We enthusiastically announce the release of: ironic 38.0.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 38.0.0 ^^^^^^ New Features ************ * Adds a new "ironic-manage" utility. Its first sub-commands, "ironic- manage drivers hardware-types" and "ironic-manage drivers interfaces [<interface type> ...]", list the hardware type and hardware interface entry points installed on the system, to help operators discover valid values for the "[DEFAULT]enabled_hardware_types" and "[DEFAULT]enabled_<interface type>_interfaces" configuration options. * Add new configuration options under the "[api]" group in config: "disallow_deploy_steps", "disallow_clean_steps", and "disallow_service_steps". Using these operators can block specific steps from being executed across all workflows. Each option accepts a list of steps in "interface.step" format (e.g. "raid.create_configuration"). Steps are rejected at the API level with an error for user-requested operations, and silently filtered at the conductor level for automated workflows (driver steps, deploy templates, runbooks). All three options are mutable and can be reloaded via SIGHUP without restarting services. For more information, refer to ` bug 2150456 <https://bugs.launchpad.net/ironic/+bug/2150456>`. Known Issues ************ * System operators should note that changing the owner field on a node does not affect its child or parent nodes, potentially resulting in these nodes being in different projects. Upgrade Notes ************* * Adds an upgrade check that issues a warning when any node has a different owner from its parent node. * The "/v1/events" API now validates request bodies using the Ironic API schema validation framework. Invalid event requests continue to return an error response, but some validation failures may now include a more generic error message than before. * The deprecated "[oslo_policy] enforce_scope" configuration option has been removed in oslo.policy version 6.0.0 which will impact Ironic as there is no longer any way to disable RBAC policy scope enforcement; scope checks are now always enforced regardless of configuration. If you are not upgrading the oslo.policy to 6.0.0, then there will not be any change in scope enforcement behaviour. * Support for Python 3.10 has been removed. Now Python 3.11 is the minimum version supported. * The default value of "tls_minimum_version" in the "[api]", "[json_rpc]", and "[agent]" configuration groups, as well as the "webserver_tls_minimum_version" option in "[DEFAULT]", has been changed from "1.2" to "1.3". TLS 1.3 is widely supported and is required for Post-Quantum Cryptography key exchange. This change was discussed on the openstack-discuss mailing list with no objections. Operators whose infrastructure does not yet support TLS 1.3 can restore the previous behavior by setting "tls_minimum_version = 1.2" in the affected configuration groups. Deprecation Notes ***************** * Depreciate the "management" interface for providing firmware updates. This was added prior to the creation of the dedicated "firmware" interface which supports all the update operations of the "management" with additional process and feature fixes coming to the "firmware" interface only. Security Issues *************** * Addresses a potential security issues where an admin of a project could create nodes with "parent_node" set to a node from a different project. * Prevents changing the "node_uuid" of ports, port groups, volume targets, and volume connectors to point to a node with a different owner from the initial node. In some cases this is not normally permitted due to the database model, but additional access checking was added across these similar resources for consistency in the event the Ironic project fixes 12150252 (https://bugs.launchpad.net/ironic/+bug/2150252). * The IPMI Vendor-Passthru interface method "send_raw" step has been disabled by default due to security implications. A malicious user with sufficient Ironic access could utilzie this interface to make manual changes to BMCs when the "ipmitool" vendor-passthru interface was enabled. * Hardens the Ironic inspector LLDP parsing by checking for maximum length of TLV value as defined in the standard (511 octets). Furthermore, adds an upper bound for possible interfaces that a device can send inspection data about (64). *bug 2155051 <https://bugs.launchpad.net/ironic/+bug/2155051>* * Kickstart configdrive URL fetches and inspection rule "api-call" actions now use TLS-hardened sessions, applying the "webserver_verify_ca", "webserver_tls_minimum_version", and "webserver_tls_ciphers" settings. Previously these code paths used bare "requests.get()" or "requests.Session()" calls without TLS hardening, potentially allowing TLS downgrade attacks on these connections. * The minimum TLS protocol version now defaults to 1.3 across all Ironic services, improving security posture and enabling Post- Quantum Cryptography key exchange support. Bug Fixes ********* * The autodetect deploy interface now supports adopting nodes. * The "[pxe]pxe_bootfile_name_by_arch" and "[pxe]ipxe_bootfile_name_by_arch" options now support composite keys in the format "arch-boot_mode" (e.g. "x86_64-bios:undionly.kpxe", "x86_64-uefi:snponly.efi"). The composite key is tried first, then the arch-only key as a fallback, preserving backward compatibility. Previously it was not possible to specify different boot files for the same architecture in different boot modes (e.g. x86_64 in both UEFI and BIOS), because the boot mode check was skipped when a by- arch entry matched. Fixes bug 2157027 (https://bugs.launchpad.net/ironic/+bug/2157027). * Fixes a bug where ironic allowed the ability for operators to send raw commands when the "ipmitool" vendor interface was enabled and configured for a baremetal node utilizing the IPMI protocol. The Ironic project generally recommends the use of "redfish" instead of IPMI, however recognizes that is not universally possible for all operators. More information can be found in bug 2150458 (https://bugs.launchpad.net/ironic/+bug/2150458). * Fixes BIOS firmware updates via Redfish SimpleUpdate on Dell iDRAC failing silently when the BMC purges the TaskMonitor before Ironic can observe it. Previously, a disappeared task was assumed successful and cleaning completed without rebooting, leaving the staged firmware unapplied. Now, a reboot is triggered to apply the staged BIOS update via the BMC's scheduled job. * Fixes a security issue where user can list volume connectors, volume targets and ports of nodes that they are not authorized to access. Volume connectors and target could be listed when specifying the node ID and ports could be listed by giving a valid shard. Related bug report bug 2150461 (https://bugs.launchpad.net/ironic/+bug/2150461). * Fixes a race condition where deleting a node could return an HTTP 409 (NodeLocked) error to the caller even though the node was successfully deleted. This occurred because the task manager's resource cleanup attempted to release the database reservation on the already-deleted node row, which could raise "NodeLocked" instead of "NodeNotFound" depending on transaction visibility timing. A subsequent retry by the client would then return HTTP 404, confusing operators. The conductor now clears its task reference to the node immediately after a successful deletion so that the cleanup path no longer attempts to release a reservation on a non-existent row. * Fixes a bug where Redfish firmware updates were incorrectly declared as failed when the BMC task was in the "New" state. Some BMCs, notably Dell iDRAC, return "TaskState.NEW" immediately after a "SimpleUpdate" request before the task transitions to "Starting". Previously, the "New" state was not recognized as an in-progress state and was treated as a terminal failure, causing the firmware update to be aborted with a misleading error message such as "Error: New". * Fixes the "_query_update_status" periodic task to use the "[redfish]firmware_update_status_interval" configuration option for its polling interval instead of "[redfish]firmware_update_fail_interval". Both options default to 60 seconds, so this was only visible when they were explicitly configured to different values. * No longer attempts to list Glance image members for images whose visibility is not "shared". Glance rejects member listing for non- shared images with a 403 error, which previously caused a spurious error to be logged on every access check for public, community, and private images. * It is documented as being able to use the 'noop' deploy interface with the manual-management hardware type and used as an example in the documentation. However the manual-management hardware type did not report that it supported 'noop' so it was not possible to do this operation so fix the code to allow it. * Fixes an issue where the conductor's internal metrics (written to "$(hostname)-ironic.metrics") were not collected when "ironic- conductor" ran under oslo.service's **spawn** worker model with "[metrics] backend = collector". The module-level "METRICS" logger in "ironic.conductor.manager" was created at import time before configuration was restored in the spawned child process, defaulting to "NoopMetricLogger". Calls to "get_metrics_data()" then raised "MetricsNotSupported" on every sensor data collection cycle. The "METRICS" logger is now re-created after "prepare_command()" restores configuration, matching the configured backend. Operators using "ironic-prometheus-exporter" should see the conductor metrics file generated correctly alongside per-node hardware metrics. * Fixes an intermittent failure of "redfish-virtual-media" based boot (used during inspection, cleaning and deployment) where the node could power on with no ISO actually mounted, leading to a timeout with no useful error. Some BMCs continue to report virtual media as still "Inserted" for a short window after a successful eject, and because the boot ISO URL is derived from the node UUID, the previously inserted URL matched the one about to be inserted, so the insert was skipped. Ironic now ejects any virtual media already present before inserting, instead of trusting the reported state. * Fixes an issue for setting bios parameters on hardware where pending settings contain all bios settings. See bug 2157002 (https://bugs.launchpad.net/ironic/+bug/2157002). * Fixes fast-track after inspection, if the first heartbeat is blocked by ongoing processing. Previously in this case "agent_url" would not be recorded on the node, and the agent was wrongly presumed dead. * Fixed an issue where inserting into the "node_history" table could fail when the event string exceeded the database column's 64KiB limit. Long events are now safely truncated based on UTF-8 encoded byte length, preserving an equal distribution of the beginning and the end of the event message to maintain troubleshooting context. * Fixes filesystem corruption errors (particularly visible on iDRAC consoles) that could occur when Redfish virtual media was ejected while the ramdisk OS was still running. The soft power off previously added during inspection tear-down is reverted; instead, the "redfish-virtual-media" boot interface now powers the node off before ejecting virtual media during ramdisk cleanup. See bug 2160374 (https://bugs.launchpad.net/ironic/+bug/2160374). * Fixes an issue where the conductor periodic task "ConductorManager._send_sensor_data" was not scheduled when "ironic- conductor" ran under oslo.service's **spawn** worker model. The task could appear in debug logs as "found" during "init_host()", but futurist never submitted it, so no sensor data was published to the notification bus even when "[sensor_data] send_sensor_data" was enabled in "ironic.conf". Spawn workers unpickle the conductor manager before configuration is reloaded in the child process. The "enabled" flag for this periodic was therefore evaluated at import time using the default value ("False"). Ironic now defers evaluation of "enabled" and "interval" for this task until configuration is available, and refreshes periodic attributes after spawn unpickling and when periodic tasks are collected. Operators using "ironic-prometheus-exporter", Ceilometer, or other consumers of conductor sensor notifications should see data collection resume without changing configuration. Other conductor periodics were not affected. * Neutron port operations now always use service credentials from config, rather than the user's token context. This prevents ports being created with an unexpected project id (e.g. the project id of the user's context). * Fixed the noVNC websocket proxy to copy the "[cors] allowed_origin" configuration value before appending the per-request "Host" header, preventing mutation of the shared oslo.config cached list object. See bug 2160548 (https://launchpad.net/bugs/2160548). Changes in ironic 37.0.0..38.0.0 -------------------------------- 6fffcf48d Enable `oslo_versionedobjects.mypy` plugin for mypy a6ea2f5e5 Power off before ejecting redfish virtual media on ramdisk cleanup ecdbab816 Another attempt to fix fast-track after inspection f82e8e157 Switch Metal3 functional jobs to 16GiB nodeset 281f1e191 Remove remaining referemce to python-dracclient 1b46c72bf doc: provide definitions of hardware types, drivers and interfaces 3efa8fa2d Add supports_deploy to AnsibleDeploy for autodetect 3e9f6b8eb Fix ironic-standalone-redfish POST_FAILURE 6984bfb24 Replace deprecated datetime.datetime.utcnow 08d285a8e Remove Python 3.10 support 351faac85 Add TLS hardening for kickstart configdrive and inspection rule connections 74ec2d48a Fix destroy_node race condition 299203f7a Maintain driver dependencies as optional dependencies 95cae9eb4 Fix Redfish firmware update handling of NEW task state 43cc6bb3e Fix autodetect deploy interface failing during node adoption 762cde0a0 security: Fix poisoning of the allowed origin list 27083f063 Use service auth for Neutron port operations 3330261e3 Drop unused bandit dec6a8a14 Remove disabling the scope enforcement c1fc50663 Ensure docker-buildx is installed on dpkg platforms 8ee65c75d Conditional check of remaining pending attributes dcfb2fa01 Remove setting of oslo_policy[enforce_scope] flag d7ad21698 CVE-2026-44918: Prevent rehoming resources to nodes with different owner e8faed84c Trivial: fix pep8 violations in redfish/firmware.py 7bbe5a2da security: block vendor.send_raw (CVE-2026-54423) 972e76481 Move RFB readiness wait to BaseConsoleContainer 495a587ea Fix BIOS firmware update not applied when TaskMonitor disappears 6071f482a add types to hardware types for supported interfaces 3421bfbe7 Only query Glance image members for shared images c92aa0037 add a mypy tox environment and CI job 9c1173694 add ironic-manage to CLI references doc section 6285b6a36 Limit LLDP TLV value length and interfaces 4419f8602 fix manual-management hardware type to use noop per the docs 9ff31d3f5 Add ironic-manage command for driver discoverability 1992a1e69 api: Add schema for volume API 4393baf91 api: Add schema for conductors API 4596f43a0 add type hints to arginfo for the steps and annotate step helpers 12a44fad2 annotate the base driver/interface methods as stubs c6961a133 add types to driver interfaces base class for steps and task 259f1814f Add a ParsedKernelCommandLine type 50a90e773 Fix release codename in webapi version history e1e81f8f0 Replace deprecated remotable_classmethod 7a26aef6c Modernize the Metal3 functional jobs 13d5e8d03 Switch jobs to build centos10 IPA images d9a577053 Fix METRICS logger not refreshed after spawn unpickle 5e550279f docs: Add a Getting Started map to the landing page dbea2cca3 fix broken project scoping e325fb79f Document the owner/lessee trust model 3b17f618d Fix autodetect ramdisk deploy with vmedia via Nova 882b345eb Add project field to node history 752bcc22a api: Add schema for volume_target/_connector API cfad89b81 api: Add schema for portgroups API ab6a22bdf Fix bootfile_name_by_arch to consider boot mode eeace5fde Clarify the ordering in [ipmi]cipher_suite_versions 4b5b9c144 Stop reimporting middleware modules 260e58e39 docs: Augment bootc docs 631074ed9 Add releasenote for disallow-steps feature 1069c0f1e Stop skipping Redfish vmedia insert on stale BMC state 9abf6a73e Default TLS minimum version to 1.3 40134c445 Fix send_sensor_data periodic with oslo.service spawn workers feb57cf25 follow-up: tls getattr cleanup d2b7cc15d api: Add schema for events API 3cf88f2a7 doc: highlight firmware interface and deprecate management for updates 75f2e20d8 Truncate node history event to avoid DB column overflow Diffstat (except docs and test files) ------------------------------------- bindep.txt | 1 + devstack/lib/ironic | 21 +- driver-requirements.txt | 10 - ironic/api/app.py | 4 +- ironic/api/controllers/v1/__init__.py | 1 - ironic/api/controllers/v1/allocation.py | 8 +- ironic/api/controllers/v1/conductor.py | 10 + ironic/api/controllers/v1/event.py | 76 +---- ironic/api/controllers/v1/node.py | 36 +-- ironic/api/controllers/v1/port.py | 18 +- ironic/api/controllers/v1/portgroup.py | 94 +++--- ironic/api/controllers/v1/utils.py | 80 +++-- ironic/api/controllers/v1/versions.py | 3 +- ironic/api/controllers/v1/volume.py | 5 + ironic/api/controllers/v1/volume_connector.py | 40 ++- ironic/api/controllers/v1/volume_target.py | 50 ++-- ironic/api/middleware/__init__.py | 28 -- ironic/api/schemas/__init__.py | 0 ironic/api/schemas/common/request_types.py | 2 + ironic/api/schemas/common/response_types.py | 10 + ironic/api/schemas/v1/__init__.py | 0 ironic/api/schemas/v1/conductor.py | 109 +++++++ ironic/api/schemas/v1/event.py | 50 ++++ ironic/api/schemas/v1/portgroup.py | 213 ++++++++++++++ ironic/api/schemas/v1/volume.py | 25 ++ ironic/api/schemas/v1/volume_connector.py | 145 +++++++++ ironic/api/schemas/v1/volume_target.py | 153 ++++++++++ ironic/api/validation/validators.py | 11 + ironic/command/manage.py | 157 ++++++++++ ironic/command/status.py | 37 +++ ironic/common/driver_factory.py | 4 +- ironic/common/glance_service/service_utils.py | 7 +- ironic/common/inspection_rules/actions.py | 26 +- ironic/common/kernel_parameters.py | 22 +- ironic/common/kickstart_utils.py | 14 +- ironic/common/neutron.py | 4 +- ironic/common/release_mappings.py | 4 +- ironic/common/rpc_service.py | 12 + ironic/common/wsgi_service.py | 4 +- ironic/conductor/base_manager.py | 2 + ironic/conductor/manager.py | 19 +- ironic/conductor/periodics.py | 65 +++- ironic/conductor/utils.py | 16 +- ironic/conf/agent.py | 4 +- ironic/conf/api.py | 10 +- ironic/conf/default.py | 4 +- ironic/conf/ipmi.py | 4 +- ironic/conf/json_rpc.py | 4 +- ironic/conf/pxe.py | 16 +- ironic/console/container/base.py | 44 +++ ironic/console/container/fake.py | 2 + ironic/console/container/kubernetes.py | 2 + ironic/console/container/systemd.py | 26 +- ironic/console/websocketproxy.py | 3 +- ironic/db/api.py | 13 +- .../16990309ad9d_add_project_to_node_history.py | 27 ++ ironic/db/sqlalchemy/api.py | 10 +- ironic/db/sqlalchemy/models.py | 47 ++- ironic/drivers/base.py | 326 ++++++++++++++------- ironic/drivers/generic.py | 6 + ironic/drivers/hardware_type.py | 76 +++-- ironic/drivers/modules/ansible/deploy.py | 13 + ironic/drivers/modules/deploy_utils.py | 30 +- .../drivers/modules/inspector/hooks/parse_lldp.py | 18 +- ironic/drivers/modules/inspector/interface.py | 20 +- ironic/drivers/modules/inspector/lldp_parsers.py | 12 + ironic/drivers/modules/inspector/lldp_tlvs.py | 3 + ironic/drivers/modules/redfish/bios.py | 7 +- ironic/drivers/modules/redfish/boot.py | 26 +- ironic/drivers/modules/redfish/firmware.py | 32 +- ironic/drivers/modules/redfish/management.py | 5 + ironic/objects/allocation.py | 18 +- ironic/objects/base.py | 1 - ironic/objects/bios.py | 21 +- ironic/objects/chassis.py | 12 +- ironic/objects/conductor.py | 15 +- ironic/objects/deploy_template.py | 15 +- ironic/objects/deployment.py | 9 +- ironic/objects/firmware.py | 6 +- ironic/objects/inspection_rule.py | 6 +- ironic/objects/node.py | 21 +- ironic/objects/node_history.py | 19 +- ironic/objects/node_inventory.py | 3 +- ironic/objects/port.py | 25 +- ironic/objects/portgroup.py | 21 +- ironic/objects/runbook.py | 30 +- ironic/objects/trait.py | 15 +- ironic/objects/volume_connector.py | 15 +- ironic/objects/volume_target.py | 18 +- .../unit/api/controllers/v1/test_allocation.py | 1 - .../console/securityproxy/test_websocketproxy.py | 65 ++++ .../unit/drivers/modules/ansible/test_deploy.py | 36 ++- .../modules/inspector/hooks/test_parse_lldp.py | 31 ++ .../unit/drivers/modules/redfish/test_bios.py | 39 ++- .../unit/drivers/modules/redfish/test_boot.py | 73 ++++- .../unit/drivers/modules/redfish/test_firmware.py | 72 ++++- .../drivers/modules/redfish/test_management.py | 6 +- .../unit/drivers/modules/test_agent_client.py | 11 +- .../unit/drivers/modules/test_deploy_utils.py | 56 ++++ playbooks/bmo-ci/post.yaml | 2 + playbooks/bmo-ci/pre.yaml | 46 +-- playbooks/bmo-ci/run.yaml | 2 + playbooks/irso-ci/post.yaml | 2 + playbooks/irso-ci/pre.yaml | 12 +- playbooks/irso-ci/run.yaml | 5 +- pyproject.toml | 81 ++++- .../notes/2150450-owners-b4019d5fa63a8bc1.yaml | 21 ++ .../notes/add-ironic-manage-3c45d8b1f7a01b81.yaml | 9 + .../notes/autodetect-adopt-c08aeabdb1345151.yaml | 4 + ...h-boot-mode-composite-key-2b0a10764f3b71a9.yaml | 13 + ...50456-step-disallow-lists-3053d47e014b08cf.yaml | 17 ++ ...-management-intf-firmware-8d808ba12cd5d524.yaml | 8 + .../notes/disable_send_raw-f92217bf07c3eb38.yaml | 20 ++ ...i-schema-validation-error-7c7a9b2f0c4e1a35.yaml | 7 + ...x-bios-update-silent-fail-5b14fa74108b3bfa.yaml | 9 + ...ix-broken-project-scoping-86c5d19912158085.yaml | 8 + ...destroy-node-release-race-b2de846007604f1c.yaml | 14 + ...are-update-new-task-state-ae20a293c30843ba.yaml | 16 + ...ce-member-list-non-shared-11a4d0edcb2be0dd.yaml | 8 + .../fix-manual-management-a694bf26fb99aba0.yaml | 8 + .../notes/fix-metrics-logger-909667ad20e3fb1d.yaml | 20 ++ ...-vmedia-stale-insert-skip-efb08f97ebd7b1b6.yaml | 12 + .../fix-set-bios-setting-9097a5447fb397de.yaml | 6 + .../harden-lldp-tlv-parsing-1583bbf1ff9131f3.yaml | 7 + .../notes/inspect-fast-track-76013246248e6a21.yaml | 6 + ...-inspection-tls-hardening-553b614b9ccfc1f4.yaml | 10 + ...-history-event-truncation-1ff1266dbedda269.yaml | 9 + ...edia-eject-cleanupramdisk-eb331db8a39d727c.yaml | 10 + ...ng-rbac-scope-enforcement-4dc79997f34b9f0c.yaml | 10 + .../notes/remove-py310-4d6556dcf0f9f66e.yaml | 5 + ...send-sensor-data-periodic-edd680131e9c50f7.yaml | 24 ++ .../notes/tls-default-1.3-9a5e3133cfc241b6.yaml | 18 ++ ...r-neutron-port-operations-03c8349ee5c06e3b.yaml | 6 + ...rigin-allowlist-poisoning-ba6ab2c92e006f58.yaml | 8 + requirements.txt | 4 +- test-requirements.txt | 1 - tox.ini | 28 +- zuul.d/ironic-jobs.yaml | 18 +- zuul.d/metal3-jobs.yaml | 62 ++-- zuul.d/project.yaml | 6 +- 185 files changed, 4297 insertions(+), 1207 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 52af16780..ae8638129 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18 +18 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.policy>=4.5.0 # Apache-2.0 +oslo.policy>=6.0.0 # Apache-2.0 @@ -34 +34 @@ tenacity>=6.3.1 # Apache-2.0 -oslo.versionedobjects>=1.31.2 # Apache-2.0 +oslo.versionedobjects>=3.10.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index b46305fb8..30f7940ad 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10 +9,0 @@ WebTest>=2.0.27 # MIT -bandit>=1.1.0,<2.0.0 # Apache-2.0