Use sprockets on the bootstrap network #6485
Conversation
labbott
force-pushed
the
sprockets
branch
3 times, most recently
from
1bc4d26 to
3f5dcad
Compare
labbott
force-pushed
the
sprockets
branch
2 times, most recently
from
486d929 to
7f5d41d
Compare
|
Marking as draft until the hubris side changes are ready and/or merged |
sled-agent/src/bootstrap/client.rs
Outdated
| let stream = TcpStream::connect(self.addr) | ||
| .await | ||
| .map_err(|err| Error::Connect { addr: self.addr, err })?; | ||
| // The sprocket client loads the associated root certificates at this point. |
There was a problem hiding this comment.
| // The sprocket client loads the associated root certificates at this point. | |
| // The sprockets client loads the associated root certificates at this point. |
| .start_reset(&ctx.base_log, ctx.global_zone_bootstrap_ip) | ||
| .start_reset( | ||
| &ctx.base_log, | ||
| (ctx.sprockets).clone(), |
There was a problem hiding this comment.
I don't think you need the parens here. Were they left over from when this was maybe a pointer?
There was a problem hiding this comment.
I'm amazed clippy did not complain
sled-agent/src/bootstrap/rack_ops.rs
Outdated
| @@ -1,4 +1,5 @@ | |||
| // This Source Code Form is subject to the terms of the Mozilla Public | |||
| // | |||
There was a problem hiding this comment.
Looks like you got an accidental newline here
| @@ -52,8 +59,9 @@ impl SprocketsServer { | |||
| /// `TcpListener::accept()`, which is cancel-safe. Note that cancelling this | |||
There was a problem hiding this comment.
Should probably change the comment here to reflect that this is a sprockets listener. I think it should still be cancel safe.
| @@ -88,3 +88,9 @@ level = "info" | |||
| mode = "file" | |||
| path = "/dev/stdout" | |||
| if_exists = "append" | |||
|
|
|||
| # These are pre-generated keys and roots designed to be used for testing. | |||
| # Create your own if you need to test | |||
There was a problem hiding this comment.
| # Create your own if you need to test | |
| # Create your own if you need to test a multi-node system. |
I think that in almost all cases where we use sprockets we'll have multiple nodes, such as in a4x2. In these cases it will be a little weird for each node to have the same keys. Should we generate a bunch of extras and check them in, or provide notes about how to do so?
There was a problem hiding this comment.
I'll copy over the sled2 keys used in sprockets as well
This uses the certificates/keys in the RoT as the basis for TLS sessions
Connect over the bootstrap network with sprockets tls
Connect over the bootstrap network with sprockets tls