feat(ironic): generate snmpv3 user credentials

components/ironic/values.yaml

@@ -290,6 +290,9 @@ pod:
       - secret:
           name: ironic-bmc-sso-oidc-ini
           optional: true
+      - secret:
+          name: ironic-snmpv3-master
+          optional: true
     ironic_novncproxy:
       - secret:
           name: ironic-ks-etc

containers/ironic/Dockerfile

@@ -12,7 +12,7 @@ RUN apt-get update && \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # renovate: name=openstack/ironic repo=https://github.com/rackerlabs/ironic.git branch=understack/2026.1
-ARG IRONIC_GIT_REF=6700c020ecf29253fff19dddda85935099ab773e
+ARG IRONIC_GIT_REF=08136f28c450a8e32708a7355f45f2c4d6caa5ad
 ADD --keep-git-dir=true https://github.com/rackerlabs/ironic.git#${IRONIC_GIT_REF} /src/ironic
 RUN git -C /src/ironic fetch --unshallow --tags
 

workflows/argo-events/kustomization.yaml

@@ -22,6 +22,7 @@ resources:
   - workflowtemplates/ansible-run.yaml
   - workflowtemplates/inspect-server.yaml
   - workflowtemplates/bmc-password.yaml
+  - workflowtemplates/snmpv3-password.yaml
   - workflowtemplates/server-firmware-update.yaml
   - workflowtemplates/resync-nautobot.yaml
   # CronWorkflows

workflows/argo-events/workflowtemplates/snmpv3-password.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: snmpv3-password
+  annotations:
+    workflows.argoproj.io/title: Obtain per-node SNMPv3 credentials
+    workflows.argoproj.io/description: |
+      Defined in `workflows/argo-events/workflowtemplates/snmpv3-password.yaml`
+
+      Prints credentials to workflow logs, like bmc-password. Use the same
+      master as the conductor. The image must contain ironic.common.snmpv3.
+      The ironic-snmpv3-master Secret must exist in the workflow namespace.
+      This only derives credentials; run configure_snmpv3_user to program the BMC.
+
+      Set NODE to the Ironic node UUID and use the appropriate OS_CLOUD.
+      Read the service tag from its inspection inventory, then submit:
+
+      ```
+      SERVICE_TAG=$(openstack baremetal node inventory save "$NODE" \
+        | jq -r '.inventory.system_vendor.serial_number')
+
+      argo -n argo-events submit --from workflowtemplate/snmpv3-password \
+        -p service_tag="$SERVICE_TAG" --watch
+      ```
+      The optional prefix parameter defaults to uc. Override with
+      -p prefix=ucsl1 to match a conductor configured with that prefix.
+      Prefixes accept 1 to 16 lowercase ASCII letters or digits and affect
+      only the username, not the passphrases.
+
+      Use username, auth_passphrase and privacy_passphrase from the logs in
+      the monitoring system. Authentication and privacy protocols must match
+      the configure_snmpv3_user runbook (defaults: SHA and AES).
+spec:
+  serviceAccountName: workflow
+  entrypoint: main
+  arguments:
+    parameters:
+      - name: service_tag
+      # Match conf.ironic.drac.snmpv3_username_prefix in conductor Helm values.
+      - name: prefix
+        value: uc
+  volumes:
+    - name: snmpv3-master
+      secret:
+        secretName: ironic-snmpv3-master
+        items:
+          - key: snmpv3.conf
+            path: snmpv3.conf
+  templates:
+    - name: main
+      container:
+        image: ghcr.io/rackerlabs/understack/ironic:2026.1
+        command:
+          - python
+          - -m
+          - ironic.common.snmpv3
+        # This workflow does not read the conductor's Helm values at
+        # conf.ironic.drac.snmpv3_username_prefix. Set the prefix parameter to
+        # the same value so the derived username matches the BMC account.
+        args:
+          - "{{workflow.parameters.service_tag}}"
+          - --config-file
+          - /etc/snmpv3/snmpv3.conf
+          - --prefix
+          - "{{workflow.parameters.prefix}}"
+        volumeMounts:
+          - name: snmpv3-master
+            mountPath: /etc/snmpv3
+            readOnly: true