openstack/ironic — Week of 2026-07-04

Security posture. Ironic tightened its cryptographic and templating defaults, moving the minimum TLS version to 1.3 and switching Jinja2 rendering to a sandboxed environment, with a small follow-up cleaning up the TLS getattr path. See https://review.opendev.org/c/openstack/ironic/+/987953 for the TLS bump.

API and data model. Node history gained a project field, and the owner/lessee trust model now has proper documentation covering how scoped access is meant to work in practice. A one-liner also corrected the release codename in the web API version history.

Bug fixes. bootfile_name_by_arch now factors in boot mode when selecting the PXE file, Redfish virtual media insert no longer skips on stale BMC state, and broken project scoping was repaired. The manual-management hardware type was pinned back to noop to match its documented behavior — landed on master and backported to two stable branches. Autodetect ramdisk deploy via vmedia through Nova also got a one-line fix.

Maintenance. The deprecated remotable_classmethod was replaced across the codebase, and the Metal3 functional CI jobs were modernized.