Omdb networking #4147

rcgoodfellow · 2023-09-27T00:10:20Z

Adds an omdb command to list external network IP addresses along with their parent.

./omdb db network list-eips
note: database URL not specified.  Will search DNS.
note: (override with --db-url or OMDB_DB_URL)
note: using DNS server for subnet fd00:1122:3344::/48
note: (if this is not right, use --dns-server to specify an alternate DNS server)
note: using database URL postgresql://root@[fd00:1122:3344:109::3]:32221,[fd00:1122:3344:105::3]:32221,[fd00:1122:3344:10b::3]:32221,[fd00:1122:3344:107::3]:32221,[fd00:1122:3344:108::3]:32221/omicron?sslmode=disable
note: database schema version matches expected (4.0.0)
 ip               ports        kind       owner
 172.20.26.1/32   0/65535      Floating   Service ExternalDns
 172.20.26.2/32   0/65535      Floating   Service ExternalDns
 172.20.26.3/32   0/65535      Floating   Service Nexus
 172.20.26.4/32   0/65535      Floating   Service Nexus
 172.20.26.5/32   0/65535      Floating   Service Nexus
 172.20.26.6/32   0/16383      SNat       Service Ntp
 172.20.26.7/32   16384/32767  SNat       Service Ntp
 172.20.26.11/32  49152/65535  SNat       Instance try/sysbench-mysql-3
 172.20.26.11/32  32768/49151  SNat       Instance try/sysbench-mysql-2
 172.20.26.11/32  16384/32767  SNat       Instance try/test-upgrade-2
 172.20.26.13/32  0/65535      Ephemeral  Instance try/test-upgrade-2
 172.20.26.14/32  0/65535      Ephemeral  Instance try/sysbench-mysql-2
 172.20.26.15/32  0/65535      Ephemeral  Instance try/sysbench-mysql-3
 172.20.26.16/32  0/16383      SNat       Instance try/sysbench-mysql-4
 172.20.26.16/32  32768/49151  SNat       Instance try/sysbench-mysql-6
 172.20.26.16/32  49152/65535  SNat       Instance try/sysbench-mysql-7

Also comes with a verbose mode to print raw datastore structures.

BRM44220005 # ./omdb db network --verbose list-eips
note: database URL not specified.  Will search DNS.
note: (override with --db-url or OMDB_DB_URL)
note: using DNS server for subnet fd00:1122:3344::/48
note: (if this is not right, use --dns-server to specify an alternate DNS server)
note: using database URL postgresql://root@[fd00:1122:3344:109::3]:32221,[fd00:1122:3344:105::3]:32221,[fd00:1122:3344:10b::3]:32221,[fd00:1122:3344:107::3]:32221,[fd00:1122:3344:108::3]:32221/omicron?sslmode=disable
note: database schema version matches expected (4.0.0)
ExternalIp {
    id: 01043656-d049-449a-9b33-1bad7f4affdd,
    name: None,
    description: None,
    time_created: 2023-08-30T20:27:57.649708Z,
    time_modified: 2023-08-30T20:27:57.649708Z,
    time_deleted: None,
    ip_pool_id: cadb8535-e32f-4be2-9259-e45dec9fa3c7,
    ip_pool_range_id: 73aede53-8fe2-40c5-a6fb-23675269e979,
    is_service: false,
    parent_id: Some(
        33e6d4a4-6cc7-440f-8a9f-152d94136191,
    ),
    kind: SNat,
    ip: V4(
        Ipv4Network {
            addr: 172.20.26.41,
            prefix: 32,
        },
    ),
    first_port: SqlU16(
        16384,
    ),
    last_port: SqlU16(
        32767,
    ),
}
ExternalIp {
    id: 015fd6de-a47a-4804-bc96-2b5880c42ac3,
    name: None,
    description: None,
    time_created: 2023-08-30T19:48:56.391829Z,
    time_modified: 2023-08-30T19:48:56.391829Z,
    time_deleted: None,
...

davepacheco · 2023-10-02T18:01:43Z

dev-tools/omdb/tests/successes.out

@@ -84,6 +84,24 @@ stderr:
 note: using database URL postgresql://root@[::1]:REDACTED_PORT/omicron?sslmode=disable
 note: database schema version matches expected (4.0.0)
 =============================================
+EXECUTING COMMAND: omdb ["db", "network"]


It seems like this output would go in the "usage" test (if you want to cover it). The point of the "successes" test is to sanity-check that the command produces reasonable-looking output against a real system. You might add omdb db network list-eips to this test instead? Or if it's too annoying to get that to work (you might have to add more redactions for the output to be stable across runs), skip it altogether?

Moved this test to usage.

davepacheco · 2023-10-02T18:03:53Z

nexus/db-queries/src/db/datastore/external_ip.rs

+
+    /// Fetch all external IP addresses of any kind for the provided instance
+    pub async fn lookup_external_ips(
+        &self,
+        opctx: &OpContext,
+    ) -> LookupResult<Vec<ExternalIp>> {
+        use db::schema::external_ip::dsl;
+        dsl::external_ip
+            .filter(dsl::time_deleted.is_null())
+            .select(ExternalIp::as_select())
+            .get_results_async(self.pool_authorized(opctx).await?)
+            .await
+            .map_err(|e| public_error_from_diesel_pool(e, ErrorHandler::Server))
+    }


I think it's pretty dangerous to add a non-authz-gated datastore operation like this. If this is a generally useful function, I'd just do the authz check. If we don't think we'd need this kind of functionality in Nexus, or if authz is a problem, I think it's fine to just put this code straight into omdb (without an authz check).

Sounds good. I just moved this into the omdb code.

davepacheco · 2023-10-02T18:05:09Z

dev-tools/omdb/src/bin/omdb/db.rs

+                    .await
+                    .context("loading requested instance")?
+                    .pop()
+                    .context("requested instance not found")?;


Not critical but I'd consider continuing rather than bailing out for this case (so that if there's an errant "owner" in the database, we can still use the tool to see as much as we can).

Good call. Done

davepacheco · 2023-10-02T18:05:26Z

dev-tools/omdb/src/bin/omdb/db.rs

+                    .await
+                    .context("loading requested project")?
+                    .pop()
+                    .context("requested project not found")?;


Same -- I'd considering continuing instead of bailing out here (but definitely not a blocker).

davepacheco · 2023-10-02T18:07:44Z

dev-tools/omdb/src/bin/omdb/db.rs

+
+    #[derive(Tabled)]
+    enum Owner {
+        Instance { project: String, name: String },


I always wonder if the tool should report ids (which are immutable and unique across silos) or names like this that potentially save someone a separate lookup (or both, but that uses up valuable space too). It's all tradeoffs -- just mentioning it to see what you think.

I explicitly chose names here - as my use case for this is mapping external IPs to something immediately tangible. I added an option for verbose output that provides the raw data structures from the DB that shows references based on UUID.

davepacheco · 2023-10-02T18:10:04Z

Thanks for doing this! This will be very useful.

davepacheco

Just spotted one stray commented-out block but otherwise looks good!

davepacheco · 2023-10-03T15:24:48Z

dev-tools/omdb/src/bin/omdb/db.rs

+    /*
+    let ips = datastore
+        .lookup_external_ips(&opctx)
+        .await
+        .context("listing external ips")?;
+    */


nit: probably want to remove this
I can't tell if this was here before because I can't access the incremental review. (Maybe a force push?)

rcgoodfellow force-pushed the omdb-networking branch from db0835b to cea99a3 Compare September 27, 2023 00:37

rcgoodfellow marked this pull request as ready for review September 27, 2023 01:02

rcgoodfellow requested review from davepacheco and jordanhendricks September 28, 2023 16:31

davepacheco reviewed Oct 2, 2023

View reviewed changes

rcgoodfellow added 5 commits October 2, 2023 21:06

list external ips with parents

840aa98

fix tests, cleanup

e5a2b5a

review feedback

28d4b25

rebase fixup

5f84818

print error and continue if service id not found

1e9179b

rcgoodfellow force-pushed the omdb-networking branch from 5934ba8 to 1e9179b Compare October 3, 2023 04:23

davepacheco approved these changes Oct 3, 2023

View reviewed changes

remove stray comment

8d09e04

davepacheco approved these changes Oct 3, 2023

View reviewed changes

rcgoodfellow merged commit d300fb8 into main Oct 3, 2023
22 checks passed

rcgoodfellow deleted the omdb-networking branch October 3, 2023 19:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Omdb networking #4147

Omdb networking #4147

rcgoodfellow commented Sep 27, 2023 •

edited

Loading

davepacheco Oct 2, 2023

rcgoodfellow Oct 3, 2023

davepacheco Oct 2, 2023

rcgoodfellow Oct 3, 2023

davepacheco Oct 2, 2023

rcgoodfellow Oct 3, 2023

davepacheco Oct 2, 2023

rcgoodfellow Oct 3, 2023

davepacheco Oct 2, 2023

rcgoodfellow Oct 3, 2023

davepacheco commented Oct 2, 2023

davepacheco left a comment

davepacheco Oct 3, 2023

Omdb networking #4147

Omdb networking #4147

Conversation

rcgoodfellow commented Sep 27, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

davepacheco commented Oct 2, 2023

davepacheco left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rcgoodfellow commented Sep 27, 2023 •

edited

Loading