From Platform Baseline to Platform Handoff: Automating DPU Onboarding with sZTP - Anssi Söderena, Fusionlayer, Inc#

Speakers: Anssi Söderena, Senior Software Developer, FusionLayer Group

• Why: A DPU that has booted and pulled an IP is not production-ready — it still needs a trusted identity, known-good software, configuration, and provable state before anything will schedule workloads on it. This is exactly the seam between identity/bootstrapping and infrastructure automation that most DPU material hand-waves, and it is a concrete OPI Blueprint with lab results rather than a concept pitch.
• What: An OPI Blueprint that onboards an NVIDIA BlueField-3 from a known platform baseline using a Secure Zero Touch Provisioning (sZTP) server/client built on RFC 8572 (SZTP Bootstrap Data), then hands the DPU off to Kubernetes and the F5 Lifecycle Operator, with F5 BIG-IP Next for Kubernetes running TMM on the DPU. The session covers the workflow, lab findings, validation approach, compatibility constraints, and the boundary between sZTP onboarding and host/BMC-mediated BFB provisioning. (from abstract only)
• How: sZTP establishes trust and identity, applies initial configuration, runs bootstrap scripts, and reports onboarding progress and errors back to the server. Validation is end-to-end: real application traffic is pushed through the DPU to prove the onboarded state actually works before handoff to the Kubernetes operators.
• Where applicable: Firmly pinned to specific platform prerequisites in this blueprint: NVIDIA BlueField-3, the NVIDIA BF-Bundle, an F5-supported DOCA version, and vanilla Kubernetes with BIG-IP Next for Kubernetes. But the sZTP pattern itself (RFC 8572 + baseline attestation + traffic validation + operator handoff) is vendor-neutral and reusable for any DPU/SmartNIC onboarding pipeline. The presenter is the author of the open-source fl-sztp client, so expect real implementation detail.