Skip to content

Prevent Sled-Agent upsert until rack is adopted by operator #11580

Open

Description

@andrewjstone

When a sled-agent is started, it attempts to find Nexus via DNS and then sends a message over the Nexus internal API that results in insertion into the sled table in CRDB. This is a mostly unconditional upsert. It also occurs on sled-agent reboots to announce changes in disk reservation.

Ideally, we would not have a client-side versioned upcall from sled-agent to Nexus at all. But that change is likely quite involved and not urgent right now.

We do, however, need to ensure that sleds cannot be added to the sled table until a rack is adopted as that allows them to be used for operational purposes. While we plan to also gate this via mTLS in the future, we need an initial tactic to use now, to prevent arbitrary upserts. The simplest solution is only to insert to the sled table if the rack_id exists in the rack table. Since the rack table is managed by Nexus alone, we can ensure this doesn't happen before we are ready.

Note that we may have to change how the rack table is currently populated for this to work with RSS and normal sled add procedures. However, that appears to be a smaller lift than removing the sled-agent directed upsert altogether.

Activity

  1. self-assigned this
    on Oct 23, 2026
  2. added a commit that references this issue on Oct 26, 2026
    5100c32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions