openstack/ironic — Week of 2026-06-13

Security hardening. The week was dominated by a coordinated security push. New JSON body depth and size limiting middleware landed for OSSN-0099 (~1,000 lines), and a directory-traversal fix in ISO9660 support went in alongside driver_info-level pxe_template override being disabled. Jinja2 templating moved to sandbox rendering, file-URL validation was hoisted into the deploy_utils main path, and configuration-molds URLs are now validated against the Swift entry in the Keystone catalog. The fix for sensitive properties leaking on volume targets was backported across eight branches, and a bound on RFB failure-reason strings shipped to four. See the body-limit middleware change for the OSSN-0099 work.

Operator controls and validation. Kernel append params are now validated as actual kernel parameters (a ~4,000-line change), with a follow-up fix for parsing quoted values and whitespace backported across seven stable branches. Operators also gained configurable step disallow lists, letting them block specific clean/deploy/service steps by policy.

Driver and inspection fixes. Redfish work corrected the interop profile Storage requirements, retried vmedia insert on server errors, and learned to skip storage controllers that lack a Volumes link. BIOS settings now coerce string values before being sent to the BMC, and port pre-creation during inspection can be disabled.

Elsewhere. TLS code was consolidated into ironic/common/tls_utils, the events API gained a schema, the firmware interface is highlighted in docs while management-for-updates is deprecated, and release mappings for 36.0 and 37.0 were added.