Omicron integration - #31
Draft
plotnick wants to merge 38 commits into
Draft
Conversation
plotnick
force-pushed
the
omicron-integration
branch
3 times, most recently
from
August 10, 2026 05:25
a97ba54 to
f345c26
Compare
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The proxy terminates TLS with the sled's platform identity, so the client verifies against baked-in platform PKI roots: no TOFU, no per-rack cert distribution, and identity survives reboot. The switch zone can't sign every handshake with the RoT, and delegating the IPCC device into the zone may not be acceptable, so sled-agent mints an ephemeral key and has the RoT sign its certificate once at startup; the proxy then terminates TLS with that key locally. The client's verifier accepts a chain that is the platform identity itself, or an ephemeral leaf the platform identity signed in the RoT's convention: Ed25519 over the SHA3-256 digest of the TBS certificate.
Job requests may name their targets by cubby, and each server checks signed targets against its cubby map, which until now was always empty. The job manager now takes a watch channel carrying the map, which sled-agent will feed from MGS. The map is a rack fact rather than universe state, so it survives gossip migrations.
The client ships the same idcerts the sled OS does, and verifies a proxy's TLS certificate against them by default. The --proxy-root flag replaces the baked-in roots, e.g., for a test PKI.
illumos has no O_CLOEXEC for posix_openpt, so rustix offers no OpenptFlags::CLOEXEC there. Set the flag with fcntl right after open on every platform.
sprockets-tls now gates IPCC behind a default-on feature. Nothing in this workspace uses it, so opt out: the client binary no longer needs libipcc.so.1, which only exists on Oxide sleds. The embedded server gets the feature back through sled-agent's own sprockets dependency. Advancing sprockets pulls a newer dice-util, whose requirements cascade far enough that the lock is regenerated wholesale.
Feature unification turns it on for every schemars user in a workspace that embeds sush, which reorders the properties of every generated schema and breaks omicron's schema snapshot tests. Nothing here depends on property order.
The same race attribution had: job B could start before the cancel landed on a loaded machine, and a dependency refresh made the window easy to hit locally. Queue B behind a chain hole.
plotnick
force-pushed
the
omicron-integration
branch
from
August 11, 2026 02:27
d0681c7 to
0b0051a
Compare
Also self-qualify the newtype macro's formatter types, so call sites need no imports of their own.
Merged
Create `Codephrase` struct and newtypes for it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the sush half of the Omicron integration; see RFD 620 §§ 4.5.1-2. It pairs with oxidecomputer/omicron#11034, which embeds the server in sled-agent and adds a proxy-only service to the switch zones. The early commits make the server embeddable; the rest allow running jobs on the rack from outside it.
🤖 Disclaimer: written with LLM assistance.