refactor(redfish): move BMC set_bmc_root_password + add probe_bmc_vendor to RedfishClientPool for rotation reuse

crates/admin-cli/src/bmc_machine/mod.rs

@@ -24,6 +24,8 @@ mod enable_infinite_boot;
 mod is_infinite_boot_enabled;
 mod lockdown;
 mod lockdown_status;
+mod probe_vendor;
+mod set_root_password;
 
 #[cfg(test)]
 mod tests;
@@ -49,4 +51,10 @@ pub enum Cmd {
     Lockdown(lockdown::Args),
     #[clap(about = "Check lockdown status")]
     LockdownStatus(lockdown_status::Args),
+    #[clap(
+        about = "Set a BMC's root password out-of-band (for fleet rotation use `credential rotate`)"
+    )]
+    SetRootPassword(set_root_password::Args),
+    #[clap(about = "Resolve a BMC's Redfish vendor")]
+    ProbeVendor(probe_vendor::Args),
 }

crates/admin-cli/src/bmc_machine/probe_vendor/args.rs

@@ -0,0 +1,61 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use clap::Parser;
+use mac_address::MacAddress;
+use rpc::forge as forgerpc;
+
+#[derive(Parser, Debug, Clone)]
+#[command(after_long_help = "\
+EXAMPLES:
+
+Probe a BMC's Redfish vendor, targeting the BMC by machine id:
+    $ nico-admin-cli bmc-machine probe-vendor --machine 12345678-1234-5678-90ab-cdef01234567
+
+Target the BMC by IP address:
+    $ nico-admin-cli bmc-machine probe-vendor --ip-address 192.0.2.20
+
+Target the BMC by MAC address:
+    $ nico-admin-cli bmc-machine probe-vendor --mac-address 00:11:22:33:44:55
+
+")]
+pub struct Args {
+    #[clap(long, short, help = "IP of the BMC whose vendor to probe")]
+    pub ip_address: Option<String>,
+    #[clap(long, help = "MAC of the BMC whose vendor to probe")]
+    pub mac_address: Option<MacAddress>,
+    #[clap(long, short, help = "ID of the machine whose BMC vendor to probe")]
+    pub machine: Option<String>,
+}
+
+impl From<Args> for forgerpc::ProbeBmcVendorRequest {
+    fn from(args: Args) -> Self {
+        let bmc_endpoint_request = if args.ip_address.is_some() || args.mac_address.is_some() {
+            Some(forgerpc::BmcEndpointRequest {
+                ip_address: args.ip_address.unwrap_or_default(),
+                mac_address: args.mac_address.map(|mac| mac.to_string()),
+            })
+        } else {
+            None
+        };
+
+        Self {
+            bmc_endpoint_request,
+            machine_id: args.machine,
+        }
+    }
+}

crates/admin-cli/src/bmc_machine/probe_vendor/cmd.rs

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use super::args::Args;
+use crate::errors::CarbideCliResult;
+use crate::rpc::ApiClient;
+
+pub async fn probe_vendor(args: Args, api_client: &ApiClient) -> CarbideCliResult<()> {
+    let response = api_client.0.probe_bmc_vendor(args).await?;
+    println!("{}", response.vendor);
+    Ok(())
+}

crates/admin-cli/src/bmc_machine/probe_vendor/mod.rs

@@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pub mod args;
+pub mod cmd;
+
+pub use args::Args;
+
+use crate::cfg::run::Run;
+use crate::cfg::runtime::RuntimeContext;
+use crate::errors::CarbideCliResult;
+
+impl Run for Args {
+    async fn run(self, ctx: &mut RuntimeContext) -> CarbideCliResult<()> {
+        cmd::probe_vendor(self, &ctx.api_client).await
+    }
+}

crates/admin-cli/src/bmc_machine/set_root_password/args.rs

@@ -0,0 +1,68 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use clap::Parser;
+use mac_address::MacAddress;
+use rpc::forge as forgerpc;
+
+#[derive(Parser, Debug, Clone)]
+#[command(after_long_help = "\
+EXAMPLES:
+
+Rotate the BMC root password, targeting the BMC by machine id:
+    $ nico-admin-cli bmc-machine set-root-password \
+    --machine 12345678-1234-5678-90ab-cdef01234567 --new-password mynewpassword
+
+Target the BMC by IP address:
+    $ nico-admin-cli bmc-machine set-root-password \
+    --ip-address 192.0.2.20 --new-password mynewpassword
+
+Target the BMC by MAC address:
+    $ nico-admin-cli bmc-machine set-root-password \
+    --mac-address 00:11:22:33:44:55 --new-password mynewpassword
+
+")]
+pub struct Args {
+    #[clap(long, short, help = "IP of the BMC whose root password to set")]
+    pub ip_address: Option<String>,
+    #[clap(long, help = "MAC of the BMC whose root password to set")]
+    pub mac_address: Option<MacAddress>,
+    #[clap(long, short, help = "ID of the machine whose BMC root password to set")]
+    pub machine: Option<String>,
+
+    #[clap(long, help = "New BMC root password to set")]
+    pub new_password: String,
+}
+
+impl From<Args> for forgerpc::SetBmcRootPasswordRequest {
+    fn from(args: Args) -> Self {
+        let bmc_endpoint_request = if args.ip_address.is_some() || args.mac_address.is_some() {
+            Some(forgerpc::BmcEndpointRequest {
+                ip_address: args.ip_address.unwrap_or_default(),
+                mac_address: args.mac_address.map(|mac| mac.to_string()),
+            })
+        } else {
+            None
+        };
+
+        Self {
+            bmc_endpoint_request,
+            machine_id: args.machine,
+            new_password: args.new_password,
+        }
+    }
+}

crates/admin-cli/src/bmc_machine/set_root_password/cmd.rs

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use super::args::Args;
+use crate::errors::CarbideCliResult;
+use crate::rpc::ApiClient;
+
+pub async fn set_root_password(args: Args, api_client: &ApiClient) -> CarbideCliResult<()> {
+    api_client.0.set_bmc_root_password(args).await?;
+    println!("BMC root password updated");
+    Ok(())
+}

crates/admin-cli/src/bmc_machine/set_root_password/mod.rs

@@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pub mod args;
+pub mod cmd;
+
+pub use args::Args;
+
+use crate::cfg::run::Run;
+use crate::cfg::runtime::RuntimeContext;
+use crate::errors::CarbideCliResult;
+
+impl Run for Args {
+    async fn run(self, ctx: &mut RuntimeContext) -> CarbideCliResult<()> {
+        cmd::set_root_password(self, &ctx.api_client).await
+    }
+}

crates/api-core/src/api.rs

@@ -2862,6 +2862,20 @@ impl Forge for Api {
         crate::handlers::bmc_endpoint_explorer::create_bmc_user(self, request).await
     }
 
+    async fn set_bmc_root_password(
+        &self,
+        request: Request<rpc::SetBmcRootPasswordRequest>,
+    ) -> Result<Response<rpc::SetBmcRootPasswordResponse>, Status> {
+        crate::handlers::bmc_endpoint_explorer::set_bmc_root_password(self, request).await
+    }
+
+    async fn probe_bmc_vendor(
+        &self,
+        request: Request<rpc::ProbeBmcVendorRequest>,
+    ) -> Result<Response<rpc::ProbeBmcVendorResponse>, Status> {
+        crate::handlers::bmc_endpoint_explorer::probe_bmc_vendor(self, request).await
+    }
+
     async fn delete_bmc_user(
         &self,
         request: Request<rpc::DeleteBmcUserRequest>,

crates/api-core/src/handlers/bmc_endpoint_explorer.rs

@@ -985,6 +985,75 @@ pub(crate) async fn delete_bmc_user(
     Ok(Response::new(rpc::DeleteBmcUserResponse {}))
 }
 
+pub(crate) async fn set_bmc_root_password(
+    api: &Api,
+    request: Request<rpc::SetBmcRootPasswordRequest>,
+) -> Result<Response<rpc::SetBmcRootPasswordResponse>, Status> {
+    log_request_data(&request);
+    let req = request.into_inner();
+
+    let machine_id = req
+        .machine_id
+        .as_ref()
+        .map(|id| try_parse_machine_id(id))
+        .transpose()?;
+
+    let mut txn = api.txn_begin().await?;
+    let (bmc_endpoint_request, _) =
+        validate_and_complete_bmc_endpoint_request(&mut txn, req.bmc_endpoint_request, machine_id)
+            .await?;
+    txn.commit().await?;
+
+    let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
+    let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
+
+    tracing::info!(%bmc_addr, "Setting BMC root password");
+
+    api.endpoint_explorer
+        .set_bmc_root_password(bmc_addr, &machine_interface, &req.new_password)
+        .await
+        .map_err(|e| CarbideError::internal(e.to_string()))?;
+
+    tracing::info!(%bmc_addr, "Successfully set BMC root password");
+
+    Ok(Response::new(rpc::SetBmcRootPasswordResponse {}))
+}
+
+pub(crate) async fn probe_bmc_vendor(
+    api: &Api,
+    request: Request<rpc::ProbeBmcVendorRequest>,
+) -> Result<Response<rpc::ProbeBmcVendorResponse>, Status> {
+    log_request_data(&request);
+    let req = request.into_inner();
+
+    let machine_id = req
+        .machine_id
+        .as_ref()
+        .map(|id| try_parse_machine_id(id))
+        .transpose()?;
+
+    let mut txn = api.txn_begin().await?;
+    let (bmc_endpoint_request, _) =
+        validate_and_complete_bmc_endpoint_request(&mut txn, req.bmc_endpoint_request, machine_id)
+            .await?;
+    txn.commit().await?;
+
+    let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
+    let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
+
+    let vendor = api
+        .endpoint_explorer
+        .probe_bmc_vendor(bmc_addr, &machine_interface)
+        .await
+        .map_err(|e| CarbideError::internal(e.to_string()))?;
+
+    tracing::info!(%bmc_addr, %vendor, "Probed BMC vendor");
+
+    Ok(Response::new(rpc::ProbeBmcVendorResponse {
+        vendor: vendor.to_string(),
+    }))
+}
+
 async fn do_create_bmc_user(
     api: &Api,
     request: &rpc::BmcEndpointRequest,