IP pools data model and API rework

common/src/api/external/mod.rs

@@ -720,6 +720,7 @@ pub enum ResourceType {
     LoopbackAddress,
     SwitchPortSettings,
     IpPool,
+    IpPoolResource,
     InstanceNetworkInterface,
     PhysicalDisk,
     Rack,

end-to-end-tests/src/bin/bootstrap.rs

@@ -4,7 +4,8 @@ use end_to_end_tests::helpers::{generate_name, get_system_ip_pool};
 use omicron_test_utils::dev::poll::{wait_for_condition, CondCheckError};
 use oxide_client::types::{
     ByteCount, DeviceAccessTokenRequest, DeviceAuthRequest, DeviceAuthVerify,
-    DiskCreate, DiskSource, IpRange, Ipv4Range, SiloQuotasUpdate,
+    DiskCreate, DiskSource, IpPoolCreate, IpPoolSiloLink, IpRange, Ipv4Range,
+    NameOrId, SiloQuotasUpdate,
 };
 use oxide_client::{
     ClientDisksExt, ClientHiddenExt, ClientProjectsExt,
@@ -38,9 +39,27 @@ async fn main() -> Result<()> {
 
     // ===== CREATE IP POOL ===== //
     eprintln!("creating IP pool... {:?} - {:?}", first, last);
+    let pool_name = "default";
+    client
+        .ip_pool_create()
+        .body(IpPoolCreate {
+            name: pool_name.parse().unwrap(),
+            description: "Default IP pool".to_string(),
+        })
+        .send()
+        .await?;
+    client
+        .ip_pool_silo_link()
+        .pool(pool_name)
+        .body(IpPoolSiloLink {
+            silo: NameOrId::Name(params.silo_name().parse().unwrap()),
+            is_default: true,
+        })
+        .send()
+        .await?;
     client
         .ip_pool_range_add()
-        .pool("default")
+        .pool(pool_name)
         .body(IpRange::V4(Ipv4Range { first, last }))
         .send()
         .await?;

end-to-end-tests/src/helpers/ctx.rs

@@ -287,6 +287,10 @@ impl ClientParams {
             .build()?;
         Ok(Client::new_with_client(&base_url, reqwest_client))
     }
+
+    pub fn silo_name(&self) -> String {
+        self.rss_config.recovery_silo.silo_name.to_string()
+    }
 }
 
 async fn wait_for_records(

nexus/db-model/src/ip_pool.rs

@@ -5,8 +5,10 @@
 //! Model types for IP Pools and the CIDR blocks therein.
 
 use crate::collection::DatastoreCollectionConfig;
+use crate::impl_enum_type;
 use crate::schema::ip_pool;
 use crate::schema::ip_pool_range;
+use crate::schema::ip_pool_resource;
 use crate::Name;
 use chrono::DateTime;
 use chrono::Utc;
@@ -35,42 +37,23 @@ pub struct IpPool {
     /// Child resource generation number, for optimistic concurrency control of
     /// the contained ranges.
     pub rcgen: i64,
-
-    /// Silo, if IP pool is associated with a particular silo. One special use
-    /// for this is  associating a pool with the internal silo oxide-internal,
-    /// which is used for internal services. If there is no silo ID, the
-    /// pool is considered a fleet-wide pool and will be used for allocating
-    /// instance IPs in silos that don't have their own pool.
-    pub silo_id: Option<Uuid>,
-
-    pub is_default: bool,
 }
 
 impl IpPool {
-    pub fn new(
-        pool_identity: &external::IdentityMetadataCreateParams,
-        silo_id: Option<Uuid>,
-        is_default: bool,
-    ) -> Self {
+    pub fn new(pool_identity: &external::IdentityMetadataCreateParams) -> Self {
         Self {
             identity: IpPoolIdentity::new(
                 Uuid::new_v4(),
                 pool_identity.clone(),
             ),
             rcgen: 0,
-            silo_id,
-            is_default,
         }
     }
 }
 
 impl From<IpPool> for views::IpPool {
     fn from(pool: IpPool) -> Self {
-        Self {
-            identity: pool.identity(),
-            silo_id: pool.silo_id,
-            is_default: pool.is_default,
-        }
+        Self { identity: pool.identity() }
     }
 }
 
@@ -93,6 +76,46 @@ impl From<params::IpPoolUpdate> for IpPoolUpdate {
     }
 }
 
+impl_enum_type!(
+    #[derive(SqlType, Debug, Clone, Copy, QueryId)]
+    #[diesel(postgres_type(name = "ip_pool_resource_type"))]
+     pub struct IpPoolResourceTypeEnum;
+
+     #[derive(Clone, Copy, Debug, AsExpression, FromSqlRow, PartialEq)]
+     #[diesel(sql_type = IpPoolResourceTypeEnum)]
+     pub enum IpPoolResourceType;
+
+     Silo => b"silo"
+);
+
+#[derive(Queryable, Insertable, Selectable, Clone, Debug)]
+#[diesel(table_name = ip_pool_resource)]
+pub struct IpPoolResource {
+    pub ip_pool_id: Uuid,
+    pub resource_type: IpPoolResourceType,
+    pub resource_id: Uuid,
+    pub is_default: bool,
+}
+
+/// Information required to delete an IP pool association. Comes from request
+/// params -- silo is a NameOrId and must be resolved to ID.
+#[derive(Clone, Debug)]
+pub struct IpPoolResourceDelete {
+    pub ip_pool_id: Uuid,
+    pub resource_type: IpPoolResourceType,
+    pub resource_id: Uuid,
+}
+
+impl From<IpPoolResource> for views::IpPoolSilo {
+    fn from(assoc: IpPoolResource) -> Self {
+        Self {
+            ip_pool_id: assoc.ip_pool_id,
+            silo_id: assoc.resource_id,
+            is_default: assoc.is_default,
+        }
+    }
+}
+
 /// A range of IP addresses for an IP Pool.
 #[derive(Queryable, Insertable, Selectable, Clone, Debug)]
 #[diesel(table_name = ip_pool_range)]

nexus/db-model/src/schema.rs

@@ -484,7 +484,14 @@ table! {
         time_modified -> Timestamptz,
         time_deleted -> Nullable<Timestamptz>,
         rcgen -> Int8,
-        silo_id -> Nullable<Uuid>,
+    }
+}
+
+table! {
+    ip_pool_resource (ip_pool_id, resource_type, resource_id) {
+        ip_pool_id -> Uuid,
+        resource_type -> crate::IpPoolResourceTypeEnum,
+        resource_id -> Uuid,
         is_default -> Bool,
     }
 }
@@ -1333,7 +1340,7 @@ table! {
 ///
 /// This should be updated whenever the schema is changed. For more details,
 /// refer to: schema/crdb/README.adoc
-pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(20, 0, 0);
+pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(21, 0, 1);
 
 allow_tables_to_appear_in_same_query!(
     system_update,
@@ -1342,8 +1349,9 @@ allow_tables_to_appear_in_same_query!(
 );
 joinable!(system_update_component_update -> component_update (component_update_id));
 
-allow_tables_to_appear_in_same_query!(ip_pool_range, ip_pool);
+allow_tables_to_appear_in_same_query!(ip_pool_range, ip_pool, ip_pool_resource);
 joinable!(ip_pool_range -> ip_pool (ip_pool_id));
+joinable!(ip_pool_resource -> ip_pool (ip_pool_id));
 
 allow_tables_to_appear_in_same_query!(inv_collection, inv_collection_error);
 joinable!(inv_collection_error -> inv_collection (inv_collection_id));
@@ -1393,6 +1401,11 @@ allow_tables_to_appear_in_same_query!(
 allow_tables_to_appear_in_same_query!(dns_zone, dns_version, dns_name);
 allow_tables_to_appear_in_same_query!(external_ip, service);
 
+// used for query to check whether an IP pool association has any allocated IPs before deleting
+allow_tables_to_appear_in_same_query!(external_ip, instance);
+allow_tables_to_appear_in_same_query!(external_ip, project);
+allow_tables_to_appear_in_same_query!(external_ip, ip_pool_resource);
+
 allow_tables_to_appear_in_same_query!(
     switch_port,
     switch_port_settings_route_config

nexus/db-queries/src/db/datastore/external_ip.rs

@@ -76,22 +76,18 @@ impl DataStore {
                     .fetch_for(authz::Action::CreateChild)
                     .await?;
 
-                // If the named pool conflicts with user's current scope, i.e.,
-                // if it has a silo and it's different from the current silo,
-                // then as far as IP allocation is concerned, that pool doesn't
-                // exist. If the pool has no silo, it's fleet-scoped and can
-                // always be used.
-                let authz_silo_id = opctx.authn.silo_required()?.id();
-                if let Some(pool_silo_id) = pool.silo_id {
-                    if pool_silo_id != authz_silo_id {
-                        return Err(authz_pool.not_found());
-                    }
+                // If this pool is not linked to the current silo, 404
+                if self.ip_pool_fetch_link(opctx, pool.id()).await.is_err() {
+                    return Err(authz_pool.not_found());
                 }
 
                 pool
             }
             // If no name given, use the default logic
-            None => self.ip_pools_fetch_default(&opctx).await?,
+            None => {
+                let (.., pool) = self.ip_pools_fetch_default(&opctx).await?;
+                pool
+            }
         };
 
         let pool_id = pool.identity.id;
@@ -147,24 +143,29 @@ impl DataStore {
     ) -> CreateResult<ExternalIp> {
         let ip_id = Uuid::new_v4();
 
-        let pool_id = match params.pool {
+        // TODO: NameOrId resolution should happen a level higher, in the nexus function
+        let (.., authz_pool, pool) = match params.pool {
             Some(NameOrId::Name(name)) => {
                 LookupPath::new(opctx, self)
                     .ip_pool_name(&Name(name))
                     .fetch_for(authz::Action::Read)
                     .await?
-                    .1
             }
             Some(NameOrId::Id(id)) => {
                 LookupPath::new(opctx, self)
                     .ip_pool_id(id)
                     .fetch_for(authz::Action::Read)
                     .await?
-                    .1
             }
             None => self.ip_pools_fetch_default(opctx).await?,
+        };
+
+        let pool_id = pool.id();
+
+        // If this pool is not linked to the current silo, 404
+        if self.ip_pool_fetch_link(opctx, pool_id).await.is_err() {
+            return Err(authz_pool.not_found());
         }
-        .id();
 
         let data = if let Some(ip) = params.address {
             IncompleteExternalIp::for_floating_explicit(