Repository navigation
[meta] upgrade progenitor to 0.13, reqwest to 0.13; use progenitor-extras - #9917
Merged
sunshowers merged 5 commits intoFeb 26, 2026
Conversation
Created using spr 1.3.6-beta.1
sunshowers
changed the title
11 of 18 tasks
This was referenced Feb 25, 2026
Created using spr 1.3.6-beta.1
Created using spr 1.3.6-beta.1
smklein
approved these changes
Feb 25, 2026
smklein
left a comment
smklein
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for pushing through this upgrade, looks kinda painful to keep both side-by-side, but seems like the right path. Happy to get everyone to 0.13 when we actually can.
Created using spr 1.3.6-beta.1
Contributor
Author
Yeah, I hope it goes away soon -- plan to push on it best I can. |
sunshowers
enabled auto-merge (squash)
February 25, 2026 23:31
sunshowers
deleted the
sunshowers/spr/meta-upgrade-progenitor-to-013-reqwest-to-013-adopt-progenitor-extras
branch
February 26, 2026 01:56
sunshowers
added a commit
to oxidecomputer/crucible
that referenced
this pull request
Feb 26, 2026
Part of oxidecomputer/omicron#9824. Some Crucible operations in Omicron use retries with [`progenitor_operation_retry.rs`](https://github.com/oxidecomputer/omicron/blob/main/common/src/progenitor_operation_retry.rs). As a result, landing this by itself would make the next crucible bump in Omicron somewhat painful. To ameliorate this: * the retry code is extracted out into its own crate on crates.io, [progenitor-extras](https://docs.rs/progenitor-extras/latest/progenitor_extras/) * oxidecomputer/omicron#9917 makes omicron use progenitor-extras.
This was referenced Oct 13, 2026
smklein
added a commit
that referenced
this pull request
Oct 14, 2026
Since the upgrade to reqwest 0.13 (#9917), building a `reqwest::Client` loads the system's TLS root certificates from disk. This can fail, as we've seen, when the process is out of file descriptors. Progenitor's generated `Client::new` unwraps that result, which is how Nexus panicked in #10871 (see also oxidecomputer/progenitor#1440). Control plane services on the underlay *currently* talk to each other over plain HTTP, so they have no use for those certificates. This PR adds `omicron_common::http_client::{internal_http_client_builder, internal_http_client}`, which trust no TLS roots (`tls_certs_only([])`) and therefore do no I/O when building a client, and uses them in place of generated `Client::new` calls and `reqwest::ClientBuilder::new()` for internal clients. Requests to `https` URLs through these clients fail certificate verification; clients that need TLS (webhooks, IdP metadata) are unchanged. This intentionally keeps the existing `unwrap`/`expect` behavior; a follow-up PR will propagate client-construction errors instead. Part of #10871.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #9824.
We need to retain compatibility with progenitor 0.10 for the time being while other repos are updated. Once the upgrades are done and everything's synced up, I'll do a cleanup pass before closing #9824.