ironic-python-agent/ironic_python_agent/extensions
Jay Faulkner e303a369dc Inspect non-raw images for safety
When IPA gets a non-raw image, it performs an on-the-fly conversion
using qemu-img convert, as well as running qemu-img frequently to get
basic information about the image before validating it.

Now, we ensure that before any qemu-img calls are made, that we have
inspected the image for safety and pass through the detected format.

If given a disk_format=raw image and image streaming is enabled
(default), we retain the existing behavior of not inspecting it in
any way and streaming it bit-perfect to the device. In this case, we
never use qemu-based tools on the image at all.

If given a disk_format=raw image and image streaming is disabled, this
change fixes a bug where the image may have been converted if it was not
actually raw in the first place. We now stream these bit-perfect to the
device.

Adds two config options:
- [DEFAULT]/disable_deep_image_inspection, which can be set to "True" in
  order to disable all security features. Do not do this.
- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types
  IPA should accept.

Both of these configuration options are wired up to be set by the lookup
data returned by Ironic at lookup time.

This uses a image format inspection module imported from Nova; this
inspector will eventually live in oslo.utils, at which point we'll
migrate our usage of the inspector to it.

Closes-Bug: #2071740
Change-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7
2024-09-04 09:11:28 -07:00
..
__init__.py Organize agent extensions 2014-04-14 15:09:12 -07:00
base.py Do not serialize command_params 2021-05-18 12:59:28 +02:00
clean.py Fix passing kwargs in clean steps 2022-07-01 23:03:55 +00:00
deploy.py Simplify error messages when running clean/deploy step 2021-11-09 13:58:44 +01:00
flow.py Update to hacking 0.12.0 and use new checks 2016-11-08 11:31:18 -08:00
image.py [codespell] Fix spelling issues in IPA 2023-12-28 10:54:46 -08:00
log.py Add a log extension 2016-06-28 17:02:11 +01:00
poll.py Adds poll mode deployment support 2020-06-21 16:44:00 +08:00
rescue.py Use crypt to generate salt 2020-03-19 15:16:00 +01:00
service.py Add get_service_steps logic to the agent 2023-08-31 06:22:22 -07:00
standby.py Inspect non-raw images for safety 2024-09-04 09:11:28 -07:00