)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e237944f71b417aa6e68852de1d10e9af48b7991","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"b7013565_939fc666","updated":"2026-05-19 15:34:25.000000000","message":"Have we ensured this can\u0027t be bypassed via runbooks?","commit_id":"22c1896f1a83b6a6b19369990970bedd74ce7bf6"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"95ba0dd8e1ac36ea69a8ef6021ed4f9ad825a61f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":8,"id":"403aa604_bb2244b5","updated":"2026-06-01 20:33:56.000000000","message":"CI failures kinda proving it works:     AssertionError: \"service step \u0027bios.apply_configuration\u0027 is not allowed\" does not match \"Step \u0027bios.apply_configuration\u0027 is not allowed. Disallowed by operator configuration [api]disallow_deploy|service|clean_steps.\"\n \n \nBut you need to fix it :)","commit_id":"9b693f6331c6647f6853765e0caa9bfd53917120"},{"author":{"_account_id":35099,"name":"Jakub Jelinek","email":"jakub.jelinek@cern.ch","username":"kubajj"},"change_message_id":"58aa29700d38cb863044d71e9a9b7136999ca873","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"da8b5ed1_606cd13b","updated":"2026-06-09 12:39:43.000000000","message":"This is neat\n\nThe only thing I can think of is steps disabled for everyone except admins - i.e. I don\u0027t want users to burn-in nodes from the hardware pool","commit_id":"ae71bf1b23807149d0792e15d163cd140e334071"}],"ironic/api/controllers/v1/node.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"6f824208e01b64e7eefba400ccd172d68e70963e","unresolved":true,"context_lines":[{"line_number":1360,"context_line":"    _check_steps(clean_steps, \u0027clean\u0027, _STEPS_SCHEMA)"},{"line_number":1361,"context_line":""},{"line_number":1362,"context_line":"    disallowed_steps \u003d CONF.api.disallow_clean_steps"},{"line_number":1363,"context_line":"    if disallowed_steps:"},{"line_number":1364,"context_line":"        for step in clean_steps:"},{"line_number":1365,"context_line":"            step_id \u003d \u0027%s.%s\u0027 % (step[\u0027interface\u0027], step[\u0027step\u0027])"},{"line_number":1366,"context_line":"            if step_id in disallowed_steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"25de37e5_6634be48","line":1363,"updated":"2026-05-19 16:04:25.000000000","message":"So, I think the basic issue is this ignores runbook execution and which would then become an effective way to side-step this.  I think the way forward to address this is to standardize the conductor side evaluation of steps *before* the async task is launched (task.process_event) in ironic/conductor/manager.py instances where steps are interacted with. As I look at this, there is also an underlying problem, we sometiems get those steps after we\u0027ve launched the process event, so we may need to do some additional internal retooling of conductor/manager.py to frontload the collection and checking of steps.","commit_id":"22c1896f1a83b6a6b19369990970bedd74ce7bf6"},{"author":{"_account_id":37087,"name":"Himanshu Roy","display_name":"Himanshu Roy","email":"hroy@redhat.com","username":"hroyrh"},"change_message_id":"9b8ef2325720833e1620cb6909ad5740f8adfcb1","unresolved":true,"context_lines":[{"line_number":1360,"context_line":"    _check_steps(clean_steps, \u0027clean\u0027, _STEPS_SCHEMA)"},{"line_number":1361,"context_line":""},{"line_number":1362,"context_line":"    disallowed_steps \u003d CONF.api.disallow_clean_steps"},{"line_number":1363,"context_line":"    if disallowed_steps:"},{"line_number":1364,"context_line":"        for step in clean_steps:"},{"line_number":1365,"context_line":"            step_id \u003d \u0027%s.%s\u0027 % (step[\u0027interface\u0027], step[\u0027step\u0027])"},{"line_number":1366,"context_line":"            if step_id in disallowed_steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa64d8ef_f9ccd87a","line":1363,"in_reply_to":"25de37e5_6634be48","updated":"2026-06-03 03:29:56.000000000","message":"Thanks for the feedback! \nI\u0027ve added check at api level, conductor/manager before state transition happens and finally under conductor/steps for autogenerated steps. At this point, the node.py api checks is redundant, but allows for early exception catch for user steps - should we keep it or not ?","commit_id":"22c1896f1a83b6a6b19369990970bedd74ce7bf6"},{"author":{"_account_id":37087,"name":"Himanshu Roy","display_name":"Himanshu Roy","email":"hroy@redhat.com","username":"hroyrh"},"change_message_id":"9b07b74894cb3b94b90435861320bf9d0c3d4772","unresolved":false,"context_lines":[{"line_number":1360,"context_line":"    _check_steps(clean_steps, \u0027clean\u0027, _STEPS_SCHEMA)"},{"line_number":1361,"context_line":""},{"line_number":1362,"context_line":"    disallowed_steps \u003d CONF.api.disallow_clean_steps"},{"line_number":1363,"context_line":"    if disallowed_steps:"},{"line_number":1364,"context_line":"        for step in clean_steps:"},{"line_number":1365,"context_line":"            step_id \u003d \u0027%s.%s\u0027 % (step[\u0027interface\u0027], step[\u0027step\u0027])"},{"line_number":1366,"context_line":"            if step_id in disallowed_steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"68df495d_8b65bbc5","line":1363,"in_reply_to":"e3ae4171_593dcbd5","updated":"2026-06-05 17:00:02.000000000","message":"Acknowledged","commit_id":"22c1896f1a83b6a6b19369990970bedd74ce7bf6"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"fecffd1e0690e174f628a6b2744315b3c541eaa3","unresolved":true,"context_lines":[{"line_number":1360,"context_line":"    _check_steps(clean_steps, \u0027clean\u0027, _STEPS_SCHEMA)"},{"line_number":1361,"context_line":""},{"line_number":1362,"context_line":"    disallowed_steps \u003d CONF.api.disallow_clean_steps"},{"line_number":1363,"context_line":"    if disallowed_steps:"},{"line_number":1364,"context_line":"        for step in clean_steps:"},{"line_number":1365,"context_line":"            step_id \u003d \u0027%s.%s\u0027 % (step[\u0027interface\u0027], step[\u0027step\u0027])"},{"line_number":1366,"context_line":"            if step_id in disallowed_steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"e3ae4171_593dcbd5","line":1363,"in_reply_to":"fa64d8ef_f9ccd87a","updated":"2026-06-05 15:14:38.000000000","message":"I think it makes sense to keep because users can still submit steps, and that is okay. Ultimately we still want a guard there.","commit_id":"22c1896f1a83b6a6b19369990970bedd74ce7bf6"}],"ironic/common/exception.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"95ba0dd8e1ac36ea69a8ef6021ed4f9ad825a61f","unresolved":true,"context_lines":[{"line_number":984,"context_line":""},{"line_number":985,"context_line":"class StepNotAllowed(Invalid):"},{"line_number":986,"context_line":"    _msg_fmt \u003d _(\"Step \u0027%(step)s\u0027 is not allowed. Disallowed by operator \""},{"line_number":987,"context_line":"                 \"configuration [api]disallow_deploy|service|clean_steps.\")"},{"line_number":988,"context_line":""},{"line_number":989,"context_line":"class InvalidImage(ImageUnacceptable):"},{"line_number":990,"context_line":"    _msg_fmt \u003d _(\"The requested image is not valid for use.\")"}],"source_content_type":"text/x-python","patch_set":8,"id":"ed620113_a00a02bb","line":987,"updated":"2026-06-01 20:33:56.000000000","message":"\u003eDisallowed by operator configuration [api]disallow_deploy|service|clean_steps.\"\n\nThis looks really rough in a log, as we\u0027re referencing a config that doesn\u0027t exist. How hard would it be to pass in deploy/service/clean to give us a cleaner message? (looks like we\u0027re already passing in step_type? Just use it?)","commit_id":"9b693f6331c6647f6853765e0caa9bfd53917120"},{"author":{"_account_id":37087,"name":"Himanshu Roy","display_name":"Himanshu Roy","email":"hroy@redhat.com","username":"hroyrh"},"change_message_id":"9b8ef2325720833e1620cb6909ad5740f8adfcb1","unresolved":true,"context_lines":[{"line_number":984,"context_line":""},{"line_number":985,"context_line":"class StepNotAllowed(Invalid):"},{"line_number":986,"context_line":"    _msg_fmt \u003d _(\"Step \u0027%(step)s\u0027 is not allowed. Disallowed by operator \""},{"line_number":987,"context_line":"                 \"configuration [api]disallow_deploy|service|clean_steps.\")"},{"line_number":988,"context_line":""},{"line_number":989,"context_line":"class InvalidImage(ImageUnacceptable):"},{"line_number":990,"context_line":"    _msg_fmt \u003d _(\"The requested image is not valid for use.\")"}],"source_content_type":"text/x-python","patch_set":8,"id":"2c1e391f_d6fe58d8","line":987,"in_reply_to":"ed620113_a00a02bb","updated":"2026-06-03 03:29:56.000000000","message":"Thanks for the feedback!\nMakes sense, that patch was bit rough around the edges. Fixed now","commit_id":"9b693f6331c6647f6853765e0caa9bfd53917120"}]}