WIP FOR A GARFIELD MONDAY

Author: andrewjstone

nexus/db-queries/src/db/datastore/physical_disk.rs

@@ -281,6 +281,25 @@ impl DataStore {
     }
 
     /// Decommissions all expunged disks.
+    //
+    // TODO: This is not safe to do.
+    //
+    // We have multliple nexuses running, and one can be lagging behind the others.
+    // It may think it knows which disks have been expunged at the current sled,
+    // but new disks could have been added in the `ExpungedButActive` state
+    // that will now get decommissioned prematurely.
+    //
+    // The planner needs to explicitly decide which disks to decommission based
+    // on the omicron_physical_disks_config field in sled_agent inventory. If
+    // the sled the disk is on has already been expunged the planner can use
+    // that instead of the sled-agent field in inventory to decide that its safe
+    // to decommission the disk. It needs to mark these as decommissioned in the
+    // blueprint and the executor needs to then perform the decommissioning for
+    // all disk ids.
+    //
+    // The planner on the next round will then go ahead and see that the given
+    // disks are decommissioned in the planning input (database) and remove the
+    // disks to decommission from the new blueprint.
     pub async fn physical_disk_decommission_all_expunged(
         &self,
         opctx: &OpContext,

nexus/reconfigurator/planning/src/planner.rs

@@ -106,7 +106,26 @@ impl<'a> Planner<'a> {
         Ok(())
     }
 
+    /// Decommission any `ExpungedButActive` disks that the sled-agent knows
+    /// are expunged.
+    ///
+    /// We need to find the set of all `ExpungedButActive` disks that no
+    /// longer exist in `parent_blueprint.blueprint_disks`. Then we need to
+    /// look at the inventory and see if the corresponding sled-agent has seen
+    /// a the omicron_physical_disks_generation from the parent_blueprint.
+    /// Alternatively, we can mark a disk decommissioned if the sled it's on
+    /// has been expunged.  If it has then the disks can be decommissioned at
+    /// that sled-agent.
+    fn do_plan_decommission_disks(&mut self) -> Result<(), Error> {
+        todo!()
+    }
+
     fn do_plan_decommission(&mut self) -> Result<(), Error> {
+        self.do_plan_decommission_disks()?;
+        self.do_plan_decommission_sleds()
+    }
+
+    fn do_plan_decommission_sleds(&mut self) -> Result<(), Error> {
         // Check for any sleds that are currently commissioned but can be
         // decommissioned. Our gates for decommissioning are:
         //