openstack/ironic — Week of 2026-10-10

Image and credential handling. The headline addition is a new image_server_auth_hosts config knob that restricts the scope of credentials sent to image servers, landing twice (presumably master plus a backport) at roughly 550 lines each. Alongside it, OCI pre-shared basic auth credential handling was fixed, and Glance encrypted images are now explicitly rejected during validation rather than silently failing later.

Networking and TBN. Template-based networking saw a cluster of corrections: VIF attach now only executes the first matching TBN action, configure_tenant_networks only plugs ports that actually carry a tenant VIF, Portgroup creation no longer dereferences a nonexistent vendor field (landed across three branches), and TBN comparisons against unset variables are now guaranteed never to match. A small _retrieve_attribute fix stops it raising when an object attribute is None.

Stability and drivers. A file descriptor leak in Cinder client connections was closed out at ~250/-140. The Ansible deploy interface gained an option to disable the per-node Python interpreter override, and redfish unit tests now mock cache_firmware_components() to stay isolated.

Elsewhere, a one-line comment clarified that the shim reference is to any shim, not specifically Red Hat's.