13266 Commits

Author SHA1 Message Date
Julia Kreger
00c5e0faf8 Checksum files before raw conversion
While working another issue, we discovered that support added to
the ironic-conductor process combined the image_download_source
option of "local" with the "force_raw" option resulted in a case
where Ironic had no concept to checksum the files *before* the
conductor process triggered an image format conversion and
then records new checksum values.

In essence, this opened the user requested image file to be
suspetible to a theoretical man-in-the-middle attack OR
the remote server replacing the content with an unknown file,
such as a new major version.

The is at odds with Ironic's security model where we do want to
ensure the end user of ironic is asserting a known checksum for
the image artifact they are deploying, so they are aware of the
present state. Due to the risk, we chose to raise this as a CVE,
as infrastructure operators should likely apply this patch.

As a note, if your *not* forcing all images to be raw format
through the conductor, then this issue is likely not a major
issue for you, but you should still apply the patch.

This is being tracked as CVE-2024-47211.

Closes-Bug: 2076289
Change-Id: Id6185b317aa6e4f4363ee49f77e688701995323a
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
2024-10-03 15:06:07 +00:00
Zuul
9fe510a14a Merge "Fix inspect interface for redfish driver in the docs" 2024-09-24 12:49:08 +00:00
Mahnoor Asghar
adfb091695 Fix inspect interface for redfish driver in the docs
Change-Id: If8d833bc5b012a17588aa7e3ebcb143bba12de12
2024-09-24 07:08:18 -04:00
Zuul
75927a8673 Merge "doc/source/admin fixes part-1" 2024-09-24 07:44:03 +00:00
Zuul
04dc10331b Merge "Imported Translations from Zanata" 2024-09-23 15:07:33 +00:00
Zuul
c84aee5608 Merge "Fix typo in parameter description" 2024-09-23 15:07:30 +00:00
OpenStack Proposal Bot
c2ed9296f5 Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I4126f8c0edfa759dea7e5dad54e520f579b94a45
2024-09-22 03:19:40 +00:00
Takashi Kajinami
c53ed07155 Fix typo in parameter description
Trivial-Fix

Change-Id: I3334823fbb614192771a77d3123aa9cf2546e5a1
2024-09-21 23:10:09 +09:00
fd2572f463 Update master for stable/2024.2
Add file to the reno documentation build to show release notes for
stable/2024.2.

Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2024.2.

Sem-Ver: feature
Change-Id: I96466f75eab2af275b1c903f1b5f3151f539e34e
2024-09-20 13:53:38 +00:00
Julia Kreger
5857ca0cd5 Update release mappings
Change-Id: I34ebd75faa4129732b5018af9801721ed992c16d
26.1.0
2024-09-18 11:45:04 -07:00
Zuul
5e7143c052 Merge "Drop SQLALCHEMY_WARN_20" 2024-09-18 16:59:22 +00:00
Zuul
4ca6a3b573 Merge "Add microversion headers to root ('/') endpoint" 2024-09-18 16:59:19 +00:00
Julia Kreger
f082c24d2a Add Prelude for end of cycle release
Change-Id: Ia32cfc52eef5c2693c307d2eec6289e41af6b278
2024-09-16 21:49:22 +00:00
Zuul
17b162e14e Merge "Bring back the metal3-integration job" 2024-09-16 16:37:23 +00:00
Zuul
3028de6ba0 Merge "Remove skip check for Python 3.6" 2024-09-16 16:11:15 +00:00
Zuul
c6523c521c Merge "CI: Remove scope enforced ci jobs" 2024-09-16 16:11:11 +00:00
Zuul
513198819a Merge "Make sure qemu-img command is available in debian/suse" 2024-09-16 16:09:21 +00:00
Zuul
67c9b5e554 Merge "Remove default override for RBAC config options" 2024-09-16 15:24:14 +00:00
Takashi Kajinami
eb27c6e219 Drop SQLALCHEMY_WARN_20
This environment was used by SQLAlchemy 1.4 and is no longer necessary
since SQLAlchemy was bumped to 2.0 .

Change-Id: I0e01f61529b633251f99d5a1a3e00ffca6c8837f
2024-09-16 06:25:25 +00:00
Muhammad Ahmad
7e85b3ed4d doc/source/admin fixes part-1
This a continuation to the efforts to ensure that the documentation is free from typos and grammatical mistakes so that the reader is not confused. Includes fixes for some of the documentation in doc/source/admin/*

Change-Id: I9ff40f1982ffad86a41e44395b6bee3a8dbfe43a
2024-09-15 10:33:49 +00:00
Zuul
7cddefd609 Merge "Drop description for ZeroMQ" 2024-09-13 14:33:31 +00:00
Dmitry Tantsur
a8c3beaca6
Bring back the metal3-integration job
Change-Id: I77516938a1322ba5016e478266a5e6292e4c7daa
2024-09-13 16:00:22 +02:00
cid
b19507d647 Add microversion headers to root ('/') endpoint
Adds microversion headers to the root endpoint so the '/' and '/v1'
endpoints consistently include microversion headers.

Closes-Bug: #2079023
Change-Id: Iea78b33e04e256c1139dd46a25f6d6a2be8e1ccc
2024-09-13 14:36:35 +01:00
Takashi Kajinami
1c201f0947 Make sure qemu-img command is available in debian/suse
The qemu-img command is required not only in Red Hat family but in
the other families such as Ubuntu, Debian or OpenSUSE.

Ensure the command is installed by bindep.

Change-Id: I94960fc644e2b8524d14633960a88a71437f0618
2024-09-13 22:11:27 +09:00
Takashi Kajinami
771cee4640 Drop description for ZeroMQ
ZeroMQ support by oslo.messaging was removed during Stein cycle so
the description is no longer useful.

Change-Id: I7f3fddc49d97195fc18fd2df41a9c505745e43db
2024-09-13 15:18:16 +09:00
Dmitry Tantsur
d44a658836
Remove legacy Query support from _paginate_query
It relies on risky stuff like nested read transactions, which are known
to be problematic on SQLite.

Change-Id: I61a885c0cb7555919279b3e21e872752dcffc64b
2024-09-12 19:59:58 -05:00
Zuul
960b7ba393 Merge "Set node "alive" when inspection finished" 2024-09-12 16:46:39 +00:00
Dmitry Tantsur
4fea3575c6 Fix inspection if bmc_address or bmc_v6address is None
IPA started sending None when the device is not found.

Change-Id: Ibeef33ff9a0acdb7c605bc46ef9e5d203c7aaa6d
2024-09-12 08:36:24 +00:00
Dmitry Tantsur
510f87a033
Try limiting MTU to at least 1280
Temporary make metal3-integration non-voting until we merge the fix for
regression https://review.opendev.org/c/openstack/ironic/+/928885.

Change-Id: If8f9907df62019b3cf6d6df7d83d5ff421f6be65
2024-09-12 10:35:40 +02:00
Zuul
072619978e Merge "Deduplicate and remove invalid information for steps" 2024-09-10 14:31:36 +00:00
Zuul
d41a1c6f72 Merge "Support Automatic Lessee from instance metadata" 2024-09-05 23:49:48 +00:00
Ghanshyam Mann
3f6507d851 Remove default override for RBAC config options
RBAC config options enforce_scope and enforce_new_defaults
were disabled by default in oslo.policy and Ironic had to override
the default value to enable those by default. Now oslo.policy
(4.4.0 onwards[1]) changed the default values[2][3] and enabled
by default for all the services. OpenStack service does not need
to override the default anymore.

NOTE: There is no change in behaviour here, oslo.policy provides the
same configuration that Ironic has overridden till now.

[1] https://review.opendev.org/c/openstack/releases/+/925032
[2] https://review.opendev.org/c/openstack/oslo.policy/+/924283
[3] https://review.opendev.org/c/openstack/requirements/+/925464

Change-Id: I280ae374048b16f1d27a55b09a4d7729de43f469
2024-09-05 12:46:12 -07:00
Julia Kreger
94fcae5e1a CI: Remove scope enforced ci jobs
The default has changed for oslo.policy, no need for us to do
explicit enabled testing overall. As such removing.

Change-Id: I2d91a0c219bd3a2d59cad2775cde5aab46130921
2024-09-04 17:32:22 -07:00
Julia Kreger
c996aafa6d CVE-2024-44982: Harden all image handling and conversion code
It was recently learned by the OpenStack community that running qemu-img
on untrusted images without a format pre-specified can present a
security risk. Furthermore, some of these specific image formats have
inherently unsafe features. This is rooted in how qemu-img operates
where all image drivers are loaded and attempt to evaluate the input data.
This can result in several different vectors which this patch works to
close.

This change imports the qemu-img handling code from Ironic-Lib into
Ironic, and image format inspection code, which has been developed by
the wider community to validate general safety of images before converting
them for use in a deployment.

This patch contains functional changes related to the hardening of these
calls including how images are handled, and updates documentation to
provide context and guidance to operators.

Closes-Bug: 2071740
Change-Id: I7fac5c64f89aec39e9755f0930ee47ff8f7aed47
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
2024-09-04 15:18:58 -07:00
Derek Higgins
b07ebc4123 Set node "alive" when inspection finished
To make the node fast trackable as soon as
inspection finishes, in addition add a wait for the
agent to callback should it not be available when
fast track is attempted.

Closes-Bug: #2078820

Change-Id: I8a95fc08cf355b7b745a565e3a05c9dc0875a63e
2024-09-04 09:19:58 +01:00
OpenStack Proposal Bot
e01522cd4c Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I4e4714bd26a38aa6dd3635b7b5a61b15e810fe14
2024-09-04 03:54:19 +00:00
Zuul
da5e44908b Merge "Enable the inspection test in the redfish standalone job" 2024-09-03 17:49:14 +00:00
Zuul
b0a650a086 Merge "Better handle missing inspection_network" 2024-09-03 14:58:38 +00:00
Takashi Kajinami
40e1003878 Remove skip check for Python 3.6
... because python 3.6 is no longer supported.

Change-Id: I382b315d59b1f77c44dc2372d26a957b8d1b510f
2024-09-03 16:06:22 +09:00
Jay Faulkner
0eda3d65ea Support Automatic Lessee from instance metadata
Ironic already has support for automatically setting a lessee on
deployment, but it is only supported for direct deployments with Ironic,
as it uses request context which is not preserved in the Nova driver.

Now, when combined with the related Nova change, Ironic can support this
behavior for fully integrated installations. On deploy time, Nova will
set several fields -- including project_id -- in instance info. If
enabled, Ironic will then use that project_id as the automatic lessee.
The previous behavior of using the project_id from the request context
is still supported as a fallback.

This is being tracked in nova as blueprint ironic-guest-metadata.

Closes-Bug: #2063352
Change-Id: Id381a3d201c2f1b137279decc0e32096d4d95012
2024-09-02 18:14:22 -07:00
Zuul
3f22f8c5f0 Merge "Temporarily disable PXE booting test in the standalone job" 2024-08-29 16:06:02 +00:00
Zuul
67542d639a Merge "idrac: inherit driver interface from redfish" 2024-08-29 04:55:05 +00:00
Jay Faulkner
42bd2a069a Use the correct command to fetch ovs state
Typo fix: s/osv/ovs/ in the command name.

Change-Id: I5c42accf5e020ad3ecf652bcabdb8b8521f95907
2024-08-28 08:49:21 -07:00
Doug Goldstein
52fdbb743d
idrac: inherit driver interface from redfish
With the removal of the wsman interfaces in the idrac driver and only
redfish being supported, the idrac driver should inherit from the
redfish driver to ensure that it properly supports all the redfish
supported interfaces. Furthermore with several of the interfaces being
no-op passthru to the redfish implementation there is no reason to not
let the user select those interfaces as well. With an eye towards not
having to support these in the future, direct users to use the stock
redfish versions in the docs as well.

Change-Id: I79ab44f31660e6d5311db46223e8bd60d2b3f213
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
2024-08-28 08:47:32 -05:00
Zuul
f8c5fa7939 Merge "Replace reference to ari/aki" 2024-08-27 23:10:59 +00:00
Dmitry Tantsur
72c792bb28
Temporarily disable PXE booting test in the standalone job
It only passes because the boot interface handling is broken in
ironic-tempest-plugin. Once something like
https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/925981
merges, it will start failing with a timeout.

Temporarily remove it from the list to allow progress on other changes.

Change-Id: I155f520be9b5815f390364c4de12528920b7594a
2024-08-27 14:46:50 +02:00
cid
aaec00275a Replace reference to ari/aki
Replace 'ari' and 'aki' with correct values for kernel/ramdisk
artifacts.

Closes-Bug: #2074090
Change-Id: I5b5bcf7e081fc0865ec43ccf6a988280ec7c9273
2024-08-27 13:46:10 +01:00
Zuul
d6188b752c Merge "Update network_data.json to include dns nameservers" 2024-08-26 21:05:11 +00:00
Jay Faulkner
1aa780377e Deduplicate and remove invalid information for steps
Lots of references to deprecated ways of doing things, as well as two
entire separate sections dedicated to how disk erasure works.

Also ensured we reference new valid config options surrounding disk
erasure.

Additional improvments could include adding documentation around how to
skip disks per node (or linking to any preexisting docs around it).

Change-Id: Ifa029e26eff0637b443d094d85e773b885d0979b
2024-08-26 11:24:37 -07:00
Zuul
e6e075de1f Merge "Clarify how to configure for non-master branch" 2024-08-26 16:20:29 +00:00