__('Please make sure that an EFI disk is selected.')}
+              </HelperTextItem>
+            </HelperText>
+          </FormHelperText>
+        </div>
+      </div>
+    )}
+    {isSecureBoot?.name && (
+      <input
+        name={isSecureBoot.name}
+        type="hidden"
+        value={isSecureBoot?.value || '0'}
+      />
+    )}
+  </>
+);
+
+SecureBoot.propTypes = {
+  bios: PropTypes.object,
+  isSecureBoot: PropTypes.object,
+  efiDiskSelected: PropTypes.bool,
+};
+
+SecureBoot.defaultProps = {
+  bios: {},
+  isSecureBoot: {},
+  efiDiskSelected: false,
+};
+
+export default SecureBoot;

data/webpack/components/ProxmoxVmType.js

@@ -299,7 +299,11 @@ const ProxmoxVmType = ({
   };
 
   return (
-    <ProxmoxBiosProvider>
+    <ProxmoxBiosProvider
+      initialEfiDiskSelected={
+        !!(vmAttrs?.efidisk && Object.keys(vmAttrs.efidisk).length > 0)
+      }
+    >
       <div>
         <InputField
           name={general?.type?.name}

data/webpack/components/__tests__/EFIDisk.test.js

@@ -0,0 +1,59 @@
+import React from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import { ProxmoxBiosProvider } from '../ProxmoxBiosContext';
+import EFIDisk from '../ProxmoxServer/components/EFIDisk';
+
+const efiDiskData = {
+  id: { name: 'efidisk[id]', value: 0 },
+  volid: { name: 'efidisk[volid]', value: 'local:0' },
+  storage: { name: 'efidisk[storage]', value: 'local' },
+  format: { name: 'efidisk[format]', value: 'raw' },
+  preEnrolledKeys: { name: 'efidisk[pre_enrolled_keys]', value: '0' },
+};
+
+const renderEfiDisk = bios =>
+  render(
+    <ProxmoxBiosProvider initialBios={bios}>
+      <EFIDisk
+        onRemove={jest.fn()}
+        data={efiDiskData}
+        storages={[]}
+        nodeId="node-1"
+        vmId="100"
+      />
+    </ProxmoxBiosProvider>
+  );
+
+describe('EFIDisk', () => {
+  it('checks and disables pre-enrolled keys for UEFI Secure Boot', async () => {
+    const { container } = renderEfiDisk('uefi_secure_boot');
+
+    const checkbox = screen.getByRole('checkbox');
+    const submittedValue = container.querySelector(
+      'input[name="efidisk[pre_enrolled_keys]"]'
+    );
+
+    expect(checkbox).toBeDisabled();
+    expect(checkbox).toBeChecked();
+    expect(submittedValue).toHaveValue('1');
+    fireEvent.click(container.querySelector('.field-help'));
+    expect(
+      await screen.findByText(
+        'This checkbox is read-only and automatically checked when UEFI Secure Boot is selected'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('unchecks and disables pre-enrolled keys without UEFI Secure Boot', () => {
+    const { container } = renderEfiDisk('ovmf');
+
+    const checkbox = screen.getByRole('checkbox');
+    const submittedValue = container.querySelector(
+      'input[name="efidisk[pre_enrolled_keys]"]'
+    );
+
+    expect(checkbox).toBeDisabled();
+    expect(checkbox).not.toBeChecked();
+    expect(submittedValue).toHaveValue('0');
+  });
+});

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: foreman_fog_proxmox
 version: !ruby/object:Gem::Version
-  version: 0.25.0
+  version: 0.25.1
 platform: ruby
 authors:
 - Tristan Robert
@@ -140,6 +140,7 @@ files:
 - app/helpers/proxmox_vm_config_helper.rb
 - app/helpers/proxmox_vm_efidisk_helper.rb
 - app/helpers/proxmox_vm_helper.rb
+- app/helpers/proxmox_vm_image_template_helper.rb
 - app/helpers/proxmox_vm_interfaces_helper.rb
 - app/helpers/proxmox_vm_os_template_helper.rb
 - app/helpers/proxmox_vm_uuid_helper.rb
@@ -295,9 +296,11 @@ files:
 - webpack/components/ProxmoxServer/components/EFIDisk.js
 - webpack/components/ProxmoxServer/components/HardDisk.js
 - webpack/components/ProxmoxServer/components/NetworkInterface.js
+- webpack/components/ProxmoxServer/components/SecureBoot.js
 - webpack/components/ProxmoxStoragesUtils.js
 - webpack/components/ProxmoxVmType.js
 - webpack/components/ProxmoxVmUtils.js
+- webpack/components/__tests__/EFIDisk.test.js
 - webpack/components/__tests__/ProxmoxComputeSelectors.test.js
 - webpack/components/__tests__/ProxmoxVmType.test.js
 - webpack/components/__tests__/ProxmoxVmUtils.test.js