Merge branch 'main' into feat/variable-frequency-health-reports

Author: rsd-darshan

crates/api-core/src/handlers/managed_host.rs

@@ -153,21 +153,6 @@ pub(crate) async fn set_primary_dpu(
         })?
         .mac_address;
 
-    // The operator picked this primary NIC by MAC. Resolve its Redfish interface
-    // id from the host's exploration report so we can send a complete pair (which
-    // enables the interface-id fallback); if the report has no id for it, target
-    // the MAC alone.
-    let boot_interface_id = db::explored_endpoints::find_by_ips(&mut txn, vec![bmc_addr])
-        .await?
-        .into_iter()
-        .next()
-        .and_then(|endpoint| {
-            endpoint
-                .report
-                .find_interface_id_for_mac(primary_interface_mac_address)
-                .map(str::to_string)
-        });
-
     txn.rollback().await?;
 
     let Some(current_primary_interface_id) = current_primary_interface_id else {
@@ -183,10 +168,10 @@ pub(crate) async fn set_primary_dpu(
         .into());
     };
 
-    // Set the boot device. Send the complete (MAC + interface id) pair when the
-    // report gave us an id, so the boot-order call can fall back to the interface
-    // id; otherwise target the MAC alone.
-    let boot_target = match boot_interface_id {
+    // Set the boot device. The new primary interface row already stores its
+    // Redfish interface id, so send the complete (MAC + id) pair when present,
+    // allowing for interface ID fallback (and target the MAC alone otherwise).
+    let boot_target = match new_primary_interface.boot_interface_id.clone() {
         Some(interface_id) => BootInterfaceTarget::Pair(MachineBootInterface {
             mac_address: primary_interface_mac_address,
             interface_id,

crates/api-core/src/tests/common/metadata.rs

@@ -135,7 +135,7 @@ pub fn invalid_metadata_testcases(
             ).to_string(),
         ),
         (
-            // Maximum of 10 labels
+            // Maximum of 16 labels
             rpc::forge::Metadata {
                 name: "aa".to_string(),
                 description: "".to_string(),
@@ -182,9 +182,33 @@ pub fn invalid_metadata_testcases(
                 rpc::forge::Label {
                     key: "key11".to_string(),
                     value: None,
+                },
+                rpc::forge::Label {
+                    key: "key12".to_string(),
+                    value: None,
+                },
+                rpc::forge::Label {
+                    key: "key13".to_string(),
+                    value: None,
+                },
+                rpc::forge::Label {
+                    key: "key14".to_string(),
+                    value: None,
+                },
+                rpc::forge::Label {
+                    key: "key15".to_string(),
+                    value: None,
+                },
+                rpc::forge::Label {
+                    key: "key16".to_string(),
+                    value: None,
+                },
+                rpc::forge::Label {
+                    key: "key17".to_string(),
+                    value: None,
                 },],
             },
-            "Invalid value: Cannot have more than 10 labels".to_string()
+            "Invalid value: Cannot have more than 16 labels".to_string()
         ),
     ].to_vec();
 

crates/api-core/src/tests/site_explorer.rs

@@ -3410,6 +3410,49 @@ async fn test_site_explorer_auto_corrects_nic_mode_per_expected_machine(
     Ok(())
 }
 
+/// A managed host's DPU-facing `machine_interface` is created (via DHCP) with
+/// just a MAC and no `boot_interface_id`. The exploration that ingests the host
+/// then backfills the vendor-specific Redfish interface id onto that row, matched
+/// by MAC, at which the primary interface ends up with a full `MachineBootInterface`.
+/// This is the same backfill path any DHCP-derived interface takes (the capture is
+/// keyed on MAC, not on how the row was created).
+#[sqlx_test]
+async fn test_site_explorer_backfills_boot_interface_id_onto_machine_interface(
+    pool: PgPool,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let env = common::api_fixtures::create_test_env(pool.clone()).await;
+
+    let dpu = DpuConfig::default();
+    let host_pf_mac = dpu.host_mac_address;
+    let mh = common::api_fixtures::create_managed_host_with_config(
+        &env,
+        ManagedHostConfig::with_dpus(vec![dpu]),
+    )
+    .await;
+
+    let mut txn = env.pool.begin().await?;
+    let interfaces = db::machine_interface::find_by_machine_ids(&mut txn, &[mh.id]).await?;
+    let primary = interfaces
+        .get(&mh.id)
+        .into_iter()
+        .flatten()
+        .find(|i| i.primary_interface)
+        .expect("ingested host should have a primary machine_interface");
+
+    // The primary row is the DPU host-PF interface (same factory MAC), now
+    // holding both halves of the pair: its MAC plus the Redfish interface id the
+    // host report named for it. The `ManagedHostConfig` fixture ids its DPU
+    // interfaces "NIC.Slot.{index + 5}-1", so the first DPU is "NIC.Slot.5-1".
+    assert_eq!(primary.mac_address, host_pf_mac);
+    assert_eq!(
+        primary.boot_interface_id.as_deref(),
+        Some("NIC.Slot.5-1"),
+        "exploration should backfill the Redfish interface id onto the machine_interface row",
+    );
+
+    Ok(())
+}
+
 /// A Managed Host whose `expected_machines` row is later removed becomes an
 /// orphan: `audit_exploration_results` emits an `OrphanManagedHost` health
 /// alert on the host's Machine. Re-adding the entry clears the alert on the

crates/api-db/migrations/20260605215213_machine_interfaces_boot_interface_id.sql

@@ -0,0 +1,4 @@
+-- Add boot_interface_id to machine_interfaces so each interface row holds a
+-- full MachineBootInterface pair with the MAC plus the vendor-named Redfish
+-- EthernetInterface.Id.
+ALTER TABLE machine_interfaces ADD COLUMN boot_interface_id text;

crates/api-db/src/machine_interface.rs

@@ -182,6 +182,25 @@ pub async fn set_primary_interface(
         .map_err(|e| DatabaseError::query(query, e))
 }
 
+/// Records the vendor-native Redfish `EthernetInterface.Id` on the machine_interface
+/// row(s) with the given MAC. Captured by site-explorer per exploration; callers only
+/// invoke this when the id resolves from the current report, so a wiped MAC leaves the
+/// last-known-good id in place.
+pub async fn set_boot_interface_id(
+    mac_address: MacAddress,
+    boot_interface_id: &str,
+    txn: &mut PgConnection,
+) -> Result<(), DatabaseError> {
+    let query = "UPDATE machine_interfaces SET boot_interface_id=$1 WHERE mac_address=$2";
+    sqlx::query(query)
+        .bind(boot_interface_id)
+        .bind(mac_address)
+        .execute(txn)
+        .await
+        .map(|_| ())
+        .map_err(|e| DatabaseError::query(query, e))
+}
+
 pub async fn associate_interface_with_dpu_machine(
     interface_id: &MachineInterfaceId,
     dpu_machine_id: &MachineId,

crates/api-model/src/machine/capabilities.rs

@@ -630,6 +630,7 @@ mod tests {
                     interface_type: InterfaceType::Data,
                     primary_interface: true,
                     mac_address: MacAddress::from_str("08:c0:eb:cb:0e:96").unwrap(),
+                    boot_interface_id: None,
                     attached_dpu_machine_id: Some(
                         MachineId::from_str(
                             "fm100dsbiu5ckus880v8407u0mkcensa39cule26im5gnpvmuufckacguc0",
@@ -654,6 +655,7 @@ mod tests {
                     interface_type: InterfaceType::Data,
                     primary_interface: true,
                     mac_address: MacAddress::from_str("08:c0:eb:cb:0e:97").unwrap(),
+                    boot_interface_id: None,
                     attached_dpu_machine_id: Some(
                         MachineId::from_str(
                             "fm100dsg23d2f4tq4tt5m2hgib5pcldrm3gvefbduau7gj3itgc3iqg3lpg",
@@ -756,6 +758,7 @@ mod tests {
                 interface_type: InterfaceType::Data,
                 primary_interface: true,
                 mac_address: MacAddress::from_str("00:00:00:00:00:00").unwrap(),
+                boot_interface_id: None,
                 attached_dpu_machine_id: None,
                 domain_id: None,
                 machine_id: None,

crates/api-model/src/machine/mod.rs

@@ -131,11 +131,6 @@ pub struct ManagedHostStateSnapshot {
     pub host_snapshot: Machine,
     pub dpu_snapshots: Vec<Machine>,
     pub dpa_interface_snapshots: Vec<DpaInterface>,
-    /// The host's boot interface (MAC + Redfish interface id), captured by
-    /// site-explorer. Populated at read time by `load_object_state` (like
-    /// `dpa_interface_snapshots`); `None` until the host has been explored with
-    /// a fully-resolved boot interface.
-    pub boot_interface: Option<MachineBootInterface>,
     /// If there is an instance provisioned on top of the machine, this holds
     /// its state
     pub instance: Option<InstanceSnapshot>,
@@ -213,8 +208,6 @@ impl<'r> sqlx::FromRow<'r, sqlx::postgres::PgRow> for ManagedHostStateSnapshot {
             host_snapshot,
             dpu_snapshots,
             dpa_interface_snapshots,
-            // Filled by load_object_state later (see dpa_interface_snapshots).
-            boot_interface: None,
             managed_state,
             instance,
             rack_health_overrides,
@@ -280,19 +273,38 @@ impl From<ManagedHostStateSnapshotError> for sqlx::Error {
 ///    so it's on the caller to figure out. What this usually means is the
 ///    caller passes `boot_interface_mac: None` to machine_setup, and then
 ///    subsequent logic flows from there (e.g. ::NoDpu handling).
-fn pick_boot_interface_mac(
+fn pick_boot_interface(
     interfaces: &[MachineInterfaceSnapshot],
-) -> Option<mac_address::MacAddress> {
+) -> Option<&MachineInterfaceSnapshot> {
     // The primary wins!
     if let Some(primary) = interfaces.iter().find(|x| x.primary_interface) {
-        return Some(primary.mac_address);
+        return Some(primary);
     }
     // ..no primary, so lets try to find *some* interface.
     interfaces
         .iter()
         .filter(|x| x.network_segment_type != Some(NetworkSegmentType::Underlay))
         .min_by_key(|x| x.mac_address)
-        .map(|x| x.mac_address)
+}
+
+fn pick_boot_interface_mac(
+    interfaces: &[MachineInterfaceSnapshot],
+) -> Option<mac_address::MacAddress> {
+    pick_boot_interface(interfaces).map(|x| x.mac_address)
+}
+
+/// Resolves the boot interface to a fully-populated [`MachineBootInterface`]
+/// (MAC + Redfish interface id) from the picked interface's own row. Split out
+/// like `pick_boot_interface_mac` so it's unit-testable without a full snapshot.
+fn pick_boot_interface_pair(
+    interfaces: &[MachineInterfaceSnapshot],
+) -> Option<MachineBootInterface> {
+    pick_boot_interface(interfaces).and_then(|interface| {
+        MachineBootInterface::from_parts(
+            Some(interface.mac_address),
+            interface.boot_interface_id.clone(),
+        )
+    })
 }
 
 impl ManagedHostStateSnapshot {
@@ -365,6 +377,19 @@ impl ManagedHostStateSnapshot {
         pick_boot_interface_mac(&self.host_snapshot.interfaces)
     }
 
+    /// Returns the host's boot interface as a fully-populated
+    /// [`MachineBootInterface`] (MAC + Redfish interface id), derived from the
+    /// same primary `machine_interface` row that [`Self::boot_interface_mac`]
+    /// selects.
+    ///
+    /// Returns `None` when that row hasn't captured a Redfish interface id yet
+    /// (e.g. not yet explored, or a zero-DPU host) -- callers then target the MAC
+    /// alone. Because the MAC and id come from one row, the pair can never name a
+    /// different interface than `boot_interface_mac`.
+    pub fn boot_interface(&self) -> Option<MachineBootInterface> {
+        pick_boot_interface_pair(&self.host_snapshot.interfaces)
+    }
+
     /// Returns `true` if override report is hw_health, `false` otherwise.
     fn merge_override_report_with_hw_health(
         output: &mut HealthReport,
@@ -2321,6 +2346,11 @@ pub struct MachineInterfaceSnapshot {
     pub interface_type: InterfaceType,
     pub primary_interface: bool,
     pub mac_address: MacAddress,
+    /// Vendor-native Redfish `EthernetInterface.Id` for this interface, captured
+    /// by site-explorer alongside the MAC. Combined with `mac_address` it forms a
+    /// [`MachineBootInterface`]; for the `primary_interface` row that pair is the
+    /// host's boot device.
+    pub boot_interface_id: Option<String>,
     pub attached_dpu_machine_id: Option<MachineId>,
     pub domain_id: Option<DomainId>,
     pub machine_id: Option<MachineId>,
@@ -2345,6 +2375,7 @@ impl MachineInterfaceSnapshot {
             machine_id: None,
             segment_id: uuid::Uuid::nil().into(),
             mac_address,
+            boot_interface_id: None,
             hostname: String::new(),
             interface_type: InterfaceType::Data,
             primary_interface: true,
@@ -2643,6 +2674,7 @@ impl<'r> FromRow<'r, PgRow> for MachineInterfaceSnapshot {
             hostname: row.try_get("hostname")?,
             interface_type: row.try_get("interface_type")?,
             mac_address: row.try_get("mac_address")?,
+            boot_interface_id: row.try_get("boot_interface_id")?,
             primary_interface: row.try_get("primary_interface")?,
             created: row.try_get("created")?,
             last_dhcp: row.try_get("last_dhcp")?,
@@ -3320,6 +3352,38 @@ mod tests {
         );
     }
 
+    // boot_interface() derives the full pair from the SAME primary row that the
+    // MAC selection uses, so the MAC and id can never name different interfaces.
+    #[test]
+    fn pick_boot_interface_pair_uses_primary_rows_mac_and_id() {
+        let other = build_mock_interface(
+            "05:00:00:00:00:01",
+            false,
+            Some(NetworkSegmentType::HostInband),
+        );
+        let primary = MachineInterfaceSnapshot {
+            boot_interface_id: Some("NIC.Slot.7-1-1".to_string()),
+            ..build_mock_interface("10:00:00:00:00:01", true, Some(NetworkSegmentType::Admin))
+        };
+
+        assert_eq!(
+            pick_boot_interface_pair(&[other, primary]),
+            Some(MachineBootInterface {
+                mac_address: "10:00:00:00:00:01".parse().unwrap(),
+                interface_id: "NIC.Slot.7-1-1".to_string(),
+            })
+        );
+    }
+
+    // When the primary row hasn't captured a Redfish interface id yet, there's no
+    // complete pair -- callers fall back to the MAC alone.
+    #[test]
+    fn pick_boot_interface_pair_is_none_without_captured_id() {
+        let primary =
+            build_mock_interface("10:00:00:00:00:01", true, Some(NetworkSegmentType::Admin));
+        assert_eq!(pick_boot_interface_pair(&[primary]), None);
+    }
+
     // Check the case  where only the BMC has been discovered so far (which
     // is common during early ingestion). In this case, there's no valid boot MAC
     // yet; callers fall back to the `::NoDpu` handling downstream.

crates/api-model/src/metadata.rs

@@ -21,6 +21,9 @@ use serde::Deserialize;
 
 use crate::ConfigValidationError;
 
+/// Maximum number of labels allowed on a resource's metadata.
+const MAX_LABELS: usize = 16;
+
 /// Metadata that can get associated with Forge managed resources
 #[derive(Debug, Default, Clone, PartialEq, Eq, Deserialize)]
 pub struct Metadata {
@@ -96,9 +99,10 @@ impl Metadata {
             }
         }
 
-        if self.labels.len() > 10 {
+        if self.labels.len() > MAX_LABELS {
             return Err(ConfigValidationError::InvalidValue(format!(
-                "Cannot have more than 10 labels, got {}",
+                "Cannot have more than {} labels, got {}",
+                MAX_LABELS,
                 self.labels.len()
             )));
         }
@@ -230,11 +234,11 @@ mod tests {
             Err(ConfigValidationError::InvalidValue(_))
         ));
 
-        // Too many labels
+        // Too many labels (17 > 16)
         let metadata = Metadata {
             name: "nice name".to_string(),
             description: "anything is fine".to_string(),
-            labels: "abcdefghijk"
+            labels: "abcdefghijklmnopq"
                 .chars()
                 .map(|c| (c.to_string(), "x".to_string()))
                 .collect(),

crates/machine-controller/src/boot_interface.rs

@@ -21,17 +21,17 @@ use model::machine::ManagedHostStateSnapshot;
 
 /// Resolve how to target this host's boot interface for Redfish setup calls.
 ///
-/// Prefers the stored, fully-captured boot interface (MAC + Redfish interface
-/// id), which enables the MAC-first / interface-id fallback; it falls back to
-/// the machine-interfaces-derived MAC (no id fallback) when no captured boot
-/// interface is available yet.
+/// Uses the host's primary `machine_interface`: when that row has a captured
+/// Redfish interface id, the full pair is returned (enabling the MAC-first /
+/// interface-id fallback); otherwise it targets the MAC alone. Both come from the
+/// same row, so the pair can never name a different interface than the MAC.
 ///
 /// Returns `None` only when the host has no boot interface at all (e.g. only the
 /// BMC has been discovered, or the primary NIC hasn't appeared yet).
 pub fn boot_interface_target(
     mh_snapshot: &ManagedHostStateSnapshot,
 ) -> Option<BootInterfaceTarget> {
-    if let Some(boot_interface) = mh_snapshot.boot_interface.clone() {
+    if let Some(boot_interface) = mh_snapshot.boot_interface() {
         return Some(BootInterfaceTarget::Pair(boot_interface));
     }
     mh_snapshot