---
features:
  - |
    Passwords for ``rescue`` operation are now hashed for
    transmission to the ``ironic-python-agent``. This functionality
    requires ``ironic-python-agent`` version ``6.0.0``.

    The setting ``[conductor]rescue_password_hash_algorithm``
    now defaults to ``sha256``, and may be set to
    ``sha256``, or ``sha512``.
upgrades:
  - |
    The version of ``ironic-python-agent`` should be upgraded to
    at least version ``6.0.0`` for rescue passwords to be hashed
    for transmission.
security:
  - |
    Operators wishing to enforce all rescue passwords to be hashed
    should use the ``[conductor]require_rescue_password_hashed``
    setting and set it to a value of ``True``.

    This setting will be changed to a default of ``True`` in the
    Victoria development cycle.