openstack/ironic — Stackers Network

openstack/ironic — Week of 2026-07-18

Sat, 18 Jul 2026 00:00:00 +0000

API surface. New JSON schemas landed for the conductors and volume APIs, formalizing request validation on two more endpoints and adding roughly 150 lines of schema definitions.

Security and stability. TLS hardening was extended to kickstart configdrive fetches and inspection rule connections, and a fix landed for poisoning of the allowed origin list. On the reliability side, a destroy_node race condition was closed (with backports across three stable branches), the Redfish firmware update path now handles the NEW task state correctly (also backported twice), and autodetection of the deploy interface no longer fails during node adoption. Glance image member lookups are now skipped for non-shared images, trimming needless calls.

Neutron integration. Port operations against Neutron now use service auth, landing on master alongside four stable-branch backports — a small change with broad coverage across supported releases.

Maintenance. Driver dependencies were reworked to be tracked as optional dependencies (with unused bandit dropped), [ipmi]cipher_suite_versions ordering was clarified in docs, a release note was added for the disallow-steps feature, and the CI image build now ensures docker-buildx is present on dpkg platforms.

openstack/ironic — Week of 2026-07-11

Sat, 11 Jul 2026 00:00:00 +0000

Security response. The week was dominated by coordinated fixes for two CVEs shipped across every supported branch. CVE-2026-44918 blocks rehoming resources to nodes with a different owner, landing as eight ~340-line backports plus a follow-up (996529) tightening the check further. CVE-2026-54423 blocks the vendor.send_raw passthrough, going out as seven parallel patches. Together these account for roughly 4,000 lines of the week's churn.

Feature work. A new ironic-manage command lands to improve driver discoverability, wired into the CLI reference docs. The API gains JSON schemas for the volume_target/volume_connector and portgroups endpoints. Typing work continues across the driver stack: annotations on the base driver/interface for tasks and steps, type hints on hardware-type supported interfaces and step arginfo helpers, stub annotations on base interface methods, a new ParsedKernelCommandLine type, and a fresh mypy tox environment and CI job to enforce it.

Bug fixes. bootfile_name_by_arch now considers boot mode (four-branch backport), BIOS firmware updates recover when the Redfish TaskMonitor disappears (three branches), and Glance image-member lookups are skipped for non-shared images (three branches). Node history events are truncated to avoid DB column overflow, pending-attribute checks are made conditional, and duplicate middleware reimports are removed.

Elsewhere. The oslo_policy[enforce_scope] override is dropped and a small pep8 cleanup lands in redfish/firmware.py.

openstack/ironic — Week of 2026-07-04

Sat, 04 Jul 2026 00:00:00 +0000

Security posture. Ironic tightened its cryptographic and templating defaults, moving the minimum TLS version to 1.3 and switching Jinja2 rendering to a sandboxed environment, with a small follow-up cleaning up the TLS getattr path. See https://review.opendev.org/c/openstack/ironic/+/987953 for the TLS bump.

API and data model. Node history gained a project field, and the owner/lessee trust model now has proper documentation covering how scoped access is meant to work in practice. A one-liner also corrected the release codename in the web API version history.

Bug fixes. bootfile_name_by_arch now factors in boot mode when selecting the PXE file, Redfish virtual media insert no longer skips on stale BMC state, and broken project scoping was repaired. The manual-management hardware type was pinned back to noop to match its documented behavior — landed on master and backported to two stable branches. Autodetect ramdisk deploy via vmedia through Nova also got a one-line fix.

Maintenance. The deprecated remotable_classmethod was replaced across the codebase, and the Metal3 functional CI jobs were modernized.

openstack/ironic — Week of 2026-06-13

Sat, 13 Jun 2026 00:00:00 +0000

Security hardening. The week was dominated by a coordinated security push. New JSON body depth and size limiting middleware landed for OSSN-0099 (~1,000 lines), and a directory-traversal fix in ISO9660 support went in alongside driver_info-level pxe_template override being disabled. Jinja2 templating moved to sandbox rendering, file-URL validation was hoisted into the deploy_utils main path, and configuration-molds URLs are now validated against the Swift entry in the Keystone catalog. The fix for sensitive properties leaking on volume targets was backported across eight branches, and a bound on RFB failure-reason strings shipped to four. See the body-limit middleware change for the OSSN-0099 work.

Operator controls and validation. Kernel append params are now validated as actual kernel parameters (a ~4,000-line change), with a follow-up fix for parsing quoted values and whitespace backported across seven stable branches. Operators also gained configurable step disallow lists, letting them block specific clean/deploy/service steps by policy.

Driver and inspection fixes. Redfish work corrected the interop profile Storage requirements, retried vmedia insert on server errors, and learned to skip storage controllers that lack a Volumes link. BIOS settings now coerce string values before being sent to the BMC, and port pre-creation during inspection can be disabled.

Elsewhere. TLS code was consolidated into ironic/common/tls_utils, the events API gained a schema, the firmware interface is highlighted in docs while management-for-updates is deprecated, and release mappings for 36.0 and 37.0 were added.

openstack/ironic — Week of 2026-06-06

Sat, 06 Jun 2026 00:00:00 +0000

Security hardening. The week is dominated by a coordinated security push backported across stable branches. New validation rejects malformed kernel_append_params so injected values can't smuggle extra kernel parameters, and ISO9660 handling gains a directory-traversal guard — both landed on master plus six and five stable branches respectively. A companion change disables driver_info-level pxe_template overrides on seven branches, and file URL validation is hoisted into the main deploy_utils path. Capping the surface from the outside, OSSN-0099 JSON body depth/size limiting middleware shipped to master and three stable branches.

TLS hardening. A second strand tightens transport security across the outbound clients: HTTP image service, Redfish BMC connections, the OCI registry client, and the Ansible stream_url module all gained TLS-hardening options. Together with the validation work above, this is roughly the bulk of the ~23k lines of churn.

Driver and agent fixes. Redfish gets a bound on the failure reason string returned via RFB and a fix for the any_left flag accumulating across storage controllers, plus clearer vmedia insertion error messages. A new agent flag lets operators disable bootloader installation during deploy.

Tooling. CI pinned setuptools to a still-shipping range and aligned voting jobs with the gate; the Zanata translation import also landed.

openstack/ironic — Week of 2026-05-30

Sat, 30 May 2026 00:00:00 +0000

TLS hardening. The dominant thread is a multi-patch rollout of TLS hardening options across Ironic's network-facing services. New configuration knobs land for the JSON-RPC service and for agent client connections, with initial documentation covering the new options. In the same vein, the novncproxy parameters are renamed from ssl_* to tls_* for naming consistency across the codebase. Altogether this accounts for roughly 950 lines of the week's churn.

Security fixes. File URL validation moves up into the main deploy_utils path (landed twice, on master and a backport) so the check runs earlier and unconditionally. The console wrapper also gets a small but pointed fix: the command passed to socat is now shell-quoted.

Metal3 integration. A new functional job exercising the Metal3 baremetal-operator is added to the gate, with companion docs describing the related ironic-standalone-operator job.

Driver and misc. The Redfish-side inspection path now skips storage controllers that lack a Volumes link rather than failing. Elsewhere, devstack learns to honor the global ENABLE_DEBUG_LOG_LEVEL, a docs cross-reference for is_root_volume is corrected, and a release-notes rendering issue that silently dropped notes is patched.