Cannot set all account privileges for newer ILOs

[BoudewijnSwen]

OneView version: 6.40.00-0450507 Terraform OneView provider: version = "6.4.0-13"

For a ProLiant DL380 Gen9 1 server profile template I can set the following local user account privileges (last 5 lines):

management_processor {
  compliance_control = "Checked"
  manage_mp = true
  mp_settings {
    administrator_account {
      delete_administrator_account = true      
    }
    local_accounts {
      display_name = "Read-Only User account"
      user_name = "ilo-user"
      password = var.ilo_user_password
      ilo_config_priv = false
      remote_console_priv = true
      user_config_priv = false
      virtual_media_priv = false
      virtual_power_and_reset_priv = false

This is in line with what the UI shows. 5 check boxes.

For DL360 Gen10 Plus 1 local user accounts, you get 4 extra privileges to set:

• Login
• Host BIOS
• Host NIC
• Host storage

I tried to set them at first by adding:

      login_priv = true
      host_bios_config_priv = false
      host_nic_config_priv = false
      host_storage_config_priv = false

But I got an Unsupported argument error. I though it might because I was using the wrong syntax, so I requested a existing template for a Gen10 which had all boxes checked in the UI, as a terraform output. But in that output, only those 5 main privileges were shown, not the 4 new ones.

I guess you cant set these from Terraform. These 4 values are not defined in "master/oneview/resource_server_profile_template.go"

This is an issue, since I also opt to delete the default administrator account from the ILO, which leaves me with only my local account, that has no privileges to login to the ILO, since the default for these 4 values is 'false'. I can only fix it through the OneView UI.

[BoudewijnSwen]

So, currently I have to manually check the boxes from the GUI. However, everytime I edit something to these templates in Terraform and do a 'terraform apply' it unchecks these boxes in the templates.

[BoudewijnSwen]

Great Nabhajit-ray! Thanks for that. I will try and test run with those changes somewhere next week. Will let you know.

[BoudewijnSwen]

SDK version = 6.5.0-13 OV appliance version = 6.50.00-0452161

He @nabhajit-ray, Unfortunately it does not seem to work yet. Looking through the code changes (I am not that well versed in Go though...), it seems it only works now for server profiles, not the templates. While deploying a template for a Gen10, with these arguments set, I get the following output:

> terraform plan
╷
│ Error: Unsupported argument
│ 
│   on profile_templates.tf line 102, in resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_M_SPT":
│  102:         login_priv = true
│ 
│ An argument named "login_priv" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on profile_templates.tf line 103, in resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_M_SPT":
│  103:         host_bios_config_priv = false
│ 
│ An argument named "host_bios_config_priv" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on profile_templates.tf line 104, in resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_M_SPT":
│  104:         host_nic_config_priv = false
│ 
│ An argument named "host_nic_config_priv" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on profile_templates.tf line 105, in resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_M_SPT":
│  105:         host_storage_config_priv = false
│ 
│ An argument named "host_storage_config_priv" is not expected here.

[nabhajit-ray]

SPT changes were added with different Pull request, which I have menioned now. The changes are in master branch and not in released branch. Have you build the provider locally and tried?

[BoudewijnSwen]

He @nabhajit-ray , I tried to build the local provider, following the instructions from HACKING.md. Though, I ran into some issues:

> go get -u github.com/HewlettPackard/terraform-provider-oneview
go: downloading github.com/HewlettPackard/terraform-provider-oneview v1.6.0
go: downloading github.com/HewlettPackard/oneview-golang v1.8.0
go: downloading github.com/HewlettPackard/oneview-golang v6.5.0+incompatible
go: downloading github.com/hashicorp/terraform v1.1.7
go: downloading github.com/docker/machine v0.16.2
github.com/HewlettPackard/terraform-provider-oneview imports
        github.com/hashicorp/terraform/plugin: cannot find module providing package github.com/hashicorp/terraform/plugin
github.com/HewlettPackard/terraform-provider-oneview imports
        github.com/HewlettPackard/terraform-provider-oneview/oneview imports
        github.com/hashicorp/terraform/helper/mutexkv: cannot find module providing package github.com/hashicorp/terraform/helper/mutexkv
github.com/HewlettPackard/terraform-provider-oneview imports
        github.com/HewlettPackard/terraform-provider-oneview/oneview imports
        github.com/hashicorp/terraform/helper/schema: cannot find module providing package github.com/hashicorp/terraform/helper/schema
github.com/HewlettPackard/terraform-provider-oneview imports
        github.com/HewlettPackard/terraform-provider-oneview/oneview imports
        github.com/hashicorp/terraform/terraform: cannot find module providing package github.com/hashicorp/terraform/terraform

I assume it has something to do with the 2nd part of the instructions in HACKING.md, but the govendor tool is not something I am allowed to install here. It's last updated in 2016 and clearly states in the readme to not use that tool anymore.

I would love to test it for you! Is there another way for me to locally build the provider from the master branch?

[nabhajit-ray]

mutexv package is no longer part of terraform package, not sure why it is looking in terraform package since it is part of SDK now. i.e. https://github.com/HewlettPackard/terraform-provider-oneview/tree/master/internal/mutexkv Meanwhile you can do the following.

Steps to use provider locally:

1. Build the provider locally first $pwd /home/terraform-provider-oneview $ls CHANGELOG.md docs go.mod LICENSE oneview variables.tf CONTRIBUTING.md endpoints-support.md go.sum main.go README.md vendor Dockerfile examples HACKING.md 'Migration Support' versions.tf $ go build -o terraform-provider-oneview

2. Create directory to place the provider $ mdkir -p .terraform/plugins/registry.terraform.io/hewlettpackard/oneview/6.1.0-13/linux_amd64/

3. Copy the provider to the created location $ mv terraform-provider-oneview .terraform/plugins/registry.terraform.io/hewlettpackard/oneview/6.1.0-13/linux_amd64/terraform-provider-oneview_v6.1.0-13

[BoudewijnSwen]

He @nabhajit-ray , thanks for the instructions, I got it setup and it seems to work!

I did get one error though during the template creation, but that one might be related to another issue I logged last week (Issue 463):

╷
│ Error: Error in response: Invalid JSON type.
│  Response Status: 400 Bad Request
│  Response Details: The "type" field content, "FwBaselineV6", included in this request is not valid.
│ 
│   with oneview_firmware_drivers.hpe_2021_05_0_and_qlogic_2_29_2_bundle,
│   on main.tf line 96, in resource "oneview_firmware_drivers" "hpe_2021_05_0_and_qlogic_2_29_2_bundle":
│   96: resource "oneview_firmware_drivers" "hpe_2021_05_0_and_qlogic_2_29_2_bundle" {
│ 
╵

When I did another 'terraform plan' it said it had 4 things to change... it listed all four templates I just created, but the things it was gonna update were alrdy set correctly. So I did another 'terraform apply'. It got to work, changed 4 things, but I could not find why it said it had changed 4 resources. In the GUI is showed that it updated the template. The task said:

Validate configuration.
Save server profile template definition.

A bit strange... but I did not got the error from the initial creation. So at least that part worked out.

I did another 'terraform plan' and it still says its gonna change 4 resources.

Terraform will perform the following actions:

  # oneview_server_profile_template.DL360_Gen10_Plus_1_M_SPT will be updated in-place
  ~ resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_M_SPT" {
        id                         = "DL360_Gen10_Plus_1_M_SPT"
        name                       = "DL360_Gen10_Plus_1_M_SPT"
        # (21 unchanged attributes hidden)

      ~ bios_option {
          + compliance_control = "Checked"
            # (1 unchanged attribute hidden)

            # (15 unchanged blocks hidden)
        }

      ~ boot_mode {
          + compliance_control = "Checked"
          ~ secure_boot        = "Unmanaged" -> "Enabled"
            # (3 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

  # oneview_server_profile_template.DL360_Gen10_Plus_1_W_SPT will be updated in-place
  ~ resource "oneview_server_profile_template" "DL360_Gen10_Plus_1_W_SPT" {
        id                         = "DL360_Gen10_Plus_1_W_SPT"
        name                       = "DL360_Gen10_Plus_1_W_SPT"
        # (21 unchanged attributes hidden)

      ~ bios_option {
          + compliance_control = "Checked"
            # (1 unchanged attribute hidden)

            # (15 unchanged blocks hidden)
        }

      ~ boot_mode {
          + compliance_control = "Checked"
          ~ secure_boot        = "Unmanaged" -> "Enabled"
            # (3 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

  # oneview_server_profile_template.DL380_Gen9_1_W_EHV_SPT will be updated in-place
  ~ resource "oneview_server_profile_template" "DL380_Gen9_1_W_EHV_SPT" {
        id                         = "DL380_Gen9_1_W_EHV_SPT"
        name                       = "DL380_Gen9_1_W_EHV_SPT"
        # (21 unchanged attributes hidden)

      ~ bios_option {
          + compliance_control = "Checked"
            # (1 unchanged attribute hidden)

            # (7 unchanged blocks hidden)
        }

      ~ boot_mode {
          + compliance_control = "Checked"
            # (4 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

  # oneview_server_profile_template.DL380_Gen9_1_W_SPT will be updated in-place
  ~ resource "oneview_server_profile_template" "DL380_Gen9_1_W_SPT" {
        id                         = "DL380_Gen9_1_W_SPT"
        name                       = "DL380_Gen9_1_W_SPT"
        # (21 unchanged attributes hidden)

      ~ bios_option {
          + compliance_control = "Checked"
            # (1 unchanged attribute hidden)

            # (7 unchanged blocks hidden)
        }

      ~ boot_mode {
          + compliance_control = "Checked"
            # (4 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

I went into the GUI and checked the user settings and it had all 4 boxes that you added ticked! So that part works like a charm!

[nabhajit-ray]

Closing this, since it is working now