Add trust quorum reconfiguration endpoints to sled-agent API #9556

plaidfinch · 2025-12-21T00:44:22Z

Adds version 13 (ADD_TRUST_QUORUM) to the Sled Agent API with the following endpoints for trust quorum reconfiguration:

POST /trust-quorum/reconfigure - Initiate a reconfiguration
POST /trust-quorum/upgrade-from-lrtq - Upgrade from low-rent (legacy) trust quorum
POST /trust-quorum/commit - Commit a trust-quorum
GET /trust-quorum/coordinator-status - Get coordinator status
POST /trust-quorum/prepare-and-commit - Prepare and commit a configuration

Types are organized per RFD 619 (via feeding Claude the RFD):

API types defined in sled-agent-types-versions/src/add_trust_quorum/
Re-exported via latest.rs and sled-agent-types/src/trust_quorum.rs
API trait uses latest:: paths for all trust quorum types

Also exports EncryptedRackSecrets, Salt, and Sha3_256Digest from trust-quorum-protocol for use in the prepare_and_commit handler.

Co-authored by Claude Code

The following endpoints are created for trust quorum reconfiguration: - POST `/trust-quorum/reconfigure` - Initiate a reconfiguration - POST `/trust-quorum/upgrade-from-lrtq` - Upgrade from low-rent (legacy) trust quorum - POST `/trust-quorum/commit` - Commit a trust-quorum - GET `/trust-quorum/coordinator-status` - Get coordinator status - POST `/trust-quorum/prepare-and-commit` - Prepare and commit a configuration Types are organized per RFD 619 (via feeding Claude the RFD): - API types defined in `sled-agent-types-versions/src/add_trust_quorum/` - Re-exported via `latest.rs` and `sled-agent-types/src/trust_quorum.rs` - API trait uses `latest::` paths for all trust quorum types Also exports `EncryptedRackSecrets`, `Salt`, and `Sha3_256Digest` from `trust-quorum-protocol` for use in the `prepare_and_commit` handler. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

plaidfinch · 2025-12-21T00:54:00Z

This is still missing the proxy methods; these will be added in a separate commit. Planning to do a self-review of the PR to identify areas of uncertainty and cross-check for any LLM-introduced confabulations during the RFD 619 refactor.

plaidfinch · 2025-12-21T00:56:16Z

sled-agent/src/http_entrypoints.rs

+                TrustQuorumCommitResponse::Committed
+            }
+            trust_quorum::CommitStatus::Pending => {
+                TrustQuorumCommitResponse::Pending


@andrewjstone You mentioned that this response is always a fatal error during reconfiguration of the TQ. Does that mean we should return an error response here, or should that be generated higher-up in Nexus?

plaidfinch · 2025-12-21T00:56:38Z

sled-agent/src/http_entrypoints.rs

+                TrustQuorumCommitResponse::Committed
+            }
+            trust_quorum::CommitStatus::Pending => {
+                TrustQuorumCommitResponse::Pending


Similarly here: should we ever return Pending from this level of the API?

plaidfinch · 2025-12-21T01:00:23Z

sled-agent/src/http_entrypoints.rs

+    ) -> Result<HttpResponseOk<TrustQuorumCommitResponse>, HttpError> {
+        let sa = request_context.context();
+        let request = body.into_inner();
+


This is a bunch of messy code to parse hex-encoded parameters representing the binary salt and data for the encrypted rack secret. I don't like it, and I want to do this better, but there's a tension because the messy parsing here prevents the necessity of tight coupling to the underlying TQ types, which was originally a desideratum. I will revisit this shortly and it should be checked carefully for correctness and cleanliness before merging.

plaidfinch · 2025-12-21T01:00:47Z

sled-agent/src/sim/http_entrypoints.rs

    ) -> Result<HttpResponseUpdatedNoContent, HttpError> {
        Ok(HttpResponseUpdatedNoContent())
    }
+


Do we want to implement these methods in the simulator or not?

plaidfinch · 2025-12-21T01:01:57Z

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

+    pub coordinator: BaseboardId,
+    /// All members of the configuration and the hex-encoded SHA3-256 hash of
+    /// their key shares.
+    pub members: BTreeMap<BaseboardId, String>,


The use of hex-encoded Strings here is not my favorite. As above — not sure what to do about it, let's discuss.

plaidfinch · 2025-12-21T01:02:15Z

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct TrustQuorumEncryptedRackSecrets {
+    /// Hex-encoded 32-byte salt used to derive the encryption key.
+    pub salt: String,


Hex-encoded string manually parsed in API handler: gross, how to better?

plaidfinch · 2025-12-21T01:02:31Z

sled-agent/types/versions/src/add_trust_quorum/trust_quorum.rs

+    /// Hex-encoded 32-byte salt used to derive the encryption key.
+    pub salt: String,
+    /// Hex-encoded encrypted data.
+    pub data: String,


A final hex-encoded string manually parsed in the API handler.

plaidfinch · 2025-12-21T01:03:31Z

trust-quorum/protocol/src/lib.rs

+    EncryptedRackSecrets, RackSecret, ReconstructedRackSecret, Salt,
+    Sha3_256Digest,


Is it okay to export Salt and Sha3_256Digest here? Or is there a different or better way to handle the need for these in the API?

plaidfinch · 2025-12-21T01:11:28Z

Looks like the build is failing in CI because of: a missing implementation of the added SledAgentApi methods in nexus/mgs-updates/src/test_util/host_phase_2_test_state.rs but this does not show up on cargo build in omicron on my local workstation — is this file feature-gated? How should these methods be filled in for HostPhase2SledAgentImpl? It looks like the LRTQ bootstore-related methods are all unimplemented!(); should I just do the same here? Tentatively I have done this in 40eecf0.

plaidfinch force-pushed the sled-agent-trust-quorum-api branch from cfdce9d to 79e918f Compare December 21, 2025 00:51

plaidfinch force-pushed the sled-agent-trust-quorum-api branch from 79e918f to 5ccf78a Compare December 21, 2025 00:52

plaidfinch commented Dec 21, 2025

View reviewed changes

plaidfinch requested a review from andrewjstone December 21, 2025 01:13

Stub out SledAgentApi methods in test utils for Nexus

40eecf0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Uh oh!

plaidfinch commented Dec 21, 2025

Uh oh!

plaidfinch commented Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch Dec 21, 2025

Uh oh!

plaidfinch commented Dec 21, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		EncryptedRackSecrets, RackSecret, ReconstructedRackSecret, Salt,
		Sha3_256Digest,

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Are you sure you want to change the base?

Add trust quorum reconfiguration endpoints to sled-agent API #9556

Uh oh!

Conversation

plaidfinch commented Dec 21, 2025

Uh oh!

plaidfinch commented Dec 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

plaidfinch commented Dec 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

plaidfinch commented Dec 21, 2025 •

edited

Loading