)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"e02fc1e41ea034600e453f59c586914528c35f62","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"9faf48dd_0ca19e71","updated":"2026-07-28 16:43:41.000000000","message":"As general feedback, please try to fit the new feature into existing concepts before suggestion more states, interfaces and transitions. Adding these have a lot of maintenance cost.\n\nPlease also expand more on the semantics. I clearly don\u0027t understand why and how reboots will work. You may want to look into the work done for disable_power_off feature and ponder the implications for non-flat networking.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"36809a0c_1f45595c","updated":"2026-07-28 17:05:52.000000000","message":"I am not convinced this hardware is well-suited for use in Ironic-provisioned clusters. It is natively designed for a interactive unlock in every use, and Ironic is specifically designed for IPA to be hands-off once the deployment is complete.\n\nI do not see a path forward where we can reduce the complexity this hardware requires to the point where I\u0027d be comfortable approving a spec to unlock it in Ironic as a part of regular flows. I could see a service/clean step to unlock-on-demand as an operator concern, but I do *not* want to replace standard Ironic power actions with anything that requires in-band coordination -- this breaks basic assumptions that Ironic makes, and opens up a security can of worms.\n\nI\u0027m going to be honest, this is the closest that I\u0027ve ever gotten to -2 a spec. There\u0027s no path forward, that I am clever enough to see, to support this hardware that doesn\u0027t violate some of the most basic assumptions in Ironic.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"659cec20933c0dc2cc01ea1eb583d7b1babe4b05","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"a287b705_3c047986","in_reply_to":"36809a0c_1f45595c","updated":"2026-07-28 17:06:39.000000000","message":"To be explicit: I am not OK with a power action requiring an IPA boot to successfully complete. If we can factor that out, somehow, maybe we can work out the rest.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"}],"specs/approved/self-encrypting-drive-support.rst":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":14,"context_line":"SSC Self-Encrypting Drives (SEDs): locking bare metal drives with a"},{"line_number":15,"context_line":"per-node passphrase, transparently unlocking them when the node boots, and"},{"line_number":16,"context_line":"factory-resetting locked drives whose passphrase is unknown (PSID revert)."},{"line_number":17,"context_line":"The design adds a new ``encrypteddrive`` hardware interface, two new"},{"line_number":18,"context_line":"provision states used to drive the ramdisk-side unlock, and a set of clean"},{"line_number":19,"context_line":"and deploy steps, backed by an OpenStack key manager for secret storage."},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7bf84a7e_b162c72c","line":17,"range":{"start_line":17,"start_character":24,"end_line":17,"end_character":60},"updated":"2026-07-27 17:22:19.000000000","message":"This might need some clarification, i.e. what hardware interface is added and in what context. I guess my \"knee-jerk\" reaction is we\u0027re talking about an entire hardware type, but this ideally should be done as a variation of deploy interface .. I guess.\n\nThe other thing is the base qualifier seems like it is self encrypting drives based upon the contents of the machine. Anyway, on to the details.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":31,"context_line":"Operators running bare metal want the same \"encryption at rest, per-tenant"},{"line_number":32,"context_line":"key, cryptographic erase\" guarantees that virtualized clouds get from volume"},{"line_number":33,"context_line":"encryption, but at the physical drive level and without a performance penalty."},{"line_number":34,"context_line":"Today Ironic has no notion of a locked drive:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* There is no way to enable a locking range and store the resulting"},{"line_number":37,"context_line":"  passphrase against a node, so a redeployed server cannot be brought back to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"8c7b7ab8_9152d03c","line":34,"range":{"start_line":34,"start_character":1,"end_line":34,"end_character":45},"updated":"2026-07-27 17:22:19.000000000","message":"FWIW, that is implied, I\u0027d reframe this as \"These are the resulting challenges\"","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[{"line_number":38,"context_line":"  a readable state automatically."},{"line_number":39,"context_line":"* On every power-on of a SED-protected node (deploy, rescue, or a bare"},{"line_number":40,"context_line":"  reboot), the drives come up locked and the instance will not boot until"},{"line_number":41,"context_line":"  something presents the passphrase from within a trusted ramdisk."},{"line_number":42,"context_line":"* When a drive is returned to the pool but its passphrase has been lost or"},{"line_number":43,"context_line":"  rotated, there is no supported flow to reset it. TCG defines a"},{"line_number":44,"context_line":"  Physical-SID (PSID, printed on the drive label) revert that erases the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"853d5217_805e7b7c","line":41,"updated":"2026-07-28 17:05:52.000000000","message":"This inherently makes this design of hardware incompatible with Ironic. A core design philosophy is that we do not run code in-band on user operating systems.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":44,"context_line":"  Physical-SID (PSID, printed on the drive label) revert that erases the"},{"line_number":45,"context_line":"  media key and returns the drive to a factory, readable state; Ironic has no"},{"line_number":46,"context_line":"  step that performs it."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Use cases:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* **Encryption at rest for bare metal.** An operator deploys a tenant onto a"}],"source_content_type":"text/x-rst","patch_set":2,"id":"786a597d_57454c34","line":47,"updated":"2026-07-27 17:22:19.000000000","message":"There is a further side effect as a downside. No local hard reboots are permitted, otherwise the node enters a locked out state, that is if I\u0027m understanding the resulting state of use. It is what it is. And then further all reboots must be routed through the management layer to help ensure the host is in working state. These are logical downsides, but really ought to be highlighted in the overall problem description as fallout.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[{"line_number":56,"context_line":"  data unrecoverable in constant time, independent of drive capacity."},{"line_number":57,"context_line":"* **Recovery of an orphaned locked drive.** A drive whose passphrase is"},{"line_number":58,"context_line":"  unknown is reset to factory state via PSID revert during cleaning, so it can"},{"line_number":59,"context_line":"  safely re-enter the pool."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Actors: the deployer/operator (enables the interface and provides drive"},{"line_number":62,"context_line":"PSIDs), the Ironic conductor (orchestrates unlock/erase and stores the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"21a6bf7f_80cd6e1b","line":59,"updated":"2026-07-28 17:05:52.000000000","message":"This third case, if implemented as a clean/service step, would be interesting even if the whole flow isn\u0027t compatible with Ironic.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":58,"context_line":"  unknown is reset to factory state via PSID revert during cleaning, so it can"},{"line_number":59,"context_line":"  safely re-enter the pool."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Actors: the deployer/operator (enables the interface and provides drive"},{"line_number":62,"context_line":"PSIDs), the Ironic conductor (orchestrates unlock/erase and stores the"},{"line_number":63,"context_line":"passphrase in the key manager), and the ramdisk agent (executes the"},{"line_number":64,"context_line":"``sedutil-cli`` operations against the physical drives)."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"48b44d53_82033809","line":62,"range":{"start_line":61,"start_character":57,"end_line":62,"end_character":6},"updated":"2026-07-27 17:22:19.000000000","message":"If this is really, truly, only printed on the label, that is super problematic as  it requires a level of interaction and auditing which is far beyond most operator\u0027s tolerances for effort. \"Get the machine online as fast as possible\".","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":58,"context_line":"  unknown is reset to factory state via PSID revert during cleaning, so it can"},{"line_number":59,"context_line":"  safely re-enter the pool."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Actors: the deployer/operator (enables the interface and provides drive"},{"line_number":62,"context_line":"PSIDs), the Ironic conductor (orchestrates unlock/erase and stores the"},{"line_number":63,"context_line":"passphrase in the key manager), and the ramdisk agent (executes the"},{"line_number":64,"context_line":"``sedutil-cli`` operations against the physical drives)."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"2ac173f3_93d353b8","line":62,"range":{"start_line":61,"start_character":57,"end_line":62,"end_character":6},"in_reply_to":"48b44d53_82033809","updated":"2026-07-28 09:01:34.000000000","message":"I know. First implementation does not include this PSID management. The problem is that during first tests, it appears that new NVMEs use a more recent version of OPAL that require PSID to unlock the SED feature. This is preatty new, but it\u0027s for security purpose (prevent hackers that hack a host or a laptop to lock the customer data)","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":66,"context_line":"Proposed change"},{"line_number":67,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Introduce a new optional hardware interface, ``encrypteddrive``, with three"},{"line_number":70,"context_line":"implementations:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``no-encrypteddrive`` (default) -- a no-op; ``is_active()`` returns"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dee5a522_c4d39dc8","line":69,"range":{"start_line":69,"start_character":47,"end_line":69,"end_character":61},"updated":"2026-07-27 17:22:19.000000000","message":"s/encrypteddrive/encrypted_drive/ perhaps? It sees like this would end up on task.driver.encrypted_drive and the underscore would follow the naming convention, even though we\u0027ve never attached any compound name to the driver before.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":66,"context_line":"Proposed change"},{"line_number":67,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Introduce a new optional hardware interface, ``encrypteddrive``, with three"},{"line_number":70,"context_line":"implementations:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``no-encrypteddrive`` (default) -- a no-op; ``is_active()`` returns"}],"source_content_type":"text/x-rst","patch_set":2,"id":"f744a7fb_e304eef9","line":69,"range":{"start_line":69,"start_character":47,"end_line":69,"end_character":61},"in_reply_to":"dee5a522_c4d39dc8","updated":"2026-07-28 09:01:34.000000000","message":"Acknowledged","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":69,"context_line":"Introduce a new optional hardware interface, ``encrypteddrive``, with three"},{"line_number":70,"context_line":"implementations:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``no-encrypteddrive`` (default) -- a no-op; ``is_active()`` returns"},{"line_number":73,"context_line":"  ``False`` so behavior is identical to today\u0027s Ironic for every node that"},{"line_number":74,"context_line":"  does not opt in."},{"line_number":75,"context_line":"* ``agent`` -- drives the ``ironic-python-agent`` ``encrypteddrive`` extension"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9b9e5c2c_f4ac9ec3","line":72,"range":{"start_line":72,"start_character":7,"end_line":72,"end_character":21},"updated":"2026-07-27 17:22:19.000000000","message":"Perhaps \"no-sed\"  instead?","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":69,"context_line":"Introduce a new optional hardware interface, ``encrypteddrive``, with three"},{"line_number":70,"context_line":"implementations:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* ``no-encrypteddrive`` (default) -- a no-op; ``is_active()`` returns"},{"line_number":73,"context_line":"  ``False`` so behavior is identical to today\u0027s Ironic for every node that"},{"line_number":74,"context_line":"  does not opt in."},{"line_number":75,"context_line":"* ``agent`` -- drives the ``ironic-python-agent`` ``encrypteddrive`` extension"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8a239e_f6337d20","line":72,"range":{"start_line":72,"start_character":7,"end_line":72,"end_character":21},"in_reply_to":"9b9e5c2c_f4ac9ec3","updated":"2026-07-28 09:01:34.000000000","message":"Acknowledged","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":73,"context_line":"  ``False`` so behavior is identical to today\u0027s Ironic for every node that"},{"line_number":74,"context_line":"  does not opt in."},{"line_number":75,"context_line":"* ``agent`` -- drives the ``ironic-python-agent`` ``encrypteddrive`` extension"},{"line_number":76,"context_line":"  over the existing agent RPC channel."},{"line_number":77,"context_line":"* ``fake`` -- for testing."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"A node opts into SED handling purely by selecting the ``agent``"}],"source_content_type":"text/x-rst","patch_set":2,"id":"60327ad9_8ea8cda6","line":76,"range":{"start_line":76,"start_character":26,"end_line":76,"end_character":38},"updated":"2026-07-27 17:22:19.000000000","message":"nit s/RPC channel/interaction/ ?\n\nSince there is not actual RPC in use like use of a message bus in the openstack sense.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":73,"context_line":"  ``False`` so behavior is identical to today\u0027s Ironic for every node that"},{"line_number":74,"context_line":"  does not opt in."},{"line_number":75,"context_line":"* ``agent`` -- drives the ``ironic-python-agent`` ``encrypteddrive`` extension"},{"line_number":76,"context_line":"  over the existing agent RPC channel."},{"line_number":77,"context_line":"* ``fake`` -- for testing."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"A node opts into SED handling purely by selecting the ``agent``"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7e8b669e_be420d6e","line":76,"range":{"start_line":76,"start_character":26,"end_line":76,"end_character":38},"in_reply_to":"60327ad9_8ea8cda6","updated":"2026-07-28 09:01:34.000000000","message":"Acknowledged","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":73,"context_line":"  ``False`` so behavior is identical to today\u0027s Ironic for every node that"},{"line_number":74,"context_line":"  does not opt in."},{"line_number":75,"context_line":"* ``agent`` -- drives the ``ironic-python-agent`` ``encrypteddrive`` extension"},{"line_number":76,"context_line":"  over the existing agent RPC channel."},{"line_number":77,"context_line":"* ``fake`` -- for testing."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"A node opts into SED handling purely by selecting the ``agent``"}],"source_content_type":"text/x-rst","patch_set":2,"id":"a4ea7eb2_e1eb1c4d","line":76,"range":{"start_line":76,"start_character":26,"end_line":76,"end_character":38},"in_reply_to":"7e8b669e_be420d6e","updated":"2026-07-28 16:33:30.000000000","message":"Most if not all agent operations are in the agent deploy interface. What justifies adding a whole new interface type? Do you envision something that is not IPA-based that still can be used with IPA-based deployment process?","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":false,"context_lines":[{"line_number":84,"context_line":"The interface exposes:"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"* ``unlock(task)`` -- boot the ramdisk and present the stored passphrase to"},{"line_number":87,"context_line":"  open the drives on the next power-on."},{"line_number":88,"context_line":"* ``do_add_encryption_key`` / ``do_remove_encryption_key`` -- enable/disable"},{"line_number":89,"context_line":"  the locking range with a passphrase (deploy/clean steps)."},{"line_number":90,"context_line":"* ``psid_reset`` -- factory-reset drives via PSID revert (deploy/clean steps)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3d533dee_e7fa3920","line":87,"updated":"2026-07-27 17:22:19.000000000","message":"My interpretation is that this would be a series of hard coded steps to reboot the node, fire up the agent, and unlock the drive, trigger the soft reboot, pivot the network, et cetra to reach an operating state.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Passphrases and PSIDs are never stored in the node record. Ironic accesses"},{"line_number":97,"context_line":"them through the OpenStack key manager abstraction"},{"line_number":98,"context_line":"(``castellan``), consistent with how Ironic already handles other secrets:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* The **per-node passphrase** is generated by the conductor when the locking"},{"line_number":101,"context_line":"  range is enabled, stored in the key manager, and retrieved when the node"}],"source_content_type":"text/x-rst","patch_set":2,"id":"4955e584_abcb7440","line":98,"updated":"2026-07-28 17:05:52.000000000","message":"Castellan and Barbican are two OpenStack projects that are not well maintained. I am -1 to adding a hard dependency on them for any Ironic feature.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":93,"context_line":"Secret storage"},{"line_number":94,"context_line":"--------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Passphrases and PSIDs are never stored in the node record. Ironic accesses"},{"line_number":97,"context_line":"them through the OpenStack key manager abstraction"},{"line_number":98,"context_line":"(``castellan``), consistent with how Ironic already handles other secrets:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* The **per-node passphrase** is generated by the conductor when the locking"},{"line_number":101,"context_line":"  range is enabled, stored in the key manager, and retrieved when the node"},{"line_number":102,"context_line":"  must be unlocked. It is passed to the ramdisk only over the authenticated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b0d74980_ec9c78b2","line":99,"range":{"start_line":96,"start_character":0,"end_line":99,"end_character":0},"updated":"2026-07-27 17:22:19.000000000","message":"So, I\u0027m just going to highlight that this will functionally lock this functionality out from approximately half of Ironic deployments. A possible path is a non-integrated path. I\u0027d re-frame this as the integrated secret storage usage path and ironic could wire up a second path for key/secret data as it relates to this feature.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":93,"context_line":"Secret storage"},{"line_number":94,"context_line":"--------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Passphrases and PSIDs are never stored in the node record. Ironic accesses"},{"line_number":97,"context_line":"them through the OpenStack key manager abstraction"},{"line_number":98,"context_line":"(``castellan``), consistent with how Ironic already handles other secrets:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* The **per-node passphrase** is generated by the conductor when the locking"},{"line_number":101,"context_line":"  range is enabled, stored in the key manager, and retrieved when the node"},{"line_number":102,"context_line":"  must be unlocked. It is passed to the ramdisk only over the authenticated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"72ce0a63_2fd1f760","line":99,"range":{"start_line":96,"start_character":0,"end_line":99,"end_character":0},"in_reply_to":"b0d74980_ec9c78b2","updated":"2026-07-28 16:33:30.000000000","message":"Yeah, it\u0027s a concern for us. I also don\u0027t think it\u0027s consistent with how Ironic handles other secrets: we keep BMC secrets in the database.\n\nI definitely don\u0027t mind adding castellan support, but it should be opt-in, not the only option.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":103,"context_line":"  agent channel and only for the duration of the operation."},{"line_number":104,"context_line":"* The **PSID** of each drive is operator-supplied out of band (it is printed"},{"line_number":105,"context_line":"  on the physical drive) and looked up per drive serial. PSIDs are read-only"},{"line_number":106,"context_line":"  from Ironic\u0027s point of view."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"The secret naming scheme (which key-manager entry holds a node\u0027s passphrase,"},{"line_number":109,"context_line":"and how a drive serial maps to its PSID entry) is configurable so operators"}],"source_content_type":"text/x-rst","patch_set":2,"id":"c6193f74_1d3f5ac1","line":106,"updated":"2026-07-27 17:22:19.000000000","message":"If, and only if based upon what has been said, I\u0027m wondering what is really the motivation to store PSIDs in a remote secret store if the PSID only gets used to reset the node out?","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":103,"context_line":"  agent channel and only for the duration of the operation."},{"line_number":104,"context_line":"* The **PSID** of each drive is operator-supplied out of band (it is printed"},{"line_number":105,"context_line":"  on the physical drive) and looked up per drive serial. PSIDs are read-only"},{"line_number":106,"context_line":"  from Ironic\u0027s point of view."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"The secret naming scheme (which key-manager entry holds a node\u0027s passphrase,"},{"line_number":109,"context_line":"and how a drive serial maps to its PSID entry) is configurable so operators"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa57e552_3099f0a2","line":106,"in_reply_to":"c6193f74_1d3f5ac1","updated":"2026-07-28 09:01:34.000000000","message":"PSID will also destroy customer data. Keep also in mind that disks can be moved from a host to another (mainteancne)\nHere we say that it can be \"dangerou\" to let it clear in DB, so we prefer to store it in a secure area (disk manufacturer confirm).\nMore over: we think that (for example) (redfish|ipmi)_password should also be store in a secure area, so castellan/barbican should be the way to go in MPV","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  rather than a new interface. Rejected: SED is an orthogonal capability that"},{"line_number":131,"context_line":"  applies regardless of RAID/deploy choice, and a dedicated interface keeps it"},{"line_number":132,"context_line":"  opt-in and cleanly disabled by default."},{"line_number":133,"context_line":"* **Reuse the ``rescue`` provision states for unlock** instead of dedicated"},{"line_number":134,"context_line":"  states. The unlock flow does reuse the rescue *network* plumbing, but"},{"line_number":135,"context_line":"  overloading rescue states would conflate two operator-visible operations and"},{"line_number":136,"context_line":"  make the state machine ambiguous. Dedicated states were chosen for clarity"},{"line_number":137,"context_line":"  (see State Machine Impact)."},{"line_number":138,"context_line":"* **Store passphrases in ``driver_info``/``instance_info``.** Rejected on"},{"line_number":139,"context_line":"  security grounds; secrets belong in the key manager."},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"83797ef2_0fb601f0","line":137,"range":{"start_line":133,"start_character":0,"end_line":137,"end_character":29},"updated":"2026-07-27 17:22:19.000000000","message":"For what it is worth, I think ironic\u0027s reviewers would reject this one, so it might make sense to drop.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":135,"context_line":"  overloading rescue states would conflate two operator-visible operations and"},{"line_number":136,"context_line":"  make the state machine ambiguous. Dedicated states were chosen for clarity"},{"line_number":137,"context_line":"  (see State Machine Impact)."},{"line_number":138,"context_line":"* **Store passphrases in ``driver_info``/``instance_info``.** Rejected on"},{"line_number":139,"context_line":"  security grounds; secrets belong in the key manager."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Data model impact"},{"line_number":142,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"45f0e0b2_bbfabe24","line":139,"range":{"start_line":138,"start_character":4,"end_line":139,"end_character":54},"updated":"2026-07-27 17:22:19.000000000","message":"We\u0027re going to likely need to find a middle-ground here.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":156,"context_line":"State Machine Impact"},{"line_number":157,"context_line":"--------------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Two new stable provision states are added to support opening locked drives on"},{"line_number":160,"context_line":"power-on, plus the verbs to reach them:"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"* ``DRIVE_UNLOCKING`` (``\"drive unlocking\"``) -- transient: the conductor is"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b520d7d0_0c273b70","line":159,"updated":"2026-07-28 16:33:30.000000000","message":"nit: we call states stable when a node does not move out without user\u0027s request. These steps are not stable.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":162,"context_line":"* ``DRIVE_UNLOCKING`` (``\"drive unlocking\"``) -- transient: the conductor is"},{"line_number":163,"context_line":"  booting the ramdisk and preparing the network to perform an unlock."},{"line_number":164,"context_line":"* ``DRIVE_UNLOCKWAIT`` (``\"unlock wait\"``) -- the conductor is waiting for the"},{"line_number":165,"context_line":"  ramdisk agent to heartbeat so it can hand it the passphrase."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"Transitions (only reached when ``encrypteddrive.is_active()``):"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"668e774e_77031540","line":165,"updated":"2026-07-28 16:33:30.000000000","message":"I\u0027m not 100% convinced that we need new states, to be honest. It seems that deploy/clean/etc can work without them by reusing existing transient states. I need to understand how you envision normal power actions working (see my other comments).","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[{"line_number":162,"context_line":"* ``DRIVE_UNLOCKING`` (``\"drive unlocking\"``) -- transient: the conductor is"},{"line_number":163,"context_line":"  booting the ramdisk and preparing the network to perform an unlock."},{"line_number":164,"context_line":"* ``DRIVE_UNLOCKWAIT`` (``\"unlock wait\"``) -- the conductor is waiting for the"},{"line_number":165,"context_line":"  ramdisk agent to heartbeat so it can hand it the passphrase."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"Transitions (only reached when ``encrypteddrive.is_active()``):"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3c262056_c3b07919","line":165,"in_reply_to":"668e774e_77031540","updated":"2026-07-28 17:05:52.000000000","message":"I am -1 and close to -2 on this implementation, and I\u0027m not sure it can be corrected in a way that I would be OK with.\n\nIn order to support this hardware we have to add:\n- additional ramdisk boots\n- complexity around powering on/off (when knowing a node is powered off is one of our primary security mechanisms\"\n- IPA running in unexpected situations\n\nI don\u0027t like this, but I really think I\u0027d like something without explicit states even less.\n\nThis manner of disk encryption seems incompatible with a cloud provisioning model.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":172,"context_line":"  drives are unlocked, and the node resumes to ``ACTIVE``."},{"line_number":173,"context_line":"* **Power-on of an active/rescued node.** When a locked node is powered on,"},{"line_number":174,"context_line":"  the conductor first boots the ramdisk: ``... -\u003e DRIVE_UNLOCKING -\u003e"},{"line_number":175,"context_line":"  DRIVE_UNLOCKWAIT -\u003e (heartbeat) -\u003e ACTIVE``."},{"line_number":176,"context_line":"* **Rescue.** When rescuing a SED node, drives are unlocked (passphrase"},{"line_number":177,"context_line":"  presented) before the rescue ramdisk is finalized, so the rescue environment"},{"line_number":178,"context_line":"  sees readable drives."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f50ae9f_78cc95de","line":175,"updated":"2026-07-28 16:33:30.000000000","message":"How does the handover from the ramdisk to the instance happens? Is it our IPA ramdisk or is it something else?","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":173,"context_line":"* **Power-on of an active/rescued node.** When a locked node is powered on,"},{"line_number":174,"context_line":"  the conductor first boots the ramdisk: ``... -\u003e DRIVE_UNLOCKING -\u003e"},{"line_number":175,"context_line":"  DRIVE_UNLOCKWAIT -\u003e (heartbeat) -\u003e ACTIVE``."},{"line_number":176,"context_line":"* **Rescue.** When rescuing a SED node, drives are unlocked (passphrase"},{"line_number":177,"context_line":"  presented) before the rescue ramdisk is finalized, so the rescue environment"},{"line_number":178,"context_line":"  sees readable drives."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"A verb to leave the wait state without completing the unlock (the downstream"},{"line_number":181,"context_line":"implementation calls it ``un_unlock``; a clearer upstream name such as"}],"source_content_type":"text/x-rst","patch_set":2,"id":"d2b78158_a76d5a85","line":178,"range":{"start_line":176,"start_character":0,"end_line":178,"end_character":23},"updated":"2026-07-27 17:22:19.000000000","message":"When we get to the code, we will need to make sure that this is super difficult to extract. Likely the best way is to encode/encrypt the value for transport on a command/post payload so we avoid any way of this data getting logged. The agent will exit for rescue releasing the memory holding the secret preventing it from easy recovery by a malicious user of \"rescue\"","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":173,"context_line":"* **Power-on of an active/rescued node.** When a locked node is powered on,"},{"line_number":174,"context_line":"  the conductor first boots the ramdisk: ``... -\u003e DRIVE_UNLOCKING -\u003e"},{"line_number":175,"context_line":"  DRIVE_UNLOCKWAIT -\u003e (heartbeat) -\u003e ACTIVE``."},{"line_number":176,"context_line":"* **Rescue.** When rescuing a SED node, drives are unlocked (passphrase"},{"line_number":177,"context_line":"  presented) before the rescue ramdisk is finalized, so the rescue environment"},{"line_number":178,"context_line":"  sees readable drives."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"A verb to leave the wait state without completing the unlock (the downstream"},{"line_number":181,"context_line":"implementation calls it ``un_unlock``; a clearer upstream name such as"}],"source_content_type":"text/x-rst","patch_set":2,"id":"6e8d0e60_93b649a9","line":178,"range":{"start_line":176,"start_character":0,"end_line":178,"end_character":23},"in_reply_to":"d2b78158_a76d5a85","updated":"2026-07-28 09:01:34.000000000","message":"Acknowledged","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":179,"context_line":""},{"line_number":180,"context_line":"A verb to leave the wait state without completing the unlock (the downstream"},{"line_number":181,"context_line":"implementation calls it ``un_unlock``; a clearer upstream name such as"},{"line_number":182,"context_line":"``abort``/``unhold`` will be chosen during review) allows an operator to"},{"line_number":183,"context_line":"recover a node stuck in ``DRIVE_UNLOCKWAIT``. Power state changes are blocked"},{"line_number":184,"context_line":"by the API while a node is in ``DRIVE_UNLOCKING`` / ``DRIVE_UNLOCKWAIT`` to"},{"line_number":185,"context_line":"avoid racing the unlock."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fae580d1_7c62ab1b","line":182,"range":{"start_line":182,"start_character":1,"end_line":182,"end_character":2},"updated":"2026-07-27 17:22:19.000000000","message":"FWIW, this would need to be ``abort`` to follow the existing flow/model. ``unhold`` is not related.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":187,"context_line":"An ASCII sketch of the added edges::"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"    DEPLOYING --post-deploy-unlocking--\u003e UNLOCK WAIT --resume--\u003e ACTIVE"},{"line_number":190,"context_line":"    ACTIVE/RESCUE --(power on)--\u003e DRIVE UNLOCKING --\u003e UNLOCK WAIT --\u003e ACTIVE"},{"line_number":191,"context_line":"    UNLOCK WAIT --abort--\u003e (previous stable state)"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"REST API impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3615b191_053af2a2","line":190,"updated":"2026-07-28 16:33:30.000000000","message":"Power actions are currently not integrated into the state machine, so it\u0027s a massive change. It\u0027s probably better to completely disable the power API and force users to go through some new service_steps instead.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":189,"context_line":"    DEPLOYING --post-deploy-unlocking--\u003e UNLOCK WAIT --resume--\u003e ACTIVE"},{"line_number":190,"context_line":"    ACTIVE/RESCUE --(power on)--\u003e DRIVE UNLOCKING --\u003e UNLOCK WAIT --\u003e ACTIVE"},{"line_number":191,"context_line":"    UNLOCK WAIT --abort--\u003e (previous stable state)"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"REST API impact"},{"line_number":194,"context_line":"---------------"},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ceb9211a_d6da265c","line":192,"updated":"2026-07-27 17:22:19.000000000","message":"A flow diagram might be better, fwiw.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":197,"context_line":"  like ``raid_interface`` and friends (new microversion). It is subject to the"},{"line_number":198,"context_line":"  same driver-composition validation."},{"line_number":199,"context_line":"* A new provisioning verb is accepted by"},{"line_number":200,"context_line":"  ``PUT /v1/nodes/{id}/states/provision`` to abort an unlock wait."},{"line_number":201,"context_line":"* ``enabled_encrypteddrive_interfaces`` / ``default_encrypteddrive_interface``"},{"line_number":202,"context_line":"  appear in the driver/interface introspection responses like every other"},{"line_number":203,"context_line":"  interface."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ad544676_d8ed1e7f","line":200,"updated":"2026-07-27 17:22:19.000000000","message":"For what it is worth, if I\u0027m recalling the abort handling properly, it should be fairly well suited to being the modeled way, which means there really will be minimal impact because it would already reach the conductor to be handled.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":201,"context_line":"* ``enabled_encrypteddrive_interfaces`` / ``default_encrypteddrive_interface``"},{"line_number":202,"context_line":"  appear in the driver/interface introspection responses like every other"},{"line_number":203,"context_line":"  interface."},{"line_number":204,"context_line":"* Setting power state is rejected (409) for nodes in the new unlock states."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Client (CLI) impact"},{"line_number":207,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"f1ff310d_6c4ca4fb","line":204,"updated":"2026-07-27 17:22:19.000000000","message":"I\u0027m wondering if this needs to be API version locked...","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"60201a80790d78a620a74685a4e344776f6e538a","unresolved":true,"context_lines":[{"line_number":240,"context_line":"  support ``agent``)."},{"line_number":241,"context_line":"* The following clean/deploy steps are added on the interface:"},{"line_number":242,"context_line":"  ``psid_reset`` (deploy + clean), ``do_add_encryption_key`` (deploy),"},{"line_number":243,"context_line":"  ``do_remove_encryption_key`` (clean). Their relative ordering is fixed via"},{"line_number":244,"context_line":"  the interface-priority maps in the step machinery."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Nova driver impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bc9f5c9b_a8bb6ccb","line":243,"updated":"2026-07-28 16:33:30.000000000","message":"nit: s/do_/ in both","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":256,"context_line":"A new ``encrypteddrive`` extension is added to ``ironic-python-agent``,"},{"line_number":257,"context_line":"wrapping ``sedutil-cli``:"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"* Detects the TCG standard of each block device (``opal2`` vs"},{"line_number":260,"context_line":"  ``enterprise`` vs non-SED) from a cached ``sedutil-cli --scan``."},{"line_number":261,"context_line":"* Commands: ``unlock_disk`` (present passphrase, open locking range, clear"},{"line_number":262,"context_line":"  shadow-MBR), ``add_encryption_key`` (initial setup + enable locking range),"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a24f8fa_0bf023e8","line":259,"updated":"2026-07-27 17:22:19.000000000","message":"What is done with this context? Is it saved/preserved at all?","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":19702,"name":"Damien RANNOU","email":"damien.rannou@corp.ovh.com","username":"DamienRANNOU","status":"OVHcloud"},"change_message_id":"ecd85e7cee63d366746b21f16bed4edc05b4a21b","unresolved":true,"context_lines":[{"line_number":256,"context_line":"A new ``encrypteddrive`` extension is added to ``ironic-python-agent``,"},{"line_number":257,"context_line":"wrapping ``sedutil-cli``:"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"* Detects the TCG standard of each block device (``opal2`` vs"},{"line_number":260,"context_line":"  ``enterprise`` vs non-SED) from a cached ``sedutil-cli --scan``."},{"line_number":261,"context_line":"* Commands: ``unlock_disk`` (present passphrase, open locking range, clear"},{"line_number":262,"context_line":"  shadow-MBR), ``add_encryption_key`` (initial setup + enable locking range),"}],"source_content_type":"text/x-rst","patch_set":2,"id":"6ac61f37_e9772c0f","line":259,"in_reply_to":"1a24f8fa_0bf023e8","updated":"2026-07-28 09:01:34.000000000","message":"This is done during enrollment, we detect the sED informations of the disks, so it\u0027s store in the ironic database.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"79e855c2b6a566e689ba96699a9ef96e51e07af3","unresolved":true,"context_lines":[{"line_number":297,"context_line":"  does not protect a running, unlocked node; the passphrase is present in"},{"line_number":298,"context_line":"  drive firmware state once unlocked, as designed by TCG."},{"line_number":299,"context_line":"* **Key manager is required** for the ``agent`` implementation; deployments"},{"line_number":300,"context_line":"  without a configured key manager can only use ``no-encrypteddrive``."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Other end user impact"},{"line_number":303,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"eb15db48_7d35142b","line":300,"updated":"2026-07-28 17:05:52.000000000","message":"The #1 primary security impact, and the reason I will -1 this spec and idea as a whole (I doubt there exists an implementation I would be OK with), is that this adds a boatload of complexity around power controls, which is one of the most important part of the Ironic flow.","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0f19e97562c0f75e2942cefcad4bbed83d0b6f0a","unresolved":true,"context_lines":[{"line_number":392,"context_line":"  hardware."},{"line_number":393,"context_line":"* Full end-to-end unlock/erase requires real SED hardware and therefore cannot"},{"line_number":394,"context_line":"  run in the gate; a documented manual/third-party test procedure will be"},{"line_number":395,"context_line":"  provided."},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"Upgrades and Backwards Compatibility"},{"line_number":398,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"44dfb44d_8fc2493e","line":395,"updated":"2026-07-27 17:22:19.000000000","message":"Into the documentation, please. :)","commit_id":"de9d7fc28a2cd9af8c1ae6656a52d02cfe16a4bd"}]}