From 99590326a3a09279a646c7c2936485a08869396e Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Thu, 19 Dec 2024 14:42:29 +0100
Subject: [PATCH] [ironic] Move image verification to agent

The ironic-python-agent gets some config values over the
lookup api as 'config' in the json.
And two values are unintuitively taken from the conductor config
section.
So, we have to set them in the api node as well, in order to have the
settings take hold in the agent.

With a current ironic-python-agent, we do not need to validate then
in the conductor itself.
---
 openstack/ironic/templates/etc/_ironic.conf.tpl | 12 ++++++++++++
 openstack/ironic/values.yaml                    |  1 +
 2 files changed, 13 insertions(+)

diff --git a/openstack/ironic/templates/etc/_ironic.conf.tpl b/openstack/ironic/templates/etc/_ironic.conf.tpl
index 9cccb40a258..899ffaa2a84 100644
--- a/openstack/ironic/templates/etc/_ironic.conf.tpl
+++ b/openstack/ironic/templates/etc/_ironic.conf.tpl
@@ -132,3 +132,15 @@ metrics_enabled = {{ if .Values.audit.metrics_enabled -}}True{{- else -}}False{{
 {{- include "osprofiler" . }}
 
 {{- include "ini_sections.cache" . }}
+
+
+{{- if or .Values.conductor.defaults.conductor.permitted_image_formats .Values.conductor.defaults.conductor.disable_deep_image_inspection }}
+
+[conductor]
+  {{- if .Values.conductor.defaults.conductor.disable_deep_image_inspection }}
+disable_deep_image_inspection = {{ .Values.conductor.defaults.conductor.disable_deep_image_inspection }}
+  {{- end }}
+  {{- if .Values.conductor.defaults.conductor.permitted_image_formats }}
+permitted_image_formats = {{ .Values.conductor.defaults.conductor.permitted_image_formats }}
+  {{- end }}
+{{- end }}
diff --git a/openstack/ironic/values.yaml b/openstack/ironic/values.yaml
index aaee1476c03..18551752cb7 100644
--- a/openstack/ironic/values.yaml
+++ b/openstack/ironic/values.yaml
@@ -209,6 +209,7 @@ conductor:
     redfish:
       swift_object_expiry_timeout: "5400"
     conductor:
+      conductor_always_validates_images: False # We only use the direct interface, so leave it to the agent
       permitted_image_formats: 'raw,qcow2,iso,vmdk'
 
 agent: