diff --git a/ansible/group_vars/all/ironic b/ansible/group_vars/all/ironic
index f9683609ef212ce1629b85ee27e8d32eeca0a8d6..3a50debcdc3fee39e1fb6c668e35b013f01aae68 100644
--- a/ansible/group_vars/all/ironic
+++ b/ansible/group_vars/all/ironic
@@ -34,11 +34,10 @@ kolla_ironic_default_console_interface: ipmitool-socat
 # Specify the list of deploy interfaces to load during service initialization.
 kolla_ironic_enabled_deploy_interfaces:
   - direct
-  - iscsi
 
 # Default deploy interface to be used for nodes that do not have
 # deploy_interface field set.
-kolla_ironic_default_deploy_interface: iscsi
+kolla_ironic_default_deploy_interface: direct
 
 # Specify the list of inspect interfaces to load during service initialization.
 kolla_ironic_enabled_inspect_interfaces:
diff --git a/dev/functions b/dev/functions
index 7833a97f99784522737d57e351dc0cdb7c41d087..147477a10f80f17dbdd7b9492f047f2b84d7d838 100644
--- a/dev/functions
+++ b/dev/functions
@@ -813,9 +813,7 @@ function configure_iptables {
     sudo iptables -I INPUT -d $INTERNAL_VIP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
     sudo iptables -I INPUT -d $INTERNAL_VIP -p tcp --dport $GLANCE_SERVICE_PORT -j ACCEPT || true
 
-    if is_ipxe_enabled; then
-        sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
-    fi
+    sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
 
     if is_cinder_enabled; then
         sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $ISCSI_SERVICE_PORT -j ACCEPT || true
diff --git a/playbooks/kayobe-overcloud-upgrade-base/run.yml b/playbooks/kayobe-overcloud-upgrade-base/run.yml
index a149215e9b8748151bbb4e88c4f5180a45713923..23621a1962fc4d414d4bf1dccd389af383cef3df 100644
--- a/playbooks/kayobe-overcloud-upgrade-base/run.yml
+++ b/playbooks/kayobe-overcloud-upgrade-base/run.yml
@@ -16,7 +16,9 @@
           # be run after install.
           shell:
             cmd: dev/configure-firewall.sh
-            chdir: "{{ previous_kayobe_src_dir }}"
+            # TODO(mgoddard): Use the previous repo when the previous release
+            # is no longer Wallaby.
+            chdir: "{{ kayobe_src_dir }}"
 
         - name: Ensure overcloud is deployed
           shell:
@@ -87,6 +89,16 @@
             cmd: "docker image prune --all --force"
           become: true
 
+        # TODO(mgoddard): Remove this task when the previous release is no
+        # longer Wallaby.
+        - name: Switch ironic nodes deploy interface to direct
+          shell:
+            cmd: >-
+              source ~/tenks-venv/bin/activate &&
+              source {{ kayobe_config_src_dir }}/etc/kolla/public-openrc.sh &&
+              openstack baremetal node set tk0 --deploy-interface direct &&
+              openstack baremetal node set tk1 --deploy-interface direct
+
         # Perform a smoke test against the upgraded current release.
 
         - name: Perform testing of VMs in the upgraded overcloud
diff --git a/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml b/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..aadb7398dcb79cd85e13aaabcc437edf4603f064
--- /dev/null
+++ b/releasenotes/notes/remove-ironic-iscsi-cb15bec4e494b62c.yaml
@@ -0,0 +1,11 @@
+---
+upgrade:
+  - |
+    Removes the ``iscsi`` interface from
+    ``kolla_ironic_enabled_deploy_interfaces``, and changes
+    ``kolla_ironic_default_deploy_interface`` to ``direct``. This is in line
+    with upstream changes in Ironic during the Xena cycle, in which the
+    ``iscsi`` deploy driver was removed.
+
+    Existing nodes using the ``iscsi`` deploy driver should be updated to an
+    alternative such as ``direct`` before upgrading.