Add the sush proxy to the switch zone

.cargo/xtask.toml

@@ -36,6 +36,10 @@ binary_allow_list = [
   "omicron-dev",
   "sled-agent",
   "sled-agent-sim",
+  # sush-proxy does not actually depend directly on ipcc, but because
+  # it and sled-agent both depend on `sprockets-tls`, feature unification
+  # results in sled-agent enabling that crate's ipcc feature for both builds.
+  "sush-proxy",
 ]
 
 # libnvme is a global zone only library and therefore we must be sure that only

Cargo.toml

@@ -174,6 +174,7 @@ members = [
     "sled-storage/zfs-test-harness",
     "sp-sim",
     "support-bundle-collection",
+    "sush-proxy",
     "test-utils",
     "trust-quorum",
     "trust-quorum/gfss",
@@ -375,6 +376,7 @@ default-members = [
     "sled-storage/zfs-test-harness",
     "sp-sim",
     "support-bundle-collection",
+    "sush-proxy",
     "trust-quorum",
     "trust-quorum/gfss",
     "trust-quorum/protocol",
@@ -710,6 +712,7 @@ omicron-pins = { path = "dev-tools/pins" }
 omicron-repl-utils = { path = "dev-tools/repl-utils" }
 omicron-rpaths = { path = "rpaths" }
 omicron-sled-agent = { path = "sled-agent" }
+omicron-sush-proxy = { path = "sush-proxy" }
 omicron-test-utils = { path = "test-utils" }
 omicron-workspace-hack = "0.1.0"
 omicron-zone-package = "0.12.3"
@@ -878,6 +881,7 @@ support-bundle-collection = { path = "support-bundle-collection" }
 support-bundle-viewer = "0.1.2"
 sush-api = { git = "https://github.com/oxidecomputer/sush", rev = "b72da8c514decf9f8d8e57f49463b8d2f93333be" }
 sush-common = { git = "https://github.com/oxidecomputer/sush", rev = "b72da8c514decf9f8d8e57f49463b8d2f93333be" }
+sush-proxy = { git = "https://github.com/oxidecomputer/sush", rev = "b72da8c514decf9f8d8e57f49463b8d2f93333be" }
 sush-server = { git = "https://github.com/oxidecomputer/sush", rev = "b72da8c514decf9f8d8e57f49463b8d2f93333be", features = ["embedded"] }
 swrite = "0.1.0"
 sync-ptr = "0.1.4"

clients/ddm-admin-client/src/lib.rs

@@ -16,6 +16,7 @@ use omicron_common::address::BOOTSTRAP_SLED_SUBNET_PREFIX_LENGTH;
 use omicron_common::address::DDMD_PORT;
 use omicron_common::address::Ipv6Subnet;
 use omicron_common::address::SLED_PREFIX_LENGTH;
+use omicron_common::address::get_sled_address;
 use omicron_common::http_client::internal_http_client_builder;
 use oxnet::Ipv6Net;
 use sled_hardware_types::underlay::BootstrapInterface;
@@ -106,6 +107,17 @@ impl Client {
         self.inner.enable_stats(request).await.map(|resp| resp.into_inner())
     }
 
+    /// Returns the sled address within each subnet
+    /// [`Self::derive_underlay_subnets_from_prefixes`] returns. Since
+    /// those are not all sled subnets, not every address answers as a
+    /// sled.
+    pub async fn derive_sled_addrs_from_prefixes(
+        &self,
+    ) -> Result<impl Iterator<Item = SocketAddrV6> + use<>, DdmError> {
+        let subnets = self.derive_underlay_subnets_from_prefixes().await?;
+        Ok(subnets.map(get_sled_address))
+    }
+
     /// Returns every non-bootstrap /64 prefix ddmd has learned. These
     /// are not all sled subnets: an internal DNS zone is reachable at
     /// its own reserved /64, advertised by the sled hosting it, and

common/src/address.rs

@@ -234,6 +234,7 @@ pub const REPO_DEPOT_PORT: u16 = 12348;
 pub const TRUST_QUORUM_PORT: u16 = 12349;
 pub const SUSH_API_PORT: u16 = 12350;
 pub const SUSH_GOSSIP_PORT: u16 = 12351;
+pub const SUSH_PROXY_PORT: u16 = 12352;
 
 pub const BOOTSTRAP_AGENT_LOCKSTEP_PORT: u16 = 8080;
 

dev-tools/ls-apis/api-manifest.toml

@@ -58,6 +58,7 @@ packages = [
     "lldpd",
     "mgd",
     "omicron-gateway",
+    "omicron-sush-proxy",
     "tfportd",
     "wicketd",
 ]
@@ -781,6 +782,30 @@ permalinks = [
     "https://github.com/oxidecomputer/omicron/blob/6cef874/sled-agent/src/instance.rs#L2283",
 ]
 
+[[intra_deployment_unit_only_edges]]
+server = "omicron-sush-proxy"
+client = "ddm-admin-client"
+note = """
+sush-proxy discovers sleds through its own switch zone's ddmd, always
+via Client::localhost (sush-proxy/src/lib.rs).
+"""
+permalinks = [
+    "https://github.com/oxidecomputer/omicron/blob/main/sush-proxy/src/lib.rs",
+]
+
+[[intra_deployment_unit_only_edges]]
+server = "omicron-sush-proxy"
+client = "gateway-client"
+note = """
+sush-proxy reads the cubby map from its own switch zone's MGS.
+sled-agent sets the mgs-address SMF property to [::1] (services.rs),
+and the manifest passes it via --mgs-address.
+"""
+permalinks = [
+    "https://github.com/oxidecomputer/omicron/blob/main/sled-agent/src/services.rs",
+    "https://github.com/oxidecomputer/omicron/blob/main/smf/sush-proxy/manifest.xml",
+]
+
 [[intra_deployment_unit_only_edges]]
 server = "propolis-server"
 client = "sled-agent-client"

dev-tools/ls-apis/tests/api_dependencies.out

@@ -26,6 +26,7 @@ Maghemite DDM Admin (client: ddm-admin-client)
     consumed by: installinator (omicron/installinator) via 1 path
     consumed by: mgd (maghemite/mgd) via 1 path
     consumed by: omicron-sled-agent (omicron/sled-agent) via 2 paths
+    consumed by: omicron-sush-proxy (omicron/sush-proxy) via 1 path
     consumed by: sled-agent-rack-setup (omicron/sled-agent/rack-setup) via 1 path [embedded in omicron-sled-agent; rack-init only]
     consumed by: wicketd (omicron/wicketd) via 1 path
 
@@ -49,7 +50,8 @@ Management Gateway Service (client: gateway-client)
     consumed by: lldpd (lldp/lldpd) via 1 path
     consumed by: mgd (maghemite/mgd) via 1 path
     consumed by: omicron-nexus (omicron/nexus) via 6 paths
-    consumed by: omicron-sled-agent (omicron/sled-agent) via 2 paths
+    consumed by: omicron-sled-agent (omicron/sled-agent) via 3 paths
+    consumed by: omicron-sush-proxy (omicron/sush-proxy) via 1 path
     consumed by: wicketd (omicron/wicketd) via 3 paths
 
 Wicketd Installinator (client: installinator-client)

package-manifest.toml

@@ -532,6 +532,16 @@ source.paths = [{ from = "smf/wicketd", to = "/var/svc/manifest/site/wicketd" }]
 output.type = "zone"
 output.intermediate_only = true
 
+[package.omicron-sush-proxy]
+service_name = "sush-proxy"
+only_for_targets.image = "standard"
+source.type = "local"
+source.rust.binary_names = ["sush-proxy"]
+source.rust.release = true
+source.paths = [{ from = "smf/sush-proxy", to = "/var/svc/manifest/site/sush-proxy" }]
+output.type = "zone"
+output.intermediate_only = true
+
 [package.wicket]
 service_name = "wicket"
 only_for_targets.image = "standard"
@@ -863,6 +873,7 @@ source.packages = [
   "pumpkind.tar.gz",
   "wicketd.tar.gz",
   "wicket.tar.gz",
+  "omicron-sush-proxy.tar.gz",
   "mg-ddm.tar.gz",
   "mgd.tar.gz",
   "switch_zone_setup.tar.gz",
@@ -893,6 +904,7 @@ source.packages = [
   "lldp.tar.gz",
   "wicketd.tar.gz",
   "wicket.tar.gz",
+  "omicron-sush-proxy.tar.gz",
   "mg-ddm.tar.gz",
   "mgd.tar.gz",
   "switch_zone_setup.tar.gz",
@@ -925,6 +937,7 @@ source.packages = [
   "lldp.tar.gz",
   "wicketd.tar.gz",
   "wicket.tar.gz",
+  "omicron-sush-proxy.tar.gz",
   "mg-ddm.tar.gz",
   "mgd.tar.gz",
   "switch_zone_setup.tar.gz",

sled-agent/Cargo.toml

@@ -63,6 +63,7 @@ omicron-common.workspace = true
 omicron-generation-kinds.workspace = true
 omicron-ledger.workspace = true
 omicron-ddm-admin-client.workspace = true
+omicron-sush-proxy.workspace = true
 omicron-uuid-kinds.workspace = true
 omicron-workspace-hack.workspace = true
 oxide-tokio-rt.workspace = true
@@ -129,7 +130,7 @@ tufaceous-brand-metadata.workspace = true
 usdt.workspace = true
 uuid.workspace = true
 walkdir.workspace = true
-x509-cert.workspace = true
+x509-cert = { workspace = true, features = ["std"] }
 zeroize.workspace = true
 zip.workspace = true
 zone.workspace = true