You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Prevent Sled-Agent upsert until rack is adopted by operator #11580
When a sled-agent is started, it attempts to find Nexus via DNS and then sends a message over the Nexus internal API that results in insertion into the sled table in CRDB. This is a mostly unconditional upsert. It also occurs on sled-agent reboots to announce changes in disk reservation.
Ideally, we would not have a client-side versioned upcall from sled-agent to Nexus at all. But that change is likely quite involved and not urgent right now.
We do, however, need to ensure that sleds cannot be added to the sled table until a rack is adopted as that allows them to be used for operational purposes. While we plan to also gate this via mTLS in the future, we need an initial tactic to use now, to prevent arbitrary upserts. The simplest solution is only to insert to the sled table if the rack_id exists in the rack table. Since the rack table is managed by Nexus alone, we can ensure this doesn't happen before we are ready.
Note that we may have to change how the rack table is currently populated for this to work with RSS and normal sled add procedures. However, that appears to be a smaller lift than removing the sled-agent directed upsert altogether.
Activity
Gate sled upsert on rack_id