feat(ironic): allow automation to configure SNMPv3 user independently of the node's provisioning lifecycle using vendor passthru

Author: syedhaseebahmed

containers/ironic/Dockerfile

@@ -12,7 +12,7 @@ RUN apt-get update && \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # renovate: name=openstack/ironic repo=https://github.com/rackerlabs/ironic.git branch=understack/2026.1
-ARG IRONIC_GIT_REF=7800737e179295a3bf73590238af3d58875a5040
+ARG IRONIC_GIT_REF=a5181744455932776ea9f38171e7f2e699918e44
 ADD --keep-git-dir=true https://github.com/rackerlabs/ironic.git#${IRONIC_GIT_REF} /src/ironic
 RUN git -C /src/ironic fetch --unshallow --tags
 

python/understack-workflows/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
 [project.scripts]
 bmc-kube-password = "understack_workflows.main.bmc_display_password:main"
 bmc-password = "understack_workflows.main.print_bmc_password:main"
+configure-snmpv3-user = "understack_workflows.main.configure_snmpv3_user:main"
 enroll-fw = "understack_workflows.main.enroll_fw:main"
 enroll-netdev = "understack_workflows.main.enroll_netdev:main"
 enroll-server = "understack_workflows.main.enroll_server:main"

python/understack-workflows/tests/test_configure_snmpv3_user.py

@@ -0,0 +1,70 @@
+from unittest.mock import Mock
+from unittest.mock import call
+
+import pytest
+from ironicclient.common.apiclient import exceptions
+from tenacity import stop_after_attempt
+from tenacity import wait_none
+
+from understack_workflows.main import configure_snmpv3_user as cli
+
+
+def test_conflict_retries_the_same_request_without_lifecycle_calls():
+    client = Mock()
+    client.client.node.vendor_passthru.side_effect = [
+        exceptions.Conflict("Node is busy"),
+        {"configured": True},
+    ]
+    # Tenacity adds retry_with at runtime but does not expose it in its types.
+    configure = cli.configure_snmpv3_user.retry_with(  # pyright: ignore[reportFunctionMemberAccess]
+        wait=wait_none(), stop=stop_after_attempt(2)
+    )
+
+    configure(client, "node-uuid", 5)
+
+    request = call.client.node.vendor_passthru(
+        "node-uuid", "configure_snmpv3_user", args={"slot": 5}, http_method="POST"
+    )
+    assert client.mock_calls == [request, request]
+
+
+@pytest.mark.parametrize("error", [exceptions.BadRequest, exceptions.Forbidden])
+def test_permanent_errors_are_not_retried(error):
+    client = Mock()
+    client.client.node.vendor_passthru.side_effect = error("Cannot configure")
+
+    with pytest.raises(error):
+        cli.configure_snmpv3_user(client, "node-uuid", 5)
+
+    client.client.node.vendor_passthru.assert_called_once()
+
+
+def test_busy_node_eventually_fails():
+    client = Mock()
+    client.client.node.vendor_passthru.side_effect = exceptions.Conflict("Busy")
+    # Tenacity adds retry_with at runtime but does not expose it in its types.
+    configure = cli.configure_snmpv3_user.retry_with(  # pyright: ignore[reportFunctionMemberAccess]
+        wait=wait_none(), stop=stop_after_attempt(2)
+    )
+
+    with pytest.raises(exceptions.Conflict):
+        configure(client, "node-uuid", 5)
+
+    assert client.client.node.vendor_passthru.call_count == 2
+
+
+def test_main_resolves_node_and_uses_monitoring_slot(mocker):
+    mocker.patch("sys.argv", ["configure-snmpv3-user", "--node", "Dell-ABC1234"])
+    client = mocker.patch.object(cli, "IronicClient").return_value
+    client.get_node.return_value.uuid = "node-uuid"
+    configure = mocker.patch.object(cli, "configure_snmpv3_user")
+
+    cli.main()
+
+    configure.assert_called_once_with(client, "node-uuid", 5)
+
+
+@pytest.mark.parametrize("slot", ["2", "17", "invalid"])
+def test_invalid_slot_is_rejected(slot):
+    with pytest.raises(SystemExit):
+        cli.argument_parser().parse_args(["--node", "node-uuid", "--slot", slot])

python/understack-workflows/understack_workflows/main/configure_snmpv3_user.py

@@ -0,0 +1,53 @@
+import argparse
+import logging
+
+from ironicclient.common.apiclient import exceptions
+from tenacity import before_sleep_log
+from tenacity import retry
+from tenacity import retry_if_exception_type
+from tenacity import stop_after_delay
+from tenacity import wait_fixed
+
+from understack_workflows import helpers
+from understack_workflows.ironic.client import IronicClient
+
+logger = logging.getLogger(__name__)
+
+
+@retry(
+    retry=retry_if_exception_type(exceptions.Conflict),
+    stop=stop_after_delay(600),
+    wait=wait_fixed(10),
+    before_sleep=before_sleep_log(logger, logging.INFO),
+    reraise=True,
+)
+def configure_snmpv3_user(client: IronicClient, node_uuid: str, slot: int) -> None:
+    """Wait for contention to clear, then configure SNMP without transitions."""
+    client.client.node.vendor_passthru(
+        node_uuid,
+        "configure_snmpv3_user",
+        args={"slot": slot},
+        http_method="POST",
+    )
+
+
+def argument_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Configure BMC SNMPv3 without changing Ironic node state."
+    )
+    parser.add_argument("--node", required=True, help="Node name or UUID")
+    parser.add_argument("--slot", type=int, choices=range(3, 17), default=5)
+    return parser
+
+
+def main() -> None:
+    helpers.setup_logger()
+    args = argument_parser().parse_args()
+    client = IronicClient()
+    node = client.get_node(args.node)
+    configure_snmpv3_user(client, node.uuid, args.slot)
+    logger.info("SNMPv3 configured on node %s", node.uuid)
+
+
+if __name__ == "__main__":
+    main()

workflows/argo-events/kustomization.yaml

@@ -23,6 +23,7 @@ resources:
   - workflowtemplates/inspect-server.yaml
   - workflowtemplates/bmc-password.yaml
   - workflowtemplates/snmpv3-password.yaml
+  - workflowtemplates/workflowtemplate-bmc-configure-snmpv3-user.yaml
   - workflowtemplates/server-firmware-update.yaml
   - workflowtemplates/resync-nautobot.yaml
   # CronWorkflows

workflows/argo-events/workflowtemplates/workflowtemplate-bmc-configure-snmpv3-user.yaml

@@ -0,0 +1,53 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: bmc-configure-snmpv3-user
+  annotations:
+    workflows.argoproj.io/title: Configure the SNMPv3 user on a node BMC
+    workflows.argoproj.io/description: |
+      Defined in `workflows/argo-events/workflowtemplates/workflowtemplate-bmc-configure-snmpv3-user.yaml`
+
+      Configures the SNMPv3 user through Ironic vendor passthrough without
+      changing node provisioning state. Retries busy nodes for up to ten minutes.
+spec:
+  entrypoint: run
+  serviceAccountName: workflow
+  arguments:
+    parameters:
+      - name: node_uuid
+  templates:
+    - name: run
+      inputs:
+        parameters:
+          - name: node_uuid
+          - name: slot
+            default: "5"
+      synchronization:
+        mutexes:
+          - name: ironic-runbooks-{{inputs.parameters.node_uuid}}
+      volumes:
+        - name: openstack
+          secret:
+            secretName: baremetal-manage
+            items:
+              - key: clouds.yaml
+                path: clouds.yaml
+      container:
+        image: ghcr.io/rackerlabs/understack/ironic-nautobot-client:latest
+        command:
+          - configure-snmpv3-user
+        args:
+          - --node
+          - "{{inputs.parameters.node_uuid}}"
+          - --slot
+          - "{{inputs.parameters.slot}}"
+        envFrom:
+          - configMapRef:
+              name: cluster-metadata
+        env:
+          - name: OS_CLOUD
+            value: understack
+        volumeMounts:
+          - name: openstack
+            mountPath: /etc/openstack
+            readOnly: true