background task for service zone nat

nexus/db-queries/src/db/datastore/ip_pool.rs

@@ -137,9 +137,6 @@ impl DataStore {
         // join ip_pool to ip_pool_resource and filter
 
         // used in both success and error outcomes
-        // TODO: Correctness
-        // we're not propogating the data used to performed the query, which
-        // makes troubleshooting a lookup failure a lot more time consuming
         let lookup_type = LookupType::ByCompositeId(
             "Default pool for current silo".to_string(),
         );

nexus/db-queries/src/db/datastore/ipv4_nat_entry.rs

@@ -20,6 +20,9 @@ use omicron_common::api::external::ResourceType;
 use omicron_common::api::external::Vni;
 
 impl DataStore {
+    /// Currently used to ensure that a NAT entry exists for an Instance.
+    /// This SHOULD NOT be directly used to create service zone nat entries,
+    /// as they are updated via a background task.
     pub async fn ensure_ipv4_nat_entry(
         &self,
         opctx: &OpContext,
@@ -76,10 +79,12 @@ impl DataStore {
         Ok(())
     }
 
-    /// Method for synchronizing service zone nat.
+    /// Method for synchronizing service zone nat, called by `ServiceZoneNatTracker`
+    /// background task.
     /// Expects a complete set of service zone nat entries.
     /// Soft-deletes db entries that are not present in `nat_entries` parameter.
-    /// Creates missing entries idempotently
+    /// Creates missing entries idempotently.
+    ///
     /// returns the number of records added
     pub async fn ipv4_nat_sync_service_zones(
         &self,

nexus/src/app/background/sync_service_zone_nat.rs

@@ -21,6 +21,18 @@ use std::net::{IpAddr, SocketAddr};
 use std::num::NonZeroU32;
 use std::sync::Arc;
 
+// Minumum number of boundary NTP zones that should be present in a valid
+// set of service zone nat configurations.
+const MIN_NTP_COUNT: usize = 1;
+
+// Minumum number of nexus zones that should be present in a valid
+// set of service zone nat configurations.
+const MIN_NEXUS_COUNT: usize = 3;
+
+// Minumum number of external DNS zones that should be present in a valid
+// set of service zone nat configurations.
+const MIN_EXTERNAL_DNS_COUNT: usize = 1;
+
 /// Background task that ensures service zones have nat entries
 /// persisted in the NAT RPW table
 pub struct ServiceZoneNatTracker {
@@ -93,6 +105,9 @@ impl BackgroundTask for ServiceZoneNatTracker {
             };
 
             let mut ipv4_nat_values: Vec<Ipv4NatValues> = vec![];
+            let mut ntp_count = 0;
+            let mut nexus_count = 0;
+            let mut dns_count = 0;
 
             for (sled_id, zones_found) in collection.omicron_zones {
                 let (_, sled) = match LookupPath::new(opctx, &self.datastore)
@@ -121,6 +136,7 @@ impl BackgroundTask for ServiceZoneNatTracker {
                     zones_found.zones;
                 let zones: Vec<sled_agent_client::types::OmicronZoneConfig> =
                     zones_config.zones;
+
                 for zone in zones {
                     let zone_type: OmicronZoneType = zone.zone_type;
                     match zone_type {
@@ -157,6 +173,7 @@ impl BackgroundTask for ServiceZoneNatTracker {
 
                             // Append ipv4 nat entry
                             ipv4_nat_values.push(nat_value);
+                            ntp_count += 1;
                         }
                         OmicronZoneType::Nexus { nic, external_ip, .. } => {
                             let external_ip = match external_ip {
@@ -189,6 +206,7 @@ impl BackgroundTask for ServiceZoneNatTracker {
 
                             // Append ipv4 nat entry
                             ipv4_nat_values.push(nat_value);
+                            nexus_count += 1;
                         },
                         OmicronZoneType::ExternalDns { nic, dns_address, .. } => {
                             let socket_addr: SocketAddr = match dns_address.parse() {
@@ -235,6 +253,7 @@ impl BackgroundTask for ServiceZoneNatTracker {
 
                             // Append ipv4 nat entry
                             ipv4_nat_values.push(nat_value);
+                            dns_count += 1;
                         },
                         // we explictly list all cases instead of using a wildcard,
                         // that way if someone adds a new type to OmicronZoneType that
@@ -265,6 +284,38 @@ impl BackgroundTask for ServiceZoneNatTracker {
                 });
             }
 
+            if dns_count < MIN_EXTERNAL_DNS_COUNT {
+                error!(
+                    &log,
+                    "generated config for fewer than the minimum allowed number of dns zones";
+                );
+                return json!({
+                    "error": "generated config for fewer than the minimum allowed number of dns zones"
+                });
+            }
+
+            if ntp_count < MIN_NTP_COUNT {
+                error!(
+                    &log,
+                    "generated config for fewer than the minimum allowed number of ntp zones";
+                );
+                return json!({
+                    "error": "generated config for fewer than the minimum allowed number of ntp zones"
+
+                });
+            }
+
+            if nexus_count < MIN_NEXUS_COUNT {
+                error!(
+                    &log,
+                    "generated config for fewer than the minimum allowed number of nexus zones";
+                );
+                return json!({
+                    "error": "generated config for fewer than the minimum allowed number of nexus zones"
+
+                });
+            }
+
             // reconcile service zone nat entries
             let result = match self.datastore.ipv4_nat_sync_service_zones(opctx, &ipv4_nat_values).await {
                 Ok(num) => num,