Merge remote-tracking branch 'origin/main' into rest-core-identifiers

# Conflicts:
#	rest-api/docs/index.html
#	rest-api/openapi/oasdiff-breaking-changes-ignore.txt

Author: kunzhao-nv

.cargo/config.toml

@@ -37,6 +37,13 @@ rustflags = [
 #[target.x86_64-unknown-linux-gnu]
 #rustflags = ["-C", "linker=clang", "-C", "link-arg=-fuse-ld=lld"]
 
+# mold is selected by the build environment rather than from here, through
+# CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER pointing at a driver that
+# already passes -fuse-ld=mold. Setting the flag here as well reached every
+# aarch64 build, including ones whose image predates the mold install, and cc
+# rejects a linker it does not have: "unrecognized command-line option
+# '-fuse-ld=mold'". Keep linker selection with the toolchain that provides it.
+
 [env]
 RUST_TEST_THREADS = "40"
 

.envrc

@@ -4,6 +4,14 @@ export TESTDB_HOST=localhost
 
 export RUSTC_WRAPPER=sccache
 
+# Native ARM64 builds use Clang. Cross-build environments provide their own
+# target-aware compiler driver through the same Cargo environment variable.
+case "$(uname -s):$(uname -m)" in
+    Linux:aarch64|Linux:arm64)
+        export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=clang
+        ;;
+esac
+
 # required for sqlx::test harnesses.
 export DATABASE_URL=postgresql://${TESTDB_USER}:${TESTDB_PASSWORD}@${TESTDB_HOST}
 export REPO_ROOT=$(git rev-parse --show-toplevel)

.github/workflows/rest-lint-and-test.yml

@@ -264,6 +264,7 @@ jobs:
           - nvswitch-manager
           - powershelf-manager
           - proto
+          - sdk-simple
           - site-agent
           - site-manager
           - site-workflow

crates/admin-cli/src/os_image/create/args.rs

@@ -27,12 +27,22 @@ EXAMPLES:
 
 Create an OS image entry in a tenant's catalog:
     $ nico-admin-cli os-image create --id 12345678-1234-5678-90ab-cdef01234567 \
-    --url https://images.example.com/ubuntu.qcow2 --digest sha256:abcd… --tenant-org-id fds34511233a
+    --url https://images.example.com/ubuntu.qcow2 --digest sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae --tenant-org-id fds34511233a
 
 Create one with a name/description and a Bearer auth token for the image URL:
     $ nico-admin-cli os-image create --id 12345678-1234-5678-90ab-cdef01234567 \
-    --url https://images.example.com/ubuntu.qcow2 --digest sha256:abcd… --tenant-org-id fds34511233a \
-    --name ubuntu-22.04 --description \"Ubuntu 22.04 base\" --auth-type Bearer --auth-token <token>
+    --url https://images.example.com/ubuntu.qcow2 --digest sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae --tenant-org-id fds34511233a \
+    --name ubuntu-22.04 --description \"Ubuntu 22.04 base\" --auth-type Bearer --auth-token ZXhhbXBsZS1pbWFnZS10b2tlbg==
+
+Overwrite the smallest whole disk, preferring an EFI disk to break a size tie:
+    $ nico-admin-cli os-image create --id 12345678-1234-5678-90ab-cdef01234567 \
+    --url https://images.example.com/ubuntu.qcow2 --digest sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae --tenant-org-id fds34511233a \
+    --boot-disk smallest
+
+Overwrite a disk selected by its stable Linux identifier:
+    $ nico-admin-cli os-image create --id 12345678-1234-5678-90ab-cdef01234567 \
+    --url https://images.example.com/ubuntu.qcow2 --digest sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae --tenant-org-id fds34511233a \
+    --boot-disk /dev/disk/by-id/nvme-Dell_BOSS-N1_VNOWW56VFCV0055601UT
 
 ")]
 pub(crate) struct Args {
@@ -84,7 +94,11 @@ pub(crate) struct Args {
         help = "Label of the root filesystem of the OS image."
     )]
     rootfs_label: Option<String>,
-    #[clap(short = 'b', long, help = "Boot device path if using local disk.")]
+    #[clap(
+        short = 'b',
+        long,
+        help = "Whole-disk target that the image overwrites. Accepts 'smallest', /dev/nvme<controller>n<namespace>, /dev/sd<letters>, or /dev/disk/by-id/<identifier>. If omitted or empty, selection prefers a disk with an EFI partition, then /dev/nvme0n1 or /dev/sda."
+    )]
     boot_disk: Option<String>,
     #[clap(long, help = "UUID of the image boot filesystem (/boot)")]
     bootfs_id: Option<String>,

crates/agent/src/ethernet_virtualization.rs

@@ -231,9 +231,9 @@ impl NvueClientContext {
     }
 
     // Wrap the inner nvue_client's `push_config()` and try to avoid re-applying
-    // a configuration we're already using. Returns Ok(Some(revision_id)) on
-    // a change, Ok(None) if the config was unchanged, and otherwise passes
-    // through errors from the inner client.
+    // a configuration we're already using. Returns Ok(Some(revision_id)) when
+    // a revision was applied, Ok(None) if the config was unchanged, and
+    // otherwise passes through errors from the inner client.
     async fn update_config(
         &mut self,
         config: &NvueConfig,
@@ -245,13 +245,9 @@ impl NvueClientContext {
         {
             Ok(None)
         } else {
-            self.nvue_client
-                .push_config(config)
-                .await
-                .map(|revision_id| {
-                    self.last_applied_hash.replace(new_hash);
-                    Some(revision_id)
-                })
+            let revision_id = self.nvue_client.push_config(config).await?;
+            self.last_applied_hash.replace(new_hash);
+            Ok(revision_id)
         }
     }
 }

crates/api-core/src/api.rs

@@ -39,7 +39,7 @@ use carbide_secrets::certificates::CertificateProvider;
 use carbide_secrets::credentials::{
     BmcCredentialType, CredentialKey, CredentialManager, CredentialType, Credentials,
 };
-use carbide_site_explorer::{EndpointExplorationService, EndpointExplorer};
+use carbide_site_explorer::{AuthenticatedBmc, EndpointExplorationService, EndpointExplorer};
 use carbide_uuid::machine::{MachineId, MachineIdSubtypeTrait, MachineInterfaceId};
 use db::db_read::PgPoolReader;
 use db::work_lock_manager::WorkLockManagerHandle;
@@ -83,6 +83,9 @@ pub struct Api {
     pub(crate) dpu_health_log_limiter: LogLimiter<MachineId>,
     pub dynamic_settings: DynamicSettings,
     pub(crate) endpoint_explorer: Arc<dyn EndpointExplorer>,
+    /// Authenticated BMC client for admin operations, supplied independently of
+    /// endpoint exploration.
+    pub(crate) bmc_client: Arc<dyn AuthenticatedBmc>,
     pub(crate) endpoint_exploration_service: Arc<EndpointExplorationService>,
     pub(crate) scout_stream_registry: ConnectionRegistry,
     #[allow(unused)]

crates/api-core/src/handlers/bmc_endpoint_explorer.rs

@@ -512,7 +512,7 @@ pub(crate) async fn disable_secure_boot(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .disable_secure_boot(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -552,7 +552,7 @@ pub(crate) async fn lockdown(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .lockdown(bmc_addr, &machine_interface, action)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -589,7 +589,7 @@ pub(crate) async fn lockdown_status(
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
     let response = api
-        .endpoint_explorer
+        .bmc_client
         .lockdown_status(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -622,7 +622,7 @@ pub(crate) async fn enable_infinite_boot(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .enable_infinite_boot(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -662,7 +662,7 @@ pub(crate) async fn is_infinite_boot_enabled(
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
     let is_enabled = api
-        .endpoint_explorer
+        .bmc_client
         .is_infinite_boot_enabled(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -754,7 +754,7 @@ pub(crate) async fn machine_setup(
         entered_mac,
     );
 
-    api.endpoint_explorer
+    api.bmc_client
         .machine_setup(bmc_addr, &machine_interface, boot_interface.as_ref())
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -844,7 +844,7 @@ pub(crate) async fn set_dpu_first_boot_order(
         )
     })?;
 
-    api.endpoint_explorer
+    api.bmc_client
         .set_boot_order_dpu_first(bmc_addr, &machine_interface, &boot_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1000,7 +1000,7 @@ async fn redfish_reset_bmc(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .redfish_reset_bmc(bmc_addr, &machine_interface, reset_type)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1015,7 +1015,7 @@ async fn ipmitool_reset_bmc(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .ipmitool_reset_bmc(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1031,7 +1031,7 @@ async fn redfish_power_control(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .redfish_power_control(bmc_addr, &machine_interface, action)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1048,10 +1048,7 @@ pub(crate) async fn bmc_credential_status(
     let (_bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &req).await?;
 
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
-    let have_credentials = api
-        .endpoint_explorer
-        .have_credentials(&machine_interface)
-        .await;
+    let have_credentials = api.bmc_client.have_credentials(&machine_interface).await;
 
     Ok(Response::new(rpc::BmcCredentialStatusResponse {
         have_credentials,
@@ -1341,7 +1338,7 @@ pub(crate) async fn set_bmc_root_password(
 
     tracing::info!(bmc_address = %bmc_addr, "Setting BMC root password");
 
-    api.endpoint_explorer
+    api.bmc_client
         .set_bmc_root_password(bmc_addr, &machine_interface, &req.new_password)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1374,7 +1371,7 @@ pub(crate) async fn probe_bmc_vendor(
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
     let vendor = api
-        .endpoint_explorer
+        .bmc_client
         .probe_bmc_vendor(bmc_addr, &machine_interface)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;
@@ -1396,7 +1393,7 @@ async fn do_create_bmc_user(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .create_bmc_user(
             bmc_addr,
             &machine_interface,
@@ -1418,7 +1415,7 @@ async fn do_delete_bmc_user(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .delete_bmc_user(bmc_addr, &machine_interface, delete_user)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;

crates/api-core/src/handlers/gpu_reset.rs

@@ -93,7 +93,7 @@ pub(crate) async fn admin_gpu_reset(
     let (bmc_addr, bmc_mac_address) = resolve_bmc_interface(api, &bmc_endpoint_request).await?;
     let machine_interface = MachineInterfaceSnapshot::mock_with_mac(bmc_mac_address);
 
-    api.endpoint_explorer
+    api.bmc_client
         .redfish_chassis_reset(bmc_addr, &machine_interface, &chassis_id, action)
         .await
         .map_err(|e| CarbideError::internal(e.to_string()))?;