12 Commits

Author SHA1 Message Date
Jay Faulkner
be8ee50ea1 Inspect non-raw images for safety
When IPA gets a non-raw image, it performs an on-the-fly conversion
using qemu-img convert, as well as running qemu-img frequently to get
basic information about the image before validating it.

Now, we ensure that before any qemu-img calls are made, that we have
inspected the image for safety and pass through the detected format.

If given a disk_format=raw image and image streaming is enabled
(default), we retain the existing behavior of not inspecting it in
any way and streaming it bit-perfect to the device. In this case, we
never use qemu-based tools on the image at all.

If given a disk_format=raw image and image streaming is disabled, this
change fixes a bug where the image may have been converted if it was not
actually raw in the first place. We now stream these bit-perfect to the
device.

Adds two config options:
- [DEFAULT]/disable_deep_image_inspection, which can be set to "True" in
  order to disable all security features. Do not do this.
- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types
  IPA should accept.

Both of these configuration options are wired up to be set by the lookup
data returned by Ironic at lookup time.

This uses a image format inspection module imported from Nova; this
inspector will eventually live in oslo.utils, at which point we'll
migrate our usage of the inspector to it.

Closes-Bug: #2071740
Change-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7
2024-09-04 09:21:59 -07:00
Dmitry Tantsur
f824930bbd
Import disk_{utils,partitioner} from ironic-lib
With the iscsi deploy long gone, these modules are only used in IPA and
in fact represent a large part of its critical logic. Having them
separately sometimes makes fixing issues tricky if an interface of
a function needs changing.

This change imports the code mostly as it is, just removing run_as_root and
a deprecated function, as well as moving configuration options to config.py.

Also migrates one relevant function from ironic_lib.utils.

Change-Id: If8fae8210d85c61abb85c388b300e40a75d0531c
2024-03-15 18:45:04 +01:00
Dmitry Tantsur
9f849472ca
Drop usage of run_as_root
IPA can only be run as root and does not use rootwrap. We need to
eventually remove support for rootwrap from ironic-lib.

Change-Id: Iffd5cae5e3dc8637bc6dd10b3bcc9fe33932b8cf
2024-01-23 14:23:23 +01:00
Jay Faulkner
36e5993a04 [codespell] Fix spelling issues in IPA
This fixes several spelling issues identified by codepsell. In some
cases, I may have manually modified a line to make the output more clear
or to correct grammatical issues which were obvious in the codespell
output.

Later changes in this chain will provide the codespell config used to
generate this, as well as adding this commit's SHA, once landed, to a
.git-blame-ignore-revs file to ensure it will not pollute git historys
for modern clients.

Related-Bug: 2047654
Change-Id: I240cf8484865c9b748ceb51f3c7b9fd973cb5ada
2023-12-28 10:54:46 -08:00
Boushra Bettir
dbf3e5408d Replace shlex module with helper function
Used helper function, `parse_device_tags`
from ironic_lib instead of the
shlex module for their identical
functionality. Updated
mock_execute.side_effect for lsblk
compatibility in utils.execute.

Closes-Bug: #2037572
Change-Id: I6600e054f9644c67ab003f0e0f6c380b5c217223
2023-10-12 13:34:32 -07:00
Julia Kreger
b6c263a5dc preserve/handle config drives on 4k block devices
When an underlying block device (or driver) only supports 4KB IO,
this can cause some issues with aspects like using an ISO9660 filesystem
which can only support a maximum of 2KB IO.

The agent will now attempt to mount the filesystem *before* deleting the
supplied file, and should that fail it will mount the configuration drive
file from the ramdisk utilizing a loopback, and then extract the contents
of the ramdisk into a newly created VFAT filesystem which supports 4KB
block IO.

Closes-Bug: #2028002
Change-Id: I336acb8e8eb5a02dde2f5e24c258e23797d200ee
2023-08-24 08:10:22 -07:00
Dmitry Tantsur
6a1334a068 Drop support for instance netboot
Change-Id: I2b4c543537dac8904028fdcdb590c1c214238e10
2022-07-07 16:38:22 +02:00
Dmitry Tantsur
65c4de903a Use a pre-defined partition UUID to detect configdrive on GPT
Using partition numbers is currently broken for devicemapper devices.
Fortunately, GPT has partition UUIDs, so we can just generate one and
use it for lookup.

Change-Id: I41ffe4f8e4c6e43182090b5aa2a2b4b34f32efd5
2022-04-29 16:56:53 +02:00
Vanou Ishii
fa70a1909b Rescan device after filesystem creation
In work_on_disk function, IPA runs mkfs commands without
following device rescan operation. This leads to incorrect
content of uuids_to_return to be returned.
These mkfs commands modify partition label but IPA fails
to catch such changes because of no following device
rescan operation.

This commit adds call of device rescan function before
uuids_to_return construction.

Change-Id: I4e8b30deb5e2247f51ce8f10bd3271f64a264089
2022-02-11 11:02:52 +09:00
Dmitry Tantsur
36d4a18fbc Move manage_uefi from the image extension to a public location
This call is very useful for custom deploy implementations, such as one
we maintain for OpenShift. Splitting it out also makes image.py slightly
more manageable.

The get_partition call is moved to partition_utils.

Change-Id: I60a6a2823d3eb27a4ae78e913e3655dae7b54ffe
2021-11-16 17:58:16 +01:00
Dmitry Tantsur
8a66978666 Respect global parameters when downloading a configdrive
* Use the same TLS parameters as everything else
* Respect image_download_connection_timeout
* Do not ignore HTTP errors

Change-Id: I84f8021f731186d82e44ac3d4ef2d12df13f830a
2021-10-20 15:11:16 +02:00
Dmitry Tantsur
24951b1029 Import deployment logic from ironic-lib
The two functions work_on_disk and create_config_drive_partition contain
a substantial part of the deployment logic. Previously we placed them in
ironic-lib for re-using on the conductor side in the iSCSI deploy
interface. Since the iSCSI deploy is going away, we can move this code
to ironic-python-agent to simplify maintenance.

Imports code from ironic_lib commit 9fb5be348202f4854a455cd08f400ae12b99e1f2.

Change-Id: I6cbcd81533f135208b57746cb0e33ffdfaf94eee
2021-05-03 14:17:57 +02:00