actually we can just leave it null for now

nexus/db-model/src/instance.rs

@@ -58,9 +58,10 @@ pub struct Instance {
     /// The auto-restart policy for this instance.
     ///
     /// This indicates whether the instance should be automatically restarted by
-    /// the control plane on failure.
+    /// the control plane on failure. If this is `NULL`, no auto-restart policy
+    /// has been configured for this instance by the user.
     #[diesel(column_name = auto_restart_policy)]
-    pub auto_restart_policy: InstanceAutoRestart,
+    pub auto_restart_policy: Option<InstanceAutoRestart>,
 
     #[diesel(embed)]
     pub runtime_state: InstanceRuntimeState,
@@ -109,7 +110,9 @@ impl Instance {
             ncpus: params.ncpus.into(),
             memory: params.memory.into(),
             hostname: params.hostname.to_string(),
-            auto_restart_policy: InstanceAutoRestart::default(),
+            // TODO(eliza): allow this to be configured via the instance-create
+            // params...
+            auto_restart_policy: None,
             runtime_state,
 
             updater_gen: Generation::new(),

nexus/db-model/src/instance_auto_restart.rs

@@ -32,12 +32,6 @@ impl InstanceAutoRestart {
     }
 }
 
-impl Default for InstanceAutoRestart {
-    fn default() -> Self {
-        Self::Never
-    }
-}
-
 impl fmt::Display for InstanceAutoRestart {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         write!(f, "{}", self.label())

nexus/db-model/src/schema.rs

@@ -407,7 +407,7 @@ table! {
         ncpus -> Int8,
         memory -> Int8,
         hostname -> Text,
-        auto_restart_policy -> crate::InstanceAutoRestartEnum,
+        auto_restart_policy -> Nullable<crate::InstanceAutoRestartEnum>,
         time_state_updated -> Timestamptz,
         state_generation -> Int8,
         active_propolis_id -> Nullable<Uuid>,

schema/crdb/dbinit.sql

@@ -1101,7 +1101,7 @@ CREATE TABLE IF NOT EXISTS omicron.public.instance (
      * What failures should result in an instance being automatically restarted
      * by the control plane.
      */
-    auto_restart_policy omicron.public.instance_auto_restart NOT NULL,
+    auto_restart_policy omicron.public.instance_auto_restart,
 
     CONSTRAINT vmm_iff_active_propolis CHECK (
         ((state = 'vmm') AND (active_propolis_id IS NOT NULL)) OR

schema/crdb/turn-boot-on-fault-into-auto-restart/README.adoc

@@ -5,17 +5,14 @@ which is a `bool`, with a new `auto_restart_policy` column, which is an enum
 (`omicron.public.instance_auto_restart`). The new enum type will allow
 auto-restart policies other than "always" and "never".
 Existing instance records are backfilled with the `all_failures` variant of
-`instance_auto_restart` if `boot_on_fault` is `true`, or `sled_failures_only` if
-`boot_on_fault` is `false`.
+`instance_auto_restart` if `boot_on_fault` is `true`. Otherwise, the
+auto-restart policy is `NULL`.
 
 The migration performs the following operations:
 
 1. `up01.sql` creates the `instance_auto_restart` enum.
 2. `up02.sql` adds a (nullable) `auto_restart_policy` column to the `instance`
    table.
 3. `up03.sql` updates instance records by setting `auto_restart_policy` to
-   `all_failures` if `boot_on_fault` is `true`, or `sled_failures_only` if
-   `boot_on_fault` is `false`.
-4. Now that all instance records have a value for `auto_restart_policy`,
-   `up04.sql` makes the `auto_restart_policy` column non-null.
-5. Finally, `up05.sql` drops the now-defunct `boot_on_fault` column.
+   `all_failures` if `boot_on_fault` is `true`.
+4. Finally, `up04.sql` drops the now-defunct `boot_on_fault` column.

schema/crdb/turn-boot-on-fault-into-auto-restart/up03.sql

@@ -1,5 +1,5 @@
 SET LOCAL disallow_full_table_scans = off;
 UPDATE omicron.public.instance SET auto_restart_policy = CASE
     WHEN boot_on_fault = true THEN 'all_failures'
-    ELSE 'never'
+    ELSE NULL
 END;

schema/crdb/turn-boot-on-fault-into-auto-restart/up04.sql

@@ -1 +1 @@
-ALTER TABLE omicron.public.instance ALTER COLUMN auto_restart_policy SET NOT NULL;
+ALTER TABLE omicron.public.instance DROP COLUMN IF EXISTS boot_on_fault;