feat: per-machine BMC vendor override

Pin a Redfish BMC vendor per machine, forced into libredfish instead of
automatic detection. The value is a plain string matched against
libredfish's RedfishVendor enum at client creation, and an unknown name
warns and falls back, so NICo keeps no vendor list. It rides on
BmcAccessInfo so every client_by_info caller honors it, and the direct
instance power and force delete paths pass it too.

Adds the machines.bmc_vendor_override column and migration, the
UpdateMachineBmcVendorOverride RPC and a field on Machine, the forced
vendor in client_by_info, and a machine vendor override set, clear, and
show CLI command.

Signed-off-by: s3rj1k <evasive.gyron@gmail.com>

Author: s3rj1k

crates/admin-cli/src/machine/mod.rs

@@ -27,6 +27,7 @@ pub mod nvlink_info;
 pub mod positions;
 pub mod reboot;
 pub mod show;
+pub mod vendor_override;
 
 #[cfg(test)]
 mod tests;
@@ -89,4 +90,9 @@ pub enum Cmd {
     Positions(positions::Args),
     #[clap(subcommand, about = "Update/show NVLink info for an MNNVL machine")]
     NvlinkInfo(nvlink_info::Args),
+    #[clap(
+        subcommand,
+        about = "Pin or clear the Redfish BMC vendor override for a machine"
+    )]
+    VendorOverride(vendor_override::Args),
 }

crates/admin-cli/src/machine/vendor_override/args.rs

@@ -0,0 +1,74 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use carbide_uuid::machine::MachineId;
+use clap::Parser;
+
+#[derive(Parser, Debug, Clone)]
+pub enum Args {
+    #[clap(about = "Pin the Redfish BMC vendor for a machine")]
+    Set(VendorOverrideSet),
+    #[clap(about = "Clear the Redfish BMC vendor override for a machine")]
+    Clear(VendorOverrideClear),
+    #[clap(about = "Show the Redfish BMC vendor override for a machine")]
+    Show(VendorOverrideShow),
+}
+
+#[derive(Parser, Debug, Clone)]
+#[command(after_long_help = "\
+EXAMPLES:
+
+Force a machine's BMC vendor to Dell:
+    $ nico-admin-cli machine vendor-override set 12345678-1234-5678-90ab-cdef01234567 \
+    --vendor Dell
+
+")]
+pub struct VendorOverrideSet {
+    #[clap(help = "The machine whose BMC vendor should be pinned")]
+    pub machine: MachineId,
+    #[clap(
+        long,
+        help = "RedfishVendor to force (e.g. Dell, Supermicro, NvidiaDpu, Hpe, Lenovo)"
+    )]
+    pub vendor: String,
+}
+
+#[derive(Parser, Debug, Clone)]
+#[command(after_long_help = "\
+EXAMPLES:
+
+Clear a machine's BMC vendor override (return to automatic detection):
+    $ nico-admin-cli machine vendor-override clear 12345678-1234-5678-90ab-cdef01234567
+
+")]
+pub struct VendorOverrideClear {
+    #[clap(help = "The machine whose BMC vendor override should be cleared")]
+    pub machine: MachineId,
+}
+
+#[derive(Parser, Debug, Clone)]
+#[command(after_long_help = "\
+EXAMPLES:
+
+Show a machine's pinned BMC vendor (or that none is set):
+    $ nico-admin-cli machine vendor-override show 12345678-1234-5678-90ab-cdef01234567
+
+")]
+pub struct VendorOverrideShow {
+    #[clap(help = "The machine whose BMC vendor override should be shown")]
+    pub machine: MachineId,
+}

crates/admin-cli/src/machine/vendor_override/cmd.rs

@@ -0,0 +1,62 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use carbide_uuid::machine::MachineId;
+use rpc::Machine;
+
+use super::args::{Args, VendorOverrideClear, VendorOverrideSet, VendorOverrideShow};
+use crate::errors::{CarbideCliError, CarbideCliResult};
+use crate::rpc::ApiClient;
+
+pub async fn vendor_override(api_client: &ApiClient, cmd: Args) -> CarbideCliResult<()> {
+    match cmd {
+        Args::Set(cmd) => set(api_client, cmd).await,
+        Args::Clear(cmd) => clear(api_client, cmd).await,
+        Args::Show(cmd) => show(api_client, cmd).await,
+    }
+}
+
+async fn fetch_machine(api_client: &ApiClient, machine_id: MachineId) -> CarbideCliResult<Machine> {
+    let mut machines = api_client
+        .get_machines_by_ids(&[machine_id])
+        .await?
+        .machines;
+    machines.pop().ok_or_else(|| {
+        CarbideCliError::GenericError(format!("Machine with ID {machine_id} was not found"))
+    })
+}
+
+async fn set(api_client: &ApiClient, cmd: VendorOverrideSet) -> CarbideCliResult<()> {
+    api_client
+        .update_machine_bmc_vendor_override(cmd.machine, Some(cmd.vendor))
+        .await
+}
+
+async fn clear(api_client: &ApiClient, cmd: VendorOverrideClear) -> CarbideCliResult<()> {
+    api_client
+        .update_machine_bmc_vendor_override(cmd.machine, None)
+        .await
+}
+
+async fn show(api_client: &ApiClient, cmd: VendorOverrideShow) -> CarbideCliResult<()> {
+    let machine = fetch_machine(api_client, cmd.machine).await?;
+    match machine.bmc_vendor_override.as_deref() {
+        Some(vendor) => println!("{vendor}"),
+        None => println!("not set (automatic detection)"),
+    }
+    Ok(())
+}

crates/admin-cli/src/machine/vendor_override/mod.rs

@@ -0,0 +1,32 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pub mod args;
+pub mod cmd;
+
+pub use args::Args;
+
+use crate::cfg::run::Run;
+use crate::cfg::runtime::RuntimeContext;
+use crate::errors::CarbideCliResult;
+
+impl Run for Args {
+    async fn run(self, ctx: &mut RuntimeContext) -> CarbideCliResult<()> {
+        cmd::vendor_override(&ctx.api_client, self).await?;
+        Ok(())
+    }
+}

crates/admin-cli/src/rpc.rs

@@ -2139,6 +2139,18 @@ impl ApiClient {
         Ok(self.0.update_machine_metadata(request).await?)
     }
 
+    pub async fn update_machine_bmc_vendor_override(
+        &self,
+        machine_id: MachineId,
+        bmc_vendor_override: Option<String>,
+    ) -> CarbideCliResult<()> {
+        let request = ::rpc::forge::MachineBmcVendorOverrideUpdateRequest {
+            machine_id: Some(machine_id),
+            bmc_vendor_override,
+        };
+        Ok(self.0.update_machine_bmc_vendor_override(request).await?)
+    }
+
     pub async fn update_rack_metadata(
         &self,
         rack_id: RackId,

crates/api-core/src/api.rs

@@ -1180,6 +1180,13 @@ impl Forge for Api {
         crate::handlers::machine::update_machine_metadata(self, request).await
     }
 
+    async fn update_machine_bmc_vendor_override(
+        &self,
+        request: Request<rpc::MachineBmcVendorOverrideUpdateRequest>,
+    ) -> std::result::Result<Response<()>, Status> {
+        crate::handlers::machine::update_machine_bmc_vendor_override(self, request).await
+    }
+
     async fn update_rack_metadata(
         &self,
         request: Request<rpc::RackMetadataUpdateRequest>,

crates/api-core/src/handlers/instance.rs

@@ -1084,6 +1084,10 @@ pub(crate) async fn invoke_power(
     // but instead queue it for the state handler. That will avoid racing
     // with other internal reboot requests from the state handler.
     let bmc_ip = bmc_ip.to_string();
+    let vendor_override = carbide_redfish::libredfish::conv::redfish_vendor_override(
+        &bmc_ip,
+        snapshot.host_snapshot.bmc_vendor_override.as_deref(),
+    );
     let client = api
         .redfish_pool
         .create_client(
@@ -1092,7 +1096,7 @@ pub(crate) async fn invoke_power(
             RedfishAuth::Key(CredentialKey::BmcCredentials {
                 credential_type: BmcCredentialType::BmcRoot { bmc_mac_address },
             }),
-            None,
+            vendor_override,
         )
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;

crates/api-core/src/handlers/machine.rs

@@ -302,6 +302,40 @@ pub(crate) async fn update_machine_metadata(
     Ok(tonic::Response::new(()))
 }
 
+pub(crate) async fn update_machine_bmc_vendor_override(
+    api: &Api,
+    request: Request<rpc::MachineBmcVendorOverrideUpdateRequest>,
+) -> std::result::Result<tonic::Response<()>, tonic::Status> {
+    log_request_data(&request);
+    let request = request.into_inner();
+    let machine_id = convert_and_log_machine_id(request.machine_id.as_ref())?;
+
+    let mut txn = api.txn_begin().await?;
+    if db::machine::find_one(&mut txn, &machine_id, MachineSearchConfig::default())
+        .await?
+        .is_none()
+    {
+        return Err(CarbideError::NotFoundError {
+            kind: "machine",
+            id: machine_id.to_string(),
+        }
+        .into());
+    }
+
+    // Store the override as a plain string, empty or absent clears it. libredfish
+    // matches the vendor when the client is built, so the API keeps no vendor list.
+    let bmc_vendor_override = match request.bmc_vendor_override {
+        Some(name) if !name.is_empty() => Some(name),
+        _ => None,
+    };
+
+    db::machine::update_bmc_vendor_override(&mut txn, &machine_id, bmc_vendor_override).await?;
+
+    txn.commit().await?;
+
+    Ok(tonic::Response::new(()))
+}
+
 pub(crate) async fn admin_force_delete_machine(
     api: &Api,
     request: Request<rpc::AdminForceDeleteMachineRequest>,
@@ -472,6 +506,11 @@ pub(crate) async fn admin_force_delete_machine(
                     "BMC IP and MAC address for machine was found. Trying to perform Bios unlock",
                 );
 
+                let vendor_override = carbide_redfish::libredfish::conv::redfish_vendor_override(
+                    &ip_address,
+                    machine.bmc_vendor_override.as_deref(),
+                );
+
                 match api
                     .redfish_pool
                     .create_client(
@@ -480,7 +519,7 @@ pub(crate) async fn admin_force_delete_machine(
                         RedfishAuth::Key(CredentialKey::BmcCredentials {
                             credential_type: BmcCredentialType::BmcRoot { bmc_mac_address },
                         }),
-                        None,
+                        vendor_override,
                     )
                     .await
                 {

crates/api-db/migrations/20260625120000_machine_bmc_vendor_override.sql

@@ -0,0 +1,4 @@
+-- Add bmc_vendor_override to machines so an operator can pin the Redfish BMC
+-- vendor for a machine. NULL means automatic detection. The value is a
+-- RedfishVendor variant name passed down into libredfish as the forced vendor.
+ALTER TABLE machines ADD COLUMN bmc_vendor_override text;

crates/api-db/src/machine.rs

@@ -926,6 +926,23 @@ pub async fn update_metadata(
     }
 }
 
+/// Set or clear the operator pinned Redfish BMC vendor override for a machine.
+/// Passing None clears it.
+pub async fn update_bmc_vendor_override(
+    txn: &mut PgConnection,
+    machine_id: &MachineId,
+    bmc_vendor_override: Option<String>,
+) -> Result<(), DatabaseError> {
+    let query = "UPDATE machines SET bmc_vendor_override = $1 WHERE id = $2";
+    sqlx::query(query)
+        .bind(bmc_vendor_override)
+        .bind(machine_id)
+        .execute(txn)
+        .await
+        .map_err(|e| DatabaseError::query(query, e))?;
+    Ok(())
+}
+
 /// Only does the update if the passed observation is newer than any existing one
 pub async fn update_network_status_observation(
     txn: &mut PgConnection,