[1/n] create a nexus-lockstep service

Cargo.toml

@@ -16,6 +16,7 @@ members = [
     "clients/gateway-client",
     "clients/installinator-client",
     "clients/nexus-client",
+    "clients/nexus-lockstep-client",
     "clients/ntp-admin-client",
     "clients/oxide-client",
     "clients/oximeter-client",
@@ -89,6 +90,7 @@ members = [
     "nexus/external-api",
     "nexus/internal-api",
     "nexus/inventory",
+    "nexus/lockstep-api",
     "nexus/macros-common",
     "nexus/metrics-producer-gc",
     "nexus/mgs-updates",
@@ -174,6 +176,7 @@ default-members = [
     "clients/gateway-client",
     "clients/installinator-client",
     "clients/nexus-client",
+    "clients/nexus-lockstep-client",
     "clients/ntp-admin-client",
     "clients/oxide-client",
     "clients/oximeter-client",
@@ -249,6 +252,7 @@ default-members = [
     "nexus/external-api",
     "nexus/internal-api",
     "nexus/inventory",
+    "nexus/lockstep-api",
     "nexus/macros-common",
     "nexus/metrics-producer-gc",
     "nexus/mgs-updates",
@@ -545,6 +549,8 @@ nexus-defaults = { path = "nexus/defaults" }
 nexus-external-api = { path = "nexus/external-api" }
 nexus-inventory = { path = "nexus/inventory" }
 nexus-internal-api = { path = "nexus/internal-api" }
+nexus-lockstep-api = { path = "nexus/lockstep-api" }
+nexus-lockstep-client = { path = "clients/nexus-lockstep-client" }
 nexus-macros-common = { path = "nexus/macros-common" }
 nexus-metrics-producer-gc = { path = "nexus/metrics-producer-gc" }
 nexus-mgs-updates = { path = "nexus/mgs-updates" }

clients/nexus-lockstep-client/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "nexus-lockstep-client"
+version = "0.1.0"
+edition = "2024"
+license = "MPL-2.0"
+
+[lints]
+workspace = true
+
+[dependencies]
+chrono.workspace = true
+futures.workspace = true
+omicron-workspace-hack.workspace = true
+progenitor.workspace = true
+regress.workspace = true
+reqwest.workspace = true
+schemars.workspace = true
+serde.workspace = true
+slog.workspace = true
+uuid.workspace = true

clients/nexus-lockstep-client/src/lib.rs

@@ -0,0 +1,24 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+//! Interface for making API requests to the Oxide control plane at large from
+//! callers that update in lockstep with Nexus itself (e.g. rack initialization,
+//! tests and debugging)
+
+progenitor::generate_api!(
+    spec = "../../openapi/nexus-lockstep.json",
+    interface = Positional,
+    derives = [schemars::JsonSchema],
+    inner_type = slog::Logger,
+    pre_hook = (|log: &slog::Logger, request: &reqwest::Request| {
+        slog::debug!(log, "client request";
+            "method" => %request.method(),
+            "uri" => %request.url(),
+            "body" => ?&request.body(),
+        );
+    }),
+    post_hook = (|log: &slog::Logger, result: &Result<_, _>| {
+        slog::debug!(log, "client response"; "result" => ?result);
+    }),
+);

common/src/address.rs

@@ -53,6 +53,7 @@ pub const BOOTSTRAP_ARTIFACT_PORT: u16 = 12227;
 pub const CRUCIBLE_PANTRY_PORT: u16 = 17000;
 pub const TFPORTD_PORT: u16 = 12231;
 pub const NEXUS_INTERNAL_PORT: u16 = 12221;
+pub const NEXUS_LOCKSTEP_PORT: u16 = 12232;
 
 /// The port on which Nexus exposes its external API on the underlay network.
 ///

dev-tools/ls-apis/api-manifest.toml

@@ -339,6 +339,15 @@ server_package_name = "nexus-internal-api"
 versioned_how = "client"
 versioned_how_reason = "Circular dependencies between Nexus and other services"
 
+[[apis]]
+client_package_name = "nexus-lockstep-client"
+label = "Nexus Internal Lockstep API"
+server_package_name = "nexus-lockstep-api"
+# nexus-lockstep-client has to be client-versioned because it's got a cyclic
+# dependency with sled-agent-client, which is server-versioned.
+versioned_how = "client"
+versioned_how_reason = "Circular dependencies between Nexus and other services"
+
 [[apis]]
 client_package_name = "oxide-client"
 label = "External API"

dev-tools/ls-apis/tests/api_dependencies.out

@@ -70,6 +70,8 @@ Nexus Internal API (client: nexus-client)
     consumed by: oximeter-collector (omicron/oximeter/collector) via 1 path
     consumed by: propolis-server (propolis/bin/propolis-server) via 3 paths
 
+Nexus Internal Lockstep API (client: nexus-lockstep-client)
+
 NTP Admin (client: ntp-admin-client)
     consumed by: omicron-nexus (omicron/nexus) via 2 paths
     consumed by: omicron-sled-agent (omicron/sled-agent) via 2 paths

dev-tools/omicron-dev/src/main.rs

@@ -108,6 +108,10 @@ impl RunAllArgs {
             "omicron-dev: nexus internal API:     {:?}",
             cptestctx.server.get_http_server_internal_address().await,
         );
+        println!(
+            "omicron-dev: nexus lockstep API:     {:?}",
+            cptestctx.server.get_http_server_lockstep_address().await,
+        );
         println!(
             "omicron-dev: cockroachdb pid:        {}",
             cptestctx.database.pid(),

dev-tools/openapi-manager/Cargo.toml

@@ -18,15 +18,16 @@ cockroach-admin-api.workspace = true
 debug-ignore.workspace = true
 dns-server-api.workspace = true
 dropshot.workspace = true
-hex.workspace = true
 fs-err.workspace = true
 gateway-api.workspace = true
+hex.workspace = true
 indent_write.workspace = true
 installinator-api.workspace = true
 itertools.workspace = true
+newtype_derive.workspace = true
 nexus-external-api.workspace = true
 nexus-internal-api.workspace = true
-newtype_derive.workspace = true
+nexus-lockstep-api.workspace = true
 ntp-admin-api.workspace = true
 omicron-workspace-hack.workspace = true
 openapi-lint.workspace = true
@@ -41,9 +42,9 @@ sha2.workspace = true
 similar.workspace = true
 sled-agent-api.workspace = true
 slog-error-chain.workspace = true
+supports-color.workspace = true
 textwrap.workspace = true
 thiserror.workspace = true
-supports-color.workspace = true
 wicketd-api.workspace = true
 
 [dev-dependencies]

dev-tools/openapi-manager/src/omicron.rs

@@ -13,6 +13,7 @@ use gateway_api::gateway_api_mod;
 use installinator_api::installinator_api_mod;
 use nexus_external_api::nexus_external_api_mod;
 use nexus_internal_api::nexus_internal_api_mod;
+use nexus_lockstep_api::nexus_lockstep_api_mod;
 use ntp_admin_api::ntp_admin_api_mod;
 use oximeter_api::oximeter_api_mod;
 use repo_depot_api::repo_depot_api_mod;
@@ -136,6 +137,15 @@ pub fn all_apis() -> Vec<ManagedApiConfig> {
             ident: "nexus-internal",
             extra_validation: None,
         },
+        ManagedApiConfig {
+            title: "Nexus lockstep API",
+            versions: Versions::new_lockstep(semver::Version::new(0, 0, 1)),
+            description: "Nexus lockstep internal API",
+            boundary: ApiBoundary::Internal,
+            api_description: nexus_lockstep_api_mod::stub_api_description,
+            ident: "nexus-lockstep",
+            extra_validation: None,
+        },
         ManagedApiConfig {
             title: "NTP Admin API",
             versions: Versions::new_versioned(

dev-tools/reconfigurator-cli/tests/output/cmds-example-stdout

@@ -644,7 +644,7 @@ to:   blueprint 86db3308-f817-4626-8838-4085949a6a41
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 37 (records: 47)
+    unchanged names: 38 (records: 50)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -813,6 +813,10 @@ internal DNS:
 +       SRV  port  5353 2521ef1e-ef52-46f0-9f27-93a3b6683d92.host.control-plane.oxide.internal
 +       SRV  port  5353 7f4e4ff4-b1eb-4c47-b079-9d7fcfcf35f6.host.control-plane.oxide.internal
 +       SRV  port  5353 e50dff5f-8d7c-440b-b86a-5ca7e9117dfa.host.control-plane.oxide.internal
++   name: _nexus-lockstep._tcp                               (records: 3)
++       SRV  port 12232 a2f67884-b0e7-498a-a005-f6686f599ca6.host.control-plane.oxide.internal
++       SRV  port 12232 e34091ec-ac63-4976-b2b8-85b9223c136f.host.control-plane.oxide.internal
++       SRV  port 12232 fb88d7af-16bd-4638-a9f4-ef04d0045f20.host.control-plane.oxide.internal
 +   name: _nexus._tcp                                        (records: 3)
 +       SRV  port 12221 a2f67884-b0e7-498a-a005-f6686f599ca6.host.control-plane.oxide.internal
 +       SRV  port 12221 e34091ec-ac63-4976-b2b8-85b9223c136f.host.control-plane.oxide.internal
@@ -1025,6 +1029,10 @@ internal DNS:
 -       SRV  port  5353 2521ef1e-ef52-46f0-9f27-93a3b6683d92.host.control-plane.oxide.internal
 -       SRV  port  5353 7f4e4ff4-b1eb-4c47-b079-9d7fcfcf35f6.host.control-plane.oxide.internal
 -       SRV  port  5353 e50dff5f-8d7c-440b-b86a-5ca7e9117dfa.host.control-plane.oxide.internal
+-   name: _nexus-lockstep._tcp                               (records: 3)
+-       SRV  port 12232 a2f67884-b0e7-498a-a005-f6686f599ca6.host.control-plane.oxide.internal
+-       SRV  port 12232 e34091ec-ac63-4976-b2b8-85b9223c136f.host.control-plane.oxide.internal
+-       SRV  port 12232 fb88d7af-16bd-4638-a9f4-ef04d0045f20.host.control-plane.oxide.internal
 -   name: _nexus._tcp                                        (records: 3)
 -       SRV  port 12221 a2f67884-b0e7-498a-a005-f6686f599ca6.host.control-plane.oxide.internal
 -       SRV  port 12221 e34091ec-ac63-4976-b2b8-85b9223c136f.host.control-plane.oxide.internal
@@ -1968,7 +1976,7 @@ internal DNS:
 +       SRV  port   123 ac5bb28e-91d5-42f3-a57a-d84e1c414c17.host.control-plane.oxide.internal
 -   name: e668d83e-a28c-42dc-b574-467e57403cc1.host          (records: 1)
 -       AAAA fd00:1122:3344:103::24
-    unchanged names: 43 (records: 55)
+    unchanged names: 44 (records: 58)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)

dev-tools/reconfigurator-cli/tests/output/cmds-expunge-newly-added-external-dns-stdout

@@ -482,7 +482,7 @@ internal DNS:
 -       SRV  port  5353 8c0a1969-15b6-4165-ba6d-a27c24151037.host.control-plane.oxide.internal
 +       SRV  port  5353 1dc649b1-2ce2-4a85-bc1f-b8a3ef23a70e.host.control-plane.oxide.internal
 +       SRV  port  5353 8c0a1969-15b6-4165-ba6d-a27c24151037.host.control-plane.oxide.internal
-    unchanged names: 91 (records: 103)
+    unchanged names: 92 (records: 106)
 
 external DNS:
 * DNS zone: "oxide.example": 
@@ -1005,7 +1005,7 @@ internal DNS:
 +       SRV  port  5353 fe2d5287-24e3-4071-b214-2640b097a759.host.control-plane.oxide.internal
 +   name: fe2d5287-24e3-4071-b214-2640b097a759.host          (records: 1)
 +       AAAA fd00:1122:3344:103::30
-    unchanged names: 91 (records: 103)
+    unchanged names: 92 (records: 106)
 
 external DNS:
 * DNS zone: "oxide.example": 
@@ -1517,7 +1517,7 @@ internal DNS:
 -       SRV  port  5353 fe2d5287-24e3-4071-b214-2640b097a759.host.control-plane.oxide.internal
 +       SRV  port  5353 1dc649b1-2ce2-4a85-bc1f-b8a3ef23a70e.host.control-plane.oxide.internal
 +       SRV  port  5353 fe2d5287-24e3-4071-b214-2640b097a759.host.control-plane.oxide.internal
-    unchanged names: 91 (records: 103)
+    unchanged names: 92 (records: 106)
 
 external DNS:
 * DNS zone: "oxide.example": 

dev-tools/reconfigurator-cli/tests/output/cmds-expunge-newly-added-internal-dns-stdout

@@ -494,7 +494,7 @@ internal DNS:
 +       AAAA fd00:1122:3344:3::1
 -   name: ns3                                                (records: 1)
 -       AAAA fd00:1122:3344:3::1
-    unchanged names: 87 (records: 97)
+    unchanged names: 88 (records: 100)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -636,7 +636,7 @@ to:   blueprint 58d5e830-0884-47d8-a7cd-b2b3751adeb4
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 91 (records: 103)
+    unchanged names: 92 (records: 106)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -826,7 +826,7 @@ internal DNS:
 +       AAAA fd00:1122:3344:2::1
 +   name: ns3                                                (records: 1)
 +       AAAA fd00:1122:3344:3::1
-    unchanged names: 87 (records: 97)
+    unchanged names: 88 (records: 100)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)

dev-tools/reconfigurator-cli/tests/output/cmds-expunge-zones-stdout

@@ -310,7 +310,7 @@ internal DNS:
 -       AAAA fd00:1122:3344:103::26
 -   name: _crucible._tcp.694bd14f-cb24-4be4-bb19-876e79cda2c8 (records: 1)
 -       SRV  port 32345 694bd14f-cb24-4be4-bb19-876e79cda2c8.host.control-plane.oxide.internal
-    unchanged names: 49 (records: 63)
+    unchanged names: 50 (records: 66)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -478,7 +478,7 @@ internal DNS:
 -       SRV  port 32345 dfac80b4-a887-430a-ae87-a4e065dba787.host.control-plane.oxide.internal
 -   name: dfac80b4-a887-430a-ae87-a4e065dba787.host          (records: 1)
 -       AAAA fd00:1122:3344:101::26
-    unchanged names: 45 (records: 59)
+    unchanged names: 46 (records: 62)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)

dev-tools/reconfigurator-cli/tests/output/cmds-host-phase-2-source-stdout

@@ -159,7 +159,7 @@ to:   blueprint 8da82a8e-bf97-4fbd-8ddd-9f6462732cf1
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 49 (records: 59)
+    unchanged names: 50 (records: 62)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -320,7 +320,7 @@ to:   blueprint 58d5e830-0884-47d8-a7cd-b2b3751adeb4
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 49 (records: 59)
+    unchanged names: 50 (records: 62)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -632,7 +632,7 @@ to:   blueprint af934083-59b5-4bf6-8966-6fb5292c29e1
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 49 (records: 59)
+    unchanged names: 50 (records: 62)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)
@@ -793,7 +793,7 @@ to:   blueprint df06bb57-ad42-4431-9206-abff322896c7
 
 internal DNS:
   DNS zone: "control-plane.oxide.internal" (unchanged)
-    unchanged names: 49 (records: 59)
+    unchanged names: 50 (records: 62)
 
 external DNS:
   DNS zone: "oxide.example" (unchanged)