openstack/ironic — Week of 2026-10-31

Networking and VIF tracking. A substantial fix landed for cases where Neutron ports weren't tracked with the baremetal port, alongside new vif.id, vif.name and vif.tags filter variables for template-based networking (TBN). Related polish included raising an error for unhandled TBN actions on VIF attach and correcting the TBNNoPortMatchesFound message format. The NetType import was straightened out on master and stable.

Security hardening. Image-server credential scope gained an image_server_auth_hosts allowlist, with image_server_auth_permit_unknown_hosts flipped to False by default. Separately, ansible_playbooks_path is now validated against permitted directories and enforced by default. A gzip-bomb mitigation that chunks decompressions and enforces a size limit was merged on master and backported across five stable branches, with a follow-up broadening the release note's scope.

Driver and inspection work. Redfish inspection now discovers NIC vendor, product and PCI address. A Lenovo UEFI boot loop in the prepare_instance flow was fixed, full-boot-request vendor handling was made consistent, and a retry was added for setting the boot device when the BMC requests it — backported to four stable branches. The known_accelerators table picked up new models.

Elsewhere. CI now builds and publishes a Debian partition image fixture; DevStack mixed-service jobs retain OVN and Tempest setup; and docs migrated off wiki.openstack.org.