diff --git a/ansible/group_vars/all/ironic b/ansible/group_vars/all/ironic
index f9683609e..3a50debcd 100644
--- a/ansible/group_vars/all/ironic
+++ b/ansible/group_vars/all/ironic
@@ -34,11 +34,10 @@ kolla_ironic_default_console_interface: ipmitool-socat
 # Specify the list of deploy interfaces to load during service initialization.
 kolla_ironic_enabled_deploy_interfaces:
   - direct
-  - iscsi
 
 # Default deploy interface to be used for nodes that do not have
 # deploy_interface field set.
-kolla_ironic_default_deploy_interface: iscsi
+kolla_ironic_default_deploy_interface: direct
 
 # Specify the list of inspect interfaces to load during service initialization.
 kolla_ironic_enabled_inspect_interfaces:
diff --git a/dev/functions b/dev/functions
index 7833a97f9..147477a10 100644
--- a/dev/functions
+++ b/dev/functions
@@ -813,9 +813,7 @@ function configure_iptables {
     sudo iptables -I INPUT -d $INTERNAL_VIP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
     sudo iptables -I INPUT -d $INTERNAL_VIP -p tcp --dport $GLANCE_SERVICE_PORT -j ACCEPT || true
 
-    if is_ipxe_enabled; then
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
-    fi
+    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
 
     if is_cinder_enabled; then
         sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $ISCSI_SERVICE_PORT -j ACCEPT || true
diff --git a/playbooks/kayobe-overcloud-upgrade-base/run.yml b/playbooks/kayobe-overcloud-upgrade-base/run.yml
index a149215e9..23621a196 100644
--- a/playbooks/kayobe-overcloud-upgrade-base/run.yml
+++ b/playbooks/kayobe-overcloud-upgrade-base/run.yml
@@ -16,7 +16,9 @@
           # be run after install.
           shell:
             cmd: dev/configure-firewall.sh
-            chdir: "{{ previous_kayobe_src_dir }}"
+            # TODO(mgoddard): Use the previous repo when the previous release
+            # is no longer Wallaby.
+            chdir: "{{ kayobe_src_dir }}"
 
         - name: Ensure overcloud is deployed
           shell:
@@ -87,6 +89,16 @@
             cmd: "docker image prune --all --force"
           become: true
 
+        # TODO(mgoddard): Remove this task when the previous release is no
+        # longer Wallaby.
+        - name: Switch ironic nodes deploy interface to direct
+          shell:
+            cmd: >-
+              source ~/tenks-venv/bin/activate &&
+              source {{ kayobe_config_src_dir }}/etc/kolla/public-openrc.sh &&
+              openstack baremetal node set tk0 --deploy-interface direct &&
+              openstack baremetal node set tk1 --deploy-interface direct
+
         # Perform a smoke test against the upgraded current release.
 
         - name: Perform testing of VMs in the upgraded overcloud
diff --git a/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml b/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml
new file mode 100644
index 000000000..aadb7398d
--- /dev/null
+++ b/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml
@@ -0,0 +1,11 @@
+---
+upgrade:
+  - |
+    Removes the ``iscsi`` interface from
+    ``kolla_ironic_enabled_deploy_interfaces``, and changes
+    ``kolla_ironic_default_deploy_interface`` to ``direct``. This is in line
+    with upstream changes in Ironic during the Xena cycle, in which the
+    ``iscsi`` deploy driver was removed.
+
+    Existing nodes using the ``iscsi`` deploy driver should be updated to an
+    alternative such as ``direct`` before upgrading.