Synchronise 2025.1 with upstream#20
Open
github-actions[bot] wants to merge 5 commits into
Open
Conversation
The pxe_bootfile_name_by_arch and ipxe_bootfile_name_by_arch options skipped the boot mode check when an architecture matched, making it impossible to specify different boot files for the same architecture in different boot modes. Support composite keys in the format arch-boot_mode (e.g. x86_64-uefi) with fallback to arch-only keys for backward compatibility. Closes-Bug: #2157027 Assisted-By: Claude - (Opus 4.6) Change-Id: I839d4b329a13aaa86873cbfcb6ec1cac0a2b4432 Signed-off-by: Harald Jensås <hjensas@redhat.com> (cherry picked from commit ab6a22b)
A recent security report highlighted issues with the ability to invoke the ipmitool vendor pass-thru interface method of ``send_raw``. Where in the step model, this becomes "$interface_name"."$method_name", hence, "vendor.send_raw". This patch disables the method because standalone operators do not have the Role Based Access Control model to fallback on in order to prevent misuse of the interface. While the interface may still be useful, this disables the ability for standard API users to invoke the method by default. NOTE(JayF): Resolved some conflicts in ironic/conf/api.py Related-Bug: 2150458 Change-Id: I1f88315346ff19a4fcde34f954350b32cf02f96c Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com> Signed-off-by: Jay Faulkner <jay@jvf.cc>
Ironic has a few similar patterns where only the source node is verified during a create or update operation: 1. A node can be created with a parent from a different project 2. Node can be updated to have a parent from a different project 3. Ports, port groups, volume targets and volume connectors can be patched to be owned by a node from a different project. This patch addresses all these cases and introduces a single helper to cover all of them. Also makes sure that baremetal:node:get is checked even if the parent node ID is a UUID (it was missing before). Related-Bug: 2150450 Change-Id: Iaa512f380926a9fc032eefea5bcdcbc5040a4739 Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com> Signed-off-by: Jay Faulkner <jay@jvf.cc> (cherry picked from commit b58d4ad) (cherry picked from commit d99b35d)
…rent owner" into stable/2025.1
When a user triggers a manual operation like cleaning, most requests towards the Neutron API are made with the authentication parameters provided by the user's context. In case of port creation this can lead to ports being created with an unexpected project id (taken from the project scope of the current user). To prevent this, we now use the service credentials from config for add_ports_to_network() and remove_neutron_ports(). Closes-Bug: #2121702 Change-Id: I0669782bacfb95b42dfa300e4f91ece62893847c Signed-off-by: Sebastian Lohff <sebastian.lohff@sap.com> (cherry picked from commit 27083f0)
github-actions
Bot
added
automated
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains a snapshot of 2025.1 from upstream stable/2025.1.