Merge "Require hashed passwords for rescue by default"

2024-07-30 10:38:46 +00:00 · 2024-07-30 10:38:46 +00:00 · 160701ed16
commit 160701ed16
parent fd11cd5bfb d146558ac3
2 changed files with 6 additions and 2 deletions
--- a/ironic/conf/conductor.py
+++ b/ironic/conf/conductor.py
@ -258,8 +258,7 @@ opts = [
               help=_('Password hash algorithm to be used for the rescue '
                      'password.')),
    cfg.BoolOpt('require_rescue_password_hashed',
-                # TODO(TheJulia): Change this to True in Victoria.
-                default=False,
+                default=True,
                mutable=True,
                help=_('Option to cause the conductor to not fallback to '
                       'an un-hashed version of the rescue password, '
--- a/releasenotes/notes/require-hashed-rescue-password-6f7c0424e12c1aeb.yaml
+++ b/releasenotes/notes/require-hashed-rescue-password-6f7c0424e12c1aeb.yaml
@ -0,0 +1,5 @@
+upgrade:
+  - |
+    Ironic now requires rescue passwords to be hashed. Operators who would like
+    to continue using unhashed passwords must set
+    `[conductor]/require_rescue_password_hashed` to ``false``.