Bug 2211691

Description of problem:

The Cinder fix for CVE-2023-2088 breaks Ironic's Boot from Volume support by changing the underlying requirement for credentials to be passed to perform a "detach" operation of a volume outside of Nova's direct handling.

Ironic independently triggers a detach on a tear down, regardless of if the end user requested a Boot from Volume node from Cinder, or from Ironic directly, in order to ensure that the storage system does not keep an attachment to a physical machine after the instance is removed. This prevents potential data loss issues with volumes and potential security issues if Ironic did not halt it's tear down process.

NOTE: This fix is not to address a vulnerability nor is this issue a vulnerability, but the change in the behavior in Cinder to remedy the vulnerability in cinder. While the fundamental issue *is* similar, the use case and the attachments are to whole physical machines in Ironic's case, and Ironic failing as a result of CVE-2023-2088 fixes is actually a good thing proving that the base Cinder fix works as expected, and that Ironic's base behavior was already properly guarding in the event there was an issue. In this case.


How reproducible:


Steps to Reproduce:

0) Deploy a cloud with cinder in the enabled_storage_interfaces configuration list for ironic.

1) Set the desired baremetal node to utilize the "cinder" storage_interface on the Ironic node. This may or may not be the install default based upon settings with which the cloud was deployed.

baremetal node set --storage-interface cinder $NODE_UUID

2) Set the baremetal node to advertise itself as having an iscsi boot capability.

baremetal node set --property capabilities=iscsi_boot:True $NODE_UUID

3) Set an iscsi initiator IQN for the node. This is the bare minimum, and is for iscsi only. Users utilizing fiber channel storage would use different parameters.

baremetal volume connector create \
         --node $NODE_UUID --type iqn --connector-id iqn.2017-08.org.openstack.$NODE_UUID

4) Request a boot from cinder volume instance matching the baremetal node from the Compute service *or* directly ask ironic to boot the volume (https://docs.openstack.org/ironic/latest/admin/boot-from-volume.html#use-without-cinder) and then trigger a baremetal node deployment.

Actual results:

Instance boots, but cannot be torn down automatically. The baremetal node tear down process fails due to the Cinder behavior change as a result of CVE-2023-2088 leaving the node in an error state when the node is requested to be removed. Potentially consuming and orphaning the baremetal node from being used until manual intervention is taken.

Manual recovery is likely a path of manually setting the node to maintenance and removing/re-adding to Ironic which is a highly undesirable action for a bare metal operator.

Expected results:

Instance and baremetal node is appropriately torn down and volume attachments are released.

Additional info: