When a node enrolls with the Ironic autodetect deploy interface or switches to it, cleaning operations silently fail to trigger. The configuration appears correct, the node provisions normally, and nothing in standard logging indicates a problem — but the sanitization step that should run between tenant allocations never executes. This is a timing-dependent state machine initialization failure: the autodetect mechanism initializes its deployment interface but does not correctly signal the cleaning state transition, leaving the node in a state where subsequent provisioning proceeds without the required sanitization cycle.
The security impact is direct and deterministic. Ironic's cleaning operations exist specifically to erase disks, reset firmware, and remove residual configuration between tenant uses of bare metal hardware. When this fails silently, nodes provisioned to new tenants may carry data or configuration from previous tenants. Unlike a traditional vulnerability requiring attacker action, this creates an operational certainty of isolation failure — every node cycling through autodetect that hasn't been patched is potentially leaking prior tenant state to the next tenant.
The failure is invisible by design. Standard Ironic logging at INFO level does not surface this state machine initialization gap. Operators reviewing node status see active nodes with correct configuration. Operators reviewing cleaning logs see gaps without explanation. The autodetect path has historically received less integration testing scrutiny than static deploy interface configurations, which allowed this initialization drift to persist undetected.
To detect whether this affects your deployment: first, identify all nodes using the autodetect deploy interface via openstack baremetal node list --provision-state available --driver-info deploy_interface=autodetect. Second, review the cleaning history for these nodes — look for the cleaning provision state transition in the node's event log. If nodes have cycled through available state without a recorded cleaning operation since the last interface change, they have likely skipped sanitization. Third, instrument the state transition path: enable DEBUG-level logging for the ironic-conductor service and monitor for messages containing cleaning and autodetect during node interface changes to catch the failure in flight.
The remediation is a code fix in the autodetect interface's state machine initialization. Until patched, the operational workaround is to manually trigger cleaning on any autodetect node: openstack baremetal node clean <node_id> --clean-steps <steps>. This is required for every node that has changed to or enrolled with autodetect, regardless of how many provisioning cycles have already occurred, because the cleaning skip is not retroactively recoverable — you cannot audit past provisioning events to confirm whether data persisted. After patching, re-enrolling affected nodes will trigger the correct state machine transition and restore automatic cleaning.