---
security:
  - |
    Disable installation of bootloaders (via grub-install) by IPA by default
    in order to improve security posture by adding a new agent configuration
    option `enable_bios_bootloader_install` which defaults to `True` for this
    branch of Ironic.

    Operators who have a stricter security posture or do not need this
    functionality can disable installation of bootloaders by setting
    `enable_bios_bootloader_install` to `False`. Addresses CVE-2026-43003.
