From 2f6b30f7ebec342dbbc84d79df9cd21e51d3ff4e Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Tue, 22 Sep 2026 15:06:28 -0400 Subject: [PATCH] Implement preference for iPXE shim This implements a secureboot compatible flow, even for PXE. Non secureboot environments suffer one useless transfer, but otherwise should be unaffected. --- confluent_server/bin/osdeploy | 2 ++ confluent_server/confluent/discovery/protocols/pxe.py | 6 +++--- confluent_server/confluent/osimage.py | 4 ++++ 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/confluent_server/bin/osdeploy b/confluent_server/bin/osdeploy index 36b4a3eb..b4b2d558 100644 --- a/confluent_server/bin/osdeploy +++ b/confluent_server/bin/osdeploy @@ -278,8 +278,10 @@ async def install_tftp_content(): raise shutil.copy('/opt/confluent/lib/ipxe/ipxe.efi', tftplocation) shutil.copy('/opt/confluent/lib/ipxe/ipxe.kkpxe', tftplocation) + shutil.copy('/opt/confluent/lib/ipxe/ipxe-shim.efi', tftplocation) if os.path.exists('/opt/confluent/lib/ipxe/ipxe-aarch64.efi'): shutil.copy('/opt/confluent/lib/ipxe/ipxe-aarch64.efi', os.path.join(armtftplocation, 'ipxe.efi')) + shutil.copy('/opt/confluent/lib/ipxe/ipxe-aarch64-shim.efi', os.path.join(armtftplocation, 'ipxe-shim.efi')) diff --git a/confluent_server/confluent/discovery/protocols/pxe.py b/confluent_server/confluent/discovery/protocols/pxe.py index 9f50d332..5ae19465 100644 --- a/confluent_server/confluent/discovery/protocols/pxe.py +++ b/confluent_server/confluent/discovery/protocols/pxe.py @@ -353,11 +353,11 @@ async def proxydhcp(handler, nodeguess): myip = socket.inet_ntoa(myipn) bootfile = 'http://{0}/confluent-public/os/{1}/boot.ipxe'.format(myip, profile).encode('utf8') elif disco['arch'] == 'uefi-x64': - bootfile = b'confluent/x86_64/ipxe.efi' + bootfile = b'confluent/x86_64/ipxe-shim.efi' elif disco['arch'] == 'bios-x86': bootfile = b'confluent/x86_64/ipxe.kkpxe' elif disco['arch'] == 'uefi-aarch64': - bootfile = b'confluent/aarch64/ipxe.efi' + bootfile = b'confluent/aarch64/ipxe-shim.efi' if len(bootfile) > 127: if bootfile.startswith(b'http'): bootfile = register_shorturl(bootfile.decode('utf8')).encode('utf8') @@ -821,7 +821,7 @@ async def reply_dhcp4(node, info, packet, cfg, reqview, httpboot, cfd, profile, return bootfile = 'http://{0}/confluent-public/os/{1}/boot.ipxe'.format(myipn, profile).encode('utf8') else: - bootfile = b'confluent/aarch64/ipxe.efi' + bootfile = b'confluent/aarch64/ipxe-shim.efi' repview[108:108 + len(bootfile)] = bootfile myip = myipn myipn = socket.inet_aton(myipn) diff --git a/confluent_server/confluent/osimage.py b/confluent_server/confluent/osimage.py index 3e0414e4..c7ff88fe 100644 --- a/confluent_server/confluent/osimage.py +++ b/confluent_server/confluent/osimage.py @@ -248,6 +248,10 @@ async def update_boot_linux(profiledir, profile, label): ipxeout.write('imgfetch boot/kernel ' + ipxeargs + '\n') for initramfs in initrds: ipxeout.write('imgfetch boot/initramfs/{0}\n'.format(initramfs)) + for shimpossible in glob.glob(profiledir + '/boot/efi/boot/*'): + shimbasename = os.path.basename(shimpossible) + if shimbasename.lower() in ('bootaa64.efi', 'bootx64.efi'): + ipxeout.write('shim boot/efi/boot/{0}\n'.format(shimbasename)) ipxeout.write('imgload kernel\nimgexec kernel\n') finally: ipxeout.close()