2025.2 Series Release Notes

32.1.0-8

Security Issues

• Fixes a security issue where image URLs pointing to unresponsive endpoints could cause conductor thread starvation. A new configuration option [DEFAULT]webserver_verify_timeout (default 5 seconds) now controls the timeout for HTTP HEAD requests used during image source validation, separate from [DEFAULT]webserver_connection_timeout (default 60 seconds) used for actual downloads.

• Fixes an issue where an Ironic conductor could experience a memory or disk exhaustion condition when a tenant provides a gzip bomb instead of a valid configdrive. Any tenant authorized to deploy machines could trigger this by supplying a base64-encoded gzip payload that Ironic decompresses while preparing the configdrive for deployment.

  This affected deployments using the Anaconda deploy interface, the redfish-virtual-media boot interface, and deployments where Ironic updates network metadata (network_data.json).

  Now, Ironic decompresses configdrives in bounded chunks and rejects any configdrive that expands to more than 64MiB – the same limit enforced by Ironic Python Agent (and the size of the partition it creates).

  This security issue is tracked as CVE-2026-115638.

• Fixes an issue where issuing a PATCH to /v1/nodes containing /maintenance would bypass the more specific baremetal:node:set_maintenance policy and instead be evaluated as baremetal:node:update. For clouds running default Ironic policy, this means someone with member role in the project indicated in node.lessee could change the maintenance state of the node unexpectedly.

  This security fix is tracked in OSSA-2026-048 and CVE-2026-89419.

• When [deploy]image_server_auth_strategy is set to http_basic (not the default), configured credentials were sent to every host from which images are requested, including user-supplied URLs. This also applies to oci:// image sources, which can fall back to http_basic credentials, and are subject to the same filtering. Operators using the default noauth strategy are not affected. A new [deploy]image_server_auth_hosts option lets operators restrict which hosts receive credentials by specifying exact hostnames or domain suffixes (e.g. .example.com). A companion [deploy]image_server_auth_permit_unknown_hosts option (default True) preserves backwards compatibility; its default will change to False in 2026.2. Operators using http_basic should configure both options. See bug 2162816 for details.

• Add validation for BMC subscription IDs used to get or delete BMC subscriptions via redfish vendor passthru. Note that there’s no explicit specification for what constitutes a valid or invalid BMC subscription ID, therefore validation consists of forbidding illegal characters and substrings. Addresses CVE-2026-90458.

Bug Fixes

• Fixes a security issue where user can list volume connectors, volume targets and ports of nodes that they are not authorized to access. Volume connectors and target could be listed when specifying the node ID and ports could be listed by giving a valid shard. Related bug report bug 2150461.

• Fixes a SameFileError when publishing an image to the local HTTP server whose destination is already a hardlink to the source, which happens when a previous deployment published the same cached image and did not clean it up. The image is already published in that case, so it is no longer treated as an error. See bug 2150735.

• The pci-devices inspection hook now works with the Redfish inspection, which reports PCI devices in the inventory rather than in the plugin data.

32.1.0

New Features

• Adds middleware to reject oversized or excessively nested JSON request bodies before they reach the JSON parser. Deeply nested payloads can crash API worker processes via RecursionError in json.loads(), and oversized payloads can exhaust memory. Three new configuration options in [api] control the body size limits (in KiB): max_json_body_size (default 1 MiB), max_json_body_size_provision (default 64 MiB), and max_json_body_size_inspection (default 16 MiB). A fourth option max_json_body_depth (default 25) limits JSON nesting depth. All options are mutable and can be changed without restarting the service.

Known Issues

• System operators should note that changing the owner field on a node does not affect its child or parent nodes, potentially resulting in these nodes being in different projects.

Upgrade Notes

• Adds an upgrade check that issues a warning when any node has a different owner from its parent node.

Deprecation Notes

• The node driver_info field value pxe_template has been deprecated and is expected to be removed in the future Ironic 2027.2 release.

Security Issues

• Addresses a potential security issues where an admin of a project could create nodes with parent_node set to a node from a different project.

• Prevents changing the node_uuid of ports, port groups, volume targets, and volume connectors to point to a node with a different owner from the initial node. In some cases this is not normally permitted due to the database model, but additional access checking was added across these similar resources for consistency in the event the Ironic project fixes 12150252.

• Fixes CVE-2026-48681 which was a lack of file path validation when interacting with ISO9660 files in the kickstart/anaconda driver, configuration drive invalid network data detection and repair functionality, and administrative deployment ISOs which are admin-provided. Ironic now explicitly rejects the submitted files when such a case has been detected.

• Disable installation of bootloaders (via grub-install) by IPA by default in order to improve security posture by adding a new agent configuration option enable_bios_bootloader_install which defaults to True for this branch of Ironic.

  Operators who have a stricter security posture or do not need this functionality can disable installation of bootloaders by setting enable_bios_bootloader_install to False. Addresses CVE-2026-43003.

• The IPMI Vendor-Passthru interface method send_raw step has been disabled by default due to security implications. A malicious user with sufficient Ironic access could utilzie this interface to make manual changes to BMCs when the ipmitool vendor-passthru interface was enabled.

• The API now rejects JSON request bodies that exceed configurable size and nesting depth limits. Previously, a maliciously crafted deeply-nested JSON payload could crash an API worker process via RecursionError, and an extremely large payload could exhaust process memory. The new JsonDepthMiddleware runs before any JSON parsing occurs, scanning raw bytes iteratively with no recursion. The JSON-RPC internal service also applies the depth check.

• Fixes a vulnerability where security proxy could be crashed if attacker controls host VNC server. The exploit requires that VNC server first informs the client that there is 0 security types available and then sends a reason with reason length for this. There is no checks for reason length, so the attacker can make the security proxy to reserve up to 4 GB of memory and causing it to crash. The security proxy is shared between all tenants, so crashing the proxy denies console access for all tenants. More information in the bug description bug 2155052.

• Fixes a security issue where a malicious ‘kernel_append_params’ in a node’s ‘instance_info’ or ‘driver_info’ could cause an attacker to take control of a node’s initial boot through boot script injection. The fix includes sanitization of ‘kernel_append_params’ to prevent such injection. Strict parsing of kernel parameters is now in place as well and enabled by default. If an operator needs to disable such strict parsing they may do so by setting the configuration option conductor.disable_kernel_parameter_parsing to ‘True’. However, this is discouraged as it weakens the security posture of Ironic. This fix addresses CVE-2026-46447. This back-port utilizes a generated, stand-alone lark parser governed by the MPL v2.0 license.

• A vulnerability was discovered in an minimally documented feature of Ironic where an absolute path to a pxe_template override value could be defined by an authenticated and privilged API user. The Ironic team has chosen to immediately deprecate and remove this functionality. To provide an immediate security fix, this functionality is now disabled by default. The functionality can be re-enabled via the [pxe]enable_insecure_template_override configuration option which was added to ironic.conf with a default value of False. This issue is tracked as bug 2148319.

• The volume target properties field can contain sensitive iSCSI connection details, including CHAP authentication credentials. A contributor identified that the baremetal:volume:view_target_properties RBAC policy check was not applied to PATCH responses. During review, the ironic core security team determined that RBAC policy enforcement alone was insufficient since standalone deployments do not have RBAC support. The fix was updated in line with code reviewer feedback to add secondary scrubbing of the properties field in all cases using mask_dict_password, ensuring password-like values are masked in all API responses unconditionally.

Bug Fixes

• The [pxe]pxe_bootfile_name_by_arch and [pxe]ipxe_bootfile_name_by_arch options now support composite keys in the format arch-boot_mode (e.g. x86_64-bios:undionly.kpxe, x86_64-uefi:snponly.efi). The composite key is tried first, then the arch-only key as a fallback, preserving backward compatibility. Previously it was not possible to specify different boot files for the same architecture in different boot modes (e.g. x86_64 in both UEFI and BIOS), because the boot mode check was skipped when a by-arch entry matched. Fixes bug 2157027.

• Fixes path handling around ISO9660 file handling as denoted in bug 2148333 under CVE-2026-48681 where a malicious user with deployment privilges could craft an ISO9660 formatted configuration drive or deployment ramdisk which includes intentional path manipulation which is non-compliant with the underlying standard. Ironic now explicitly looks for such attempts and rejects the content.

• Fixes a bug where ironic allowed the ability for operators to send raw commands when the ipmitool vendor interface was enabled and configured for a baremetal node utilizing the IPMI protocol.

  The Ironic project generally recommends the use of redfish instead of IPMI, however recognizes that is not universally possible for all operators.

  More information can be found in bug 2150458.

• Fixes security issue identified in bug 2148307 where users of the anaconda deployment interface could supply a malicious template. The conductor process now sandboxes all jinja2 rendering operations.

• Fixes an issue in the url handling logic of instance deploy logic where file paths validity was not checked upfront, and the conductor service would directly begin calculating checksums. This highlighted a DoS issue where an attacker could exhaust conductor threads by attempting to request, “file:///dev/zero”, which would never return the thread. This is because file URLs don’t require downloading first, and validity checking logic was all in the file access logic, not checksum logic.

  Ironic now explicitly invokes the URL/validity checking logic prior to calling the checksum logic which effectively prevents this issue.

  This issue is tracked as CVE-2026-44919.

• No longer attempts to list Glance image members for images whose visibility is not shared. Glance rejects member listing for non-shared images with a 403 error, which previously caused a spurious error to be logged on every access check for public, community, and private images.

• Fixes the socat serial console failing to start. The console command was quoted for a shell, but socat executes it directly without one, so it tried to run the whole quoted command line as a single program name and failed with No such file or directory. The command is now escaped for socat’s own address syntax instead, which keeps the arguments separated while still preventing socat options from being injected through it.

• Fixes a vulnerability where security proxy could be crashed if the VNC server sends unreasonable large reason length. The security proxy is shared between all tenants, so crashing the proxy denies console access for all tenants. More information in the bug description bug 2155052.

• Fixes a vulnerability (CVE-2026-44917) which was identified inhandling of pxe_template overrides where an authenticated and authorized user could request an override template via direct file path which would bypass file URL handling guards introduced in OSSA-2025-001. This feature was minimally documented through only a release note, and does not appear to have actual use. This functionality is being disabled by default, and will be promptly removed from Ironic’s current development branch.

• Neutron port operations now always use service credentials from config, rather than the user’s token context. This prevents ports being created with an unexpected project id (e.g. the project id of the user’s context).

• The PATCH endpoint for volume targets now applies the baremetal:volume:view_target_properties RBAC policy check to its response payload, consistent with the GET endpoints. Additionally, the properties field is now scrubbed using mask_dict_password to mask any password-like keys, providing defense-in-depth independent of RBAC policy enforcement.

• Fixed the noVNC websocket proxy to copy the [cors] allowed_origin configuration value before appending the per-request Host header, preventing mutation of the shared oslo.config cached list object. See bug 2160548.

32.0.1

Bug Fixes

• Fixes an issue where [agent_container] config section was not registered properly. Now they are registered properly and will show up in ironic.conf.sample.

• [Bug 2135265] Fixes an issue where an exception in one of the inspection hooks when using the agent inspector interface would result in the node not being cleaned up.

• Ensure that the path to where we are copying the bootloader exists before attempting to copy the bootloader in.

• When disable_deep_image_inspection = true, the code path uses the destination filename as the source file name resulting in a failure. Due to the way the code attempts to clean up, this error is swallowed and only caught later on when the file is used.

• Fixes a race condition where the Redfish power interface could fail with HTTP 400 (BadRequest) or HTTP 409 (Conflict) errors during power operations. These errors are now treated as success when the node is already in the target power state (either on or off), preventing deployment failures when power state changes complete after Ironic’s state verification times out. Also refresh system state to get current power state from BMC instead of using potentially stale cached data.

• Fixes an issue where console command passed to socat’s EXEC: was not quoted which could have security implications.

• NIC firmware components with null or empty firmware package versions are now filtered out during caching to avoid NOT NULL database constraint violations.

• Fix retrieving BIOS settings via redfish based interfaces. The code used some references to an earlier version of the spec which was ultimately not adopted. Fixes bug 2137596.

• Fixes a security issue where the deprecated configuration molds feature would allow an user invoking molds to request authorization to be sent to a remote endpoint. This user supplied URL could be a swift or http url. While when used with http, the feature was explicitly designed around a concept of just publishing to a file in a limited context with authentication details provided by the conductor, where as with swift the impact is greater because the time limited session token for Ironic’s access of swift resources could be leaked, captured, and used.

  The configuration molds feature now explicitly checks the swift endpoint URL and raises an exception when the URL does not match the user supplied the configured Swift endpoint.

  More information can be found in bug 2148317.

• When caching an image between different file systems, the hard link operation would fail. This is fixed by falling back to a copy operation.

• Fixes an issue where baremetal nodes that experienced inspection errors, either through timeout or hard failure, were not having their inspection VIFs (Virtual Interfaces) removed from the node’s ports. This resulted in network resource leaks that persisted after the node transitioned to the inspect fail state.

  The inspection error handling now properly cleans up inspection networks by calling remove_inspection_network() on all error paths, matching the behavior of cleaning, servicing, and deployment error handlers. This ensures that inspection VIFs are always removed from ports when inspection fails, preventing network resource leaks.

• Fixes an issue where disable_ramdisk could bypass API validation when supplied via a runbook because validation happened before runbook resolution.

• The port API endpoints were not returning the vendor and category fields when they should have been. A number of places the API docs were incorrect and missed adding information about the vendor and category fields but other fields were omitted as well.

• Fixes ironic’s pxe filter logic which some operators may leverage to restrict access to resources as related to hardware discovery use cases. The launcher was inadvertently broken during the removal of eventlet.

• Fixes an issue with the redfish firmware updates attached to the management interface where firmware updates performed as part of the SERVICE steps workflow could end up stuck in service wait. This issue has been corrected and the nodes should now properly have their state checked. For more information, please consult bug 2136895.

• Fixed an issue in the Redfish management driver where boot device setting failed for vendors requiring full boot parameter requests (such as American Megatrends International, ASRock Rack, and Redfish compatible systems). The driver was incorrectly using a parameter that could be None, but these vendors require explicit values for all boot parameters. This fix ensures that vendors in VENDORS_REQUIRING_FULL_BOOT_REQUEST always receive explicit boot configuration values, resolving boot device configuration failures on affected systems.

• Fixes storage of inventory and plugin data in Swift. Previously, the data has not been stored as JSON. This meant that the data was stored in an odd format with part of the fields missing.

• Fixes an issue where virtual media ISO creation (used by Redfish and iLO drivers) did not respect architecture-specific kernel and ramdisk configuration parameters. When deploy_kernel_by_arch and deploy_ramdisk_by_arch (or their rescue equivalents) were configured, the ISO generation would still use the generic parameters instead of selecting the correct kernel and ramdisk based on the node’s CPU architecture. This particularly affected ARM64 nodes that require different agent images than x86_64 nodes. For more information, see bug 2126991.

• The flat network driver now raises NetworkError when rebind operations fail to bind any VIFs, instead of silently continuing. This prevents unexpected behavior when all port bindings fail during node rebind.

• A feature was added in 2025.2 to allow Ironic conductor to access images shared with its project in addition to its own images but the check did not use the Glance API correctly resulting in non-function. This fixes it and exposes a type checked method. Bug #2099276.

• Fixed HttpImageService.validate_href() ImageRefValidationFailed exception if protocol is HTTP/HTTPS and the HTTP header response is a redirection other then 301 (MOVED_PERMANENTLY). HTTP/HTTPS protocol is often used under standalone Ironic configuration to identify an image source (e.g –instance-info image_source=<URI>). The HTTP server may use redirection to load balance or geographically distribute the requests, or simply point to the correct URL. The redirection may vary from 301 (MOVED_PERMANENTLY), to 302 (FOUND), or 307 (TEMPORARY_REDIRECT), and 308 (PERMANENT_REDIRECT).

• Fixes an issue where some iDRAC10 machines requires a specific Virtual Media Slot. Ironic will attempt to automatically identify the version, and ensures the right slot is used to insert the iso. See bug 2125571 for details.

• Added upgrade check warning of ilo driver deprecation.

• Extremely large instance images, post eventlet removal, were causing CPU spikes and the conductor process to hang while the image was being fetched and validated. This optimizes the instance fetch and validation in two ways – first, we now calculate the image checksum while the file is being fetched instead of as a separate step. Secondly, we were, in some cases, using the default chunk size of 128 bytes during downloads. Now, we use a more standard and reasonable value of 1 megabyte.

• Avoid an unhandled exception in the local_link_connection inspection hook which would cause inspection to fail instead of skipping past missing ports as originally intended.

• Fix the loading of built-in inspection rules which are supplied via a file on the conductor. See bug 2136776

• MAC address handling was not consistent in normalizing uppercase vs lowercase which lead to cases where a port would not properly match to one in the system during inspection breaking clean up of old ports or setting of the PXE flag on other ports. This fixes bug 2143955.

• Fixes exception on retrieving NIC components in the periodic power sync on Redfish hardware when NetworkAdapters is not implemented for Chassis.

• Fixes an issue where firmware upgrades would fail on HP iLO Generation 11 machines when the NetworkAdapters endpoint returns HTTP 400 (Bad Request) responses during the firmware component caching process. Exception handling allows the code to continue execution past that issue.

• Fixed iPXE boot interfaces (ipxe and http-ipxe) not being recognized as PXE-capable by the neutron network interface. This resolves inconsistent neutron port creation and deletion during cleaning operations that could lead to orphaned neutron ports.

• Fixes deploying OCI artifacts uploaded by ORAS to Quay.io (and potentially other registries) as a single manifest.

• Fixes power state sync interfering with firmware updates. The conductor now skips power synchronization for nodes with in-progress firmware updates, preventing power cycling that could interrupt the update process and cause failures.

• Some BMCs do not allow changing the DateTimeLocalOffset to the same value that it already is. Since DateTimeLocalOffset is applied after DateTime if both are supplied, just supply the DateTime if the values are the same. Some BMCs do not utilize microseconds and per the Redfish spec they should not be sent a microsecond if they did not advertise one in their interface. This partially fixes bug 2143772.

• Improved Redfish compatibility with ASRock Rack servers by updating how boot mode and boot device settings are applied.

  Previously, calls to set_boot_device and set_boot_mode only included minimal parameters (e.g., BootOverrideTarget and BootOverrideMode), which were insufficient for certain vendor implementations like ASRockRack.

  This fix updates the Redfish driver to send the full payload, including BootSourceOverrideEnabled, BootSourceOverrideTarget, BootSourceOverrideMode, ensuring better compliance and reliability on these platforms.

• When using the redfish inspection driver, the system product name in the data was always the value ‘System’ due to the wrong field being read. See bug 2136233

• Allow the set_bmc_clock management setup in the redfish interface to set the time to the conductor if the time is not explicitly provided. This makes it possible to call this step and get an accurate time. For Ironic to manage the BMC, the time must be inline with the conductor so this is a better reasonable default. This also makes it possible to use the set_bmc_clock in runbooks, as originally intended, because users cannot supply a time for the runbooks without this fix the runbook could only ever set the time to a fixed value which isn’t useful. Fixes bug 2146355.

• Fixes validation of image source URLs that are redirects to another URL. Previously, it would raise UnboundLocalError.

• The ipa-inspection-callback-url kernel parameter now uses the external_callback_url configuration when set. Previously, this URL used the internal address even when external_callback_url was configured, creating inconsistency with ipa-api-url which correctly used the external address.

• Report a better error message than a KeyError when there are no interfaces in the inspection data when running the validate-interfaces inspection hook.

• Fix an issue in the OpenStack Nova-integrated installation that mac address may conflict at Neutron service during baremetal instance re-scheduling, by allowing VIFs to be unplugged when a node is in the AVAILABLE state. See bug bug 2109300 for more details.

Other Notes

• Addition of an additional vendor variable for VENDORS_REQUIRING_FULL_BOOT_REQUEST. This is because there are some recognised vendors, i.e. Lenovo, which use various BMC for their hardware, some of which require a full boot request; in such cases the vendor can now be changed to redfish_compatible.

32.0.0

Prelude

The Ironic developers are proud to announce our release for the 2025.2 development cycle in the form of Ironic 32.0.0. This release brings substantial changes in Ironic which will improve the experience and performance of Ironic. Amongst these herculian efforts includes the removal of Eventlet, Database Object Indirection, Redfish inspection use of inspection rules and hooks. Along with numerous bug fixes to address operator feedback to ultimately improve the user experience. All of this work is on top of our previously released 31.0.0 and 30.0.0 releases which were performed as part of this development cycle.

New Features

• Adds periodic cleanup of stale conductor entries from the database. A new periodic task automatically removes conductor records that have been offline for longer than the configured timeout period, helping prevent accumulation of stale conductor entries.

  Three new configuration options have been added to the [conductor] section:

  • conductor_cleanup_interval - The interval in seconds of how often to run the cleanup task (default: 86400 seconds - 1 day). For example: 86400 seconds = 1 day, 604800 seconds = 1 week, 2592000 seconds = 30 days (approx. 1 month).

  • conductor_cleanup_timeout - How long a conductor must be offline before it’s considered stale and eligible for cleanup (default: 1209600 seconds - 2 weeks). This value is always required to be at least 3x larger than [conductor]heartbeat_timeout since if otherwise, active conductors might be mistakenly removed from the database. The cleanup task will skip execution and log a warning if this requirement is not met.

  • conductor_cleanup_batch_size - Maximum number of stale conductors to clean up in a single operation (default: 50).

• A new “category” field has been added to the Port object. This field is meant to help distinguish between different types of Ports. Relevant to trait based port scheduling feature.

• A new “vendor” field has been added to the Port object. This field is meant to help distinguish between different types of Ports. Relevant to trait based port scheduling feature.

• The redfish inspection interface can now utilize inspection rules as well as inspection hooks.

• Adds inspection hooks in the redfish inspect interface for processing data received during inspection. The three default configuration hooks validate-interfaces, ports and architecture are added. A new configuration option inspection_hooks is added in the redfish configuration section.

• Adds the capability for the Ironic API services to operate without a direct connection to the Ironic database backend. Instead the RPC Object model through the concept of remotable objects. The [default]use_rpc_for_database setting can be utilized to leverage this mode of operation, however it is also implied when the [default]rpc_transport option is set to none or local.

• Ironic now utilizes native OS threads for all periodic and background activities. This change is not configurable, and should any issues be observed with Ironic’s operation, please do not hesitate to report them to the developer community.

Upgrade Notes

• The minimum version of the futurist library is now 3.2.0. This change is being made to support the removal of the Eventlet library from use in Ironic.

• The wsgi_scripts entry point ironic-api-wsgi has been removed from setup.cfg. WSGI servers should now use the module path ironic.wsgi:application directly instead of the generated script. This change aligns with the OpenStack goal to migrate from WSGI scripts to module paths and is compatible with modern Python packaging tools.

  For example, with gunicorn:

  gunicorn ironic.wsgi:application
  

  Or with uwsgi:

  [uwsgi]
  module = ironic.wsgi:application
  

• The Apache mod_wsgi sample configuration has been removed. Operators should use modern WSGI servers like uWSGI or Gunicorn instead, which provide better performance and are simpler to configure. See the updated deployment documentation for examples.

• The options in the [local_rpc] group introduced in Ironic 31.0 have been removed and no longer have any effect.

• When using the redfish inspection method, the node property cpus will no longer be populated. No other inspection method populated this field.

• The introduction of the capability to utilize remotable objects with the API has resulted in object versions internally being incremented without actual schema changes. This may result in an upgrade taking a little longer, depending on the size of the database, as object versions are updated during the upgrade sequence.

• Support for Python 3.9 has been removed. Now Python 3.10 is the minimum version supported.

Deprecation Notes

• While the legacy ironic.api.wsgi:initialize_wsgi_app() function remains available for backward compatibility, new deployments should use ironic.wsgi:application instead.

• Use of the API DBHook feature, i.e. the resulting api.request.dbapi pattern in API service code is deprecated and the DBHook will be removed in a future release of Ironic. Any downstream maintainers which utilize this pattern are encouraged to utilize an object to serve as an intermediary stepping stone between the API and the database.

Critical Issues

• With the move to the use of native threading, the required memory footprint of Ironic has increased. This is a result of both threading being used combined with process model changes which were necessary to remove the eventlet library from Ironic. The new process model consists of a launcher process with a sub-process which represents the actual application workload. In the case of single-process Ironic, a single launcher process with two workers is what operators should expect.

  As for memory utilization, it is generally tracked by two measurements. A Virtual Memory Size (VSZ) which represents memory an application has allocated, but may not actively using. The more relevant masurement is the Resident Set Size (RSS), which is the amount of memory in actual use. Due to the process changes, Operators can expect a 2-3x increase in the amount overall system memory in use (RSS). The VSZ can be expected to be upwards of 10x larger, and will closely track with the current number of active threads being executed upon.

  The Ironic project is aware this may require some operator tuning of resource constraints applied to Ironic. However, the improved concurrency and performance should be an appropriate trade-off.

Bug Fixes

• Performance of Basic HTTP authentication has been improved by keeping a memory cache of bcrypt password checks. This improves the performance of Ironic conductor with JSON-RPC, and API access when using Basic HTTP authentication.

• Fixes an issue that when accelerator devices were removed from node, a re-introspection does not remove previous accelerator device information from the node.

• [Bug 2069771] Fixes an issue where deleted or decommissioned conductors would remain in openstack baremetal conductor list indefinitely with Alive = False status. The new periodic cleanup task automatically removes these stale entries after the configured timeout period.

• When power state synchronization confirms or restores the expected state, the last_error field may retain stale messages, giving a misleading impression of failure on an otherwise healthy node. If [conductor]node_history is enabled, the field is now cleared, ensuring status reflects current node health while preserving error history.

• Fixes an issue with <range in> operator in root device hint. Now it’s possible to use the range operator correctly, specifying a two values range that includes the size of the root device in GiB.

• Fixes bug where reserved service steps (wait, hold) executed on nodes in “service failed” state would incorrectly transition the node directly to “active” state, bypassing the expected intermediate wait/hold states. Now nodes in “service failed” state properly transition to “service wait” or “service hold” when wait/hold steps are executed, maintaining the expected state machine flow.

• Fixes servicing abort handling to respect the abortable flag of service steps. Previously, servicing steps could be aborted regardless of their abortable flag setting. Now, if a service step has abortable set to False, the abort will be deferred until the current step completes, similar to how cleaning steps work. This ensures service steps that cannot be safely interrupted are allowed to complete before the abort takes effect.

• No longer uses JSON RPC with [DEFAULT]rpc_transport set to none. It was required during the transition away from eventlet, and is no longer needed. RPC can still be enabled by setting rpc_transport to json-rpc.

• When using the redfish inspection method, the node property cpu_arch is now populated correctly with i686 or x86_64 for the processor.

• Fixes the ability to invoke the abort API verb when a node is in service fail state, allowing the user to back out of a failure state. For more information see bug 2119989.

• The eventlet library is no longer invoked by Ironic for the management of threads.