We are stoked to announce the release of: ironic 23.0.3 This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 23.0.3 ^^^^^^ Security Issues *************** * An issue in Ironic has been resolved where image checksums would not be checked prior to the conversion of an image to a "raw" format image from another image format. With default settings, this normally would not take place, however the "image_download_source" option, which is available to be set at a "node" level for a single deployment, by default for that baremetal node in all cases, or via the "[agent]image_download_source" configuration option when set to "local". By default, this setting is "http". This was in concert with the "[DEFAULT]force_raw_images" when set to "True", which caused Ironic to download and convert the file. In a fully integrated context of Ironic's use in a larger OpenStack deployment, where images are coming from the Glance image service, the previous pattern was not problematic. The overall issue was introduced as a result of the capability to supply, cache, and convert a disk image provided as a URL by an authenticated user. Ironic will now validate the user supplied checksum prior to image conversion on the conductor. This can be disabled using the "[conductor]disable_file_checksum" configuration option. Bug Fixes ********* * Fixes inspection failure when "bmc_address" or "bmc_v6address" is "null" in the inventory received from the ramdisk. * Fixes a security issue where Ironic would fail to checksum disk image files it downloads when Ironic had been requested to download and convert the image to a raw image format. This required the "image_download_source" to be explicitly set to "local", which is not the default. This fix can be disabled by setting "[conductor]disable_file_checksum" to "True", however this option will be removed in new major Ironic releases. As a result of this, parity has been introduced to align Ironic to Ironic-Python-Agent's support for checksums used by "standalone" users of Ironic. This includes support for remote checksum files to be supplied by URL, in order to prevent breaking existing users which may have inadvertently been leveraging the prior code path. This support can be disabled by setting "[conductor]disable_support_for_checksum_files" to "True". * Fixes aborting in-band inspection. Previously, it would fail with "Can not transition from state 'inspect failed' on event 'abort'". Changes in ironic 23.0.2..23.0.3 -------------------------------- b3d85c494 Checksum files before raw conversion 7c996f0aa Fix double transition to INSPECTFAIL on aborting in-band inspection 009f73717 Fix inspection if bmc_address or bmc_v6address is None 1588d4215 Try limiting MTU to at least 1280 786996b77 [CI][stable only] fix zuul config fbe70f8e6 [CI] Fix job parent name Diffstat (except docs and test files) ------------------------------------- devstack/settings | 11 +- ironic/api/controllers/v1/ramdisk.py | 4 +- ironic/common/checksum_utils.py | 258 +++++++++++++++++++++ ironic/common/exception.py | 22 ++ ironic/common/image_service.py | 35 +++ ironic/common/images.py | 7 +- ironic/conductor/inspection.py | 5 +- ironic/conf/conductor.py | 22 ++ ironic/drivers/modules/deploy_utils.py | 70 ++++-- ironic/drivers/modules/image_cache.py | 44 +++- ironic/drivers/modules/inspector/agent.py | 8 +- .../unit/drivers/modules/inspector/test_agent.py | 40 ++++ .../unit/drivers/modules/test_deploy_utils.py | 229 ++++++++++++++++-- .../notes/bmc-address-none-8214a3f7b67d6a0d.yaml | 5 + ...hecksum-before-conversion-66d273b94fa2ba4d.yaml | 44 ++++ .../notes/inspect-abort-8add5e6e6b599357.yaml | 5 + zuul.d/ironic-jobs.yaml | 3 +- 24 files changed, 1216 insertions(+), 93 deletions(-)