summaryrefslogtreecommitdiff
path: root/ironic/api
Commit message (Collapse)AuthorAgeFilesLines
* Fix resource_url in the remaining resourcesDmitry Tantsur2022-01-2410-38/+31
| | | | | | | | | Node history was particularly affected: limit was not converted from string to integer, so "next" link was never added. Add some safeguards to the generic API code. Change-Id: I1328e2f07621bf7e39b96eb4a7ddb66c9a2b65bb
* Merge "Set resource_url when getting all nodes"Zuul2022-01-181-0/+2
|\
| * Set resource_url when getting all nodesArne Wiebalck2022-01-171-0/+2
| | | | | | | | | | | | | | Since the default value resource_url is None, make sure the parameter is set to 'nodes' when getting all nodes. Change-Id: I6cc52eb56c7888a433d24aa79154143d6f35cf83
* | Set resource_url when getting all ports or portgroupsArne Wiebalck2022-01-172-2/+6
|/ | | | | | | Since the default value resource_url is None, make sure the parameter is set to 'ports' when getting all ports. Change-Id: Id603ae5a4a802dfc8f866b15c8d327d95eba9310
* Merge "Allow enabling fast-track per node"Zuul2021-12-151-7/+8
|\
| * Allow enabling fast-track per nodeDmitry Tantsur2021-12-081-7/+8
| | | | | | | | | | | | | | This is useful when some nodes need the "agent" power interface, while the others can be deployed normally. Change-Id: Ief7df40c83ef03d0ec5ae92d09ceffd39d3c12a3
* | Merge "Add "none" RPC transport that disables the RPC bus"Zuul2021-12-081-0/+1
|\ \
| * | Add "none" RPC transport that disables the RPC busDmitry Tantsur2021-12-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using the new combined executable in a single-conductor scenario, it may make sense to completely disable the remote RPC. The new ``rpc_transport`` value ``none`` achieves that. Change-Id: I6a83358c65b3ed213c8a991d42660ca51fc3a8ec Story: #2009676 Task: #44104
* | | Merge "Fix restricted allocation creation for old policy defaults"Zuul2021-12-071-2/+4
|\ \ \ | |/ / |/| |
| * | Fix restricted allocation creation for old policy defaultsTzu-Mainn Chen2021-10-251-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | The logic for restricted allocation creation checks that the user is not trying to create an allocation with an owner other than themselves. However the logic as it stands will always fail, as it does not check if the user actually set an allocation owner. Change-Id: I780d8e88f9319dc37ab56309bddbfb6b5f3c9d13
* | | Refactor common configuration bits from service commandsDmitry Tantsur2021-12-011-1/+1
| |/ |/| | | | | | | | | | | | | The prepare_service call from ironic.common.service is changed to also configure guru meditation and profiler. A new call prepare_command is provided for the cases it's not required. Change-Id: I5b9b7b7bc827c8bcda06e9a967deae8577ad87f4
* | There is no aim, we do deploy/manage baremetal.Julia Kreger2021-10-151-2/+2
|/ | | | | | | Fix the root description header, since the Ironic project is very far past the days of when we were aiming to provision baremetal. Change-Id: I21f6058fe29b1495dbde63ec09a1227568dc3f08
* API endpoints to get node historyJulia Kreger2021-09-153-2/+113
| | | | | | | | | | | Adds API for retrieving node history events via a node. Includes pagination and limitation of the response set. Story: 2002980 Tas: 42961 Change-Id: I22a92fa6c30d721f6a5dd0670b2e0a9cf76ad7b1
* Merge "Add support for fields in drivers API"Zuul2021-09-152-10/+44
|\
| * Add support for fields in drivers APITadeas Kot2021-08-272-10/+44
| | | | | | | | | | | | | | | | This commit add support for the fields query parameter to the GET /v1/drivers?fields=... and GET /v1/drivers/<driver_name>?fields=.... Story: 1674775 Task: 10581 Change-Id: I2ca4eb490e320e736a93851eed526ec862be901e
* | Minor formatting and doc changes to change boot mode feature commit.Cenne2021-08-241-8/+7
|/ | | | | | | Story: 2008567 Task: 41709 depends-on: https://review.opendev.org/c/openstack/ironic/+/800084 Change-Id: I44e41dc3d8abcb99a2248d7b9c7ac5e9d786bb98
* Add api endpoints for changing boot_mode and secure_boot stateCenne2021-08-232-1/+110
| | | | | | | | | | | | | | | | | | | | Done: - Node API endpoints expose - RPC methods - Conductor Manager methods - Conductor utils new methods - RBAC new policies - Node API tests - Manager Tests (+ some testing for utils methods) - RBAC tests - Docs (api-ref) - REST API version history - Releasenotes Story: 2008567 Task: 41709 Change-Id: I2d72389edf546b99c536c6b130ca85ababf80591
* Add `boot_mode` and `secure_boot` to node object and expose in apiCenne2021-07-083-1/+11
| | | | | | | | | | | | | * add fields to Node object * expose them at endpoint `/v1/nodes/{node_ident}/states` * update states on powersync / entering managed state. * tests * update api endpoint info in api-ref Story: 2008567 Task: 41709 Change-Id: Iddd1421a6fa37d69da56658a2fefa5bc8cfd15e4
* Merge "Fix typos in API sanitization change notes"Zuul2021-07-072-6/+5
|\
| * Fix typos in API sanitization change notesJulia Kreger2021-07-072-6/+5
| | | | | | | | | | | | | | | | | | | | Change https://review.opendev.org/c/openstack/ironic/+/794880 included a few minor typos and required a clarification of a point which. This change just makes those minor text changes. Change-Id: I883d4ca89ba984c29b53b531af98f2f0be39edbf
* | Merge "Allow node_sanitize function to be provided overrides"Zuul2021-07-072-40/+95
|\ \ | |/
| * Allow node_sanitize function to be provided overridesJulia Kreger2021-07-062-40/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The biggest amount of API overhead is the node sanitization process, at least at this point in time. We have streamlined the database interaction to ensure specific field selection lists are as orderly as possible, but the node sanitization code re-executes some methods over and over which do not require variable data from the underlying node. These are blanket settings "is the user allowed to see x, or y". Which means we can call node_sanitize pre-seeding these arguments and execute the calls once, instead of a thousand times to have the same exact result. Story: 2008885 Task: 42433 Change-Id: I342e7900cac388cb4749480684418a5a15ac60eb
* | Merge "API to pass fields to node object list"Zuul2021-07-061-55/+110
|\ \ | |/
| * API to pass fields to node object listJulia Kreger2021-06-251-55/+110
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change modifies the nodes _get_nodes_collection method to consider and pass in an explicit lisst of requested fields into the node list method, while also including the required fields for things like ownership/policy checking. And slightly modifies node_convert_with_links method to simplify it while enabling field validity to be checked, and specific requisite field lists provided in based upon that value. And also optionally builds the traits list as they are nolonger *always* populated on all objects with fully populated objects as only partially hydrated objects are provided back when specific fields are requested. Story: 2008885 Task: 42572 Change-Id: Ided419263d84184cab902944b6c518f98618c9d2
* | Merge "Remove redundant/legacy is_admin logic"Zuul2021-06-241-3/+0
|\ \ | |/ |/|
| * Remove redundant/legacy is_admin logicJulia Kreger2021-06-151-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The original model used was to assert is_admin on the object context which was actually used in only one place in ironic's code. Redudnantly of course. This is an excess call of is_admin on all API invocations, and is simply not necessary as individual calls have API policy checking and is_admin was only being consulted in the glance service utils... However, the glance service utils also confirmed it should be able to access glance if there was an auth_token present on the request which should also always be the case. This was somewhat identified as redundant/possible bug during the Wallaby cycle and appears to be fine to remove This does *not* remove the deprecated rule. At present, it appears that rule may not be removed until after Xena. Change-Id: I5a176f51db93d2a2238496f6955c1c7d9a79c548
* | Fix node detail instance_uuid request handlingJulia Kreger2021-06-171-57/+42
|/ | | | | | | | | | | | | | | | | | | | | The instance_uuid handling on the detailed node information endpoint of the api (/v1/nodes/detail?instance_uuid=<uuid>), which is used by services such as Nova for explicit node status lookups, previously had special conditional logic surrounding it which skipped the inclusion of the API requestor project-id, from being incorporated into the database query. Ultimately, this allowed an authenticated user to obtain a partially redacted node entry where sensitive informational fields were scrubbed from the response payload. With this fix, queries for an explicit instance_uuid now follow the standard path inside the Ironic API to the database which includes inclusion of a requestor Project-ID if required by configured policy. Change-Id: I9bfa5a54e02c8a1e9c8cad6b9acdbad6ab62bef3 Story: 2008976 Task: 42620
* Merge "Secure RBAC - Efficent node santiziation"Zuul2021-06-011-16/+28
|\
| * Secure RBAC - Efficent node santiziationJulia Kreger2021-05-241-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | An investigation of performance issues in Ironic revealed that the policy checking was performing extra un-needed work which performed excess computational overhead when parsing the result data. In this specific case, the Secure RBAC work added some additional policy checks around individual the fields. Change-Id: I77b6e0e6c721f2ff1f8b9f511acde97fcdb21a39 Story: 2008885 Task: 42432
* | Include bios registry fields in bios APIBob Fournier2021-05-273-12/+59
| | | | | | | | | | | | | | | | | | | | Provide the fields in the BIOS setting API - ``/v1/nodes/{node}/bios/{setting}``, and in the BIOS setting list API when details are requested - ``/v1/nodes/<node>/bios?detail=True``. Story: #2008571 Task: #42483 Change-Id: Ie86ec57e428e2bb2efd099a839105e51a94824ab
* | Delay rendering configdriveDmitry Tantsur2021-05-191-0/+3
|/ | | | | | | | | | | | | When the configdrive input is JSON (meta_data, etc), delay the rendering until the ISO image is actually used. It has two benefits: 1) Avoid storing a large ISO image in instance_info, 2) Allow deploy steps to access the original user's input. Fix configdrive masking to correctly mask dicts. Story: #2008875 Task: #42419 Change-Id: I86d30bbb505b8c794bfa6412606f4516f8885aa9
* Aliases for a few unfortunately named state transitionskafilat-adeleke2021-04-153-3/+7
| | | | | | | | | | This RFE proposes a new microversion that will provide aliases to two poorly named provisioning verbs to match the existing CLI commands Story: #2007551 Task: #39402 Change-Id: Ifd14aebbfb4b17c5108f44092dac0b89d1c2c50a
* Add agent_status and agent_status_message params to heartbeatArun S A G2021-03-313-4/+38
| | | | | | | | | | | | | | | | | | | | agent_status is used by anaconda ramdisk to inform the conductor about state of the deployment. Valid agent states are 'start', 'end' and 'error'. The agent_status_message is used to describe the why the agent_status is set to a particular state. Use of these parameters require API version 1.72 or greater. When anaconda finishes deployment the agent_status is set to 'end'. When anaconda ramdisk is unable to deploy the OS for some reason the agent_status is set to 'error'. PXEAnacondaDeploy is implemented to handle the 'anaconda' deploy interface. PXEAnacondaDeploy ties to together pieces needed to deploy a node using anaconda ramdisk. Co-Authored-By: Jay Faulkner <jay@jvf.cc> Change-Id: Ieb452149730510b001c4712bbb2e0f28acfc3c2e
* Allow using per-site network_data schemaDmitry Tantsur2021-03-261-67/+94
| | | | | | | | | I have been against it since the beginning of this work, hoping that we can settle down on one network data format, one is more native for Ironic because of our relation to OpenStack. This has not happened, with e.g. CoreOS only using its own formats. So, let it be. Use with caution. Change-Id: I872d010517cd343fcbcafadb4535f07ca15c2c95
* Merge "Remove extra/vif_port_id"Zuul2021-03-253-107/+5
|\
| * Remove extra/vif_port_idJulia Kreger2021-03-223-107/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removes API translation layer into port/portgroup internal_info Removes internal logic to support use of VIFs stored in the extra field, which effectively means all vif binding must now utilize vif attachment and detachment. This is a change that we likely should have pushed forward a couple years back, but I didn't want to break compatability with very old of ironic or standalone users which were deploying instances using very old instructions. That being said, it is necessary to remove the legacy vif support so new access controls can properly wrap vif API endpoints. Depends-On: https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/769204 Change-Id: I588b3a64475656542389ff83786189e2dc16d35c
* | Merge "Follow-up to RBAC allocation changes"Zuul2021-03-211-9/+3
|\ \
| * | Follow-up to RBAC allocation changesJulia Kreger2021-03-181-9/+3
| | | | | | | | | | | | Change-Id: I4f703258be47cf0de0a31f7e706a1aba1ea302f0
* | | Increment API version for Secure RBACJulia Kreger2021-03-181-1/+3
| |/ |/| | | | | | | | | | | | | | | This patch increments the API version for the Secure RBAC as was covered in the specification in order to signify to API consumers that may need to be aware if the API surface can support Secure RBAC policy configuration. Change-Id: Ia659708bb89ff416b65367505d3e068c6d4a198f
* | Merge "API to force manual cleaning without booting IPA"Zuul2021-03-173-7/+25
|\ \ | |/ |/|
| * API to force manual cleaning without booting IPADmitry Tantsur2021-03-163-7/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a new argument disable_ramdisk to the manual cleaning API. Only steps that are marked with requires_ramdisk=False can be run in this mode. Cleaning prepare/tear down is not done. Some steps (like redfish BIOS) currently require IPA to detect a successful reboot. They are not marked with requires_ramdisk just yet. Change-Id: Icacac871603bd48536188813647bc669c574de2a Story: #2008491 Task: #41540
* | Allocation support for project scoped RBACJulia Kreger2021-03-122-23/+152
|/ | | | | | | | Adds policy scope based RBAC handling for the allocations endpoing which enables admins to create allocations if they have baremetal nodes which are available to them. Change-Id: I60e273afaf344fded9bdb8c4c8e143efc9971fc1
* RBAC Follow-up: Review follow-up.Julia Kreger2021-03-081-7/+7
| | | | | | | | | Since the existing change is approved and in the gate now, it doesn't make sense to edit it for the review feedback. The included minor feedback is addressed by this change. Change-Id: I046c194af01fe77c3eac541f245a377e8e8f71eb
* Volume targets/connectors Project Scoped RBACJulia Kreger2021-03-043-37/+215
| | | | | | | | | | | | This patch adds project scoped access, as part of the work to delineate system and project scope access. Adds policies: * baremetal:volume:list_all * baremetal:volume:list * baremetal:volume:view_target_properties Change-Id: I898310b515195b7065a3b1c7998ef3f29f5e8747
* Port/Portgroup project scoped accessJulia Kreger2021-03-024-49/+211
| | | | | | | | | | | | | | | | | | | | | This patch implements the project scoped rbac policies for a system and project scoped deployment of ironic. Because of the nature of Ports and Portgroups, along with the subcontroller resources, this change was a little more invasive than was originally anticipated. In that process, along with some discussion in the #openstack-ironic IRC channel, that it would be most security concious to respond only with 404s if the user simply does not have access to the underlying node object. In essence, their view of the universe has been restricted as they have less acess rights, and we appropriately enforce that. Not expecting that, or not conciously being aware of that, can quickly lead to confusion though. Possibly a day or more of Julia's life as well, but it comes down to perceptions and awareness. Change-Id: I68c5f2bae76ca313ba77285747dc6b1bc8b623b9
* Project Scoping Node endpointJulia Kreger2021-03-023-25/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Adds additional policies: * baremetal:node_get:last_error * baremetal:node:get:reservation * baremetal:node:get:driver_internal_info * baremetal:node:get:driver_info * baremetal:node:update:driver_info * baremetal:node:update:properties * baremetal:node:update:chassis_uuid * baremetal:node:update:instance_uuid * baremetal:node:update:lessee * baremetal:node:update:driver_interfaces * baremetal:node:update:network_data * baremetal:node:update:conductor_group * baremetal:node:update:name * With new policies, responses of filtering and posted data is performed. Testing has been added to the RBAC testing files to align with this and the defaults where pertinant. * Adds another variation of the common policy check method which may be useful in the long term. This is too soon to tell, but the overall purpose is to allow similar logic patterns to the authorize behavior. This is because the standard policies are, at present, also used to control behavior of response, and node response sanitization needs to be carefully navigated. This change excludes linked resources such as /nodes/<uuid>/ports, portgroups, volumes/[targets|connectors]. Those will be in later changes, as the node itself is quite a bit. Special note: * The indicator endpoint code in the API appears to be broken and given that should be fixed in a separate patch. Change-Id: I2869bf21f761cfc543798cf1f7d97c5500cd3681
* Validate configdrive string formatDmitry Tantsur2021-02-171-0/+18
| | | | | | | | The ironicclient CLI silently passes invalid JSON as a configdrive blob, which fails much later with a confusing errors. Add an early check in the API. Change-Id: Ifa9993a9454fe036a600ca8b855397321d4fbc04
* Merge "Add 'deploy steps' parameter for provisioning API"Zuul2021-02-124-35/+124
|\
| * Add 'deploy steps' parameter for provisioning APIAija Jauntēva2021-02-034-35/+124
| | | | | | | | | | | | Story: 2008043 Task: 40705 Change-Id: I3dc2d42b3edd2a9530595e752895e9d113f76ea8
* | Pass context objects directly to policy enforcementLance Bragstad2021-01-231-10/+16
|/ | | | | | | | | | | | | | | | | | | The oslo.policy Enforcer() object knows what to do with instances of oslo.context RequestContext() if you pass it one. This makes it easier for people to perform policy enforcement since they don't need to map important authorization information from the context object into a dictionary (historically called `creds`). This practiced didn't guarantee any consistency in `creds` implementations. You also don't need to call context.to_policy_values() anymore. The oslo.policy library will do that for you under the hood and map context values into a set of policy attributes it understands. This commit updates the calls to enforcement to pass in the context object where applicable. Change-Id: Ife4ba098303088023e4341354a1e3bc9f378ce93
View Lorry Controller Status