Bug 1898517 - Ironic auto-discovery may result in rogue nodes registered in ironic
Summary: Ironic auto-discovery may result in rogue nodes registered in ironic
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Bare Metal Hardware Provisioning
Version: 4.7
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.7.0
Assignee: Dmitry Tantsur
QA Contact: Lubov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-11-17 12:08 UTC by Dmitry Tantsur
Modified: 2021-02-24 15:34 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Node auto-discovery is no longer enabled in baremetal IPI. It was not handled correctly and caused duplicate bare metal hosts registration.
Clone Of:
Environment:
Last Closed: 2021-02-24 15:34:16 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:34:53 UTC

Description Dmitry Tantsur 2020-11-17 12:08:05 UTC
We have auto-discovery enabled in ironic-inspector-image, which means that anything that boots IPA and is not being deployed will be introspected and registered in ironic. Since BMO cannot detect such nodes, they prevent normal enrollment later on because of MAC address duplication.

Let us disable ironic auto-discovery until we support it in BMO.

Comment 2 Dmitry Tantsur 2021-01-06 13:20:07 UTC
Testing: make sure that just powering on a node (outside of openshift) does not result in adding it to ironic.

For example:
1) Deploy masters
2) Power on a worker manually without adding it to OpenShift (e.g. via ipmitool or its web UI).
3) The worker may or may not boot the inspection ramdisk, but in the end should fail and no new node should appear in ironic.
3.1) If the worker does not network boot by default, it's worth manually setting it to network boot in the firmware settings (or using ipmitool).

Comment 6 errata-xmlrpc 2021-02-24 15:34:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633


Note You need to log in before you can comment on or make changes to this bug.