cEOS: make the RESTCONF bootstrap actually reach a running server

[mbakalarski]

RESTCONF never came up on a cEOS node. The startup-config configures ssl profile restconf before the Job that creates the certificate it names, so EOS marks the profile invalid at boot — and creating the certificate afterwards does not revisit that verdict. management api restconf stayed at "SSL profile not in valid state", nothing listened on 6020, and the Job reported success throughout.

Found while exercising netclab-xp's RESTCONF scenarios against a real lab: every Request failed to connect, and ss -tnl on the device showed only 443.

Three fixes, each of which the lab needed on its own

Re-apply the SSL profile after generating the certificate. Only a config change re-evaluates the profile, and re-entering the same certificate ... key ... line is a no-op — so the profile is removed and re-added. Idempotent on re-runs.

Make the Job's checks honest. curl exits 0 on an HTTP 404, and during boot nginx answers on 443 with Page not found before eAPI is registered — so the old if ! curl reported "Certificate generated successfully" without ever having reached the device. Now --fail-with-body plus a check for "result", and a second request that asks the device whether RESTCONF is actually enabled.

Wait for the device in the container, not via restartPolicy. With OnFailure the whole cEOS boot had to fit inside backoffLimit restarts of a growing backoff. One node made it on the 3rd restart; the other exhausted all 6 and the Job failed. The wait is now an explicit 600s deadline, which leaves backoffLimit for real failures.

Verified

kind, two cEOS 4.36.1F nodes, cold boot, no manual intervention:

• both Jobs Complete in ~2min with 0 restarts (previously: one Job Failed, one needed 2 restarts)
• both logs show RESTCONF not up yet, retrying... before succeeding — the SSL profile is re-evaluated asynchronously, so that second loop is load-bearing too
• both devices answer HTTP 200 on RESTCONF 6020 and eAPI 443

Note: chart-install-test.yml installs with the default values, whose only node is srlinux — so this cEOS path is not covered by CI.

Chart version bumped to 0.5.10.

🤖 Generated with Claude Code