Hi Julia,hello everybody,

I have finally got some time to test it further and found some interesting things (see below). I have also got some good tips and support in the IRC.

I have changed the defaults and set both boot parameters to "uefi":
[deploy]
default_boot_mode = uefi

[ilo]
default_boot_mode = uefi

It is detecting the mode correctly and properly configures server to boot. See some latest extract from logs related to "openstack baremetal node provide" operation:

2021-05-10 08:45:28.233 561784 INFO ironic.conductor.task_manager [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Node ca718c74-77a6-46df-8b44-6a83db6a0ebe moved to provision state "cleaning" from state "manageable"; target provision state is "available"
2021-05-10 08:45:32.235 561784 INFO ironic.drivers.modules.ilo.power [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] The node ca718c74-77a6-46df-8b44-6a83db6a0ebe operation of 'power off' is completed in 2 seconds.
2021-05-10 08:45:32.255 561784 INFO ironic.conductor.utils [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Successfully set node ca718c74-77a6-46df-8b44-6a83db6a0ebe power state to power off by power off.
2021-05-10 08:45:34.056 561784 INFO ironic.drivers.modules.ilo.common [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Node ca718c74-77a6-46df-8b44-6a83db6a0ebe pending boot mode is uefi.
2021-05-10 08:45:35.470 561784 INFO ironic.drivers.modules.ilo.common [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Set the node ca718c74-77a6-46df-8b44-6a83db6a0ebe to boot from URL https://10.23.137.234/tmp-images/ilo/boot-ca718c74-77a6-46df-8b44-6a83db6a0ebe.iso?filename=tmpi262v2zy.iso successfully.
2021-05-10 08:45:43.485 561784 WARNING oslo.service.loopingcall [-] Function 'ironic.drivers.modules.ilo.power._wait_for_state_change.<locals>._wait' run outlasted interval by 1.32 sec
2021-05-10 08:45:44.857 561784 INFO ironic.drivers.modules.ilo.power [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] The node ca718c74-77a6-46df-8b44-6a83db6a0ebe operation of 'power on' is completed in 4 seconds.
2021-05-10 08:45:44.872 561784 INFO ironic.conductor.utils [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Successfully set node ca718c74-77a6-46df-8b44-6a83db6a0ebe power state to power on by rebooting.
2021-05-10 08:45:44.884 561784 INFO ironic.conductor.task_manager [req-24fe55db-c252-471c-9639-9ad43a15137b - - - - -] Node ca718c74-77a6-46df-8b44-6a83db6a0ebe moved to provision state "clean wait" from state "cleaning"; target provision state is "available"

Everyhing goes ok and I come to Grub2.

I can load the kernel with:
grub> linux /vmlinuz

However when I try to load initrd with:
grub> initrd /initrd

It first waits and goes to black screen with red cursor which is frozen.

I have tried same procedure with standard ubuntu kernel and initrd  from http://archive.ubuntu.com/ubuntu/dists/bionic/main/installer-amd64/current/images/hd-media/ and it works correctly and starts the installer.

I went to try the combinations:
- kernel from Ubuntu server + initrd from custom IPA: this was failing the same way as described above
- kernel from IPA + initrd from Ubuntu server: this was working and starting the Ubuntu installer. 
- kernel from Ubuntu servetr + initrd from IPA download server (ipa-centos8-stable-victoria.initramfs): failing same as above.

I am pretty lost with what is going on :( Does anyone have more ideas?

-Vuk

On Thu, Apr 1, 2021 at 8:42 PM Julia Kreger <juliaashleykreger@gmail.com> wrote:
Adding the list back and trimming the message. Replies in-band.

Well, that is good that the server is not signed, nor other esp images
are not working.
On Thu, Apr 1, 2021 at 11:20 AM Vuk Gojnic <vuk.gojnic@gmail.com> wrote:
>
> Hey Julia,
>
> Thanks for asking. I have tried with several ESP image options with same effect (one taken from Ubuntu Live ISO that boots on that node, another downloaded and third made with grub tools). None of them was signed.

Interesting. At least it is consistent! Have you tried to pull down
the iso image and take it apart to verify it is UEFI bootable against
a VM or another physical machine?

I'm wondering if you need both uefi parameters set. You definitely
don't have properties['capabilities']['boot_mode'] set which is used
or... maybe a better word to use is drawn in for asserting defaults,
but you do have the deploy_boot_mode setting set.

I guess a quick manual sanity check of the actual resulting iso image
is going to be critical. Debug logging may also be useful, and I'm
only thinking that because there is no logging from the generation of
the image.

>
> The server is not in UEFI secure boot mode.

Interesting, sure sounds like it is based on your original message. :(

> Btw. I will be on holidays for next week so I might not be able to follow up on this discussion before Apr 12th.

No worries, just ping us on irc.freenode.net in #openstack-ironic if a
reply on the mailing list doesn't grab our attention.

>
> Bests,
> Vuk
>
> On Thu, Apr 1, 2021 at 4:20 PM Julia Kreger <juliaashleykreger@gmail.com> wrote:
>>
>> Greetings,
>>
>> Two questions:
>> 1) Are the ESP image contents signed, or are they built using one of
>> the grub commands?
>> 2) Is the machine set to enforce secure boot at this time?
>>
>>
[trim]