Files

Julia Kreger 1c281d8445 Lockout configdrive reads on network boots

We discovered it was possible, when the agent was network
booted, due to the model of "don't break existing users"
coding, that it was possible for the script to consider
a standing config drive as valid. This could result in
configuration getting loaded from the configuration drive
which is a security issue, but only for the networking portion
of the configuration due to the use of glean instead of
cloud-init.

We since reverted out the default to have simple-init enabled,
and this change fixes the load logic so we prevent these possible
cases considering that ironic deployments using virtual media
should now all be on code bases with the publisher ID value set.

Change-Id: If2a63fd16d8ae8e71b61b39f7c0c87ff45a81cf0
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>

2025-12-17 10:28:37 -08:00

environment.d

Merge "cs10 - remove excess intel firmware"

2025-11-12 12:49:25 +00:00

extra-data.d

Copies the "ironic-agent" element from DIB

2019-08-01 23:23:37 +05:30

install.d

Build CS9 DIB IPA ramdisk with python 3.12

2025-05-19 12:03:53 +00:00

post-install.d

Fix firmware cleanup - more.

2025-11-12 12:15:23 -08:00

static

Lockout configdrive reads on network boots

2025-12-17 10:28:37 -08:00

element-deps

Revert "Add simple-init by default"

2025-12-15 18:06:40 +00:00

element-provides

Copies the "ironic-agent" element from DIB

2019-08-01 23:23:37 +05:30

package-installs.yaml

fix: Adds bsdextrautils package for Debian which provides hexdump

2025-03-04 13:05:21 -06:00

pkg-map

Do not build Debian Bullseye image anymore

2025-11-06 16:15:59 +01:00

README.rst

set a maximum systemd journal size

2025-08-04 21:16:03 +00:00

source-repository-ironic-python-agent

Import ansible version of the image building job

2019-08-29 14:22:49 +02:00

source-repository-requirements

Update upper-constraints handling

2019-10-18 12:49:28 +02:00

svc-map

Fix: IPA image building with OpenSuse.

2021-03-26 09:23:20 +00:00

README.rst

ironic-python-agent-ramdisk

Builds a ramdisk with ironic-python-agent.

More information can be found at: https://docs.openstack.org/ironic-python-agent/latest/

Beyond installing the ironic-python-agent, this element does the following:

Installs the dhcp-all-interfaces so the node, upon booting, attempts to obtain an IP address on all available network interfaces.
Disables the iptables service on SysV and systemd based systems.
Disables the ufw service on Upstart based systems.
Installs packages required for the operation of the ironic-python-agent::

qemu-utils parted hdparm util-linux genisoimage
When installing from source, python-dev and gcc are also installed in order to support source based installation of ironic-python-agent and its dependencies.
Install the certificate if any, which is set to the environment variable DIB_IPA_CERT for validating the authenticity by ironic-python-agent. The certificate can be self-signed certificate or CA certificate.
Compresses initramfs with command specified in environment variable DIB_IPA_COMPRESS_CMD, which is 'gzip' by default. This command should listen for raw data from stdin and write compressed data to stdout. Command can be with arguments.
Configures rescue mode if DIB_IPA_ENABLE_RESCUE is not set to false.
By default, sets a maximum size for the ramdisk systemd journal to 15M. This can be disabled by setting DIB_IPA_DISABLE_JOURNAL_MAX_LOG_SIZE to any value which is not False.

This element outputs three files:

$IMAGE-NAME.initramfs: The deploy ramdisk file containing the ironic-python-agent (IPA) service.
$IMAGE-NAME.kernel: The kernel binary file.

Note

The package based install currently only enables the service when using the systemd init system. This can easily be changed if there is an agent package which includes upstart or sysv packaging.

Note

Using the ramdisk will require at least 1.5GB of ram