summaryrefslogtreecommitdiff
path: root/ironic/api/controllers/v1/utils.py
Commit message (Collapse)AuthorAgeFilesLines
* API endpoints to get node historyJulia Kreger2021-09-151-0/+5
| | | | | | | | | | | Adds API for retrieving node history events via a node. Includes pagination and limitation of the response set. Story: 2002980 Tas: 42961 Change-Id: I22a92fa6c30d721f6a5dd0670b2e0a9cf76ad7b1
* Add `boot_mode` and `secure_boot` to node object and expose in apiCenne2021-07-081-0/+2
| | | | | | | | | | | | | * add fields to Node object * expose them at endpoint `/v1/nodes/{node_ident}/states` * update states on powersync / entering managed state. * tests * update api endpoint info in api-ref Story: 2008567 Task: 41709 Change-Id: Iddd1421a6fa37d69da56658a2fefa5bc8cfd15e4
* Include bios registry fields in bios APIBob Fournier2021-05-271-4/+22
| | | | | | | | | | Provide the fields in the BIOS setting API - ``/v1/nodes/{node}/bios/{setting}``, and in the BIOS setting list API when details are requested - ``/v1/nodes/<node>/bios?detail=True``. Story: #2008571 Task: #42483 Change-Id: Ie86ec57e428e2bb2efd099a839105e51a94824ab
* Aliases for a few unfortunately named state transitionskafilat-adeleke2021-04-151-0/+2
| | | | | | | | | | This RFE proposes a new microversion that will provide aliases to two poorly named provisioning verbs to match the existing CLI commands Story: #2007551 Task: #39402 Change-Id: Ifd14aebbfb4b17c5108f44092dac0b89d1c2c50a
* Add agent_status and agent_status_message params to heartbeatArun S A G2021-03-311-0/+5
| | | | | | | | | | | | | | | | | | | | agent_status is used by anaconda ramdisk to inform the conductor about state of the deployment. Valid agent states are 'start', 'end' and 'error'. The agent_status_message is used to describe the why the agent_status is set to a particular state. Use of these parameters require API version 1.72 or greater. When anaconda finishes deployment the agent_status is set to 'end'. When anaconda ramdisk is unable to deploy the OS for some reason the agent_status is set to 'error'. PXEAnacondaDeploy is implemented to handle the 'anaconda' deploy interface. PXEAnacondaDeploy ties to together pieces needed to deploy a node using anaconda ramdisk. Co-Authored-By: Jay Faulkner <jay@jvf.cc> Change-Id: Ieb452149730510b001c4712bbb2e0f28acfc3c2e
* Remove extra/vif_port_idJulia Kreger2021-03-221-83/+0
| | | | | | | | | | | | | | | | | Removes API translation layer into port/portgroup internal_info Removes internal logic to support use of VIFs stored in the extra field, which effectively means all vif binding must now utilize vif attachment and detachment. This is a change that we likely should have pushed forward a couple years back, but I didn't want to break compatability with very old of ironic or standalone users which were deploying instances using very old instructions. That being said, it is necessary to remove the legacy vif support so new access controls can properly wrap vif API endpoints. Depends-On: https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/769204 Change-Id: I588b3a64475656542389ff83786189e2dc16d35c
* Merge "API to force manual cleaning without booting IPA"Zuul2021-03-171-0/+11
|\
| * API to force manual cleaning without booting IPADmitry Tantsur2021-03-161-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a new argument disable_ramdisk to the manual cleaning API. Only steps that are marked with requires_ramdisk=False can be run in this mode. Cleaning prepare/tear down is not done. Some steps (like redfish BIOS) currently require IPA to detect a successful reboot. They are not marked with requires_ramdisk just yet. Change-Id: Icacac871603bd48536188813647bc669c574de2a Story: #2008491 Task: #41540
* | Allocation support for project scoped RBACJulia Kreger2021-03-121-7/+21
|/ | | | | | | | Adds policy scope based RBAC handling for the allocations endpoing which enables admins to create allocations if they have baremetal nodes which are available to them. Change-Id: I60e273afaf344fded9bdb8c4c8e143efc9971fc1
* RBAC Follow-up: Review follow-up.Julia Kreger2021-03-081-7/+7
| | | | | | | | | Since the existing change is approved and in the gate now, it doesn't make sense to edit it for the review feedback. The included minor feedback is addressed by this change. Change-Id: I046c194af01fe77c3eac541f245a377e8e8f71eb
* Volume targets/connectors Project Scoped RBACJulia Kreger2021-03-041-0/+104
| | | | | | | | | | | | This patch adds project scoped access, as part of the work to delineate system and project scope access. Adds policies: * baremetal:volume:list_all * baremetal:volume:list * baremetal:volume:view_target_properties Change-Id: I898310b515195b7065a3b1c7998ef3f29f5e8747
* Port/Portgroup project scoped accessJulia Kreger2021-03-021-15/+107
| | | | | | | | | | | | | | | | | | | | | This patch implements the project scoped rbac policies for a system and project scoped deployment of ironic. Because of the nature of Ports and Portgroups, along with the subcontroller resources, this change was a little more invasive than was originally anticipated. In that process, along with some discussion in the #openstack-ironic IRC channel, that it would be most security concious to respond only with 404s if the user simply does not have access to the underlying node object. In essence, their view of the universe has been restricted as they have less acess rights, and we appropriately enforce that. Not expecting that, or not conciously being aware of that, can quickly lead to confusion though. Possibly a day or more of Julia's life as well, but it comes down to perceptions and awareness. Change-Id: I68c5f2bae76ca313ba77285747dc6b1bc8b623b9
* Project Scoping Node endpointJulia Kreger2021-03-021-10/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Adds additional policies: * baremetal:node_get:last_error * baremetal:node:get:reservation * baremetal:node:get:driver_internal_info * baremetal:node:get:driver_info * baremetal:node:update:driver_info * baremetal:node:update:properties * baremetal:node:update:chassis_uuid * baremetal:node:update:instance_uuid * baremetal:node:update:lessee * baremetal:node:update:driver_interfaces * baremetal:node:update:network_data * baremetal:node:update:conductor_group * baremetal:node:update:name * With new policies, responses of filtering and posted data is performed. Testing has been added to the RBAC testing files to align with this and the defaults where pertinant. * Adds another variation of the common policy check method which may be useful in the long term. This is too soon to tell, but the overall purpose is to allow similar logic patterns to the authorize behavior. This is because the standard policies are, at present, also used to control behavior of response, and node response sanitization needs to be carefully navigated. This change excludes linked resources such as /nodes/<uuid>/ports, portgroups, volumes/[targets|connectors]. Those will be in later changes, as the node itself is quite a bit. Special note: * The indicator endpoint code in the API appears to be broken and given that should be fixed in a separate patch. Change-Id: I2869bf21f761cfc543798cf1f7d97c5500cd3681
* Validate configdrive string formatDmitry Tantsur2021-02-171-0/+18
| | | | | | | | The ironicclient CLI silently passes invalid JSON as a configdrive blob, which fails much later with a confusing errors. Add an early check in the API. Change-Id: Ifa9993a9454fe036a600ca8b855397321d4fbc04
* Merge "Add 'deploy steps' parameter for provisioning API"Zuul2021-02-121-0/+45
|\
| * Add 'deploy steps' parameter for provisioning APIAija Jauntēva2021-02-031-0/+45
| | | | | | | | | | | | Story: 2008043 Task: 40705 Change-Id: I3dc2d42b3edd2a9530595e752895e9d113f76ea8
* | Pass context objects directly to policy enforcementLance Bragstad2021-01-231-10/+16
|/ | | | | | | | | | | | | | | | | | | The oslo.policy Enforcer() object knows what to do with instances of oslo.context RequestContext() if you pass it one. This makes it easier for people to perform policy enforcement since they don't need to map important authorization information from the context object into a dictionary (historically called `creds`). This practiced didn't guarantee any consistency in `creds` implementations. You also don't need to call context.to_policy_values() anymore. The oslo.policy library will do that for you under the hood and map context values into a set of policy attributes it understands. This commit updates the calls to enforcement to pass in the context object where applicable. Change-Id: Ife4ba098303088023e4341354a1e3bc9f378ce93
* Improve object_to_dict argumentsSteve Baker2020-11-271-39/+32
| | | | | | | | | | | | As a follow-up to the review feedback in[1], type specific fields arguments are removed and the type is inferred from the versioned object fields. Story: 1651346 Task: 10551 [1] https://review.opendev.org/751160 Change-Id: I89a65214ab7d550d0b4a327dd033c27399ae13bf
* JSON conversion followup changeSteve Baker2020-11-261-15/+7
| | | | | | | | This change addresses nit-level review comments from this task. Story: 1651346 Task: 10551 Change-Id: I01608004ce90facadb73e252203900a1e62cbea1
* Expunge the internal version of WSMESteve Baker2020-11-191-2/+11
| | | | | | | | | This change removes unused code and concludes the conversion of the REST API from WSME based to plain JSON. Change-Id: Ib04c759f86d9758b67a75648b5971f5a80c77ecb Story: 1651346 Task: 10551
* Convert ports endpoint to plain JSONSteve Baker2020-11-161-6/+72
| | | | | | Change-Id: I0594e84905957873de17275ee396531b816cd468 Story: 1651346 Task: 10551
* Convert nodes endpoint to plain JSONSteve Baker2020-11-161-21/+0
| | | | | | Change-Id: I59f89d1907cd532325399b0a06edb96575d7eeec Story: 1651346 Task: 10551
* Utility functions for REST API JSON handlingSteve Baker2020-11-161-0/+240
| | | | | | | | | | | | | | | | | | | | | | | | | collection.list_convert_with_links Build a collection dict including the next link for paging support utils.object_to_dict Helper function to convert RPC objects to REST API dicts utils.populate_node_uuid Look up the node referenced in the object and populate a dict utils.replace_node_uuid_with_id Replace ``node_uuid`` dict value with ``node_id`` utils.replace_node_id_with_uuid Replace ``node_id`` dict value with ``node_uuid` utils.patch_update_changed_fields Update rpc object based on changed fields in a dict. utils.patched_validate_with_schema Validate a patched dict object against a validator or schema. utils.patch_validate_allowed_fields Validate that a patch list only modifies allowed fields utils.sanitize_dict Removes sensitive and unrequested data Change-Id: I39fa73ac9a62d30a3eaa00c75129ac1e00270652 Story: 1651346 Task: 10551
* Duplicate trait validation with jsonschemaSteve Baker2020-11-161-1/+9
| | | | | | | | | | | | This change implements the same validation rules as the validate_trait function, but with jsonschema. When the 3 uses of validate_trait are converted to using jsonschema for post (and patch) calls, this function can be deleted. Change-Id: Ie2c0f32f254275007b491748e2a63fa94aa09434 Story: 1651346 Task: 10551
* Accept and use a TLS certificate from the agentDmitry Tantsur2020-09-091-0/+5
| | | | | | | | | | | | | | Accepts the certificate from a heartbeat and stores its path in driver_internal_info for further usage by the agent client (or any 3rd party deploy implementations). Similarly to agent_url, the certificate is protected from further changes (unless the local copy does not exist) and is removed on reboot or tear down (unless fast-tracking). Change-Id: I81b326116e62cd86ad22b533f55d061e5ed53e96 Story: #2007214 Task: #40603
* Rename Response to PassthruResponseSteve Baker2020-07-201-8/+2
| | | | | | | | | | | | | | | | | | The Reponse type is only used to wrap passthru responses, so this change renames it to PassthruResponse and changes how it is used to make it more clear what is happening. The 'return_type' and 'error' fields are removed as they are not used by passthru. Now that no Unset usage is required, future removal of core WSME logic won't affect PassthruResponse. If the passthru response has 'attach' set then the return value will be an io.BytesIO object which is handled by the expose decorator. This is preferable to having utils.vendor_passthru have the side-effect of setting the pecan Response.app_iter - now all the response handling is done in the expose decorator. Change-Id: Ibcf7860c4a67f0ec8747e5710d8c1ef7281573d1
* Remove File typeSteve Baker2020-07-201-2/+2
| | | | | | | | | | The only use of the File type is for wrapping passthru responses in a io.BytesIO, so this change does this wrapping directly and removes the File type. Change-Id: I6759bc304839bd89a50fc3bf9e26b1cd20537a0a Story: 1651346 Task: 10551
* Merge "Add `network_data` field to ironic node object"Zuul2020-05-191-0/+1
|\
| * Add `network_data` field to ironic node objectIlya Etingof2020-05-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A new dictionary field `network_data` is added to the node object. This new field can be populated by the operator with node static network configuration. Ironic API now performs formal JSON document validation of node `network_data` field content against user-supplied JSON schema at driver validation step. As of this commit, the new `network_data` field is not actually used by ironic, otherwise it should be perfectly functional. In the following commits, network static configuration will be taken from this field and handed over to ironic ramdisk bootstrapping utilities. Change-Id: I868b3b56a17f59e5aa1494b2e0ebc9c4e34ef173 Story: 2006691 Task: 36991
* | Do all serialization in the expose decoratorSteve Baker2020-05-061-2/+1
|/ | | | | | | | | Instead of delegating to the @wsme.wsexpose decorator, bring the required logic into this decorator, including a mimimum required tojson function. Change-Id: I96661570d77ecb641b4ac7508e65bd7ca83194a5 Story: 1651346
* Centralise imports of wsme typesSteve Baker2020-04-201-1/+2
| | | | | | | | | | Instead of importing wsme types directly from the wsme packages, import them from ironic.api.types. This reduces the number of wsme imports throughout the codebase, and confines much of the future code changes to the new types.py and a few other files. Change-Id: I231a1f82915ab9e07c00857aa6210c0764b8ce4b Story: 1651346
* Add node lessee fieldTzu-Mainn Chen2020-04-071-3/+24
| | | | | | | | | | | | This change adds a `lessee` field to nodes, and exposes it to policy. It also updates the non-admin node list API to match for both owner and lessee; and updates the allocation conductor to match owner allocations with nodes with the appropriate lessee. Change-Id: Ib31b49c7143ec8fd6cb486fc24038215b197c418 Story: 2006506 Task: 37930
* Add network_type to port local_link_connectionHarald Jensås2020-04-021-0/+6
| | | | | | | | | | | | | Add network_type to the port objects local_link_connection field. The network_type can be set to either managed or unmanaged. When the type is unmanaged other fields are not required. Use unmanaged when the neutron network_interface is required, but the network is in fact a flat network where no actual switch management is done. Story: 2007315 Task: 39161 Change-Id: I00c5ea22a8163c27c9ce4470e3713c282d0eb131
* Fix the remaining hacking issuesDmitry Tantsur2020-03-311-8/+6
| | | | | | | | | | Fixes W504 and E117, resulting in some indentation changes. Also fixes code that exceeds the complexity requirement, that is bumped to 20 (mostly to avoid refactoring the agent heartbeat call, resulting in conflicts for the deploy steps work). Change-Id: I8e49f2c039b0ddfca9138f8e148708b7e8b5df7e
* Add separate policies for updating node instance_info and extraTzu-Mainn Chen2020-03-091-0/+24
| | | | | | | | | | | | In order to provision a node using standalone Ironic, a user must be able to update a few additional node attributes. However, we would not want a lessee user to be able to update every node attribute. This change allows an Ironic administrator to provide policy-based access to updating instance_info and extra. Change-Id: I43c22027116da1e057972dbe853403c16e965fc9 Story: #2006506 Task: #38748
* Merge "Expose allocation owner to additional policy checks"Zuul2020-03-091-10/+36
|\
| * Expose allocation owner to additional policy checksTzu-Mainn Chen2020-02-201-10/+36
| | | | | | | | | | | | | | | | | | | | | | Add is_allocation_owner to policy, giving Ironic admins the option of modifying the policy file to allow users specified by an allocation's owner field to perform API actions on that allocation. Change-Id: Iae87b2dbf8a199565aeeee28ec00a42941e2b4bb Story: #2006506 Task: #38741
* | Pre-shared agent tokenJulia Kreger2020-02-201-0/+5
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to improve security of the lookup/heartbeat endpoints, we need to generate and provide temporary tokens to the initial callers, if supported, to facilitate the verification of commands. This is the first patch in an entire series which utimately enables the endpoint communication to be better secured. The idea behind this started in private story 2006634 which is locked as a security related filing covering multiple aspects of ironic/ironic-python-agent interaction centered around miss-use and generally exposed endpoints. That story will remain marked as a private bug because it has several different items covered, some of which did not prove to be actually exploitable, but spawned stories 2006777, 2006773, 2007025, and is ultimately similar to Story 1526748. Operationally this is a minimally invasive security enhancement to lay the foundation to harden interactions with the agent. This will take place over a series of patches to both Ironic and the Ironic-Python-Agent. Also see "Security of /heartbeat and /lookup endpoints" in http://lists.openstack.org/pipermail/openstack-discuss/2019-November/010789.html Story: 2007025 Task: 37818 Change-Id: I0118007cac3d6548e9d41c5e615a819150b6ef1a
* Merge "Allow node owners to administer associated ports"Zuul2020-02-071-0/+46
|\
| * Allow node owners to administer associated portsTzu-Mainn Chen2020-01-021-0/+46
| | | | | | | | | | | | | | | | | | | | | | Expose a port's node's owner to policy, giving Ironic admins the option of modifying the policy file to allow users specified by a node's owner field to perform API actions on that node's associated ports. Change-Id: I47ecbad9729f18dacc703e2a625ef3e92bfb00ed Story: #2006506 Task: #37539
* | Merge "Support node retirement"Zuul2020-02-051-0/+2
|\ \
| * | Support node retirementArne Wiebalck2020-01-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds support for node retirement: nodes can have additional properties 'retired' and 'retired_reason' which change the way the nodes (can) traverse the FSM and which operations are allowed. In particular: - retired nodes cannot move from manageable to available; - upon instance deletion, retired nodes move to manageable (rather than available). Story: #2005425 Task: #38142 Change-Id: I8113a44c28f62bf83f8e213aeb6704f96055d52b
* | | Fix jsonpatch related testsRiccardo Pittau2020-02-031-1/+2
|/ / | | | | | | | | | | | | | | | | | | | | | | | | Latest release of jsonpatch fixed an issue with array boundaries[1] but broke tests since JsonPatchConflict is now correctly raised when a patch tries to replace an item that doesn't exist. This patch fixes the issue with the tests including JsonPatchConflict in the json exceptions intercepted by the method apply_jsonpatch. [1] https://github.com/stefankoegl/python-json-patch/commit/b3726f3a8bdcdf0f0841e078228014de8477b0ec Change-Id: I6edf6eb7ae1e9f3aa7bc3220cd943a4849f4997c
* | Subclass wsme.exc.ClientSideErrorSteve Baker2020-01-221-13/+13
|/ | | | | | | | | | This change avoids importing a wsgi namespace exception class, and allows the future option of changing the parent class of exception.ClientSideError when wsme is no longer processing API requests. Change-Id: I8165e094fafb91ff94eaa1dd96baba7671487448 Story: 1651346
* Merge "Restrict ability to change owner on provisioned or allocated node"Zuul2019-12-271-7/+19
|\
| * Restrict ability to change owner on provisioned or allocated nodeTzu-Mainn Chen2019-12-131-7/+19
| | | | | | | | | | | | | | | | | | | | | | Prevents a user from changing the owner of a provisioned node unless they pass the new policy rule 'baremetal:node:update_owner_provisioned'. In addition, always prevents a user from changing the owner of an allocated node, if the allocation specifies an owner. Story: 2006997 Task: 37766 Change-Id: I4e8559bd215f70fb895ed0d41b2154c648e03597
* | Stop using six libraryRiccardo Pittau2019-12-231-4/+3
|/ | | | | | | | | | Since we've dropped support for Python 2.7, it's time to look at the bright future that Python 3.x will bring and stop forcing compatibility with older versions. This patch removes the six library from requirements, not looking back. Change-Id: Ib546f16965475c32b2f8caabd560e2c7d382ac5a
* Add owner to allocations and create relevant policiesTzu-Mainn Chen2019-12-101-0/+8
| | | | | | | | | | Add an owner to allocations. Depending on policy, a non-admin can then create an allocation and have the owner set to their project. Allocation processing then respects the owner. Change-Id: I2965a4a601b9fa2c0212097da37b104a3e5514df Story: #2006506 Task: #37540
* Merge "Allow node owners to administer nodes"Zuul2019-11-181-0/+52
|\
| * Allow node owners to administer nodesTzu-Mainn Chen2019-11-141-0/+52
| | | | | | | | | | | | | | | | | | | | | | Introduce is_node_owner to policy, giving Ironic admins the option of modifying the policy file to allow users specified by a node's owner field to perform API actions on that node. Change-Id: If08586f3e9705dd38ff83e4b500d9ee3cd45bce3 Story: #2006506 Task: #37214
View Lorry Controller Status