Bare Metal Provisioning

Overview

Xloud Bare Metal provisioning (powered by Ironic) treats physical servers as first-class cloud resources. Operators enroll nodes by registering their management interface credentials, introspect hardware to automatically collect CPU, RAM, disk, and NIC information, and then provision OS images directly to bare metal — with the same API workflow used for virtual machine instances. Bifrost provides a standalone enrollment and provisioning path for initial cluster bootstrap, operating independently of the full Xloud Identity and compute stack.

Prerequisites

Ironic and Ironic Conductor services enabled in your deployment
Physical servers with accessible BMC (IPMI, Redfish, or iDRAC) on the management network
Provisioning network configured with DHCP and PXE boot support
Deploy image (e.g., Ubuntu 22.04 IPA) uploaded to Xloud Image Service
Administrator role in the target project

Architecture

Service Components

Component	Role
Ironic API	REST API for node registration, state transitions, and provisioning requests
Ironic Conductor	Executes node state transitions — power operations, PXE boot, disk imaging
Ironic Python Agent (IPA)	Lightweight OS booted in RAM during introspection and deployment; collects hardware inventory and writes disk images
Bifrost	Standalone provisioning tool using Ironic without the full cloud stack — used for initial cluster bootstrap

Key Capabilities

Xloud-Developed — Bare metal provisioning is available with XPCI.

PXE / iPXE Network Boot

Nodes boot from the network using PXE or iPXE. The Ironic Conductor serves a lightweight agent image over TFTP/HTTP, which runs entirely in RAM to perform hardware introspection and disk imaging.

BMC Power Management

Full out-of-band control via IPMI and Redfish — power on, power off, reboot, boot device selection, sensor readings, and firmware inventory. No agent or OS required on the target server.

Unified Management

Manage bare metal servers and virtual machines from the same API and dashboard. The Xloud Compute scheduler places workloads on either physical or virtual hosts using a single resource pool.

Hardware Introspection

Automated discovery of CPU, RAM, disk, and NIC details. The Ironic Python Agent collects a full hardware inventory during introspection, eliminating manual data entry for node properties.

Supported BMC Types

Vendor	BMC	Minimum Version	Driver	Notes
Dell	iDRAC	9+	`idrac` or `redfish`	Redfish preferred for newer firmware
HPE	iLO	5+	`ilo` or `redfish`	iLO REST API available alongside Redfish
Lenovo	XCC	2.0+	`redfish`	Lenovo XClarity Controller
Supermicro	BMC	Redfish-capable	`redfish`	Varies by motherboard model
Generic	IPMI 2.0	Any	`ipmi`	Baseline support for all IPMI-compliant hardware

Redfish provides richer capabilities than IPMI — firmware inventory, detailed sensor data, and secure HTTPS transport. Use Redfish when available and fall back to IPMI only for legacy hardware.

Supported Drivers

Driver	Protocol	BMC Type	Notes
`ipmi`	IPMI 2.0	Generic IPMI	Supported on most server hardware from all major vendors
`redfish`	Redfish (REST/HTTPS)	DMTF Redfish v1.x	Dell iDRAC 9+, HPE iLO 5+, Supermicro BMC
`idrac`	IPMI + Redfish	Dell iDRAC	Dell-specific driver with extended capabilities
`ilo`	iLO REST API	HPE iLO	HPE-specific driver with HPE-native features
`irmc`	iRMC	Fujitsu iRMC	Fujitsu PRIMERGY servers

Prefer the redfish driver when BMC firmware supports it. Redfish provides richer hardware introspection data and is the long-term standard for out-of-band management.

Node Provisioning Lifecycle

Ironic nodes progress through a defined set of states. Understanding this lifecycle is essential for diagnosing enrollment and provisioning issues.

State	Description
`enroll`	Node registered in Ironic; credentials not yet validated
`manageable`	Credentials validated; node is under administrator control
`inspecting`	Ironic Python Agent running in RAM; collecting hardware inventory
`available`	Node ready for provisioning; available to Compute scheduler
`active`	OS deployed; node is running as a provisioned bare metal instance
`cleaning`	Disk wipe in progress; returning node to clean state after deprovisioning

Enrolling a Node

Dashboard
CLI

Bare metal node enrollment requires administrator privileges.

Navigate to bare metal nodes

Configure driver and credentials

Field	Example Value	Description
Driver	`redfish`	Management interface driver
Driver Info: `redfish_address`	`https://192.168.1.100`	BMC URL
Driver Info: `redfish_username`	`admin`	BMC username
Driver Info: `redfish_password`	`*****`	BMC password
Driver Info: `redfish_verify_ca`	`false`	Skip TLS verification for self-signed BMC certs
Name	`compute-node-04`	Human-readable node name

Transition to manageable

After enrollment, select the node and click Set Manageable. Ironic validates the BMC credentials by attempting a power state query.

Node transitions to manageable state. Power state is reported as power on or power off.

Run hardware introspection

Select the node in manageable state and click Inspect. Ironic instructs the BMC to PXE-boot into the Ironic Python Agent. Introspection typically takes 3–5 minutes.

Node returns to manageable state. The Overview tab shows detected CPU, RAM, disk, and NIC details.

Make available for provisioning

Select the node and click Provide. This moves the node to the available state, making it eligible for provisioning by Compute.

Node status shows available. The node appears in the scheduler’s resource pool.

Authenticate

Load admin credentials

source admin-openrc.sh

Register the node

Enroll a bare metal node with Redfish driver

openstack baremetal node create \
  --driver redfish \
  --driver-info redfish_address=https://192.168.1.100 \
  --driver-info redfish_username=admin \
  --driver-info redfish_password=secret \
  --driver-info redfish_verify_ca=false \
  --name compute-node-04

Note the returned uuid — used in subsequent commands.

Set deploy interface and boot options

Configure deploy and boot interfaces

openstack baremetal node set compute-node-04 \
  --deploy-interface direct \
  --boot-interface pxe \
  --raid-interface no-raid

Validate and transition to manageable

Transition to manageable state

openstack baremetal node manage compute-node-04

Validate driver interfaces

openstack baremetal node validate compute-node-04

All interface columns should show True. Failures indicate missing driver info.

Run introspection

Start hardware introspection

openstack baremetal node inspect compute-node-04

Wait for introspection to complete

openstack baremetal node show compute-node-04 -c provision_state

Wait until provision_state returns manageable (inspection complete).

Provide the node

Move node to available state

openstack baremetal node provide compute-node-04

Node reaches available state. List with openstack baremetal node list --provision-state available.

Bifrost Standalone Enrollment

Bifrost is used to provision the first physical nodes in a new cluster — before Xloud Identity and the full API stack are running. It provides a subset of Ironic functionality without requiring Keystone authentication.

Install Bifrost

Clone and install Bifrost

git clone https://opendev.org/openstack/bifrost.git
cd bifrost
./scripts/env-setup.sh
source /opt/stack/bifrost/bin/activate

Configure inventory

bifrost-inventory.yml

compute-node-01:
  ansible_host: 192.168.1.101
  uuid: "{{ ansible_date_time.epoch }}-compute-01"
  driver_info:
    power:
      ipmi_address: 192.168.1.201
      ipmi_username: admin
      ipmi_password: secret
  nics:
    - mac: "aa:bb:cc:dd:ee:01"
  properties:
    cpu_arch: x86_64
    ram_mb: 65536
    disk_gb: 500
    cpus: 32

Enroll and deploy

Enroll nodes and deploy image

ansible-playbook -i bifrost-inventory.yml \
  /opt/stack/bifrost/playbooks/bifrost-enroll-dynamic.yaml

ansible-playbook -i bifrost-inventory.yml \
  /opt/stack/bifrost/playbooks/bifrost-deploy-dynamic.yaml \
  -e ipa_upstream_release=latest \
  -e deploy_image_filename=ubuntu-22.04-server.raw

Nodes boot, receive the OS image, and come up with the configured hostname and SSH key.

Network Requirements

Network	Purpose	Requirements
Provisioning network	PXE boot and IPA communication during enrollment and deployment	DHCP server, TFTP/HTTP for PXE, routed to Ironic Conductor
Management network	Out-of-band BMC access (IPMI/Redfish)	Isolated VLAN, reachable from Ironic Conductor only
Tenant network	Production traffic after provisioning	Standard Xloud networking — assigned post-deployment

The provisioning and management networks should be isolated from tenant networks. The management network carries BMC credentials and power control traffic — exposure to tenant VMs is a security risk.

Troubleshooting

Node stuck in 'enroll' state after creation

Cause: Ironic has not yet validated the BMC credentials — the node must be explicitly transitioned to manageable.Resolution:

Transition to manageable

openstack baremetal node manage <node-uuid>

If this fails with a driver error, verify BMC connectivity:

Validate driver interfaces

openstack baremetal node validate <node-uuid>

Check power interface result — False indicates unreachable BMC.

Introspection fails or times out

Cause: The node did not PXE-boot into the IPA image, or the IPA image could not reach the Ironic Conductor over the provisioning network.Resolution:

Verify the node’s NIC MAC address is registered: openstack baremetal port list --node <uuid>
Confirm the provisioning DHCP server is serving the correct PXE configuration
Check Ironic Conductor logs: journalctl -u ironic-conductor -f
Verify IPA can reach Ironic API: the IPA image needs HTTP access to the callback URL

Provisioning fails with 'cleaning failed'

Cause: The automated disk cleaning step (shredding previous data) failed, often due to disk detection errors in the IPA environment.Resolution:

Check node error message

openstack baremetal node show <node-uuid> -c last_error

For test environments, disable cleaning to skip disk wiping:

Disable automated cleaning

openstack baremetal node set <node-uuid> --automated-clean false

Disabling automated cleaning leaves previous data on disk. Do not use this setting in production environments where nodes are shared across projects.

Node shows correct provision_state but never boots OS

Cause: The deploy image was written to the wrong disk device, or the boot loader was not installed correctly.Resolution: Check IPA logs in the Ironic Conductor:

View conductor logs for deployment errors

journalctl -u ironic-conductor --since "1 hour ago" | grep <node-uuid>

Verify the correct root device hint is set if the server has multiple disks:

Set root device hint

openstack baremetal node set <node-uuid> \
  --property root_device='{"wwn": "0x4000cca77fc4dba1"}'

Next Steps

Compute Architecture

Understand how Ironic integrates with the Xloud Compute scheduler for bare metal placement

Ansible Integration

Automate post-provision OS configuration on newly deployed bare metal nodes

Compute Hosts

Manage hypervisor and bare metal hosts in the compute resource pool

Security Hardening

Apply security hardening to bare metal nodes after provisioning

Core Services

Other Services

Bare Metal Provisioning

Overview

Architecture

Service Components

Key Capabilities

PXE / iPXE Network Boot

BMC Power Management

Unified Management

Hardware Introspection

Supported BMC Types

Supported Drivers

Node Provisioning Lifecycle

Enrolling a Node

Navigate to bare metal nodes

Configure driver and credentials

Transition to manageable

Run hardware introspection

Make available for provisioning

Authenticate

Register the node

Set deploy interface and boot options

Validate and transition to manageable

Run introspection

Provide the node

Bifrost Standalone Enrollment

Install Bifrost

Configure inventory

Enroll and deploy

Network Requirements

Troubleshooting

Next Steps

Compute Architecture

Ansible Integration

Compute Hosts

Security Hardening

Core Services

Other Services

​Overview

​Architecture

​Service Components

​Key Capabilities

PXE / iPXE Network Boot

BMC Power Management

Unified Management

Hardware Introspection

​Supported BMC Types

​Supported Drivers

​Node Provisioning Lifecycle

​Enrolling a Node

Navigate to bare metal nodes

Configure driver and credentials

Transition to manageable

Run hardware introspection

Make available for provisioning

Authenticate

Register the node

Set deploy interface and boot options

Validate and transition to manageable

Run introspection

Provide the node

​Bifrost Standalone Enrollment

Install Bifrost

Configure inventory

Enroll and deploy

​Network Requirements

​Troubleshooting

​Next Steps

Compute Architecture

Ansible Integration

Compute Hosts

Security Hardening

Overview

Architecture

Service Components

Key Capabilities

Supported BMC Types

Supported Drivers

Node Provisioning Lifecycle

Enrolling a Node

Bifrost Standalone Enrollment

Network Requirements

Troubleshooting

Next Steps