iDRAC Redfish API Automation: Python and PowerShell Patterns

Every fleet has a script that logs into iDRACs over SSH and scrapes racadm output. Redfish replaces that with a documented HTTPS API that returns JSON, works the same way on iDRAC7 through iDRAC10, and encrypts everything in transit by default. This article covers the authentication model, the handful of endpoints that do most of the work, and the workflows Dell ships as reference scripts so you do not have to write them from scratch.

Authentication: session token, not credentials per call

POST credentials once to create a session, then use the returned X-Auth-Token (and the session URI) for every subsequent call. That avoids re-authenticating on every request and keeps credentials out of your process list.

# Create a session
curl -sk -X POST "https://10.0.0.10/redfish/v1/SessionService/Sessions" \
  -H "Content-Type: application/json" \
  -d '{"UserName":"root","Password":"calvin"}' -D headers.txt

# Reuse the token for everything else
TOKEN=$(grep -i x-auth-token headers.txt | awk '{print $2}')
curl -sk -H "X-Auth-Token: $TOKEN" "https://10.0.0.10/redfish/v1/Systems/System.Embedded.1" | jq .

Use -k only in the lab. In production, trust the iDRAC certificate — the whole point of Redfish over legacy protocols is that it is TLS-encrypted and verifiable.

The endpoints worth memorising

• /redfish/v1/Systems/System.Embedded.1 — inventory, power state, boot order, BIOS attribute registry.
• /redfish/v1/Systems/System.Embedded.1/Bios — GET current attributes, PATCH to change them, then apply through the job service.
• /redfish/v1/Managers/iDRAC.Embedded.1 — iDRAC attributes, lifecycle controller logs, virtual console/media config.
• /redfish/v1/UpdateService/FirmwareInventory — every firmware component with version and updateability.
• /redfish/v1/Managers/iDRAC.Embedded.1/Oem/Dell/DellLCService — operations unique to Dell, including Server Configuration Profile export/import.

Typical automation workflows

# Power
curl -sk -H "X-Auth-Token: $TOKEN" -X POST \
  https://10.0.0.10/redfish/v1/Systems/System.Embedded.1/Actions/ComputerSystem.Reset \
  -d '{"ResetType":"On"}'

# Next one-time boot device
PATCH /redfish/v1/Systems/System.Embedded.1  {"Boot":{"BootSourceOverrideTarget":"Pxe"}}

# Firmware inventory for a fleet report
for h in $(cat idracs.txt); do
  curl -sk -H "X-Auth-Token: $TOKEN" "https://$h/redfish/v1/UpdateService/FirmwareInventory?\$expand=." \
    | jq -r '.Members[] | "\(.Name) \(.Version)"'
done

Batch firmware inventory is the highest-value first automation: it answers “which servers are on a vulnerable BIOS” in seconds instead of a change-request cycle. Server Configuration Profile (SCP) export/import is the second: it captures BIOS, iDRAC and RAID configuration as a single file you can diff and restore after a board replacement.

Use the vendor libraries instead of raw curl

Dell publishes iDRAC-Redfish-Scripting with Python and PowerShell samples covering BIOS, iDRAC, firmware, server and storage operations, plus an installable module (pip3 install IdracRedfishSupport) whose set_iDRAC_script_session() prompts once for IP, user, password, certificate verification and whether to use an X-auth token session. Prerequisites are modest: PowerEdge 12G and newer, iDRAC7/8 firmware 2.40.40.40+, iDRAC9 3.00.00.00+, Python 3.x with requests.

For a fleet, run these as an Ansible module or a cron job that writes results into your CMDB — the API is fast enough that polling 200 servers is a background task, not a project. And treat the Redfish host as a privileged management interface: secret-scope it, do not expose it through the same jump path as production SSH, and log every PATCH.

Related reading: iDRAC versus iLO versus IPMI, Ansible command modules for multi-vendor automation and pyATS Genie parsing and state diff.

原文链接：https://github.com/dell/iDRAC-Redfish-Scripting