)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b1b56a8361622c643f32edd385e3b05aa91c760a","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"439060de_43386118","updated":"2024-09-16 16:46:37.000000000","message":"Noting that dtantsur and I spoke about this in length in IRC:\nstarting around 16:11 -\u003e https://meetings.opendev.org/irclogs/%23openstack-ironic/%23openstack-ironic.2024-09-16.log.html\n\ntl;dr: the neutron case is extra scary because we cannot use the \"rescue trick\" in the case of a tenant OS. They could still have the tenant OS running, if any BMC blip or failure occurred, up in the IPA network -- a prime location to spring an attack on provisioning machines\n\nAt a minimum, we\u0027ll wanna hide this behind a setting that details the risk so folks can opt-in, but I\u0027m not giving up on finding better ideas :D","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"783c7ab1_fe6bad54","updated":"2024-09-16 16:11:24.000000000","message":"The -1 is mainly around the network and safety comments; I\u0027m very perplexed why we\u0027d think this is safer on a flat network.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"f300173bd6ebb23e71cdc57cc82d090dfdc1af42","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"3e42b225_90b162a3","updated":"2024-09-20 13:07:16.000000000","message":"Nobody has expressed interest in providing more feedback, and we got 2x +2 already \u003d\u003e merging.","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"}],"specs/approved/nc-si.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"09dfeb569b0df8ec1c4e4ea2fb59a5d14f3d7585","unresolved":true,"context_lines":[{"line_number":29,"context_line":"* When multi-tenant networking is used, it\u0027s essentially to switch the"},{"line_number":30,"context_line":"  networking with the machine powered on, otherwise the code running on it will"},{"line_number":31,"context_line":"  be exposed to both networks (e.g. IPA will stay running on the tenant"},{"line_number":32,"context_line":"  network)."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Unfortunately, in some cases powering off a machine is not possible:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"4bea6044_c1a54aa0","line":32,"updated":"2024-09-16 16:21:37.000000000","message":"We\u0027d almost need to be able to send a signal to IPA, like we do for rescue, saying \"networking switch is happening\", except in this case, we\u0027d explicitly have IPA down interfaces  and the like.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":29,"context_line":"* When multi-tenant networking is used, it\u0027s essentially to switch the"},{"line_number":30,"context_line":"  networking with the machine powered on, otherwise the code running on it will"},{"line_number":31,"context_line":"  be exposed to both networks (e.g. IPA will stay running on the tenant"},{"line_number":32,"context_line":"  network)."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Unfortunately, in some cases powering off a machine is not possible:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1e40c1b7_4be16f15","line":32,"in_reply_to":"4bea6044_c1a54aa0","updated":"2024-09-17 14:39:48.000000000","message":"We could do this. However, we cannot secure the other direction: when we turn off the user\u0027s OS and start IPA.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":56,"context_line":"* All *power interfaces* will use an explicit reboot request (or fail if it\u0027s"},{"line_number":57,"context_line":"  not available) even when normally they would use a power-off/power-on pair"},{"line_number":58,"context_line":"  (e.g. ``redfish``). To detect the reboot, we\u0027ll insert a hardcoded sleep and"},{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"59df60cc_5556420e","line":59,"updated":"2024-09-16 16:11:24.000000000","message":"Can we explicitly only permit this use case when we can do out-of-band reboots? I\u0027m concerned about a case where someone tries to hook this up to only use in-band reboots for a machine without a BMC -- putting it in a situation where any blip during booting, causing an IPA not to start, might require remote hands.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":56,"context_line":"* All *power interfaces* will use an explicit reboot request (or fail if it\u0027s"},{"line_number":57,"context_line":"  not available) even when normally they would use a power-off/power-on pair"},{"line_number":58,"context_line":"  (e.g. ``redfish``). To detect the reboot, we\u0027ll insert a hardcoded sleep and"},{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"aea33781_1885e300","line":59,"in_reply_to":"59df60cc_5556420e","updated":"2024-09-16 16:21:57.000000000","message":"Power interfaces are only about out-of-band reboots, so this particular case is fine.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* All *power interfaces* will use an explicit reboot request (or fail if it\u0027s"},{"line_number":57,"context_line":"  not available) even when normally they would use a power-off/power-on pair"},{"line_number":58,"context_line":"  (e.g. ``redfish``). To detect the reboot, we\u0027ll insert a hardcoded sleep and"},{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"74912237_e60f8fe0","line":59,"in_reply_to":"aea33781_1885e300","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* The ``boot_instance`` deploy step will use the ``run_image`` IPA command"},{"line_number":65,"context_line":"  (soft reboot) instead of powering the machine on."}],"source_content_type":"text/x-rst","patch_set":2,"id":"a03206dc_f3f24858","line":62,"updated":"2024-09-16 16:11:24.000000000","message":"How much longer will we expect this to leave an agent running? I\u0027m curious if we can/need to guard this new logic path with good error handling to ensure we don\u0027t leave an IPA ramdisk running indefinitely -- especially with our knowledge about how many operators rarely update them.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b55d6e2db7d5c526165eb4c1d21079e9b1aeaff6","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* The ``boot_instance`` deploy step will use the ``run_image`` IPA command"},{"line_number":65,"context_line":"  (soft reboot) instead of powering the machine on."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9e8ad141_304eab8d","line":62,"in_reply_to":"7eeb1e6f_8fa643cb","updated":"2024-09-16 16:23:50.000000000","message":"In the multitenant network case, we can use a switchport shutoff (or putting it into an isolation network) as a proxy for power off, for security purposes.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* The ``boot_instance`` deploy step will use the ``run_image`` IPA command"},{"line_number":65,"context_line":"  (soft reboot) instead of powering the machine on."}],"source_content_type":"text/x-rst","patch_set":2,"id":"08e8a0f6_8b137277","line":62,"in_reply_to":"9e8ad141_304eab8d","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  then wait for the machine to be on."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"* The ``tear_down_agent`` deploy step will no longer try to power off the"},{"line_number":62,"context_line":"  machine, making it mostly no-op (modulo collecting the ramdisk logs)."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* The ``boot_instance`` deploy step will use the ``run_image`` IPA command"},{"line_number":65,"context_line":"  (soft reboot) instead of powering the machine on."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7eeb1e6f_8fa643cb","line":62,"in_reply_to":"a03206dc_f3f24858","updated":"2024-09-16 16:21:57.000000000","message":"What do we do though? If we power off the machine, it is no longer reachable.\n\n... which makes me think: I probably need to change the normal error handling to not power off the machine.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":74,"context_line":"* The usage of ``disable_power_off`` opens up a potential vulnerability in the"},{"line_number":75,"context_line":"  multi-tenant networking because IPA will be available on the tenant network"},{"line_number":76,"context_line":"  for a short time. Thus, the ``neutron`` network interface will fail"},{"line_number":77,"context_line":"  validation for nodes with this flag set to ``True``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"}],"source_content_type":"text/x-rst","patch_set":2,"id":"d02f4ad2_5352a5e0","line":77,"updated":"2024-09-16 16:11:24.000000000","message":"I\u0027m not sure making it fail network validation is required. In fact, the case of a neutron networked machine makes this **less rare**. If anything, we should do the opposite; e.g.:\n\n- machine boots in flat network\n- machine leaves IPA running in flat network\n- attacker with machine on flat network, provisioned earlier by ironic, has access to try and exploit running IPA\n\nvs \n\n- machine boots in cleaning/deployment network\n- machine leaves IPA running in cleaning/deployment network\n- attackers cannot accces running IPA from another Ironic tenant machine","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b55d6e2db7d5c526165eb4c1d21079e9b1aeaff6","unresolved":true,"context_lines":[{"line_number":74,"context_line":"* The usage of ``disable_power_off`` opens up a potential vulnerability in the"},{"line_number":75,"context_line":"  multi-tenant networking because IPA will be available on the tenant network"},{"line_number":76,"context_line":"  for a short time. Thus, the ``neutron`` network interface will fail"},{"line_number":77,"context_line":"  validation for nodes with this flag set to ``True``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"}],"source_content_type":"text/x-rst","patch_set":2,"id":"e0841e73_597f2368","line":77,"in_reply_to":"21c45d76_cb2a8e52","updated":"2024-09-16 16:23:50.000000000","message":"This is the same problem as rescue: we should handle it similarly. Tell IPA a network switch is coming, IPA acknowledges it, does some local work for security (iptables block everything, down network ports, anything we think is needed)","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":74,"context_line":"* The usage of ``disable_power_off`` opens up a potential vulnerability in the"},{"line_number":75,"context_line":"  multi-tenant networking because IPA will be available on the tenant network"},{"line_number":76,"context_line":"  for a short time. Thus, the ``neutron`` network interface will fail"},{"line_number":77,"context_line":"  validation for nodes with this flag set to ``True``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"}],"source_content_type":"text/x-rst","patch_set":2,"id":"21c45d76_cb2a8e52","line":77,"in_reply_to":"d02f4ad2_5352a5e0","updated":"2024-09-16 16:21:57.000000000","message":"When do we flip the networking though? If we do it before the final reboot, the instance network will see IPA. If we do it after the final reboot, we can pull the rug from under the booting operating system.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":74,"context_line":"* The usage of ``disable_power_off`` opens up a potential vulnerability in the"},{"line_number":75,"context_line":"  multi-tenant networking because IPA will be available on the tenant network"},{"line_number":76,"context_line":"  for a short time. Thus, the ``neutron`` network interface will fail"},{"line_number":77,"context_line":"  validation for nodes with this flag set to ``True``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"}],"source_content_type":"text/x-rst","patch_set":2,"id":"8b1ac6a4_ae31ea2e","line":77,"in_reply_to":"e0841e73_597f2368","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"},{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."}],"source_content_type":"text/x-rst","patch_set":2,"id":"f08fc7e8_e159ced7","line":81,"updated":"2024-09-16 16:11:24.000000000","message":"We should perhaps ensure we fail *early* if any cleaning/servicing steps or runbooks are passed in that have an explicit power_on or power_off action. For explict cleaning/servicing we don\u0027t want to cover up this detail IMO.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"},{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."}],"source_content_type":"text/x-rst","patch_set":2,"id":"d65093f4_6106468d","line":81,"in_reply_to":"ef3487c9_1fa83d1c","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* After ``tear_down_agent``, the agent will still be running. Any custom deploy"},{"line_number":80,"context_line":"  steps or out-of-band actions that rely on the machine to be powered off after"},{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ef3487c9_1fa83d1c","line":81,"in_reply_to":"f08fc7e8_e159ced7","updated":"2024-09-16 16:21:57.000000000","message":"++","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Alternatives"},{"line_number":87,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"88750e6d_927e1378","line":84,"updated":"2024-09-16 16:11:24.000000000","message":"I\u0027ll note... we could likely still track this scenario if we were able to monitor failing IPA auth attempts; e.g. if we still get heartbeats (even though they fail for token-reasons) from the ipa api host, we know it hasn\u0027t rebooted.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b55d6e2db7d5c526165eb4c1d21079e9b1aeaff6","unresolved":true,"context_lines":[{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Alternatives"},{"line_number":87,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"4bf064e5_07f0ce6e","line":84,"in_reply_to":"10b257b2_4e71f296","updated":"2024-09-16 16:23:50.000000000","message":"Depends on how we go with the potential networking remediations","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Alternatives"},{"line_number":87,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fc652bf0_40d88ae5","line":84,"in_reply_to":"4bf064e5_07f0ce6e","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":81,"context_line":"  this step may fail."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* In case of IPMI, if the BMC ignores the reboot request, we\u0027ll still mark it"},{"line_number":84,"context_line":"  as successful."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Alternatives"},{"line_number":87,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"10b257b2_4e71f296","line":84,"in_reply_to":"88750e6d_927e1378","updated":"2024-09-16 16:21:57.000000000","message":"Hmm, I need to think about it. It may be actually possible to detect if IPA is still running if we don\u0027t wipe agent_url.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Short of convincing the vendors to fix the NC-SI issue in hardware, I do not"},{"line_number":90,"context_line":"see any alternatives. The NC-SI setup seems to be gaining popularity,"},{"line_number":91,"context_line":"especially in *far edge* setups."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"As to the implementation, I\u0027d really prefer we stop adding new fields to"},{"line_number":94,"context_line":"``driver_info`` and other free-form dictionary. However, this is currently the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"84d7da36_0da9b9bf","line":91,"updated":"2024-09-16 16:11:24.000000000","message":"Have we closed the loop with the hardware vendors on how awful this is?","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Short of convincing the vendors to fix the NC-SI issue in hardware, I do not"},{"line_number":90,"context_line":"see any alternatives. The NC-SI setup seems to be gaining popularity,"},{"line_number":91,"context_line":"especially in *far edge* setups."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"As to the implementation, I\u0027d really prefer we stop adding new fields to"},{"line_number":94,"context_line":"``driver_info`` and other free-form dictionary. However, this is currently the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"913482c1_509076c6","line":91,"in_reply_to":"5b79b480_f61e0689","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"dcef82f1256a2cef6028074f8bea1866f034df47","unresolved":true,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Short of convincing the vendors to fix the NC-SI issue in hardware, I do not"},{"line_number":90,"context_line":"see any alternatives. The NC-SI setup seems to be gaining popularity,"},{"line_number":91,"context_line":"especially in *far edge* setups."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"As to the implementation, I\u0027d really prefer we stop adding new fields to"},{"line_number":94,"context_line":"``driver_info`` and other free-form dictionary. However, this is currently the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5b79b480_f61e0689","line":91,"in_reply_to":"84d7da36_0da9b9bf","updated":"2024-09-16 16:21:57.000000000","message":"Well, I do not have a direct feedback channel, but I did express my disapproval to whoever was ready to listen. Saving switch ports beats sanity, it seems.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb51f6d8cfaf50a89ab6261b9869aa0d03e98fc3","unresolved":true,"context_lines":[{"line_number":150,"context_line":"---------------"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The new mode will not be compatible with the multi-tenant networking approach,"},{"line_number":153,"context_line":"thus we\u0027ll add a validation to make sure they\u0027re not used together."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Other end user impact"},{"line_number":156,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"affe5b74_24580dd1","line":153,"updated":"2024-09-16 16:11:24.000000000","message":"I disagree with this as mentioned above.","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"24dfc8f7052d27c313e328c04c9edd24c700b27c","unresolved":false,"context_lines":[{"line_number":150,"context_line":"---------------"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The new mode will not be compatible with the multi-tenant networking approach,"},{"line_number":153,"context_line":"thus we\u0027ll add a validation to make sure they\u0027re not used together."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Other end user impact"},{"line_number":156,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"c90f2405_4bd57204","line":153,"in_reply_to":"affe5b74_24580dd1","updated":"2024-09-17 14:39:48.000000000","message":"Done","commit_id":"f26db017dfd3fe712e7d3c54ff0f7929d690ef78"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"69d4c7376bcb97d16ebee81843bf4a903eb71ce0","unresolved":true,"context_lines":[{"line_number":13,"context_line":"Problem description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Power off is a very fundamental action for bare-metal provisioning. Not only is"},{"line_number":17,"context_line":"it available as an API primitive, Ironic also often uses a sequence of power"},{"line_number":18,"context_line":"off and power on instead of a single reboot action. This happens for three"},{"line_number":19,"context_line":"reasons:"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"03c131eb_c82fcec6","line":17,"range":{"start_line":16,"start_character":77,"end_line":17,"end_character":2},"updated":"2024-09-18 13:48:03.000000000","message":"nit: it is","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"f300173bd6ebb23e71cdc57cc82d090dfdc1af42","unresolved":true,"context_lines":[{"line_number":13,"context_line":"Problem description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Power off is a very fundamental action for bare-metal provisioning. Not only is"},{"line_number":17,"context_line":"it available as an API primitive, Ironic also often uses a sequence of power"},{"line_number":18,"context_line":"off and power on instead of a single reboot action. This happens for three"},{"line_number":19,"context_line":"reasons:"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3c426855_8a673de5","line":17,"range":{"start_line":16,"start_character":77,"end_line":17,"end_character":2},"in_reply_to":"03c131eb_c82fcec6","updated":"2024-09-20 13:07:16.000000000","message":"I think it\u0027s actually correct: https://dictionary.cambridge.org/grammar/british-grammar/not-only-but-also","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"ac222ece6eefc569770a55b1630dbc3236ab57ed","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Problem description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Power off is a very fundamental action for bare-metal provisioning. Not only is"},{"line_number":17,"context_line":"it available as an API primitive, Ironic also often uses a sequence of power"},{"line_number":18,"context_line":"off and power on instead of a single reboot action. This happens for three"},{"line_number":19,"context_line":"reasons:"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5437e6c6_edc9ba91","line":17,"range":{"start_line":16,"start_character":77,"end_line":17,"end_character":2},"in_reply_to":"3c426855_8a673de5","updated":"2024-09-21 10:39:59.000000000","message":"Acknowledged","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"908177b223355d4b873978bd22491f6c6b88e37e","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3508df61_531ea852","line":195,"updated":"2024-09-17 14:43:47.000000000","message":"I think we should make this a global setting, as it\u0027s also potentially risky (chance to skip cleaning if a BMC is bugged in way\u0027s I\u0027ve seen before) for flat networking cases.","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"c9bcdf22e8cc747355431be33b4f4fce6b8c555e","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"cd0036c4_d5afe74c","line":195,"in_reply_to":"233e89cb_c99c9770","updated":"2024-09-17 16:31:46.000000000","message":"This spec is no longer about a driver_info field (and a separate RBAC policy is the reason).","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"043c3d84e8fe90d2b74d1078ec75986ea9a19a0a","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"46ca4ed0_ebd29ebd","line":195,"in_reply_to":"3508df61_531ea852","updated":"2024-09-17 14:53:59.000000000","message":"RBAC is not enough?","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"2a8dade618c776a902e4543eb95d39407b2d4264","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"c02bdeff_910f38a6","line":195,"in_reply_to":"46ca4ed0_ebd29ebd","updated":"2024-09-17 14:59:06.000000000","message":"The question to ask is if a project manager or admin should be able to toggle this vs a system manager or admin. IMO, security decisions like this should be made at a system level.","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ebb26ec1b108bf1201b616d1e21ad90c3e930222","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"233e89cb_c99c9770","line":195,"in_reply_to":"aee20cb1_b0899a71","updated":"2024-09-17 16:30:19.000000000","message":"Can you RBAC deny a specific field in driver_info? Or are you saying we\u0027ll hook it up as a separate policy when implemented?","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"bde7ba21da49b9a774a2271e7fe08a38235e0c7f","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"aee20cb1_b0899a71","line":195,"in_reply_to":"c02bdeff_910f38a6","updated":"2024-09-17 15:29:51.000000000","message":"Well, the system admin can set the RBAC rule to always deny, right?","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"fb938080872579e0f638d36a0bb41d9edbe9f0fd","unresolved":true,"context_lines":[{"line_number":192,"context_line":"A new security parameter will be added:"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"``[neutron]allow_disabling_power_off`` (boolean, default ``False``)"},{"line_number":195,"context_line":"    If ``False``, the validation of the ``neutron`` network interface will fail"},{"line_number":196,"context_line":"    for nodes that have ``disable_power_off`` enabled. If set to ``True``, this"},{"line_number":197,"context_line":"    feature will be usable together."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7b2ed334_bd4be41c","line":195,"in_reply_to":"cd0036c4_d5afe74c","updated":"2024-09-17 16:33:16.000000000","message":"aha, I missed that change. Less stuff in random json fields ++++++++++++++","commit_id":"77353cd15e0a72593d075062cc1f7952921e86d6"}]}