openstack/ironic — 2026-05-30

TLS hardening. The dominant thread is a multi-patch rollout of TLS hardening options across Ironic's network-facing services. New configuration knobs land for the JSON-RPC service and for agent client connections, with initial documentation covering the new options. In the same vein, the novncproxy parameters are renamed from ssl_* to tls_* for naming consistency across the codebase. Altogether this accounts for roughly 950 lines of the week's churn.

Security fixes. File URL validation moves up into the main deploy_utils path (landed twice, on master and a backport) so the check runs earlier and unconditionally. The console wrapper also gets a small but pointed fix: the command passed to socat is now shell-quoted.

Metal3 integration. A new functional job exercising the Metal3 baremetal-operator is added to the gate, with companion docs describing the related ironic-standalone-operator job.

Driver and misc. The Redfish-side inspection path now skips storage controllers that lack a Volumes link rather than failing. Elsewhere, devstack learns to honor the global ENABLE_DEBUG_LOG_LEVEL, a docs cross-reference for is_root_volume is corrected, and a release-notes rendering issue that silently dropped notes is patched.