Merge branch 'main' into self-assembling-zones-part-1

.cargo/config

@@ -7,13 +7,50 @@
 [build]
 rustdocflags = "--document-private-items"
 
-# On illumos, use `-znocompstrtab` to reduce link time.
+# On illumos, use `-znocompstrtab` to reduce link time. We also add the Oxide
+# specific platform directory to the RPATH where additional libraries can be
+# found such as libipcc.
 #
-# Note that these flags are overridden by a user's environment variable, so
-# things critical to correctness probably don't belong here.
+# Our reasoning for including `-R/usr/platform/oxide/lib/amd64` here:
+# - Oxide specific features - This path contains Oxide specific libraries such
+#   as libipcc and will likely grow over time to include more functionality.
+# - Avoid the rpaths crate - The rpaths crate was built to deal with runtime
+#   paths that are dynamic such as with libraries like libpq which can live in
+#   different locations based on OS. This path will only ever be found on
+#   illumos and will be tied directly to the Oxide platform.
+# - Less developer burden - Having something like the ipcc crate emit
+#   `DEP_IPCC_LIBDIRS` means that we end up littering the repo with Cargo.toml
+#   and build.rs changes whenever ipcc shows up somewhere in the dependency
+#   tree. While initially exploring that path we ran into a significant number
+#   of tests failing due to not being able to find libipcc in the runtime path
+#   which can be confusing or surprising to someone doing work on omicron.
+#
+# We could also update Helios so that a symlink is created from
+# /usr/platform/oxide/lib/amd64 into /usr/lib/64 but we opted to not take
+# this route forward as it meant waiting for another round of updates on
+# shared build machines and to buildomat itself.
+#
+# As documented at:
+# https://doc.rust-lang.org/cargo/reference/config.html#buildrustflags
+#
+# There are four mutually exclusive sources of extra flags. They are checked in
+# order, with the first one being used:
+#   1. `CARGO_ENCODED_RUSTFLAGS` environment variable.
+#   2. `RUSTFLAGS` environment variable.
+#   3. All matching target.<triple>.rustflags and target.<cfg>.rustflags config
+#      entries joined together.
+#   4. build.rustflags config value.
+#
+# When overriding the defaults in this config by environment variable the user
+# may need to manually pass the additional options found below.
+#
+# Note that other runtime paths should not be added here, but should instead
+# reuse the infrastructure found in the `rpaths` crate which can be found in
+# this repo. Those paths are usually platform specific and will vary based on a
+# variety of things such as host OS.
 [target.x86_64-unknown-illumos]
 rustflags = [
-    "-C", "link-arg=-Wl,-znocompstrtab"
+    "-C", "link-arg=-Wl,-znocompstrtab,-R/usr/platform/oxide/lib/amd64"
 ]
 
 # Set up `cargo xtask`.

.config/nextest.toml

@@ -3,7 +3,7 @@
 #
 # The required version should be bumped up if we need new features, performance
 # improvements or bugfixes that are present in newer versions of nextest.
-nextest-version = { required = "0.9.59", recommended = "0.9.59" }
+nextest-version = { required = "0.9.64", recommended = "0.9.67" }
 
 experimental = ["setup-scripts"]
 
@@ -17,7 +17,9 @@ setup = 'crdb-seed'
 fail-fast = false
 
 [script.crdb-seed]
-command = 'cargo run -p crdb-seed'
+# Use the test profile for this executable since that's how almost all
+# invocations of nextest happen.
+command = 'cargo run -p crdb-seed --profile test'
 
 # The ClickHouse cluster tests currently rely on a hard-coded set of ports for
 # the nodes in the cluster. We would like to relax this in the future, at which
@@ -30,3 +32,9 @@ clickhouse-cluster = { max-threads = 1 }
 [[profile.default.overrides]]
 filter = 'package(oximeter-db) and test(replicated)'
 test-group = 'clickhouse-cluster'
+
+[[profile.ci.overrides]]
+filter = 'binary_id(omicron-nexus::test_all)'
+# As of 2023-01-08, the slowest test in test_all takes 196s on a Ryzen 7950X.
+# 900s is a good upper limit that adds a comfortable buffer.
+slow-timeout = { period = '60s', terminate-after = 15 }

.github/buildomat/build-and-test.sh

@@ -4,10 +4,12 @@ set -o errexit
 set -o pipefail
 set -o xtrace
 
+target_os=$1
+
 # NOTE: This version should be in sync with the recommended version in
 # .config/nextest.toml. (Maybe build an automated way to pull the recommended
 # version in the future.)
-NEXTEST_VERSION='0.9.59'
+NEXTEST_VERSION='0.9.67'
 
 cargo --version
 rustc --version
@@ -48,6 +50,13 @@ ptime -m bash ./tools/install_builder_prerequisites.sh -y
 #
 banner build
 export RUSTFLAGS="-D warnings"
+# When running on illumos we need to pass an additional runpath that is
+# usually configured via ".cargo/config" but the `RUSTFLAGS` env variable
+# takes precedence. This path contains oxide specific libraries such as
+# libipcc.
+if [[ $target_os == "illumos" ]]; then
+	RUSTFLAGS="-D warnings -C link-arg=-R/usr/platform/oxide/lib/amd64"
+fi
 export RUSTDOCFLAGS="-D warnings"
 export TMPDIR=$TEST_TMPDIR
 export RUST_BACKTRACE=1

.github/buildomat/jobs/build-and-test-helios.sh

@@ -5,7 +5,7 @@
 #: target = "helios-2.0"
 #: rust_toolchain = "1.72.1"
 #: output_rules = [
-#:	"/var/tmp/omicron_tmp/*",
+#:	"%/var/tmp/omicron_tmp/*",
 #:	"!/var/tmp/omicron_tmp/crdb-base*",
 #:	"!/var/tmp/omicron_tmp/rustc*",
 #: ]

.github/buildomat/jobs/build-and-test-linux.sh

@@ -5,7 +5,7 @@
 #: target = "ubuntu-22.04"
 #: rust_toolchain = "1.72.1"
 #: output_rules = [
-#:	"/var/tmp/omicron_tmp/*",
+#:	"%/var/tmp/omicron_tmp/*",
 #:	"!/var/tmp/omicron_tmp/crdb-base*",
 #:	"!/var/tmp/omicron_tmp/rustc*",
 #: ]

.github/buildomat/jobs/deploy.sh

@@ -2,7 +2,7 @@
 #:
 #: name = "helios / deploy"
 #: variety = "basic"
-#: target = "lab-2.0-opte-0.25"
+#: target = "lab-2.0-opte-0.27"
 #: output_rules = [
 #:  "%/var/svc/log/oxide-sled-agent:default.log*",
 #:  "%/pool/ext/*/crypt/zone/oxz_*/root/var/svc/log/oxide-*.log*",
@@ -281,19 +281,15 @@ rmdir pkg
 E2E_TLS_CERT="/opt/oxide/sled-agent/pkg/initial-tls-cert.pem"
 
 #
-# Image-related tests use images served by catacomb. The lab network is
-# IPv4-only; the propolis zones are IPv6-only. These steps set up tcpproxy
-# configured to proxy to catacomb via port 54321 in the global zone.
+# Download the Oxide CLI and images from catacomb.
 #
 pfexec mkdir -p /usr/oxide
-pfexec rm -f /usr/oxide/tcpproxy
-pfexec curl -sSfL -o /usr/oxide/tcpproxy \
-	http://catacomb.eng.oxide.computer:12346/tcpproxy
-pfexec chmod +x /usr/oxide/tcpproxy
-pfexec rm -f /var/svc/manifest/site/tcpproxy.xml
-pfexec curl -sSfL -o /var/svc/manifest/site/tcpproxy.xml \
-	http://catacomb.eng.oxide.computer:12346/tcpproxy.xml
-pfexec svccfg import /var/svc/manifest/site/tcpproxy.xml
+pfexec curl -sSfL -o /usr/oxide/oxide \
+	http://catacomb.eng.oxide.computer:12346/oxide-v0.1.0
+pfexec chmod +x /usr/oxide/oxide
+
+curl -sSfL -o debian-11-genericcloud-amd64.raw \
+	http://catacomb.eng.oxide.computer:12346/debian-11-genericcloud-amd64.raw
 
 #
 # The lab-netdev target is a ramdisk system that is always cleared
@@ -336,7 +332,38 @@ echo "Waited for chrony: ${retry}s"
 
 export RUST_BACKTRACE=1
 export E2E_TLS_CERT IPPOOL_START IPPOOL_END
-./tests/bootstrap
+eval "$(./tests/bootstrap)"
+export OXIDE_HOST OXIDE_TOKEN
+
+#
+# The Nexus resolved in `$OXIDE_RESOLVE` is not necessarily the same one that we
+# successfully talked to in bootstrap, so wait a bit for it to fully come online.
+#
+retry=0
+while ! curl -sSf "$OXIDE_HOST/v1/ping" --resolve "$OXIDE_RESOLVE" --cacert "$E2E_TLS_CERT"; do
+	if [[ $retry -gt 60 ]]; then
+		echo "$OXIDE_RESOLVE failed to come up after 60 seconds"
+		exit 1
+	fi
+	sleep 1
+	retry=$((retry + 1))
+done
+
+/usr/oxide/oxide --resolve "$OXIDE_RESOLVE" --cacert "$E2E_TLS_CERT" \
+	project create --name images --description "some images"
+/usr/oxide/oxide --resolve "$OXIDE_RESOLVE" --cacert "$E2E_TLS_CERT" \
+	disk import \
+	--path debian-11-genericcloud-amd64.raw \
+	--disk debian11-boot \
+	--project images \
+	--description "debian 11 cloud image from distros" \
+	--snapshot debian11-snapshot \
+	--image debian11 \
+	--image-description "debian 11 original base image" \
+	--image-os debian \
+	--image-version "11"
+/usr/oxide/oxide --resolve "$OXIDE_RESOLVE" --cacert "$E2E_TLS_CERT" \
+	image promote --project images --image debian11
 
 rm ./tests/bootstrap
 for test_bin in tests/*; do

.github/buildomat/jobs/package.sh

@@ -37,7 +37,7 @@ rustc --version
 # trampoline global zone images.
 #
 COMMIT=$(git rev-parse HEAD)
-VERSION="1.0.4-0.ci+git${COMMIT:0:11}"
+VERSION="5.0.0-0.ci+git${COMMIT:0:11}"
 echo "$VERSION" >/work/version.txt
 
 ptime -m ./tools/install_builder_prerequisites.sh -yp

.github/workflows/hakari.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           toolchain: stable
       - name: Install cargo-hakari
-        uses: taiki-e/install-action@ccc14bdc8d34cddf54e4f9fb2da0c208427207a3 # v2
+        uses: taiki-e/install-action@681c09da0e1063a389bc0f4cfa913bfdfdaf0a4d # v2
         with:
           tool: cargo-hakari
       - name: Check workspace-hack Cargo.toml is up-to-date

.github/workflows/rust.yml

@@ -34,7 +34,7 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
-    - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1
+    - uses: Swatinem/rust-cache@a22603398250b864f7190077025cf752307154dc # v2.7.2
       if: ${{ github.ref != 'refs/heads/main' }}
     - name: Report cargo version
       run: cargo --version
@@ -64,7 +64,7 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
-    - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1
+    - uses: Swatinem/rust-cache@a22603398250b864f7190077025cf752307154dc # v2.7.2
       if: ${{ github.ref != 'refs/heads/main' }}
     - name: Report cargo version
       run: cargo --version
@@ -94,7 +94,7 @@ jobs:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
-    - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1
+    - uses: Swatinem/rust-cache@a22603398250b864f7190077025cf752307154dc # v2.7.2
       if: ${{ github.ref != 'refs/heads/main' }}
     - name: Report cargo version
       run: cargo --version

.github/workflows/update-maghemite.yml

@@ -47,15 +47,15 @@ jobs:
 
       - name: Extract new maghemite package version
         run: |
-          eval $(cat tools/maghemite_openapi_version | grep COMMIT)
+          eval $(cat tools/maghemite_mg_openapi_version | grep COMMIT)
           echo "version=${COMMIT:0:7}" >> $GITHUB_OUTPUT
         id: updated
 
       - name: Commit changes
         run: |
           . ./tools/reflector/helpers.sh
 
-          PATHS=("tools/maghemite_openapi_version")
+          PATHS=("tools/maghemite_ddm_openapi_version" "tools/maghemite_mg_openapi_version" "tools/maghemite_mgd_checksums")
           CHANGES=()
           commit $TARGET_BRANCH $INT_BRANCH ${{ inputs.reflector_user_id }} PATHS CHANGES
 

.github/workflows/validate-openapi-spec.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
-      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.2
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: '18'
       - name: Install our tools