[khackworth]

Adding volume mount for network-device-credentials secret
Adding oslo.config for netdev creds
includes get_credential and get_panos_credentials helpers

[github-actions]

Python test results

416 tests   411 ✅  51s ⏱️
  1 suites    5 💤
  1 files      0 ❌

Results for commit 7761d79.

♻️ This comment has been updated with latest results.

[cardoe]

We really don't need to mess with mounting paths. We should use Oslo.config for anything we need to load.

[cardoe]

So we'll revisit this to declare the variables properly so we can validate configs as well but we can move forward to let testing happen.

So we'll revisit this to declare the variables properly so we can validate configs as well but we can move forward to let testing happen.

[cardoe]

Thanks for putting this together. A few things to change before merging:

1. Password and key options need secret=True

None of the credential options set secret=True. Without it, oslo.config prints the real values in the config dump at service startup whenever debug logging is on. Please add it to every *_password option and to panorama_master_key:

cfg.StrOpt("standard_password", secret=True, help="PAN-OS standard password"),
cfg.StrOpt("panorama_master_key", secret=True, help="Panorama master key"),

2. Rename the groups to share a netdev_ prefix

• nd_service_accounts → netdev_common
• f5 → netdev_f5
• panos → netdev_panos

All three now group together in the config and are clearly tied to network devices. A bare f5 or panos section in ironic.conf could also clash with an upstream or vendor plugin later. With the rename, the nd = "nd" entry in .typos.toml can go. Allowing nd everywhere would hide real "and" typos across the repo.

3. Drop the enroll-fw.yaml change

This loads a different secret (network-device-credentials, not -ini) into the enroll-fw pod as environment variables. Nothing in the workflow reads them, so every network device password ends up in the env of every enroll-fw pod for no benefit. Please add it in the PR that actually uses it, and use a file mount rather than envFrom when that happens.

4. The secret key must end in .conf

etcSources mounts network-device-credentials-ini into /etc/ironic/ironic.conf.d/, and --config-dir only reads *.conf files. If the ExternalSecret's key is something like network_devices.ini, it will be ignored without any error and every option will come back as None or its default. Please confirm the key is network_devices.conf.

5. Trim the tests and fix the cleanup

Most of these tests set an override and check that oslo.config returns it, which tests oslo.config rather than our code. One small test that checks the helpers return the right shape is enough.

Whatever stays shouldn't reach into CONF._groups[group]._opts. If those private attributes change, the try/except silently skips the cleanup and the tests start affecting each other. test_panos_uses_defaults already only passes because of the order the tests run in. Use oslo_config.fixture.Config instead, which undoes the overrides for you.

Also, rather than turning off S105/S106 for every test file in pyproject.toml, please put # noqa: S105 / # noqa: S106 on the specific lines that have fake passwords.

[cardoe]

These review comments are done in add-network-device-credentials-config...netdev-credentials-review