Skip to content

docs: Document site setup API parity #3462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kfelternv wants to merge 4 commits into
base: main
Choose a base branch
from
+99 −97
Open

docs: Document site setup API parity #3462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b64b67d
docs: Document site setup API parity
kfelternv Jul 14, 2026
4439eca
docs: Fix machine power command order
kfelternv Jul 14, 2026
52111e6
docs: Fix Expected Machine command examples
kfelternv Jul 14, 2026
6394d26
docs: Clarify machine power authorization
kfelternv Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/index.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,8 @@ navigation:
path: provisioning/ingesting-hosts.md
- page: Ingesting Hosts (REST API)
path: provisioning/ingesting-hosts-rest-api.md
- page: Site Setup API Parity
path: provisioning/site-setup-api-parity.md
- page: Boot Interfaces and DPU Modes
path: provisioning/boot-interfaces-and-dpu-modes.md
- page: Machine Validation
Expand Down
32 changes: 14 additions & 18 deletions docs/playbooks/machine_reboot.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,31 +15,27 @@ instance lifecycle.**

The following steps can be used to reboot a machine:

### 1. Obtain access to `nico-admin-cli`
### 1. Obtain access to `nicocli`

See [nico-admin-cli access on a NICo deployment](nico_admin_cli.md).
Configure `nicocli` for the target REST API. The caller's organization must have an Infrastructure Provider that owns the Site containing the Machine, and the caller must have the `PROVIDER_ADMIN` role.

### 2. Execute the `nico-admin-cli machine reboot` command
### 2. Execute the Machine power control operation

`nico-admin-cli machine reboot` can be used to restart a machine.
It always will require the machine's BMC IP and port to be specified.

BMC credentials can either be explicitly passed, or the `--machine-id` parameter
can be used to let the NICo site controller read the last known credentials
for the machine.

Rebooting a machine will also always reset its boot order. The machine
will PXE boot, and thereby will be able to retrieve new boot instructions from
the NICo site controller.

**Example:**
Use `GracefulRestart` when the operating system can shut down cleanly. Use `ForceRestart` only when a graceful restart is not possible.

```bash
/opt/nico/nico-admin-cli -a https://127.0.0.1:1079 machine reboot --address 123.123.123.123 --port 9999 --machine-id="60cef902-9779-4666-8362-c9bb4b37184f"
nicocli machine power-control-machine machine-power-control-machine \
--action GracefulRestart \
<machine-id>
Comment on lines +27 to +29

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the relevant documentation section with line numbers.
sed -n '1,120p' docs/playbooks/machine_reboot.md | cat -n

# Look for other nicocli machine examples and usage patterns in the repo.
rg -n "nicocli machine|power-control-machine|GracefulRestart|GracefulShutdown|machine power-control-machine" docs . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**'

Repository: NVIDIA/infra-controller

Length of output: 50383

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate the CLI command definition and usage text for power-control-machine.
rg -n -C 4 "power-control-machine|machine-power-control-machine|GracefulRestart|AcknowledgeAttachedInstance|acknowledge-attached-instance" \
  rest-api/cli crates/admin-cli rest-api/openapi/spec.yaml docs/playbooks/machine_reboot.md

# Inspect the command-related test or usage strings if present.
sed -n '520,620p' rest-api/cli/pkg/commands_test.go | cat -n

# Inspect the OpenAPI operation around the relevant endpoint.
python3 - <<'PY'
from pathlib import Path
p = Path('rest-api/openapi/spec.yaml')
text = p.read_text()
for needle in ['machine-power-control-machine', 'power-control-machine', 'acknowledge-attached-instance']:
    idx = text.find(needle)
    print(f'NEEDLE={needle} IDX={idx}')
    if idx != -1:
        start = max(0, idx-400)
        end = min(len(text), idx+1200)
        print(text[start:end])
        print('---')
PY

Repository: NVIDIA/infra-controller

Length of output: 16588

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read the exact playbook region with line numbers.
sed -n '20,45p' docs/playbooks/machine_reboot.md | cat -n

# Inspect the CLI command registration and generated usage around the operation.
rg -n -C 3 "machine-power-control-machine|power-control-machine" rest-api/cli crates/admin-cli

# Show the relevant OpenAPI path/operation block compactly.
python3 - <<'PY'
from pathlib import Path
import re
text = Path('rest-api/openapi/spec.yaml').read_text()
m = re.search(r'(?ms)^ {2}machine-power-control-machine:\n(?:.*\n){0,80}', text)
print(m.group(0) if m else 'NOT FOUND')
PY

Repository: NVIDIA/infra-controller

Length of output: 1165

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find the command-tree builder and the generated usage/command mapping for the machine power-control operation.
rg -n -C 4 "machine-power-control-machine|power-control-machine|acknowledgeAttachedInstance|acknowledge-attached-instance|UsageText|command options" rest-api/cli crates/admin-cli rest-api/openapi/spec.yaml

# Inspect the CLI command tests around usage generation for machine commands.
sed -n '1,220p' rest-api/cli/pkg/commands_test.go | cat -n

# Inspect the OpenAPI operation block and parameters around the machine power-control endpoint.
python3 - <<'PY'
from pathlib import Path
import re
text = Path('rest-api/openapi/spec.yaml').read_text()
for pat in [
    r"(?ms)^  /v2/org/\{org\}/nico/machine/\{machineId\}/power-control:\n(?:.*\n){0,120}",
    r"(?ms)^      operationId: machine-power-control-machine\n(?:.*\n){0,40}",
]:
    m = re.search(pat, text)
    print("MATCH" if m else "NO MATCH", pat)
    if m:
        print(m.group(0))
        print("----")
PY

Repository: NVIDIA/infra-controller

Length of output: 50379

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the exact OpenAPI path for the machine power-control endpoint.
python3 - <<'PY'
from pathlib import Path
import re
text = Path('rest-api/openapi/spec.yaml').read_text()
m = re.search(r'(?ms)^  /v2/org/\{org\}/nico/machine/\{machineId\}/power-control:\n(?:.*\n){0,180}', text)
print(m.group(0) if m else 'NOT FOUND')
PY

# Find the CLI machine command registration/usage strings if present in source.
rg -n -C 4 "power-control-machine|machine-id|machineId|acknowledgeAttachedInstance|acknowledge-attached-instance|command options" \
  rest-api/cli crates/admin-cli docs/playbooks/machine_reboot.md

Repository: NVIDIA/infra-controller

Length of output: 26807

Remove the repeated machine-power-control-machine token. Both snippets should read nicocli machine power-control-machine --action GracefulRestart <machine-id>.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/playbooks/machine_reboot.md` around lines 27 - 29, Remove the duplicated
machine-power-control-machine token from the nicocli command in the reboot
playbook, leaving the command as nicocli machine power-control-machine followed
by --action GracefulRestart and <machine-id>, consistently in both snippets.

```

or using username and password:
If the Machine has an attached Instance, acknowledge the workload disruption explicitly:

```bash
/opt/nico/nico-admin-cli -a https://127.0.0.1:1079 machine reboot --address 123.123.123.123 --port 9999 --username myhost --password mypassword
nicocli machine power-control-machine machine-power-control-machine \
--action GracefulRestart \
--acknowledge-attached-instance true \
<machine-id>
```

A successful request returns HTTP 202. Retrieve the Machine afterward with `nicocli machine get <machine-id>` and confirm that it returns to the expected lifecycle state.

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the target document around the cited line
wc -l docs/playbooks/machine_reboot.md
sed -n '1,120p' docs/playbooks/machine_reboot.md

# Locate the referenced API/docs mention in the repository, if any
rg -n "power-control|HTTP 202|machine get|poll|polling|lifecycle state" docs -S

Repository: NVIDIA/infra-controller

Length of output: 19463

🏁 Script executed:

#!/bin/bash
set -euo pipefail

wc -l docs/playbooks/machine_reboot.md
sed -n '1,120p' docs/playbooks/machine_reboot.md

rg -n "power-control|HTTP 202|machine get|poll|polling|lifecycle state" docs -S

Repository: NVIDIA/infra-controller

Length of output: 19463

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find any API reference or runbook text for the machine power-control endpoint
rg -n "power-control-machine|GracefulRestart|ForceRestart|HTTP 202|accepted" docs -S

# Read the nearby sections in the machine reboot playbook and any lifecycle guidance
sed -n '1,120p' docs/playbooks/machine_reboot.md
sed -n '1,220p' docs/overview/lifecycle.md
sed -n '1,220p' docs/architecture/state_handling.md

Repository: NVIDIA/infra-controller

Length of output: 20670

🌐 Web query:

docs.nvidia.com infra-controller machine power-control-machine HTTP 202 accepted lifecycle state poll

💡 Result:

In the NVIDIA Infra Controller (NICo) architecture, power control operations—such as those managed via the machine power control endpoints—are typically handled asynchronously, returning an HTTP 202 Accepted status [1]. This status indicates that the request has been received and queued for processing, but the operation has not yet completed [2]. Because the state handling is asynchronous and designed for reliability, resources undergo lifecycle state transitions that may take time or require periodic retries by the controller [2]. NICo utilizes a state controller mechanism where handler functions are scheduled for execution periodically (typically every 30 seconds) to ensure resources reach their desired state, even in the event of intermittent failures [2]. To track the progress of these power control operations or determine the current state of a machine, users should: 1. Lifecycle State Polling: Instead of expecting an immediate result from the power control request, the system relies on the resource's lifecycle state machine [2][3][4]. Users can poll the specific machine's status via the REST API to observe transitions as the controller processes the request [5][6]. 2. Observability Metrics: NICo provides Prometheus metrics that expose detailed lifecycle timestamps, current states, and expected next transitions [7]. These metrics can be used to monitor whether a machine is stuck in a state or has successfully completed a transition (e.g., from a power-off state to an operational state) [7]. 3. Task/Status Tracking: For certain operations, the API provides task-based tracking or status history, allowing users to verify the completion of requested actions [5][6]. In summary, an HTTP 202 response signifies that the intent to change the machine's power state has been successfully enqueued [2]. Subsequent verification of the operation's success should be performed by monitoring the resource's lifecycle state or associated status metrics through the NICo REST API [5][6][7].

Citations:

Poll until the reboot reaches a terminal state. HTTP 202 only means the request was accepted; a single nicocli machine get can still observe the pre-restart lifecycle state. Document a bounded poll loop with a timeout and explicit success/failure terminal states.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/playbooks/machine_reboot.md` at line 41, Update the reboot verification
instructions to poll `nicocli machine get <machine-id>` repeatedly after the
HTTP 202 response, using a bounded timeout. Document the expected successful
terminal lifecycle state and the terminal failure states, including explicit
success and failure outcomes when the timeout expires or a failure state is
observed.

136 changes: 57 additions & 79 deletions docs/provisioning/ingesting-hosts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,15 @@

Once you have NVIDIA Infra Controller (NICo) up and running, you can begin ingesting machines.

The preferred operator workflow uses the REST API and `nicocli`. Follow [Ingesting Hosts (REST API)](ingesting-hosts-rest-api.md) for credential setup, Expected Machine registration, ingestion verification, and table maintenance. The direct Core workflow below remains available for operations that do not yet have REST parity; see [Site Setup API Parity](site-setup-api-parity.md) for the current status and tracked gaps.

## Prerequisites

Ensure you have the following prerequisites met before ingesting machines:

1. You have the `nico-admin-cli` command available: You can compile it from sources or you can use the pre-compiled binary. Another choice is to use a containerized version. You can also download it from the cluster; see next section for details.
1. You have `nicocli` installed and configured for the target REST API. See the [Quick Start Guide](../getting-started/quick-start.md).

2. You can access the NICo site using the `nico-admin-cli`.
2. For the remaining REST parity gaps, you have `nico-admin-cli` and direct access to the NICo site. See the next section for details.

3. The NICo API service is running at IP address `NICo_API_EXTERNAL`. It is recommended that you add this IP address to your trusted list.

Expand Down Expand Up @@ -111,95 +113,61 @@ The required credentials include the following:
https://api-<ENVIRONMENT_NAME>.<SITE_DOMAIN_NAME> --nico-root-ca-path <NICO_ROOT_CA_PATH> --client-cert-path <CLIENT_CERT_PATH> --client-key-path <CLIENT_KEY_PATH>
```

### Update Host and DPU BMC Password

Run this command to update the desired Host and DPU BMC password:

```bash
nico-admin-cli -a <api-url> credential add-bmc --kind=site-wide-root --password='x'
```

### Update Host UEFI Password
### Store Host and DPU BMC Password

Run this command to generate the desired host UEFI password:
Run this command to store the desired Host and DPU BMC password:

```bash
nico-admin-cli -a <api-url> host generate-host-uefi-password
nicocli bmc-credential create \
--site-id <site-uuid> \
--kind SiteWideRoot \
--password '<password>'
```

### Store Host and DPU UEFI Passwords

Run this command to update host uefi password:
Run this command to store the desired host UEFI password:

```bash
nico-admin-cli -a <api-url> credential add-uefi --kind=host --password='<password-gemerated-in-previous-step>'
nicocli uefi-credential create \
--site-id <site-uuid> \
--kind Host \
--password '<password>'
```

Run this command to update DPU uefi password:
Run this command to store the desired DPU UEFI password:
```bash
nico-admin-cli -a <api-url> credential add-uefi --kind=dpu --password='x'
nicocli uefi-credential create \
--site-id <site-uuid> \
--kind DPU \
--password '<password>'
```

## Add Expected Machines Table

NICo needs to know the factory default credentials for each BMC, which is expressed as a JSON table of "Expected Machines". The serial number is used to verify the BMC MAC matches the actual serial number of the chassis.

Prepare an `expected_machines.json` file as follows:
Register a single Expected Machine with `nicocli`:

```json
{
"expected_machines": [
{
"bmc_mac_address": "C4:5A:B1:C8:38:0D",
"bmc_username": "root",
"bmc_password": "default-password1",
"chassis_serial_number": "SERIAL-1"
},
{
"bmc_mac_address": "C4:5A:FF:FF:FF:FF",
"bmc_username": "root",
"bmc_password": "default-password2",
"chassis_serial_number": "SERIAL-2"
}
]
}
```bash
nicocli expected-machine create \
--site-id <site-uuid> \
--bmc-mac-address <mac> \
--chassis-serial-number <chassis-serial> \
--default-bmc-username <bmc-user> \
--default-bmc-password <bmc-password>
```

Only servers listed in this table will be ingested, so you must include all servers in this file.

### Optional Per-Host Fields

Each entry supports additional optional fields:

- **`host_lifecycle_profile`** (object): Per-host profile for settings that affect
state-machine progression. Future per-host knobs should be added here.
- **`disable_lockdown`** (bool, default `false`): When `true`, the state machine
does not lockdown the host during lifecycle management. This is useful for automation
workflows that need lockdown persistently disabled.

```json
{
"bmc_mac_address": "C4:5A:B1:C8:38:0D",
"bmc_username": "root",
"bmc_password": "default-password1",
"chassis_serial_number": "SERIAL-1",
"host_lifecycle_profile": {
"disable_lockdown": true
}
}
```

- **`dpf_enabled`** (bool): Enable/disable DPF for this host.
- **`dpu_mode`** (`"dpu_mode"` | `"nic_mode"` | `"no_dpu"`): Per-host DPU operating mode.
- **`bmc_retain_credentials`** (bool): Skip BMC password rotation.
- **`default_pause_ingestion_and_poweron`** (bool): Pause ingestion and power-on for this host.
- **`bmc_ip_address`** (string): Static BMC IP (pre-allocates a machine interface).

When the file is ready, upload it to the site with the following command:
For more than one machine, prepare the JSON array documented in [Ingesting Hosts (REST API)](ingesting-hosts-rest-api.md#batch-recommended-for-full-rack-onboarding), then run:

```bash
nico-admin-cli -a <api-url> em replace-all --filename expected_machines.json
nicocli expected-machine batch-create --data-file expected-machines.json
```

Only registered Expected Machines will be ingested.

For optional REST fields and batch JSON examples, use [Ingesting Hosts (REST API)](ingesting-hosts-rest-api.md#registering-expected-machines).

## Approve all Machines for Ingestion

NICo uses Measured Boot using the on-host Trusted Platform Module (TPM) v2.0 to enforce cryptographic identity of the host hardware and firmware.
Expand Down Expand Up @@ -234,8 +202,8 @@ When a machine is not being created or is stuck in a pre-`Ready` state, `nico-ap
You can check the current detailed state of any managed host using:

```bash
nico-admin-cli -a <api-url> managed-host show --all
nico-admin-cli -a <api-url> managed-host show <machine-id>
nicocli machine list --output table
nicocli machine get <machine-id>
```

For a full guide on diagnosing stuck objects, including how to use the NICo Grafana dashboard and how to read state handler error logs, see [Stuck Objects Runbook](../playbooks/stuck_objects/stuck_objects.md).
Expand Down Expand Up @@ -299,32 +267,42 @@ The expected machines table in the nico-api database holds the following fields

### Individual operations

Use `nico-admin-cli` to operate on individual entries:
Use `nicocli` to operate on individual entries:

```bash
nico-admin-cli -a <api-url> em update ...
nico-admin-cli -a <api-url> em add ...
nico-admin-cli -a <api-url> em delete ...
nicocli expected-machine update \
--description '<description>' \
<expected-machine-id>
nicocli expected-machine create \
--site-id <site-uuid> \
--bmc-mac-address <mac> \
--chassis-serial-number <chassis-serial> \
--default-bmc-username <bmc-username> \
--default-bmc-password <bmc-password>
nicocli expected-machine delete <expected-machine-id>
```

### Bulk operations

Replace all entries from a JSON file:
Create or update entries from a JSON file:

```bash
nico-admin-cli -a <api-url> em replace-all --filename expected_machines.json
nicocli expected-machine batch-create --data-file expected-machines.json
nicocli expected-machine batch-update --data-file expected-machine-updates.json
```
Comment thread
coderabbitai[bot] marked this conversation as resolved.

Erase all entries:
See [Ingesting Hosts (REST API)](ingesting-hosts-rest-api.md#batch-update) for the batch update JSON shape.

Delete an entry by ID:

```bash
nico-admin-cli -a <api-url> em erase
nicocli expected-machine delete <expected-machine-id>
```

### Export

Export the current table as JSON:

```bash
nico-admin-cli -a <api-url> -f json em show
```
nicocli expected-machine list --all --output json
```
26 changes: 26 additions & 0 deletions docs/provisioning/site-setup-api-parity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Site Setup API Parity

Use the REST API and `nicocli` for site setup whenever an operation is listed as covered below. Direct `nico-admin-cli` access remains necessary only for the gaps that have not yet reached the REST API.

| Site setup task | Current status | Preferred command or tracked gap |
|---|---|---|
| Store the site-wide BMC root credential | Covered | `nicocli bmc-credential create --site-id <site-uuid> --kind SiteWideRoot --password <password>` |
| Store the site-default host UEFI credential | Covered | `nicocli uefi-credential create --site-id <site-uuid> --kind Host --password <password>` |
| Store the site-default DPU UEFI credential | Covered | `nicocli uefi-credential create --site-id <site-uuid> --kind DPU --password <password>` |
| Register an Expected Machine | Covered | `nicocli expected-machine create --site-id <site-uuid> --bmc-mac-address <mac> --chassis-serial-number <serial> --default-bmc-username <user> --default-bmc-password <password>` |
| Register Expected Machines in a batch | Covered | `nicocli expected-machine batch-create --data-file expected-machines.json` |
Comment on lines +7 to +11

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

rg -n --hidden --glob '!**/.git/**' -S "bmc-credential create|uefi-credential create|expected-machine create|--password|password.*stdin|prompt|secret-file|read-password|password-file|nicocli" docs .

Repository: NVIDIA/infra-controller

Length of output: 50380

🏁 Script executed:

sed -n '1,40p' docs/provisioning/site-setup-api-parity.md
printf '\n---\n'
sed -n '110,170p' docs/provisioning/ingesting-hosts.md
printf '\n---\n'
sed -n '180,210p' docs/manuals/nicocli-reference.md

Repository: NVIDIA/infra-controller

Length of output: 6460

🏁 Script executed:

sed -n '35,80p' docs/provisioning/ingesting-hosts-rest-api.md
printf '\n---\n'
sed -n '430,460p' docs/manuals/nicocli-reference.md
printf '\n---\n'
sed -n '1,80p' docs/manuals/nico-admin-cli/commands/credential/credential-add-bmc.md
printf '\n---\n'
sed -n '1,80p' docs/manuals/nico-admin-cli/commands/credential/credential-add-uefi.md

Repository: NVIDIA/infra-controller

Length of output: 6350

Stop documenting real secrets as command-line arguments.

These examples expose BMC and UEFI passwords in shell history and process listings. Use a supported prompt/stdin/secret-file path if the CLI has one; otherwise replace the examples with an approved ephemeral invocation pattern and avoid --password in operator-facing docs.

  • docs/provisioning/site-setup-api-parity.md#L7-L11
  • docs/provisioning/ingesting-hosts.md#L121-L158
📍 Affects 2 files
  • docs/provisioning/site-setup-api-parity.md#L7-L11 (this comment)
  • docs/provisioning/ingesting-hosts.md#L121-L158
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/provisioning/site-setup-api-parity.md` around lines 7 - 11, Remove real
password values from operator-facing CLI examples in
docs/provisioning/site-setup-api-parity.md lines 7-11 and
docs/provisioning/ingesting-hosts.md lines 121-158. Update the
credential-related commands, including bmc-credential, uefi-credential, and
expected-machine examples, to use a supported prompt, stdin, or secret-file
mechanism; if none exists, use an approved ephemeral invocation pattern and do
not document --password arguments.

Source: Path instructions

| Approve, list, or remove measured-boot machine trust rules | Gap | Tracked by [#2801](https://github.com/NVIDIA/infra-controller/issues/2801). Use `nico-admin-cli attestation measured-boot site trusted-machine approve`, `list`, or `remove` until that issue is complete. |
| Approve, list, or remove measured-boot profile trust rules | Gap | Tracked by [#2801](https://github.com/NVIDIA/infra-controller/issues/2801). Use `nico-admin-cli attestation measured-boot site trusted-profile approve`, `list`, or `remove` until that issue is complete. |
| Clear a Site Explorer endpoint error | Gap | Tracked by [#2802](https://github.com/NVIDIA/infra-controller/issues/2802). Use `nico-admin-cli site-explorer clear-error <bmc-ip>` until that issue is complete. |
| Queue a Site Explorer endpoint for re-exploration | Gap | Tracked by [#2802](https://github.com/NVIDIA/infra-controller/issues/2802). Use `nico-admin-cli site-explorer re-explore <bmc-ip>` until that issue is complete. Bulk selection and execution also remain part of this gap. |
Comment on lines +12 to +15

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== site-setup-api-parity.md ==\n'
nl -ba docs/provisioning/site-setup-api-parity.md | sed -n '1,80p'

printf '\n== ingesting-hosts.md (around lines 100-120) ==\n'
nl -ba docs/provisioning/ingesting-hosts.md | sed -n '100,120p'

printf '\n== ingesting-hosts.md (around lines 238-255) ==\n'
nl -ba docs/provisioning/ingesting-hosts.md | sed -n '238,255p'

Repository: NVIDIA/infra-controller

Length of output: 233

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== site-setup-api-parity.md (1-80) ==\n'
sed -n '1,80p' docs/provisioning/site-setup-api-parity.md | cat -n

printf '\n== ingesting-hosts.md (100-120) ==\n'
sed -n '100,120p' docs/provisioning/ingesting-hosts.md | cat -n

printf '\n== ingesting-hosts.md (238-255) ==\n'
sed -n '238,255p' docs/provisioning/ingesting-hosts.md | cat -n

Repository: NVIDIA/infra-controller

Length of output: 6169

Include the nico-admin-cli connection context here.
docs/provisioning/ingesting-hosts.md shows these commands require -a <api-url> plus the CA/client cert/key flags. Either add the full invocation to these gap examples or state that the values are already preconfigured; otherwise the documented workflow is not runnable.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/provisioning/site-setup-api-parity.md` around lines 12 - 15, Update the
measured-boot and Site Explorer CLI examples in the site setup API parity table
to include the required nico-admin-cli connection context, matching the flags
documented in ingesting-hosts.md, or explicitly state that those values are
preconfigured. Ensure every referenced command remains directly runnable with
the documented API URL and CA, client certificate, and client key configuration.

Source: Path instructions


## Remaining parity plan

The REST/nicocli parity work is tracked under [#2852](https://github.com/NVIDIA/infra-controller/issues/2852):

- [#2799](https://github.com/NVIDIA/infra-controller/issues/2799) covers site-wide BMC and UEFI credentials and is complete.
- [#2801](https://github.com/NVIDIA/infra-controller/issues/2801) adds measured-boot trust approval operations.
- [#2802](https://github.com/NVIDIA/infra-controller/issues/2802) adds Site Explorer clear-error and re-explore operations.
- [#2803](https://github.com/NVIDIA/infra-controller/issues/2803) covers additional admin-cli inventory. Its implementation merged in [#3241](https://github.com/NVIDIA/infra-controller/pull/3241); the issue remains open for administrative closure.

After #2801 and #2802 are complete, update this table to replace the remaining direct admin-cli commands with their generated `nicocli` commands.
Loading