From 480d17b135c3ffc8fe0d37d295251f7012e71b6b Mon Sep 17 00:00:00 2001
From: haseeb <syedhaseebahmed12@gmail.com>
Date: Mon, 19 Oct 2026 21:19:37 +0530
Subject: [PATCH] feat(ironic): Add configure_snmpv3_user step to
 DracRedfishManagement

https://github.com/rackerlabs/ironic/pull/15
---
 components/ironic/values.yaml                 |  3 +
 containers/ironic/Dockerfile                  |  2 +-
 workflows/argo-events/kustomization.yaml      |  1 +
 .../workflowtemplates/snmpv3-password.yaml    | 70 +++++++++++++++++++
 4 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 workflows/argo-events/workflowtemplates/snmpv3-password.yaml

diff --git a/components/ironic/values.yaml b/components/ironic/values.yaml
index 9ccbad81b..c28e48562 100644
--- a/components/ironic/values.yaml
+++ b/components/ironic/values.yaml
@@ -290,6 +290,9 @@ pod:
       - secret:
           name: ironic-bmc-sso-oidc-ini
           optional: true
+      - secret:
+          name: ironic-snmpv3-master
+          optional: true
     ironic_novncproxy:
       - secret:
           name: ironic-ks-etc
diff --git a/containers/ironic/Dockerfile b/containers/ironic/Dockerfile
index 391c7befb..eccec3e57 100644
--- a/containers/ironic/Dockerfile
+++ b/containers/ironic/Dockerfile
@@ -12,7 +12,7 @@ RUN apt-get update && \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # renovate: name=openstack/ironic repo=https://github.com/rackerlabs/ironic.git branch=understack/2026.1
-ARG IRONIC_GIT_REF=6700c020ecf29253fff19dddda85935099ab773e
+ARG IRONIC_GIT_REF=08136f28c450a8e32708a7355f45f2c4d6caa5ad
 ADD --keep-git-dir=true https://github.com/rackerlabs/ironic.git#${IRONIC_GIT_REF} /src/ironic
 RUN git -C /src/ironic fetch --unshallow --tags
 
diff --git a/workflows/argo-events/kustomization.yaml b/workflows/argo-events/kustomization.yaml
index 4c83fdfec..ac59f6bf3 100644
--- a/workflows/argo-events/kustomization.yaml
+++ b/workflows/argo-events/kustomization.yaml
@@ -22,6 +22,7 @@ resources:
   - workflowtemplates/ansible-run.yaml
   - workflowtemplates/inspect-server.yaml
   - workflowtemplates/bmc-password.yaml
+  - workflowtemplates/snmpv3-password.yaml
   - workflowtemplates/server-firmware-update.yaml
   - workflowtemplates/resync-nautobot.yaml
   # CronWorkflows
diff --git a/workflows/argo-events/workflowtemplates/snmpv3-password.yaml b/workflows/argo-events/workflowtemplates/snmpv3-password.yaml
new file mode 100644
index 000000000..7f75e2539
--- /dev/null
+++ b/workflows/argo-events/workflowtemplates/snmpv3-password.yaml
@@ -0,0 +1,70 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: snmpv3-password
+  annotations:
+    workflows.argoproj.io/title: Obtain per-node SNMPv3 credentials
+    workflows.argoproj.io/description: |
+      Defined in `workflows/argo-events/workflowtemplates/snmpv3-password.yaml`
+
+      Prints credentials to workflow logs, like bmc-password. Use the same
+      master as the conductor. The image must contain ironic.common.snmpv3.
+      The ironic-snmpv3-master Secret must exist in the workflow namespace.
+      This only derives credentials; run configure_snmpv3_user to program the BMC.
+
+      Set NODE to the Ironic node UUID and use the appropriate OS_CLOUD.
+      Read the service tag from its inspection inventory, then submit:
+
+      ```
+      SERVICE_TAG=$(openstack baremetal node inventory save "$NODE" \
+        | jq -r '.inventory.system_vendor.serial_number')
+
+      argo -n argo-events submit --from workflowtemplate/snmpv3-password \
+        -p service_tag="$SERVICE_TAG" --watch
+      ```
+      The optional prefix parameter defaults to uc. Override with
+      -p prefix=ucsl1 to match a conductor configured with that prefix.
+      Prefixes accept 1 to 16 lowercase ASCII letters or digits and affect
+      only the username, not the passphrases.
+
+      Use username, auth_passphrase and privacy_passphrase from the logs in
+      the monitoring system. Authentication and privacy protocols must match
+      the configure_snmpv3_user runbook (defaults: SHA and AES).
+spec:
+  serviceAccountName: workflow
+  entrypoint: main
+  arguments:
+    parameters:
+      - name: service_tag
+      # Match conf.ironic.drac.snmpv3_username_prefix in conductor Helm values.
+      - name: prefix
+        value: uc
+  volumes:
+    - name: snmpv3-master
+      secret:
+        secretName: ironic-snmpv3-master
+        items:
+          - key: snmpv3.conf
+            path: snmpv3.conf
+  templates:
+    - name: main
+      container:
+        image: ghcr.io/rackerlabs/understack/ironic:2026.1
+        command:
+          - python
+          - -m
+          - ironic.common.snmpv3
+        # This workflow does not read the conductor's Helm values at
+        # conf.ironic.drac.snmpv3_username_prefix. Set the prefix parameter to
+        # the same value so the derived username matches the BMC account.
+        args:
+          - "{{workflow.parameters.service_tag}}"
+          - --config-file
+          - /etc/snmpv3/snmpv3.conf
+          - --prefix
+          - "{{workflow.parameters.prefix}}"
+        volumeMounts:
+          - name: snmpv3-master
+            mountPath: /etc/snmpv3
+            readOnly: true