Bug 2137679

What problem/issue/behavior are you having trouble with?  What do you expect to see?
Virtual BMC is used to manage power and boot sequence of libvirt virtual domains by using IPMI commands.
Here is RH article on how to use VBMC for this purpose: https://access.redhat.com/solutions/4315581

When libvirt virtual domains are defined from XML with VNC password provided, the password is set properly in <graphics> block. But after OpenStack overcloud introspection is run, Ironic uses IPMI commands to switch virtual domains to boot from PXE and powers them on.

When you power on, off or check power status of virtual domains VirtualBMC translates it into libvirt commands to respectively power on/off or check power. But, when Ironic i.e. sets boot mode by running ipmitool with command "chassis bootdev pxe", VirtualBMC dumps XML domain definition, makes changes to block responsible for boot order ( <os> ) and applies changed XML to running domain. This is the moment VNC password disappears.

There is a line of code in vbmc.py that dumps XML domain definition in "set_boot_device" class method:
                tree = ET.fromstring(domain.XMLDesc())

I believe domain.XMLDesc() lacks flag to dump XML with sensitive data, in this case VNC password.

What is the business impact? Please also provide timeframe information.
Client declares security issue in its production environment because of passwordless VNC connection possible.

Where are you experiencing the behavior? What environment?
On all lab and prodauction environments.

When does the behavior occur? Frequency? Repeatedly? At certain times?
This behaviour occurs always.

Changing from:
tree = ET.fromstring(domain.XMLDesc())
to:
tree = ET.fromstring(domain.XMLDesc(VIR_DOMAIN_XML_SECURE))
solves the issue.