Redfish and IPMI APIs - the standards for hardware management

Redfish and IPMI are the standards for hardware management. This lesson covers what they are and when to use each.

IPMI

IPMI (Intelligent Platform Management Interface) is the classic standard:

• Defines a message-based interface over LAN.
• Encodes operations in RMCP+ (UDP port 623).
• Provides power, console, sensor access.
• Mature, widely supported.

Tools: ipmitool, vendor-specific (Dell iDRAC, HPE iLO).

Redfish

Redfish is the modern standard:

• REST API over HTTPS (port 443).
• JSON payloads (schema.org-based).
• Replaces IPMI’s binary protocol with HTTP.
• Defined by DMTF (Distributed Management Task Force).
• Supported by newer hardware.

Tools: redfish (Python library), vendor-specific UIs.

Redfish operations

import os
import redfish

# Connect. The password comes from the environment, so it is
# never in the source file and never in argv. cafile pins the
# BMC's issuing CA - see the callout below.
rf = redfish.redfish_client(
    base_url=os.environ['BMC_URL'],
    username=os.environ['BMC_USER'],
    password=os.environ['BMC_PASSWORD'],
    cafile='/etc/pki/bmc/bmc-ca.pem',
)
rf.login(auth='session')   # session token, not basic auth on every request

try:
    systems = rf.get('/redfish/v1/Systems').dict
    for member in systems['Members']:
        system = rf.get(member['@odata.id']).dict

        # Discover the reset URI from the Actions block. Do not
        # build it by hand: the path is vendor-defined and the
        # system Id is not always '1'.
        reset_uri = system['Actions']['#ComputerSystem.Reset']['target']
        print(system['Id'], system['PowerState'], reset_uri)

        resp = rf.post(reset_uri, body={'ResetType': 'ForceOff'})
        resp.status    # expect 200 or 204
finally:
    rf.logout()        # BMCs have a small session limit; leaked
                       # sessions lock you out of your own hardware

The two habits worth taking from that example, beyond the certificate:

• Discover the action URI, do not build it. Reading Actions['#ComputerSystem.Reset']['target'] gets you the right path on every vendor. String-concatenating /redfish/v1/Systems/{id}/Actions/ComputerSystem.Reset works on the boxes you tested and 404s on the next model, and a typo in that path — a stray character between the ID and /Actions — produces a URI no BMC will route.
• Log out. BMCs allow a handful of concurrent sessions. A script that exits without logout() leaks one each run, and after a few hours nobody can log in at all, including through the web UI, until the sessions time out or the BMC is reset.

IPMI vs Redfish

For new automation, prefer Redfish. For legacy hardware, use IPMI. Most modern BMCs support both.

Use cases

• Power management: both work.
• Sensor reading: both work; Redfish is easier.
• Firmware update: both work; Redfish is more standard.
• Configuration: Redfish is more standard.
• STONITH: both work; Pacemaker has an agent for each - fence_ipmilan for IPMI, fence_redfish for Redfish. See linux-fencing-devices-and-agents for the pcs stonith create form of both, and note that the firewall rule changes with the protocol: UDP 623 for IPMI, TCP 443 for Redfish.

Integration

# Substitute your own value before running:
BMC_IP=192.0.2.50

# Redfish library. Install into a virtualenv, not system-wide:
# pip into the system Python is refused on Debian/Ubuntu (PEP 668).
python3 -m venv /opt/redfish-venv
/opt/redfish-venv/bin/pip install redfish

# IPMI - -f reads the password from a root-only file. -P would
# expose it in /proc/PID/cmdline and in shell history.
ipmitool -I lanplus -H "$BMC_IP" -U admin -f /etc/ipmi/bmc.pw chassis status

The same rule applies to Redfish: pass the credential with curl --netrc-file, or read it from an environment variable, never as -u admin:password on the command line.

Both integrate with orchestration (Ansible, Puppet, Pacemaker).

Knowledge check