[spr] initial version

Created using spr 1.3.6-beta.1

Author: sunshowers

dev-tools/reconfigurator-cli/tests/output/cmds-add-sled-no-disks-stdout

@@ -36,6 +36,7 @@ generated inventory collection eb0796d5-ab8a-4f7b-a884-b4aeacb8ab51 from configu
 > # Try to plan a new blueprint; this should be okay even though the sled
 > # we added has no disks.
 > blueprint-plan dbcbd3d6-41ff-48ae-ac0b-1becc9b2fd21 eb0796d5-ab8a-4f7b-a884-b4aeacb8ab51
+INFO skipping noop image source check for all sleds (no current TUF repo)
 INFO skipping sled (no zpools in service), sled_id: 00320471-945d-413c-85e7-03e091a70b3c
 INFO sufficient BoundaryNtp zones exist in plan, desired_count: 0, current_count: 0
 INFO sufficient Clickhouse zones exist in plan, desired_count: 1, current_count: 1

dev-tools/reconfigurator-cli/tests/output/cmds-example-stdout

@@ -493,6 +493,7 @@ T ENA ID                                   PARENT
 * yes ade5749d-bdf3-4fab-a8ae-00bea01b3a5a 02697f74-b14a-4418-90f0-c28b2a3a6aa9 <REDACTED_TIMESTAMP> 
 
 > blueprint-plan ade5749d-bdf3-4fab-a8ae-00bea01b3a5a
+INFO skipping noop image source check for all sleds (no current TUF repo)
 INFO found sled missing NTP zone (will add one), sled_id: 89d02b1b-478c-401a-8e28-7a26f74fa41b
 INFO sufficient BoundaryNtp zones exist in plan, desired_count: 0, current_count: 0
 WARN failed to place all new desired Clickhouse zones, placed: 0, wanted_to_place: 1

dev-tools/reconfigurator-cli/tests/output/cmds-expunge-newly-added-external-dns-stdout

@@ -969,6 +969,7 @@ parent:    3f00b694-1b16-4aaa-8f78-e6b3a527b434
 
 > # blueprint-plan will place a new external DNS zone, diff DNS to see the new zone has `ns<N>` and NS records.
 > blueprint-plan 366b0b68-d80e-4bc1-abd3-dc69837847e0
+INFO skipping noop image source check for all sleds (no current TUF repo)
 INFO sufficient BoundaryNtp zones exist in plan, desired_count: 0, current_count: 0
 INFO sufficient Clickhouse zones exist in plan, desired_count: 1, current_count: 1
 INFO sufficient ClickhouseKeeper zones exist in plan, desired_count: 0, current_count: 0

dev-tools/reconfigurator-cli/tests/output/cmds-expunge-newly-added-internal-dns-stdout

@@ -1002,6 +1002,7 @@ external DNS:
 
 > # Planning a new blueprint will now replace the expunged zone, with new records for its replacement.
 > blueprint-plan 58d5e830-0884-47d8-a7cd-b2b3751adeb4
+INFO skipping noop image source check for all sleds (no current TUF repo)
 INFO sufficient BoundaryNtp zones exist in plan, desired_count: 0, current_count: 0
 INFO sufficient Clickhouse zones exist in plan, desired_count: 1, current_count: 1
 INFO sufficient ClickhouseKeeper zones exist in plan, desired_count: 0, current_count: 0

nexus/db-model/src/target_release.rs

@@ -64,11 +64,13 @@ impl TargetRelease {
     pub fn into_external(
         &self,
         release_source: views::TargetReleaseSource,
+        mupdate_override: bool,
     ) -> views::TargetRelease {
         views::TargetRelease {
             generation: (&self.generation.0).into(),
             time_requested: self.time_requested,
             release_source,
+            mupdate_override,
         }
     }
 }

nexus/db-queries/src/db/datastore/deployment.rs

@@ -1560,6 +1560,23 @@ impl DataStore {
         Self::blueprint_current_target_only(&conn).await.map_err(|e| e.into())
     }
 
+    /// Get the minimum generation for the current target blueprint, if one exists
+    pub async fn blueprint_target_get_current_min_gen(
+        &self,
+        opctx: &OpContext,
+    ) -> Result<Generation, Error> {
+        opctx.authorize(authz::Action::Read, &authz::BLUEPRINT_CONFIG).await?;
+        let conn = self.pool_connection_authorized(opctx).await?;
+        let target = Self::blueprint_current_target_only(&conn).await?;
+
+        let authz_blueprint = authz_blueprint_from_id(target.target_id);
+        Self::blueprint_get_minimum_generation_connection(
+            &authz_blueprint,
+            &conn,
+        )
+        .await
+    }
+
     // Helper to fetch the current blueprint target (without fetching the entire
     // blueprint for that target).
     //
@@ -1587,6 +1604,28 @@ impl DataStore {
 
         Ok(current_target.into())
     }
+
+    // Helper to fetch the minimum generation for a blueprint ID (without
+    // fetching the entire blueprint for that ID.)
+    async fn blueprint_get_minimum_generation_connection(
+        authz: &authz::Blueprint,
+        conn: &async_bb8_diesel::Connection<DbConnection>,
+    ) -> Result<Generation, Error> {
+        use nexus_db_schema::schema::blueprint::dsl;
+
+        let id = authz.id();
+        let db_blueprint = dsl::blueprint
+            .filter(dsl::id.eq(id))
+            .select(DbBlueprint::as_select())
+            .first_async::<DbBlueprint>(conn)
+            .await
+            .optional()
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
+        let db_blueprint = db_blueprint.ok_or_else(|| {
+            Error::not_found_by_id(ResourceType::Blueprint, &id)
+        })?;
+        Ok(db_blueprint.target_release_minimum_generation.0)
+    }
 }
 
 // Helper to create an `authz::Blueprint` for a specific blueprint ID

nexus/db-queries/src/db/datastore/target_release.rs

@@ -125,7 +125,15 @@ impl DataStore {
                 }
             }
         };
-        Ok(target_release.into_external(release_source))
+        // We choose to fetch the blueprint directly from the database rather
+        // than relying on the cached blueprint in Nexus because our APIs try to
+        // be strongly consistent. This shows up/will show up as a warning in
+        // the UI, and we don't want the warning to flicker in and out of
+        // existence based on which Nexus is getting hit.
+        let min_gen = self.blueprint_target_get_current_min_gen(opctx).await?;
+        // The semantics of min_gen mean we use a > sign here, not >=.
+        let mupdate_override = min_gen > target_release.generation.0;
+        Ok(target_release.into_external(release_source, mupdate_override))
     }
 }
 
@@ -135,6 +143,12 @@ mod test {
     use crate::db::model::{Generation, TargetReleaseSource};
     use crate::db::pub_test_utils::TestDatabase;
     use chrono::{TimeDelta, Utc};
+    use nexus_inventory::now_db_precision;
+    use nexus_reconfigurator_planning::blueprint_builder::BlueprintBuilder;
+    use nexus_reconfigurator_planning::example::{
+        ExampleSystemBuilder, SimRngState,
+    };
+    use nexus_types::deployment::BlueprintTarget;
     use omicron_common::api::external::{
         TufArtifactMeta, TufRepoDescription, TufRepoMeta,
     };
@@ -145,7 +159,8 @@ mod test {
 
     #[tokio::test]
     async fn target_release_datastore() {
-        let logctx = dev::test_setup_log("target_release_datastore");
+        const TEST_NAME: &str = "target_release_datastore";
+        let logctx = dev::test_setup_log(TEST_NAME);
         let db = TestDatabase::new_with_datastore(&logctx.log).await;
         let (opctx, datastore) = (db.opctx(), db.datastore());
 
@@ -163,6 +178,56 @@ mod test {
         );
         assert!(initial_target_release.tuf_repo_id.is_none());
 
+        // Set up an initial blueprint and make it the target. This models real
+        // systems which always have a target blueprint.
+        let mut rng = SimRngState::from_seed(TEST_NAME);
+        let (system, mut blueprint) = ExampleSystemBuilder::new_with_rng(
+            &logctx.log,
+            rng.next_system_rng(),
+        )
+        .build();
+        assert_eq!(
+            blueprint.target_release_minimum_generation,
+            1.into(),
+            "initial blueprint should have minimum generation of 1",
+        );
+        // Treat this blueprint as the initial one for the system.
+        blueprint.parent_blueprint_id = None;
+
+        datastore
+            .blueprint_insert(&opctx, &blueprint)
+            .await
+            .expect("inserted blueprint");
+        datastore
+            .blueprint_target_set_current(
+                opctx,
+                BlueprintTarget {
+                    target_id: blueprint.id,
+                    // enabled = true or false shouldn't matter for this.
+                    enabled: true,
+                    time_made_target: now_db_precision(),
+                },
+            )
+            .await
+            .expect("set blueprint target");
+
+        // We should always be able to get a view of the target release.
+        let initial_target_release_view = datastore
+            .target_release_view(opctx, &initial_target_release)
+            .await
+            .expect("got target release");
+        eprintln!(
+            "initial target release view: {:#?}",
+            initial_target_release_view
+        );
+
+        // This target release should not have the mupdate override set, because
+        // the generation is <= the minimum generation in the target blueprint.
+        assert!(
+            !initial_target_release_view.mupdate_override,
+            "mupdate_override should be false for initial target release"
+        );
+
         // We should be able to set a new generation just like the first.
         // We allow some slack in the timestamp comparison because the
         // database only stores timestamps with μsec precision.
@@ -256,6 +321,86 @@ mod test {
         );
         assert_eq!(target_release.tuf_repo_id, Some(tuf_repo_id));
 
+        // Generate a new blueprint with a greater target release generation.
+        let mut builder = BlueprintBuilder::new_based_on(
+            &logctx.log,
+            &blueprint,
+            &system.input,
+            &system.collection,
+            TEST_NAME,
+        )
+        .expect("created blueprint builder");
+        builder.set_rng(rng.next_planner_rng());
+        builder
+            .set_target_release_minimum_generation(
+                blueprint.target_release_minimum_generation,
+                5.into(),
+            )
+            .expect("set target release minimum generation");
+        let bp2 = builder.build();
+
+        datastore
+            .blueprint_insert(&opctx, &bp2)
+            .await
+            .expect("inserted blueprint");
+        datastore
+            .blueprint_target_set_current(
+                opctx,
+                BlueprintTarget {
+                    target_id: bp2.id,
+                    // enabled = true or false shouldn't matter for this.
+                    enabled: true,
+                    time_made_target: now_db_precision(),
+                },
+            )
+            .await
+            .expect("set blueprint target");
+
+        // Fetch the target release again.
+        let target_release = datastore
+            .target_release_get_current(opctx)
+            .await
+            .expect("got target release");
+        let target_release_view_2 = datastore
+            .target_release_view(opctx, &target_release)
+            .await
+            .expect("got target release");
+
+        eprintln!("target release view 2: {target_release_view_2:#?}");
+
+        assert!(
+            target_release_view_2.mupdate_override,
+            "mupdate override is set",
+        );
+
+        // Now set the target release again -- this should cause the mupdate
+        // override to disappear.
+        let before = Utc::now();
+        let target_release = datastore
+            .target_release_insert(
+                opctx,
+                TargetRelease::new_system_version(&target_release, tuf_repo_id),
+            )
+            .await
+            .unwrap();
+        let after = Utc::now();
+
+        assert_eq!(target_release.generation, Generation(5.into()));
+        assert!(target_release.time_requested >= before);
+        assert!(target_release.time_requested <= after);
+
+        let target_release_view_3 = datastore
+            .target_release_view(opctx, &target_release)
+            .await
+            .expect("got target release");
+
+        eprintln!("target release view 3: {target_release_view_3:#?}");
+
+        assert!(
+            !target_release_view_3.mupdate_override,
+            "mupdate override is not set",
+        );
+
         // Clean up.
         db.terminate().await;
         logctx.cleanup_successful();

nexus/reconfigurator/planning/src/blueprint_builder/builder.rs

@@ -303,6 +303,10 @@ pub(crate) enum Operation {
         num_datasets_expunged: usize,
         num_zones_expunged: usize,
     },
+    SledNoopZoneImageSourcesUpdated {
+        sled_id: SledUuid,
+        count: usize,
+    },
 }
 
 impl fmt::Display for Operation {
@@ -367,6 +371,13 @@ impl fmt::Display for Operation {
                       {num_zones_expunged} zones)"
                 )
             }
+            Self::SledNoopZoneImageSourcesUpdated { sled_id, count } => {
+                write!(
+                    f,
+                    "sled {sled_id}: performed {count} noop \
+                     zone image source updates"
+                )
+            }
         }
     }
 }
@@ -1133,6 +1144,20 @@ impl<'a> BlueprintBuilder<'a> {
         Ok(datasets.into())
     }
 
+    /// Returns the remove_mupdate_override field for a sled.
+    pub(crate) fn sled_get_remove_mupdate_override(
+        &self,
+        sled_id: SledUuid,
+    ) -> Result<Option<MupdateOverrideUuid>, Error> {
+        let editor = self.sled_editors.get(&sled_id).ok_or_else(|| {
+            Error::Planner(anyhow!(
+                "tried to get remove_mupdate_override for \
+                 unknown sled {sled_id}"
+            ))
+        })?;
+        Ok(editor.get_remove_mupdate_override())
+    }
+
     fn next_internal_dns_gz_address_index(&self, sled_id: SledUuid) -> u32 {
         let used_internal_dns_gz_address_indices = self
             .current_sled_zones(

nexus/reconfigurator/planning/src/blueprint_editor/sled_editor.rs

@@ -286,6 +286,18 @@ impl SledEditor {
         }
     }
 
+    /// Returns the remove_mupdate_override field for this sled.
+    pub fn get_remove_mupdate_override(&self) -> Option<MupdateOverrideUuid> {
+        match &self.0 {
+            InnerSledEditor::Active(editor) => {
+                *editor.remove_mupdate_override.value()
+            }
+            InnerSledEditor::Decommissioned(sled) => {
+                sled.config.remove_mupdate_override
+            }
+        }
+    }
+
     fn as_active_mut(
         &mut self,
     ) -> Result<&mut ActiveSledEditor, SledEditError> {
@@ -343,8 +355,6 @@ impl SledEditor {
     }
 
     /// Sets the image source for a zone.
-    ///
-    /// Currently only used by test code.
     pub fn set_zone_image_source(
         &mut self,
         zone_id: &OmicronZoneUuid,

nexus/reconfigurator/planning/src/blueprint_editor/sled_editor/scalar.rs

@@ -16,7 +16,6 @@ impl<T> ScalarEditor<T> {
         ScalarEditor { original, value: EditValue::Original }
     }
 
-    #[expect(dead_code)]
     pub(crate) fn value(&self) -> &T {
         match &self.value {
             EditValue::Original => &self.original,