Max level shown:
12026-01-27T01:14:02.892ZDEBGtest_event_delivery (init_with_steps): Running step start_crdb
22026-01-27T01:14:02.892ZDEBGtest_event_delivery: Starting CRDB
32026-01-27T01:14:02.973ZINFOtest_event_delivery: cockroach temporary directory: /var/tmp/omicron_tmp/.tmpgtRzte
42026-01-27T01:14:02.973ZINFOtest_event_delivery: cockroach: copying from seed tarball (/var/tmp/omicron_tmp/crdb-base-build/2568847d748e1bae965de0b3126e3133c4bd29b2d2831f880273cca7dc24bf97.tar) to storage directory (/var/tmp/omicron_tmp/.tmpgtRzte/data)
52026-01-27T01:14:03.010ZINFOtest_event_delivery: cockroach command line: cockroach start-single-node --insecure --http-addr=:0 --store=path=/var/tmp/omicron_tmp/.tmpgtRzte/data,ballast-size=0 --listen-addr [::1]:0 --listening-url-file /var/tmp/omicron_tmp/.tmpgtRzte/listen-url
62026-01-27T01:14:03.010ZINFOtest_event_delivery: cockroach environment: BUILDOMAT_JOB_ID=01KFY6DEWKSJ6KBWEPJMNGAW6V BUILDOMAT_TASK_ID=4 CARGO=/home/build/.rustup/toolchains/1.91.1-x86_64-unknown-illumos/bin/cargo CARGO_HOME=/home/build/.cargo CARGO_INCREMENTAL=0 CARGO_MANIFEST_DIR=/work/oxidecomputer/omicron/nexus CARGO_PKG_AUTHORS= CARGO_PKG_DESCRIPTION= CARGO_PKG_HOMEPAGE= CARGO_PKG_LICENSE=MPL-2.0 CARGO_PKG_LICENSE_FILE= CARGO_PKG_NAME=omicron-nexus CARGO_PKG_REPOSITORY= CARGO_PKG_RUST_VERSION= CARGO_PKG_VERSION=0.1.0 CARGO_PKG_VERSION_MAJOR=0 CARGO_PKG_VERSION_MINOR=1 CARGO_PKG_VERSION_PATCH=0 CARGO_PKG_VERSION_PRE= CARGO_TERM_COLOR=always CI=true CRDB_SEED_TAR=/var/tmp/omicron_tmp/crdb-base-build/2568847d748e1bae965de0b3126e3133c4bd29b2d2831f880273cca7dc24bf97.tar GITHUB_BRANCH=propolis-doorbell-buffernt GITHUB_REF=refs/heads/propolis-doorbell-buffernt GITHUB_REPOSITORY=oxidecomputer/omicron GITHUB_SHA=5db41474f9cbdbb902460f66375144650fa634e2 GOTRACEBACK=crash HOME=/home/build LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 LD_LIBRARY_PATH=/work/oxidecomputer/omicron/target/debug/build/aws-lc-sys-2365d10e992c2e9e/out/build/artifacts:/work/oxidecomputer/omicron/target/debug/build/blake3-3a6f042b78b00084/out:/work/oxidecomputer/omicron/target/debug/build/bzip2-sys-a5022a14d5411a51/out/lib:/work/oxidecomputer/omicron/target/debug/build/libgit2-sys-3c3387d8a4ad6ac9/out/build:/work/oxidecomputer/omicron/target/debug/build/ring-aaa5d3556d6e760b/out:/work/oxidecomputer/omicron/target/debug/build/tofino-ea950bd608a63962/out:/work/oxidecomputer/omicron/target/debug/build/zstd-sys-163c6620fa51a768/out:/work/oxidecomputer/omicron/target/debug/deps:/work/oxidecomputer/omicron/target/debug:/home/build/.rustup/toolchains/1.91.1-x86_64-unknown-illumos/lib/rustlib/x86_64-unknown-illumos/lib:/home/build/.rustup/toolchains/1.91.1-x86_64-unknown-illumos/lib LOGNAME=build NEXTEST=1 NEXTEST_ATTEMPT=1 NEXTEST_ATTEMPT_ID=0069c974-2637-48b9-9dc2-1efafeb7535a:omicron-nexus::test_all$integration_tests::webhooks::test_event_delivery NEXTEST_BINARY_ID=omicron-nexus::test_all NEXTEST_BIN_EXE_nexus=/work/oxidecomputer/omicron/target/debug/nexus NEXTEST_BIN_EXE_schema-updater=/work/oxidecomputer/omicron/target/debug/schema-updater NEXTEST_BIN_EXE_schema_updater=/work/oxidecomputer/omicron/target/debug/schema-updater NEXTEST_EXECUTION_MODE=process-per-test NEXTEST_LD_LIBRARY_PATH=/work/oxidecomputer/omicron/target/debug/build/aws-lc-sys-2365d10e992c2e9e/out/build/artifacts:/work/oxidecomputer/omicron/target/debug/build/blake3-3a6f042b78b00084/out:/work/oxidecomputer/omicron/target/debug/build/bzip2-sys-a5022a14d5411a51/out/lib:/work/oxidecomputer/omicron/target/debug/build/libgit2-sys-3c3387d8a4ad6ac9/out/build:/work/oxidecomputer/omicron/target/debug/build/ring-aaa5d3556d6e760b/out:/work/oxidecomputer/omicron/target/debug/build/tofino-ea950bd608a63962/out:/work/oxidecomputer/omicron/target/debug/build/zstd-sys-163c6620fa51a768/out:/work/oxidecomputer/omicron/target/debug/deps:/work/oxidecomputer/omicron/target/debug:/home/build/.rustup/toolchains/1.91.1-x86_64-unknown-illumos/lib/rustlib/x86_64-unknown-illumos/lib:/home/build/.rustup/toolchains/1.91.1-x86_64-unknown-illumos/lib NEXTEST_PROFILE=ci NEXTEST_RUN_ID=0069c974-2637-48b9-9dc2-1efafeb7535a NEXTEST_RUN_MODE=test NEXTEST_STRESS_CURRENT=none NEXTEST_STRESS_TOTAL=none NEXTEST_TEST_GLOBAL_SLOT=1 NEXTEST_TEST_GROUP=@global NEXTEST_TEST_GROUP_SLOT=none NEXTEST_TEST_NAME=integration_tests::webhooks::test_event_delivery NEXTEST_TEST_PHASE=run NEXTEST_TOTAL_ATTEMPTS=1 OUT_DIR=/work/oxidecomputer/omicron/target/debug/build/omicron-nexus-6c541d174146822e/out PATH=/work/oxidecomputer/omicron/out/mgd/root/opt/oxide/mgd/bin:/work/oxidecomputer/omicron/out/dendrite-stub/bin:/work/oxidecomputer/omicron/out/clickhouse:/work/oxidecomputer/omicron/out/cockroachdb/bin:/home/build/.cargo/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/ooce/bin:/opt/ooce/sbin PWD=/work/oxidecomputer/omicron RUSTC_BOOTSTRAP=1 RUSTDOCFLAGS=--document-private-items -D warnings RUSTFLAGS=--cfg tokio_unstable -D warnings -C link-arg=-R/usr/platform/oxide/lib/amd64 RUSTUP_HOME=/home/build/.rustup RUSTUP_TOOLCHAIN=1.91.1-x86_64-unknown-illumos RUST_BACKTRACE=1 RUST_RECURSION_COUNT=1 SHLVL=1 SSL_CERT_DIR=/usr/ssl/certs SSL_CERT_FILE=/etc/ssl/cacert.pem TMPDIR=/var/tmp/omicron_tmp TZ=UTC USER=build _=/usr/bin/ptime
72026-01-27T01:14:05.444ZINFOtest_event_delivery: cockroach pid: 7970
82026-01-27T01:14:05.444ZINFOtest_event_delivery: cockroach listen URL: postgresql://root@[::1]:55261/omicron?sslmode=disable
92026-01-27T01:14:05.496ZDEBGtest_event_delivery (init_with_steps): Running step start_clickhouse
102026-01-27T01:14:05.496ZDEBGtest_event_delivery: Starting Clickhouse
112026-01-27T01:14:06.111ZDEBGtest_event_delivery (init_with_steps): Running step start_internal_dns
122026-01-27T01:14:06.112ZINFOtest_event_delivery (store): opening sled database path = /var/tmp/omicron_tmp/.tmp3yFXkQ
132026-01-27T01:14:06.237ZINFOtest_event_delivery (store): pruning trees for generations newer than 0
142026-01-27T01:14:06.237ZINFOtest_event_delivery (store): pruning trees for generations older than 0 keep = 3
152026-01-27T01:14:06.238ZINFOtest_event_delivery (dns): DNS server bound to address kind = dns local_address = [::1]:50749
162026-01-27T01:14:06.238ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:62102 method = GET path = /config versions = all starting from 2.0.0
172026-01-27T01:14:06.238ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:62102 method = GET path = /config versions = from 1.0.0 to 2.0.0
182026-01-27T01:14:06.238ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:62102 method = PUT path = /config versions = all starting from 2.0.0
192026-01-27T01:14:06.238ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:62102 method = PUT path = /config versions = from 1.0.0 to 2.0.0
202026-01-27T01:14:06.239ZINFOtest_event_delivery (http): listening kind = dns local_addr = [::1]:62102
212026-01-27T01:14:06.240ZDEBGtest_event_delivery (http): successfully registered DTrace USDT probes kind = dns local_addr = [::1]:62102
222026-01-27T01:14:06.240ZDEBGtest_event_delivery (init_with_steps): Running step start_external_dns
232026-01-27T01:14:06.240ZINFOtest_event_delivery (store): opening sled database path = /var/tmp/omicron_tmp/.tmpOULkfk
242026-01-27T01:14:06.252ZINFOtest_event_delivery (store): pruning trees for generations newer than 0
252026-01-27T01:14:06.252ZINFOtest_event_delivery (store): pruning trees for generations older than 0 keep = 3
262026-01-27T01:14:06.252ZINFOtest_event_delivery (dns): DNS server bound to address kind = dns local_address = [::1]:49275
272026-01-27T01:14:06.252ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:60726 method = GET path = /config versions = all starting from 2.0.0
282026-01-27T01:14:06.252ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:60726 method = GET path = /config versions = from 1.0.0 to 2.0.0
292026-01-27T01:14:06.252ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:60726 method = PUT path = /config versions = all starting from 2.0.0
302026-01-27T01:14:06.253ZDEBGtest_event_delivery (http): registered endpoint kind = dns local_addr = [::1]:60726 method = PUT path = /config versions = from 1.0.0 to 2.0.0
312026-01-27T01:14:06.253ZINFOtest_event_delivery (http): listening kind = dns local_addr = [::1]:60726
322026-01-27T01:14:06.258ZDEBGtest_event_delivery (http): successfully registered DTrace USDT probes kind = dns local_addr = [::1]:60726
332026-01-27T01:14:06.259ZDEBGtest_event_delivery (init_with_steps): Running step start_nexus_internal
342026-01-27T01:14:06.259ZDEBGtest_event_delivery: Starting Nexus (internal API)
352026-01-27T01:14:06.260ZINFOtest_event_delivery: setting up nexus server
362026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = Action
372026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = AuditLog
382026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = AnyActor
392026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = AuthenticatedActor
402026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = BlueprintConfig
412026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = Database
422026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = DnsConfig
432026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = Fleet
442026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = Inventory
452026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = IpPoolList
462026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = VpcList
472026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = ConsoleSessionList
482026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = DeviceAuthRequestList
492026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = QuiesceState
502026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloCertificateList
512026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloGroupList
522026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloIdentityProviderList
532026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloUserList
542026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloUserSessionList
552026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloUserTokenList
562026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = SubnetPoolList
572026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = UpdateTrustRootList
582026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = TargetReleaseConfig
592026-01-27T01:14:06.266ZINFOtest_event_delivery (ServerContext): registering Oso class class = AlertClassList
602026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = ScimClientBearerTokenList
612026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = MulticastGroupList
622026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = Project
632026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = Disk
642026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = Snapshot
652026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = ProjectImage
662026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = AffinityGroup
672026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = AntiAffinityGroup
682026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = Instance
692026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = IpPool
702026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = InstanceNetworkInterface
712026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = Vpc
722026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = VpcRouter
732026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = InternetGateway
742026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = InternetGatewayIpPool
752026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = InternetGatewayIpAddress
762026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = RouterRoute
772026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = VpcSubnet
782026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = FloatingIp
792026-01-27T01:14:06.267ZINFOtest_event_delivery (ServerContext): registering Oso class class = ExternalSubnet
802026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Image
812026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloImage
822026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = AddressLot
832026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Blueprint
842026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = LoopbackAddress
852026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Certificate
862026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = ConsoleSession
872026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = DeviceAuthRequest
882026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = DeviceAccessToken
892026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = PhysicalDisk
902026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Rack
912026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SshKey
922026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Silo
932026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloUser
942026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SiloGroup
952026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SupportBundle
962026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = IdentityProvider
972026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SamlIdentityProvider
982026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Sled
992026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = SubnetPool
1002026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = TufRepo
1012026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = TufArtifact
1022026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = TufTrustRoot
1032026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Alert
1042026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = AlertReceiver
1052026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = WebhookSecret
1062026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Zpool
1072026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = Service
1082026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = UserBuiltin
1092026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = ScimClientBearerToken
1102026-01-27T01:14:06.268ZINFOtest_event_delivery (ServerContext): registering Oso class class = MulticastGroup
1112026-01-27T01:14:06.269ZINFOtest_event_delivery (ServerContext): full Oso configuration config = #\n# Oso configuration for Omicron\n# This file is augmented by generated snippets.\n#\n\n#\n# ACTOR TYPES AND BASIC RULES\n#\n\n# `AnyActor` includes both authenticated and unauthenticated users.\nactor AnyActor {}\n\n# An `AuthenticatedActor` has an identity in the system. All of our operations\n# today require that an actor be authenticated.\nactor AuthenticatedActor {}\n\n# For any resource, `actor` can perform action `action` on it if they're\n# authenticated and their role(s) give them the corresponding permission on that\n# resource.\nallow(actor: AnyActor, action: Action, resource) if\n actor.authenticated and\n has_permission(actor.authn_actor.unwrap(), action.to_perm(), resource);\n\n# Define role relationships\nhas_role(actor: AuthenticatedActor, role: String, resource: Resource)\n\tif resource.has_role(actor, role);\n\n#\n# ROLES AND PERMISSIONS IN THE FLEET/SILO/PROJECT HIERARCHY\n#\n# We define the following permissions for most resources in the system:\n#\n# - "create_child": required to create child resources (of any type)\n#\n# - "list_children": required to list child resources (of all types) of a\n# resource\n#\n# - "modify": required to modify or delete a resource\n#\n# - "read": required to read a resource\n#\n# We define the following predefined roles for only a few high-level resources:\n# the Fleet (see below), Silo, Organization, and Project. The specific roles\n# are oriented around intended use-cases:\n#\n# - "admin": has all permissions on the resource\n#\n# - "collaborator": has "read", "list_children", and "create_child", plus\n# the "admin" role for child resources. The idea is that if you're an\n# Organization Collaborator, you have full control over the Projects within\n# the Organization, but you cannot modify or delete the Organization itself.\n#\n# - "viewer": has "read" and "list_children" on a resource\n#\n# Below the Project level, permissions are granted via roles at the Project\n# level. For example, for someone to be able to create, modify, or delete any\n# Instances, they must be granted project.collaborator, which means they can\n# create, modify, or delete _all_ resources in the Project.\n#\n# The complete set of predefined roles:\n#\n# - fleet.admin (superuser for the whole system)\n# - fleet.collaborator (can manage Silos)\n# - fleet.viewer (can read most non-siloed resources in the system)\n# - silo.admin (superuser for the silo)\n# - silo.collaborator (can create and own Organizations; grants project.admin on all projects)\n# - silo.limited-collaborator (grants project.limited-collaborator on all projects)\n# - silo.viewer (can read most resources within the Silo; grants project.viewer)\n# - organization.admin (complete control over an organization)\n# - organization.collaborator (can manage Projects)\n# - organization.viewer (can read most resources within the Organization)\n# - project.admin (complete control over a Project)\n# - project.collaborator (can manage all resources within the Project, including networking)\n# - project.limited-collaborator (can manage compute resources, but not networking resources)\n# - project.viewer (can read most resources within the Project)\n#\n# Outside the Silo/Organization/Project hierarchy, we (currently) treat most\n# resources as nested under Fleet or else a synthetic resource (see below). We\n# do not yet support role assignments on anything other than Fleet, Silo,\n# Organization, or Project.\n#\n\n# "Fleet" is a global singleton representing the whole system. The name comes\n# from the idea described in RFD 24, but it's not quite right. This probably\n# should be more like "Region" or "AvailabilityZone". The precise boundaries\n# have not yet been figured out.\nresource Fleet {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "read",\n\t "create_child",\n\t];\n\n\troles = [\n\t # Roles that can be attached by users\n\t "admin",\n\t "collaborator",\n\t "viewer",\n\n\t # Internal-only roles\n\t "external-authenticator"\n\t];\n\n\t# Roles implied by other roles on this resource\n\t"viewer" if "collaborator";\n\t"collaborator" if "admin";\n\n\t# Permissions granted directly by roles on this resource\n\t"list_children" if "viewer";\n\t"read" if "viewer";\n\t"create_child" if "collaborator";\n\t"modify" if "admin";\n}\n\n# For fleets specifically, roles can be conferred by roles on the user's Silo.\n# Note that certain Actors may not ever have any roles assigned to them, like\n# SCIM Actors.\nhas_role(actor: AuthenticatedActor, role: String, _: Fleet) if\n\tsilo_role in actor.confers_fleet_role(role) and\n\thas_role(actor, silo_role, actor.silo.unwrap());\n\nresource Silo {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "read",\n\t "create_child",\n\t];\n\troles = [ "admin", "collaborator", "limited-collaborator", "viewer" ];\n\n\t# Roles implied by other roles on this resource\n\t"viewer" if "limited-collaborator";\n\t"limited-collaborator" if "collaborator";\n\t"collaborator" if "admin";\n\n\t# Permissions granted directly by roles on this resource\n\t"list_children" if "viewer";\n\t"read" if "viewer";\n\n\t"create_child" if "collaborator";\n\t"modify" if "admin";\n\n\t# Permissions implied by roles on this resource's parent (Fleet). Fleet\n\t# privileges allow a user to see and potentially administer the Silo,\n\t# but they do not give anyone permission to look at anything inside the\n\t# Silo. To achieve this, we use permission rules here. (If we granted\n\t# Fleet administrators _roles_ on the Silo, then those would cascade\n\t# into the Silo as well.)\n\trelations = { parent_fleet: Fleet };\n\t"read" if "viewer" on "parent_fleet";\n\t"modify" if "collaborator" on "parent_fleet";\n\n\t# external authenticator has to create silo users\n\t"list_children" if "external-authenticator" on "parent_fleet";\n\t"create_child" if "external-authenticator" on "parent_fleet";\n}\n\nhas_relation(fleet: Fleet, "parent_fleet", silo: Silo)\n\tif silo.fleet = fleet;\n\n# As a special case, all authenticated users can read their own Silo. That's\n# not quite the same as having the "viewer" role. For example, they cannot list\n# Organizations in the Silo.\n#\n# One reason this is necessary is because if an unprivileged user tries to\n# create an Organization using "POST /organizations", they should get back a 403\n# (which implies they're able to see /organizations, which is essentially seeing\n# the Silo itself) rather than a 404. This behavior isn't a hard constraint\n# (i.e., you could reasonably get a 404 for an API you're not allowed to call).\n# Nor is the implementation (i.e., we could special-case this endpoint somehow).\n# But granting this permission is the simplest way to keep this endpoint's\n# behavior consistent with the rest of the API.\n#\n# This rule is also used to determine if a user can list the identity providers\n# in the Silo (which they should be able to), since that's predicated on being\n# able to read the Silo.\n#\n# It's unclear what else would break if users couldn't see their own Silo.\nhas_permission(actor: AuthenticatedActor, "read", silo: Silo)\n\tif actor.is_user and silo in actor.silo;\n\nresource Project {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "read",\n\t "create_child",\n\t];\n\troles = [ "admin", "collaborator", "limited-collaborator", "viewer" ];\n\n\t# Roles implied by other roles on this resource\n\t# Role hierarchy: admin > collaborator > limited-collaborator > viewer\n\t#\n\t# The "limited-collaborator" role can create/modify non-networking\n\t# resources (instances, disks, etc.) but cannot create/modify networking\n\t# infrastructure (VPCs, subnets, routers, internet gateways).\n\t# See nexus/authz-macros for InProjectLimited vs InProjectFull.\n\t"viewer" if "limited-collaborator";\n\t"limited-collaborator" if "collaborator";\n\t"collaborator" if "admin";\n\n\t# Permissions granted directly by roles on this resource\n\t"list_children" if "viewer";\n\t"read" if "viewer";\n\t"create_child" if "limited-collaborator";\n\t"modify" if "admin";\n\n\t# Roles implied by roles on this resource's parent (Silo)\n\trelations = { parent_silo: Silo };\n\t"admin" if "collaborator" on "parent_silo";\n\t"limited-collaborator" if "limited-collaborator" on "parent_silo";\n\t"viewer" if "viewer" on "parent_silo";\n}\nhas_relation(silo: Silo, "parent_silo", project: Project)\n\tif project.silo = silo;\n\n#\n# GENERAL RESOURCES OUTSIDE THE SILO/PROJECT HIERARCHY\n#\n# Many resources use snippets of Polar generated by the `authz_resource!` Rust\n# macro. Some resources require custom Polar code. Those appear here.\n#\n\nresource Certificate {\n\tpermissions = [ "read", "modify" ];\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Fleet-level and silo-level roles both grant privileges on certificates.\n\t"read" if "admin" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\t"read" if "admin" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", certificate: Certificate)\n\tif certificate.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", certificate: Certificate)\n\tif certificate.silo.fleet = fleet;\n\nresource SiloUser {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "read",\n\t "create_child",\n\t];\n\n\t# Fleet and Silo administrators can manage a Silo's users. This is one\n\t# of the only areas of Silo configuration that Fleet Administrators have\n\t# permissions on.\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\t"list_children" if "read" on "parent_silo";\n\t"read" if "read" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_silo";\n\t"list_children" if "read" on "parent_fleet";\n\t"read" if "read" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", user: SiloUser)\n\tif user.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", user: SiloUser)\n\tif user.silo.fleet = fleet;\n\n# authenticated actors have all permissions on themselves\nhas_permission(actor: AuthenticatedActor, _perm: String, silo_user: SiloUser)\n if actor.equals_silo_user(silo_user);\n\nhas_permission(actor: AuthenticatedActor, "read", silo_user: SiloUser)\n if actor.is_user and silo_user.silo in actor.silo;\n\nresource SiloGroup {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "read",\n\t "create_child",\n\t];\n\n\trelations = { parent_silo: Silo };\n\t"list_children" if "read" on "parent_silo";\n\t"read" if "read" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_silo";\n}\nhas_relation(silo: Silo, "parent_silo", group: SiloGroup)\n\tif group.silo = silo;\n\nresource SshKey {\n\tpermissions = [ "read", "modify" ];\n\trelations = { silo_user: SiloUser };\n\n\t"read" if "read" on "silo_user";\n}\n# We want to allow the user to modify the ssh key but disallow a SCIM IdP token\n# from doing the same.\nhas_permission(actor: AuthenticatedActor, "modify", ssh_key: SshKey)\n\tif actor.is_user and has_permission(actor, "modify", ssh_key.silo_user);\nhas_relation(user: SiloUser, "silo_user", ssh_key: SshKey)\n\tif ssh_key.silo_user = user;\n\nresource IdentityProvider {\n\tpermissions = [\n\t "read",\n\t "modify",\n\t "create_child",\n\t "list_children",\n\t];\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Silo-level roles grant privileges on identity providers.\n\t"read" if "viewer" on "parent_silo";\n\t"list_children" if "viewer" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_silo";\n\n\t# Fleet-level roles also grant privileges on identity providers.\n\t"read" if "viewer" on "parent_fleet";\n\t"list_children" if "viewer" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", identity_provider: IdentityProvider)\n\tif identity_provider.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: IdentityProvider)\n\tif collection.silo.fleet = fleet;\n\nresource SamlIdentityProvider {\n\tpermissions = [\n\t "read",\n\t "modify",\n\t "create_child",\n\t "list_children",\n\t];\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Silo-level roles grant privileges on identity providers.\n\t"read" if "viewer" on "parent_silo";\n\t"list_children" if "viewer" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_silo";\n\n\t# Fleet-level roles also grant privileges on identity providers.\n\t"read" if "viewer" on "parent_fleet";\n\t"list_children" if "viewer" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", saml_identity_provider: SamlIdentityProvider)\n\tif saml_identity_provider.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: SamlIdentityProvider)\n\tif collection.silo.fleet = fleet;\n\nresource ScimClientBearerToken {\n\tpermissions = [ "read", "modify" ];\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n # necessary to authenticate SCIM actors\n\t"read" if "external-authenticator" on "parent_fleet";\n\n\t# Silo-level roles grant privileges for SCIM client tokens.\n\t"read" if "admin" on "parent_silo";\n\t"modify" if "admin" on "parent_silo";\n\n\t# Fleet-level roles also grant privileges for SCIM client tokens.\n\t"read" if "admin" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", scim_client_bearer_token: ScimClientBearerToken)\n\tif scim_client_bearer_token.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: ScimClientBearerToken)\n\tif collection.silo.fleet = fleet;\n\n\n#\n# SYNTHETIC RESOURCES OUTSIDE THE SILO HIERARCHY\n#\n# The resources here do not correspond to anything that appears explicitly in\n# the API or is stored in the database. These are used either at the top level\n# of the API path (e.g., "/v1/system/ip-pools") or as an implementation detail of the system\n# (in the case of console sessions and "Database"). The policies are\n# either statically-defined in this file or driven by role assignments on the\n# Fleet. None of these resources defines their own roles.\n#\n\n# Describes the quiesce state of a particular Nexus instance.\n#\n# These authz checks must not require the database. We grant this directly to\n# callers of the internal API.\nresource QuiesceState {\n\tpermissions = [ "read", "modify" ];\n}\nhas_permission(USER_INTERNAL_API: AuthenticatedActor, "read", _q: QuiesceState);\nhas_permission(\n USER_INTERNAL_API: AuthenticatedActor,\n "modify",\n _q: QuiesceState\n);\n\n# Describes the policy for reading and modifying DNS configuration\n# (both internal and external)\nresource DnsConfig {\n\tpermissions = [ "read", "modify" ];\n\trelations = { parent_fleet: Fleet };\n\t# "external-authenticator" requires these permissions because that's the\n\t# context that Nexus uses when creating and deleting Silos. These\n\t# operations necessarily need to read and modify DNS configuration.\n\t"read" if "external-authenticator" on "parent_fleet";\n\t"modify" if "external-authenticator" on "parent_fleet";\n\t# "admin" on the parent fleet also gets these permissions, primarily for\n\t# the test suite.\n\t"read" if "admin" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", dns_config: DnsConfig)\n\tif dns_config.fleet = fleet;\n\n# Describes the policy for accessing blueprints\nresource BlueprintConfig {\n\tpermissions = [\n\t "list_children", # list blueprints\n\t "create_child", # create blueprint\n\t "read", # read the current target\n\t "modify", # change the current target\n\t];\n\n\trelations = { parent_fleet: Fleet };\n\t"create_child" if "admin" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n\t"list_children" if "viewer" on "parent_fleet";\n\t"read" if "viewer" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", list: BlueprintConfig)\n\tif list.fleet = fleet;\n\n# Describes the policy for accessing "/v1/system/update/trust-roots" in the API\nresource UpdateTrustRootList {\n\tpermissions = [ "list_children", "create_child" ];\n\trelations = { parent_fleet: Fleet };\n\t"list_children" if "viewer" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", collection: UpdateTrustRootList)\n\tif collection.fleet = fleet;\n\n# Describes the policy for accessing blueprints\nresource TargetReleaseConfig {\n\tpermissions = [\n\t "read", # read the current target release\n\t "modify", # change the current target release\n\t];\n\n\trelations = { parent_fleet: Fleet };\n\t"read" if "viewer" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", resource: TargetReleaseConfig)\n\tif resource.fleet = fleet;\n\n# Describes the policy for reading and modifying low-level inventory\nresource Inventory {\n\tpermissions = [ "read", "modify" ];\n\trelations = { parent_fleet: Fleet };\n\t"read" if "viewer" on "parent_fleet";\n\t"modify" if "admin" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", inventory: Inventory)\n\tif inventory.fleet = fleet;\n\n# Describes the policy for accessing "/v1/system/ip-pools" in the API\nresource IpPoolList {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "create_child",\n\t];\n\n\t# Fleet Administrators can create or modify the IP Pools list.\n\trelations = { parent_fleet: Fleet };\n\t"modify" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n\n\t# Fleet Viewers can list IP Pools\n\t"list_children" if "viewer" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", ip_pool_list: IpPoolList)\n\tif ip_pool_list.fleet = fleet;\n\n# Any authenticated user can create a child of a provided IP Pool.\n# This is necessary to use the pools when provisioning instances.\nhas_permission(actor: AuthenticatedActor, "create_child", ip_pool: IpPool)\n\tif actor.is_user and silo in actor.silo and silo.fleet = ip_pool.fleet;\n\n# Describes the policy for accessing "/v1/multicast-groups" in the API\n# Groups are created when the first instance joins and deleted when the last leaves.\nresource MulticastGroupList {\n\tpermissions = [ "list_children" ];\n\n\trelations = { parent_fleet: Fleet };\n\n\t# Fleet Viewers can list multicast groups\n\t"list_children" if "viewer" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", multicast_group_list: MulticastGroupList)\n\tif multicast_group_list.fleet = fleet;\n\n# Any authenticated user can list multicast groups in their fleet.\n# This enables silo users to discover groups for attaching instances,\n# without requiring the Fleet::Viewer role.\nhas_permission(actor: AuthenticatedActor, "list_children", multicast_group_list: MulticastGroupList)\n\tif actor.is_user and silo in actor.silo and silo.fleet = multicast_group_list.fleet;\n\n# MulticastGroup is a fleet-level discovery resource.\n# Join/leave authorization is gated by Instance::Modify, not the group itself.\nresource MulticastGroup {\n\tpermissions = [ "read", "list_children" ];\n\trelations = { parent_fleet: Fleet };\n}\nhas_relation(fleet: Fleet, "parent_fleet", multicast_group: MulticastGroup)\n\tif multicast_group.fleet = fleet;\n\n# Any authenticated user can read multicast groups in their fleet\nhas_permission(actor: AuthenticatedActor, "read", multicast_group: MulticastGroup)\n\tif actor.is_user and silo in actor.silo and silo.fleet = multicast_group.fleet;\n\n# Any authenticated user can list members of multicast groups in their fleet\nhas_permission(actor: AuthenticatedActor, "list_children", multicast_group: MulticastGroup)\n\tif actor.is_user and silo in actor.silo and silo.fleet = multicast_group.fleet;\n\n# Describes the policy for reading and writing the audit log\nresource AuditLog {\n\tpermissions = [\n\t "list_children", # retrieve audit log\n\t "create_child", # create audit log entry\n\t];\n\n\trelations = { parent_fleet: Fleet };\n\n\t# Fleet viewers can read the audit log\n\t"list_children" if "viewer" on "parent_fleet";\n}\n\n# Any actor should be able to write to the audit log because we need to be able\n# to write to the log from any request, authenticated or not. Audit log writes\n# are always a byproduct of other operations: there are no endpoints that allow\n# the user to write to the log deliberately. Note we use AuthenticatedActor\n# because we don't really mean unauthenticated -- in the case of login\n# operations, we use the external authenticator actor that creates the session\n# to authorize the audit log write.\nhas_permission(_actor: AuthenticatedActor, "create_child", _audit_log: AuditLog);\n\nhas_relation(fleet: Fleet, "parent_fleet", audit_log: AuditLog)\n\tif audit_log.fleet = fleet;\n\n# Describes the policy for creating and managing web console sessions.\nresource ConsoleSessionList {\n\tpermissions = [ "create_child" ];\n\trelations = { parent_fleet: Fleet };\n\t"create_child" if "external-authenticator" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", collection: ConsoleSessionList)\n\tif collection.fleet = fleet;\n\n# Allow silo admins to delete and list user sessions\nresource SiloUserSessionList {\n permissions = [ "modify", "list_children" ];\n relations = { parent_silo: Silo };\n\n # A silo admin can modify (e.g., delete) a user's sessions.\n "modify" if "admin" on "parent_silo";\n\n # A silo admin can list a user's sessions.\n "list_children" if "admin" on "parent_silo";\n}\nhas_relation(silo: Silo, "parent_silo", authn_list: SiloUserSessionList)\n if authn_list.silo_user.silo = silo;\n\n# give users 'modify' and 'list_children' on their own sessions\nhas_permission(actor: AuthenticatedActor, "modify", authn_list: SiloUserSessionList)\n if actor.equals_silo_user(authn_list.silo_user);\nhas_permission(actor: AuthenticatedActor, "list_children", authn_list: SiloUserSessionList)\n if actor.equals_silo_user(authn_list.silo_user);\n\n# Allow silo admins to delete and list user access tokens\nresource SiloUserTokenList {\n permissions = [ "modify", "list_children" ];\n relations = { parent_silo: Silo };\n\n # A silo admin can modify (e.g., delete) a user's tokens.\n "modify" if "admin" on "parent_silo";\n\n # A silo admin can list a user's tokens.\n "list_children" if "admin" on "parent_silo";\n}\nhas_relation(silo: Silo, "parent_silo", authn_list: SiloUserTokenList)\n if authn_list.silo_user.silo = silo;\n\n# give users 'modify' and 'list_children' on their own tokens\nhas_permission(actor: AuthenticatedActor, "modify", authn_list: SiloUserTokenList)\n if actor.equals_silo_user(authn_list.silo_user);\nhas_permission(actor: AuthenticatedActor, "list_children", authn_list: SiloUserTokenList)\n if actor.equals_silo_user(authn_list.silo_user);\n\n# Describes the policy for creating and managing device authorization requests.\nresource DeviceAuthRequestList {\n\tpermissions = [ "create_child" ];\n\trelations = { parent_fleet: Fleet };\n\t"create_child" if "external-authenticator" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", collection: DeviceAuthRequestList)\n\tif collection.fleet = fleet;\n\n# Describes the policy for creating and managing Silo certificates\nresource SiloCertificateList {\n\tpermissions = [ "list_children", "create_child" ];\n\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Both Fleet and Silo administrators can see and modify the Silo's\n\t# certificates.\n\t"list_children" if "admin" on "parent_silo";\n\t"list_children" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", collection: SiloCertificateList)\n\tif collection.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: SiloCertificateList)\n\tif collection.silo.fleet = fleet;\n\n# Describes the policy for creating and managing Silo identity providers\nresource SiloIdentityProviderList {\n\tpermissions = [ "list_children", "create_child" ];\n\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Everyone who can read the Silo (which includes all the users in the\n\t# Silo) can see the identity providers in it.\n\t"list_children" if "read" on "parent_silo";\n\n\t# Fleet and Silo administrators can manage the Silo's identity provider\n\t# configuration. This is one of the only areas of Silo configuration\n\t# that Fleet Administrators have permissions on. This is also one of\n\t# the only cases where we need to look two levels up the hierarchy to\n\t# see if somebody has the right permission. For most other things,\n\t# permissions cascade down the hierarchy so we only need to look at the\n\t# parent.\n\t"create_child" if "admin" on "parent_silo";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", collection: SiloIdentityProviderList)\n\tif collection.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: SiloIdentityProviderList)\n\tif collection.silo.fleet = fleet;\n\n# Describes the policy for creating and managing Silo users (mostly intended for\n# API-managed users)\nresource SiloUserList {\n\tpermissions = [ "list_children", "create_child" ];\n\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Everyone who can read the Silo (which includes all the users in the\n\t# Silo) can see the users in it.\n\t"list_children" if "read" on "parent_silo";\n\n\t# Fleet and Silo administrators can manage the Silo's users. This is\n\t# one of the only areas of Silo configuration that Fleet Administrators\n\t# have permissions on. This is also one of the few cases (so far) where\n\t# we need to look two levels up the hierarchy to see if somebody has the\n\t# right permission. For most other things, permissions cascade down the\n\t# hierarchy so we only need to look at the parent.\n\t"create_child" if "admin" on "parent_silo";\n\t"list_children" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", collection: SiloUserList)\n\tif collection.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: SiloUserList)\n\tif collection.silo.fleet = fleet;\n\n# Grant SCIM IdP actors the permissions they need on users.\nhas_permission(actor: AuthenticatedActor, "read", silo_user: SiloUser)\n if actor.is_scim_idp and silo_user.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "create_child", silo_user_list: SiloUserList)\n\tif actor.is_scim_idp and silo_user_list.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "modify", silo_user: SiloUser)\n\tif actor.is_scim_idp and silo_user.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "list_children", silo_user_list: SiloUserList)\n if actor.is_scim_idp and silo_user_list.silo in actor.silo;\n\n# Describes the policy for creating and managing Silo groups (mostly intended\n# for API-managed groups)\nresource SiloGroupList {\n\tpermissions = [ "list_children", "create_child" ];\n\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Everyone who can read the Silo (which includes all the groups in the\n\t# Silo) can see the groups in it.\n\t"list_children" if "read" on "parent_silo";\n\n\t# Fleet and Silo administrators can manage the Silo's groups. This is\n\t# one of the only areas of Silo configuration that Fleet Administrators\n\t# have permissions on. This is also one of the few cases (so far) where\n\t# we need to look two levels up the hierarchy to see if somebody has the\n\t# right permission. For most other things, permissions cascade down the\n\t# hierarchy so we only need to look at the parent.\n\t"create_child" if "admin" on "parent_silo";\n\t"list_children" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", collection: SiloGroupList)\n\tif collection.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: SiloGroupList)\n\tif collection.silo.fleet = fleet;\n\n# Grant SCIM IdP actors the permissions they need on groups.\nhas_permission(actor: AuthenticatedActor, "read", silo_group: SiloGroup)\n if actor.is_scim_idp and silo_group.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "create_child", silo_group_list: SiloGroupList)\n\tif actor.is_scim_idp and silo_group_list.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "modify", silo_group: SiloGroup)\n\tif actor.is_scim_idp and silo_group.silo in actor.silo;\nhas_permission(actor: AuthenticatedActor, "list_children", silo_group_list: SiloGroupList)\n if actor.is_scim_idp and silo_group_list.silo in actor.silo;\n\n# These rules grants the external authenticator role the permissions it needs to\n# read silo users and modify their sessions. This is necessary for login to\n# work.\nhas_permission(actor: AuthenticatedActor, "read", silo: Silo)\n\tif has_role(actor, "external-authenticator", silo.fleet);\nhas_permission(actor: AuthenticatedActor, "read", user: SiloUser)\n\tif has_role(actor, "external-authenticator", user.silo.fleet);\nhas_permission(actor: AuthenticatedActor, "modify", user: SiloUser)\n\tif has_role(actor, "external-authenticator", user.silo.fleet);\nhas_permission(actor: AuthenticatedActor, "read", group: SiloGroup)\n\tif has_role(actor, "external-authenticator", group.silo.fleet);\nhas_permission(actor: AuthenticatedActor, "modify", group: SiloGroup)\n\tif has_role(actor, "external-authenticator", group.silo.fleet);\n\nhas_permission(actor: AuthenticatedActor, "read", session: ConsoleSession)\n\tif has_role(actor, "external-authenticator", session.fleet);\nhas_permission(actor: AuthenticatedActor, "modify", session: ConsoleSession)\n\tif has_role(actor, "external-authenticator", session.fleet);\n\n# All authenticated users can read and delete device authn requests because\n# by necessity these operations happen before we've figured out what user (or\n# even Silo) the device auth is associated with. Any user can claim a device\n# auth request with the right user code (that's how it works) -- it's the user\n# code and associated logic that prevents unauthorized access here.\nhas_permission(actor: AuthenticatedActor, "read", _device_auth: DeviceAuthRequest)\n if actor.is_user;\nhas_permission(actor: AuthenticatedActor, "modify", _device_auth: DeviceAuthRequest)\n if actor.is_user;\n\nhas_permission(actor: AuthenticatedActor, "read", device_token: DeviceAccessToken)\n\tif has_role(actor, "external-authenticator", device_token.fleet);\n\nhas_permission(actor: AuthenticatedActor, "read", identity_provider: IdentityProvider)\n\tif has_role(actor, "external-authenticator", identity_provider.silo.fleet);\n\nhas_permission(actor: AuthenticatedActor, "read", saml_identity_provider: SamlIdentityProvider)\n\tif has_role(actor, "external-authenticator", saml_identity_provider.silo.fleet);\n\n# Describes the policy for who can access the internal database.\nresource Database {\n\tpermissions = [\n\t # "query" is required to perform any query against the database,\n\t # whether a read or write query. This is checked when an operation\n\t # checks out a database connection from the connection pool.\n\t #\n\t # Any authenticated user gets this permission. There's generally\n\t # some other authz check involved in the database query. For\n\t # example, if you're querying the database to "read" a "Project", we\n\t # should also be checking that. So why do we do this at all? It's\n\t # a belt-and-suspenders measure so that if we somehow introduced an\n\t # unauthenticated code path that hits the database, it cannot be\n\t # used to DoS the database because we won't allow the operation to\n\t # make the query. (As long as the code path _is_ authenticated, we\n\t # can use throttling mechanisms to prevent DoS.)\n\t "query",\n\n\t # "modify" is required to populate database data that's delivered\n\t # with the system. It should also be required for schema changes,\n\t # when we support those. This is separate from "query" so that we\n\t # cannot accidentally invoke these code paths from API calls and\n\t # other general functions.\n\t "modify"\n\t];\n}\n\n# All authenticated users have the "query" permission on the database.\nhas_permission(_actor: AuthenticatedActor, "query", _resource: Database);\n\n# The "db-init" user is the only one with the "modify" permission.\nhas_permission(USER_DB_INIT: AuthenticatedActor, "modify", _resource: Database);\nhas_permission(USER_DB_INIT: AuthenticatedActor, "create_child", _resource: IpPoolList);\n# It also has "admin" on the internal silo to populate it with built-in resources.\n# TODO-completeness: actually limit to just internal silo and not all silos\nhas_role(USER_DB_INIT: AuthenticatedActor, "admin", _silo: Silo);\n\n# Allow the internal API admin permissions on all silos.\nhas_role(USER_INTERNAL_API: AuthenticatedActor, "admin", _silo: Silo);\n\nresource WebhookSecret {\n\tpermissions = [ "read", "modify" ];\n\trelations = { parent_alert_receiver: AlertReceiver };\n\n\t"read" if "read" on "parent_alert_receiver";\n\t"modify" if "modify" on "parent_alert_receiver";\n}\n\nhas_relation(rx: AlertReceiver, "parent_alert_receiver", secret: WebhookSecret)\n\tif secret.alert_receiver = rx;\n\nresource AlertClassList {\n\tpermissions = [ "list_children" ];\n\trelations = { parent_fleet: Fleet };\n\n\t"list_children" if "viewer" on "parent_fleet";\n}\n\nhas_relation(fleet: Fleet, "parent_fleet", collection: AlertClassList)\n\tif collection.fleet = fleet;\n\nresource ScimClientBearerTokenList {\n\tpermissions = [ "create_child", "list_children" ];\n\trelations = { parent_silo: Silo, parent_fleet: Fleet };\n\n\t# Silo-level roles grant privileges for SCIM client tokens.\n # These are all admin because being able to create these tokens would allow\n # a user to grant themselves admin by modifying group membership through SCIM calls\n\t"create_child" if "admin" on "parent_silo";\n\t"list_children" if "admin" on "parent_silo";\n\n # Fleet-level roles also grant privileges for SCIM client tokens, for\n # configuration before silo admins are present.\n\t"create_child" if "admin" on "parent_fleet";\n\t"list_children" if "admin" on "parent_fleet";\n}\nhas_relation(silo: Silo, "parent_silo", scim_client_bearer_token_list: ScimClientBearerTokenList)\n\tif scim_client_bearer_token_list.silo = silo;\nhas_relation(fleet: Fleet, "parent_fleet", collection: ScimClientBearerTokenList)\n\tif collection.silo.fleet = fleet;\n\n# VpcList is a synthetic resource for controlling VPC creation.\n# Unlike other project resources, VPC creation requires the full "collaborator"\n# role rather than "limited-collaborator", enforcing the networking restriction.\n# This allows organizations to restrict who can reconfigure the network topology\n# while still allowing users with limited-collaborator to work with compute\n# resources (instances, disks, etc.) within the existing network.\nresource VpcList {\n\tpermissions = [ "list_children", "create_child" ];\n\n\trelations = { containing_project: Project };\n\n\t"list_children" if "read" on "containing_project";\n\t"create_child" if "collaborator" on "containing_project";\n}\nhas_relation(project: Project, "containing_project", collection: VpcList)\n\tif collection.project = project;\n\n# Describes the policy for accessing "/v1/system/subnet-pools" in the API\nresource SubnetPoolList {\n\tpermissions = [\n\t "list_children",\n\t "modify",\n\t "create_child",\n\t];\n\n\t# Fleet Administrators can create or modify the Subnet Pools list.\n\trelations = { parent_fleet: Fleet };\n\t"modify" if "admin" on "parent_fleet";\n\t"create_child" if "admin" on "parent_fleet";\n\n\t# Fleet Viewers can list External Subnet Pools\n\t"list_children" if "viewer" on "parent_fleet";\n}\nhas_relation(fleet: Fleet, "parent_fleet", subnet_pool_list: SubnetPoolList)\n\tif subnet_pool_list.fleet = fleet;\n\n\n\n resource Disk {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: Disk)\n if child.project = parent;\n \n\n resource Snapshot {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: Snapshot)\n if child.project = parent;\n \n\n resource ProjectImage {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: ProjectImage)\n if child.project = parent;\n \n\n resource AffinityGroup {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: AffinityGroup)\n if child.project = parent;\n \n\n resource AntiAffinityGroup {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: AntiAffinityGroup)\n if child.project = parent;\n \n\n resource Instance {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: Instance)\n if child.project = parent;\n \n\n resource IpPool {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: IpPool)\n if child.fleet = fleet;\n \n\n resource InstanceNetworkInterface {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: Instance\n };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: InstanceNetworkInterface)\n if has_relation(project, "containing_project", child.instance);\n\n has_relation(parent: Instance, "parent", child: InstanceNetworkInterface)\n if child.instance = parent;\n \n\n resource Vpc {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: Vpc)\n if child.project = parent;\n \n\n resource VpcRouter {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: Vpc\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: VpcRouter)\n if has_relation(project, "containing_project", child.vpc);\n\n has_relation(parent: Vpc, "parent", child: VpcRouter)\n if child.vpc = parent;\n \n\n resource InternetGateway {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: Vpc\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: InternetGateway)\n if has_relation(project, "containing_project", child.vpc);\n\n has_relation(parent: Vpc, "parent", child: InternetGateway)\n if child.vpc = parent;\n \n\n resource InternetGatewayIpPool {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: InternetGateway\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: InternetGatewayIpPool)\n if has_relation(project, "containing_project", child.internet_gateway);\n\n has_relation(parent: InternetGateway, "parent", child: InternetGatewayIpPool)\n if child.internet_gateway = parent;\n \n\n resource InternetGatewayIpAddress {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: InternetGateway\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: InternetGatewayIpAddress)\n if has_relation(project, "containing_project", child.internet_gateway);\n\n has_relation(parent: InternetGateway, "parent", child: InternetGatewayIpAddress)\n if child.internet_gateway = parent;\n \n\n resource RouterRoute {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: VpcRouter\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: RouterRoute)\n if has_relation(project, "containing_project", child.vpc_router);\n\n has_relation(parent: VpcRouter, "parent", child: RouterRoute)\n if child.vpc_router = parent;\n \n\n resource VpcSubnet {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = {\n containing_project: Project,\n parent: Vpc\n };\n\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(project: Project, "containing_project", child: VpcSubnet)\n if has_relation(project, "containing_project", child.vpc);\n\n has_relation(parent: Vpc, "parent", child: VpcSubnet)\n if child.vpc = parent;\n \n\n resource FloatingIp {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "limited-collaborator" on "containing_project";\n "create_child" if "limited-collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: FloatingIp)\n if child.project = parent;\n \n\n resource ExternalSubnet {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_project: Project };\n "list_children" if "viewer" on "containing_project";\n "read" if "viewer" on "containing_project";\n "modify" if "collaborator" on "containing_project";\n "create_child" if "collaborator" on "containing_project";\n }\n\n has_relation(parent: Project, "containing_project", child: ExternalSubnet)\n if child.project = parent;\n \n\n resource Image {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_silo: Silo };\n "list_children" if "viewer" on "containing_silo";\n "read" if "viewer" on "containing_silo";\n "modify" if "collaborator" on "containing_silo";\n "create_child" if "collaborator" on "containing_silo";\n }\n\n has_relation(parent: Silo, "containing_silo", child: Image)\n if child.silo = parent;\n \n\n resource SiloImage {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n\n relations = { containing_silo: Silo };\n "list_children" if "viewer" on "containing_silo";\n "read" if "viewer" on "containing_silo";\n "modify" if "collaborator" on "containing_silo";\n "create_child" if "collaborator" on "containing_silo";\n }\n\n has_relation(parent: Silo, "containing_silo", child: SiloImage)\n if child.silo = parent;\n \n\n resource AddressLot {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: AddressLot)\n if child.fleet = fleet;\n \n\n resource Blueprint {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Blueprint)\n if child.fleet = fleet;\n \n\n resource LoopbackAddress {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: LoopbackAddress)\n if child.fleet = fleet;\n \n\n\n resource ConsoleSession {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: ConsoleSession)\n if child.fleet = fleet;\n \n\n resource DeviceAuthRequest {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: DeviceAuthRequest)\n if child.fleet = fleet;\n \n\n resource DeviceAccessToken {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: DeviceAccessToken)\n if child.fleet = fleet;\n \n\n resource PhysicalDisk {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: PhysicalDisk)\n if child.fleet = fleet;\n \n\n resource Rack {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Rack)\n if child.fleet = fleet;\n \n\n\n\n\n\n resource SupportBundle {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: SupportBundle)\n if child.fleet = fleet;\n \n\n\n\n resource Sled {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Sled)\n if child.fleet = fleet;\n \n\n resource SubnetPool {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: SubnetPool)\n if child.fleet = fleet;\n \n\n resource TufRepo {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: TufRepo)\n if child.fleet = fleet;\n \n\n resource TufArtifact {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: TufArtifact)\n if child.fleet = fleet;\n \n\n resource TufTrustRoot {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: TufTrustRoot)\n if child.fleet = fleet;\n \n\n resource Alert {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Alert)\n if child.fleet = fleet;\n \n\n resource AlertReceiver {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: AlertReceiver)\n if child.fleet = fleet;\n \n\n\n resource Zpool {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Zpool)\n if child.fleet = fleet;\n \n\n resource Service {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: Service)\n if child.fleet = fleet;\n \n\n resource UserBuiltin {\n permissions = [\n "list_children",\n "modify",\n "read",\n "create_child",\n ];\n \n relations = { parent_fleet: Fleet };\n "list_children" if "viewer" on "parent_fleet";\n "read" if "viewer" on "parent_fleet";\n "modify" if "admin" on "parent_fleet";\n "create_child" if "admin" on "parent_fleet";\n }\n has_relation(fleet: Fleet, "parent_fleet", child: UserBuiltin)\n if child.fleet = fleet;\n \n\n
1122026-01-27T01:14:06.316ZINFOtest_event_delivery (ServerContext): Setting up resolver using DNS address: [::1]:50749
1132026-01-27T01:14:06.316ZINFOtest_event_delivery (DnsResolver): new DNS resolver addresses = [[::1]:50749]
1142026-01-27T01:14:06.317ZINFOtest_event_delivery (ServerContext): Setting up qorb database pool from a single host url = PostgresConfigWithUrl {\n url_raw: "postgresql://root@[::1]:55261/omicron?sslmode=disable",\n config: Config {\n user: Some(\n "root",\n ),\n password: None,\n dbname: Some(\n "omicron",\n ),\n options: None,\n application_name: None,\n ssl_mode: Disable,\n host: [\n Tcp(\n "::1",\n ),\n ],\n hostaddr: [],\n port: [\n 55261,\n ],\n connect_timeout: None,\n tcp_user_timeout: None,\n keepalives: true,\n keepalives_idle: 7200s,\n keepalives_interval: None,\n keepalives_retries: None,\n target_session_attrs: Any,\n channel_binding: Prefer,\n load_balance_hosts: Disable,\n },\n}
1152026-01-27T01:14:06.322ZDEBGtest_event_delivery (ServerContext): registered USDT probes
1162026-01-27T01:14:07.976ZINFOtest_event_delivery (datastore): Database schema version is up to date desired_version = 225.0.0 found_version = 225.0.0
1172026-01-27T01:14:07.997ZWARNtest_event_delivery (datastore): No db_metadata_nexus records exist - skipping access check explanation = This is expected during initial deployment or before migration nexus_id = 913233fe-92a8-4635-9572-183f495429c4 (omicron_zone)
1182026-01-27T01:14:07.997ZINFOtest_event_delivery (nexus): Datastore is ready for usage
1192026-01-27T01:14:08.116ZDEBGtest_event_delivery (clickhouse-client): registered USDT probes id = 93304a1c-c37b-40d0-a181-75e368d9dac9
1202026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /crucible/0/upstairs/{upstairs_id}/downstairs/{downstairs_id}/stop-request versions = all
1212026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /crucible/0/upstairs/{upstairs_id}/downstairs/{downstairs_id}/stopped versions = all
1222026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /crucible/0/upstairs/{upstairs_id}/repair/{repair_id}/progress versions = all
1232026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /crucible/0/upstairs/{upstairs_id}/repair-finish versions = all
1242026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /crucible/0/upstairs/{upstairs_id}/repair-start versions = all
1252026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /disk/{disk_id}/remove-read-only-parent versions = all
1262026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = PUT path = /disks/{disk_id} versions = all
1272026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /metrics/collectors versions = all
1282026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = GET path = /metrics/collectors/{collector_id}/producers versions = all
1292026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /metrics/producers versions = all
1302026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = GET path = /nat/ipv4/changeset/{from_gen} versions = all
1312026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = GET path = /probes/{sled} versions = all
1322026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /refresh-vpc-routes versions = all
1332026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = GET path = /sled-agents/{sled_id} versions = all
1342026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /sled-agents/{sled_id} versions = all
1352026-01-27T01:14:08.196ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = PUT path = /switch/{switch_id} versions = all
1362026-01-27T01:14:08.197ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = GET path = /v1/ping versions = all
1372026-01-27T01:14:08.197ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = PUT path = /vmms/{propolis_id} versions = all
1382026-01-27T01:14:08.197ZDEBGtest_event_delivery (dropshot_internal): registered endpoint local_addr = 127.0.0.1:58210 method = POST path = /volume/{volume_id}/remove-read-only-parent versions = all
1392026-01-27T01:14:08.197ZINFOtest_event_delivery (dropshot_internal): listening local_addr = 127.0.0.1:58210
1402026-01-27T01:14:08.197ZDEBGtest_event_delivery (dropshot_internal): successfully registered DTrace USDT probes local_addr = 127.0.0.1:58210
1412026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /bgtasks versions = all
1422026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /bgtasks/activate versions = all
1432026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /bgtasks/view/{bgtask_name} versions = all
1442026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /clickhouse/policy versions = all
1452026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /clickhouse/policy versions = all
1462026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /debug/fetch-omdb-binary versions = all
1472026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /demo-saga versions = all
1482026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /demo-saga/{demo_saga_id}/complete versions = all
1492026-01-27T01:14:08.202ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/blueprints/all versions = all
1502026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = DELETE path = /deployment/blueprints/all/{blueprint_id} versions = all
1512026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/blueprints/all/{blueprint_id} versions = all
1522026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /deployment/blueprints/import versions = all
1532026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /deployment/blueprints/regenerate versions = all
1542026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/blueprints/target versions = all
1552026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /deployment/blueprints/target versions = all
1562026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = PUT path = /deployment/blueprints/target/enabled versions = all
1572026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/reconfigurator-config versions = all
1582026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /deployment/reconfigurator-config versions = all
1592026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/reconfigurator-config/{version} versions = all
1602026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /deployment/update-status versions = all
1612026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /experimental/v1/system/support-bundles versions = all
1622026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /experimental/v1/system/support-bundles versions = all
1632026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = DELETE path = /experimental/v1/system/support-bundles/{bundle_id} versions = all
1642026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /experimental/v1/system/support-bundles/{bundle_id} versions = all
1652026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = PUT path = /experimental/v1/system/support-bundles/{bundle_id} versions = all
1662026-01-27T01:14:08.203ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /experimental/v1/system/support-bundles/{bundle_id}/download versions = all
1672026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = HEAD path = /experimental/v1/system/support-bundles/{bundle_id}/download versions = all
1682026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /experimental/v1/system/support-bundles/{bundle_id}/download/{file} versions = all
1692026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = HEAD path = /experimental/v1/system/support-bundles/{bundle_id}/download/{file} versions = all
1702026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /experimental/v1/system/support-bundles/{bundle_id}/index versions = all
1712026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /instances/{instance_id}/migrate versions = all
1722026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /mgs-updates versions = all
1732026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /oximeter/read-policy versions = all
1742026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /oximeter/read-policy versions = all
1752026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /physical-disk/expunge versions = all
1762026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /quiesce versions = all
1772026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /quiesce versions = all
1782026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = PUT path = /racks/{rack_id}/initialization-complete versions = all
1792026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /sagas versions = all
1802026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /sagas/{saga_id} versions = all
1812026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /sleds/add versions = all
1822026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = POST path = /sleds/expunge versions = all
1832026-01-27T01:14:08.204ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /sleds/uninitialized versions = all
1842026-01-27T01:14:08.205ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /trust-quorum/{rack_id}/config/latest versions = all
1852026-01-27T01:14:08.205ZDEBGtest_event_delivery (dropshot_lockstep): registered endpoint local_addr = 127.0.0.1:42623 method = GET path = /v1/ping versions = all
1862026-01-27T01:14:08.205ZINFOtest_event_delivery (dropshot_lockstep): listening local_addr = 127.0.0.1:42623
1872026-01-27T01:14:08.205ZDEBGtest_event_delivery (dropshot_lockstep): successfully registered DTrace USDT probes local_addr = 127.0.0.1:42623
1882026-01-27T01:14:08.205ZINFOtest_event_delivery (SEC): SEC running sec_id = 913233fe-92a8-4635-9572-183f495429c4
1892026-01-27T01:14:08.206ZTRACtest_event_delivery (DataLoader): authorize begin action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
1902026-01-27T01:14:08.206ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
1912026-01-27T01:14:08.210ZDEBGtest_event_delivery (DataLoader): authorize result action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
1922026-01-27T01:14:08.210ZDEBGtest_event_delivery (DataLoader): attempting to create built-in users
1932026-01-27T01:14:08.212ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
1942026-01-27T01:14:08.212ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
1952026-01-27T01:14:08.213ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
1962026-01-27T01:14:08.464ZINFOtest_event_delivery (MgsUpdateDriver): starting MgsUpdateDriver
1972026-01-27T01:14:08.474ZTRACtest_event_delivery (dns): buffer buffer = Length: 67 (0x43) bytes\n0000: 19 71 01 00 00 01 00 00 00 00 00 01 04 5f 6d 67 .q..........._mg\n0010: 73 04 5f 74 63 70 0d 63 6f 6e 74 72 6f 6c 2d 70 s._tcp.control-p\n0020: 6c 61 6e 65 05 6f 78 69 64 65 08 69 6e 74 65 72 lane.oxide.inter\n0030: 6e 61 6c 00 00 21 00 01 00 00 29 04 d0 00 00 00 nal..!....).....\n0040: 00 00 00 ... kind = dns peer_addr = [::1]:63323 req_id = 46d9764c-0016-4ea7-adc6-343f101915c8
1982026-01-27T01:14:08.475ZDEBGtest_event_delivery (dns): message_request kind = dns mr = MessageRequest {\n header: Header {\n id: 6513,\n message_type: Query,\n op_code: Query,\n authoritative: false,\n truncation: false,\n recursion_desired: true,\n recursion_available: false,\n authentic_data: false,\n checking_disabled: false,\n response_code: NoError,\n query_count: 1,\n answer_count: 0,\n name_server_count: 0,\n additional_count: 1,\n },\n queries: Queries {\n queries: [\n LowerQuery {\n name: LowerName(\n Name("_mgs._tcp.control-plane.oxide.internal."),\n ),\n original: Query {\n name: Name("_mgs._tcp.control-plane.oxide.internal."),\n query_type: SRV,\n query_class: IN,\n },\n },\n ],\n original: [\n 4,\n 95,\n 109,\n 103,\n 115,\n 4,\n 95,\n 116,\n 99,\n 112,\n 13,\n 99,\n 111,\n 110,\n 116,\n 114,\n 111,\n 108,\n 45,\n 112,\n 108,\n 97,\n 110,\n 101,\n 5,\n 111,\n 120,\n 105,\n 100,\n 101,\n 8,\n 105,\n 110,\n 116,\n 101,\n 114,\n 110,\n 97,\n 108,\n 0,\n 0,\n 33,\n 0,\n 1,\n ],\n },\n answers: [],\n name_servers: [],\n additionals: [],\n sig0: [],\n edns: Some(\n Edns {\n rcode_high: 0,\n version: 0,\n flags: EdnsFlags {\n dnssec_ok: false,\n z: 0,\n },\n max_payload: 1232,\n options: OPT {\n options: [],\n },\n },\n ),\n} peer_addr = [::1]:63323 req_id = 46d9764c-0016-4ea7-adc6-343f101915c8
1992026-01-27T01:14:08.476ZERROtest_event_delivery (dns): failed to handle incoming DNS message: MessageRequest { header: Header { id: 6513, message_type: Query, op_code: Query, authoritative: false, truncation: false, recursion_desired: true, recursion_available: false, authentic_data: false, checking_disabled: false, response_code: NoError, query_count: 1, answer_count: 0, name_server_count: 0, additional_count: 1, }, queries: Queries { queries: [ LowerQuery { name: LowerName( Name("_mgs._tcp.control-plane.oxide.internal."), ), original: Query { name: Name("_mgs._tcp.control-plane.oxide.internal."), query_type: SRV, query_class: IN, }, }, ], original: [ 4, 95, 109, 103, 115, 4, 95, 116, 99, 112, 13, 99, 111, 110, 116, 114, 111, 108, 45, 112, 108, 97, 110, 101, 5, 111, 120, 105, 100, 101, 8, 105, 110, 116, 101, 114, 110, 97, 108, 0, 0, 33, 0, 1, ], }, answers: [], name_servers: [], additionals: [], sig0: [], edns: Some( Edns { rcode_high: 0, version: 0, flags: EdnsFlags { dnssec_ok: false, z: 0, }, max_payload: 1232, options: OPT { options: [], }, }, ), } SERVFAIL: server is not authoritative for name: "_mgs._tcp.control-plane.oxide.internal." kind = dns peer_addr = [::1]:63323 req_id = 46d9764c-0016-4ea7-adc6-343f101915c8
2002026-01-27T01:14:08.477ZTRACtest_event_delivery (dns): buffer buffer = Length: 74 (0x4a) bytes\n0000: 0a 54 01 00 00 01 00 00 00 00 00 01 0b 5f 72 65 .T..........._re\n0010: 70 6f 2d 64 65 70 6f 74 04 5f 74 63 70 0d 63 6f po-depot._tcp.co\n0020: 6e 74 72 6f 6c 2d 70 6c 61 6e 65 05 6f 78 69 64 ntrol-plane.oxid\n0030: 65 08 69 6e 74 65 72 6e 61 6c 00 00 21 00 01 00 e.internal..!...\n0040: 00 29 04 d0 00 00 00 00 00 00 .)........ kind = dns peer_addr = [::1]:63731 req_id = 54f89615-d818-410a-a8ba-603d7ed3e388
2012026-01-27T01:14:08.477ZDEBGtest_event_delivery (dns): message_request kind = dns mr = MessageRequest {\n header: Header {\n id: 2644,\n message_type: Query,\n op_code: Query,\n authoritative: false,\n truncation: false,\n recursion_desired: true,\n recursion_available: false,\n authentic_data: false,\n checking_disabled: false,\n response_code: NoError,\n query_count: 1,\n answer_count: 0,\n name_server_count: 0,\n additional_count: 1,\n },\n queries: Queries {\n queries: [\n LowerQuery {\n name: LowerName(\n Name("_repo-depot._tcp.control-plane.oxide.internal."),\n ),\n original: Query {\n name: Name("_repo-depot._tcp.control-plane.oxide.internal."),\n query_type: SRV,\n query_class: IN,\n },\n },\n ],\n original: [\n 11,\n 95,\n 114,\n 101,\n 112,\n 111,\n 45,\n 100,\n 101,\n 112,\n 111,\n 116,\n 4,\n 95,\n 116,\n 99,\n 112,\n 13,\n 99,\n 111,\n 110,\n 116,\n 114,\n 111,\n 108,\n 45,\n 112,\n 108,\n 97,\n 110,\n 101,\n 5,\n 111,\n 120,\n 105,\n 100,\n 101,\n 8,\n 105,\n 110,\n 116,\n 101,\n 114,\n 110,\n 97,\n 108,\n 0,\n 0,\n 33,\n 0,\n 1,\n ],\n },\n answers: [],\n name_servers: [],\n additionals: [],\n sig0: [],\n edns: Some(\n Edns {\n rcode_high: 0,\n version: 0,\n flags: EdnsFlags {\n dnssec_ok: false,\n z: 0,\n },\n max_payload: 1232,\n options: OPT {\n options: [],\n },\n },\n ),\n} peer_addr = [::1]:63731 req_id = 54f89615-d818-410a-a8ba-603d7ed3e388
2022026-01-27T01:14:08.478ZERROtest_event_delivery (dns): failed to handle incoming DNS message: MessageRequest { header: Header { id: 2644, message_type: Query, op_code: Query, authoritative: false, truncation: false, recursion_desired: true, recursion_available: false, authentic_data: false, checking_disabled: false, response_code: NoError, query_count: 1, answer_count: 0, name_server_count: 0, additional_count: 1, }, queries: Queries { queries: [ LowerQuery { name: LowerName( Name("_repo-depot._tcp.control-plane.oxide.internal."), ), original: Query { name: Name("_repo-depot._tcp.control-plane.oxide.internal."), query_type: SRV, query_class: IN, }, }, ], original: [ 11, 95, 114, 101, 112, 111, 45, 100, 101, 112, 111, 116, 4, 95, 116, 99, 112, 13, 99, 111, 110, 116, 114, 111, 108, 45, 112, 108, 97, 110, 101, 5, 111, 120, 105, 100, 101, 8, 105, 110, 116, 101, 114, 110, 97, 108, 0, 0, 33, 0, 1, ], }, answers: [], name_servers: [], additionals: [], sig0: [], edns: Some( Edns { rcode_high: 0, version: 0, flags: EdnsFlags { dnssec_ok: false, z: 0, }, max_payload: 1232, options: OPT { options: [], }, }, ), } SERVFAIL: server is not authoritative for name: "_repo-depot._tcp.control-plane.oxide.internal." kind = dns peer_addr = [::1]:63731 req_id = 54f89615-d818-410a-a8ba-603d7ed3e388
2032026-01-27T01:14:08.478ZTRACtest_event_delivery (dns): buffer buffer = Length: 79 (0x4f) bytes\n0000: 3c 29 01 00 00 01 00 00 00 00 00 01 10 5f 63 72 <)..........._cr\n0010: 75 63 69 62 6c 65 2d 70 61 6e 74 72 79 04 5f 74 ucible-pantry._t\n0020: 63 70 0d 63 6f 6e 74 72 6f 6c 2d 70 6c 61 6e 65 cp.control-plane\n0030: 05 6f 78 69 64 65 08 69 6e 74 65 72 6e 61 6c 00 .oxide.internal.\n0040: 00 21 00 01 00 00 29 04 d0 00 00 00 00 00 00 .!....)........ kind = dns peer_addr = [::1]:55140 req_id = 20f65856-97a3-4a88-825f-a7b518347e5d
2042026-01-27T01:14:08.478ZDEBGtest_event_delivery (dns): message_request kind = dns mr = MessageRequest {\n header: Header {\n id: 15401,\n message_type: Query,\n op_code: Query,\n authoritative: false,\n truncation: false,\n recursion_desired: true,\n recursion_available: false,\n authentic_data: false,\n checking_disabled: false,\n response_code: NoError,\n query_count: 1,\n answer_count: 0,\n name_server_count: 0,\n additional_count: 1,\n },\n queries: Queries {\n queries: [\n LowerQuery {\n name: LowerName(\n Name("_crucible-pantry._tcp.control-plane.oxide.internal."),\n ),\n original: Query {\n name: Name("_crucible-pantry._tcp.control-plane.oxide.internal."),\n query_type: SRV,\n query_class: IN,\n },\n },\n ],\n original: [\n 16,\n 95,\n 99,\n 114,\n 117,\n 99,\n 105,\n 98,\n 108,\n 101,\n 45,\n 112,\n 97,\n 110,\n 116,\n 114,\n 121,\n 4,\n 95,\n 116,\n 99,\n 112,\n 13,\n 99,\n 111,\n 110,\n 116,\n 114,\n 111,\n 108,\n 45,\n 112,\n 108,\n 97,\n 110,\n 101,\n 5,\n 111,\n 120,\n 105,\n 100,\n 101,\n 8,\n 105,\n 110,\n 116,\n 101,\n 114,\n 110,\n 97,\n 108,\n 0,\n 0,\n 33,\n 0,\n 1,\n ],\n },\n answers: [],\n name_servers: [],\n additionals: [],\n sig0: [],\n edns: Some(\n Edns {\n rcode_high: 0,\n version: 0,\n flags: EdnsFlags {\n dnssec_ok: false,\n z: 0,\n },\n max_payload: 1232,\n options: OPT {\n options: [],\n },\n },\n ),\n} peer_addr = [::1]:55140 req_id = 20f65856-97a3-4a88-825f-a7b518347e5d
2052026-01-27T01:14:08.479ZERROtest_event_delivery (dns): failed to handle incoming DNS message: MessageRequest { header: Header { id: 15401, message_type: Query, op_code: Query, authoritative: false, truncation: false, recursion_desired: true, recursion_available: false, authentic_data: false, checking_disabled: false, response_code: NoError, query_count: 1, answer_count: 0, name_server_count: 0, additional_count: 1, }, queries: Queries { queries: [ LowerQuery { name: LowerName( Name("_crucible-pantry._tcp.control-plane.oxide.internal."), ), original: Query { name: Name("_crucible-pantry._tcp.control-plane.oxide.internal."), query_type: SRV, query_class: IN, }, }, ], original: [ 16, 95, 99, 114, 117, 99, 105, 98, 108, 101, 45, 112, 97, 110, 116, 114, 121, 4, 95, 116, 99, 112, 13, 99, 111, 110, 116, 114, 111, 108, 45, 112, 108, 97, 110, 101, 5, 111, 120, 105, 100, 101, 8, 105, 110, 116, 101, 114, 110, 97, 108, 0, 0, 33, 0, 1, ], }, answers: [], name_servers: [], additionals: [], sig0: [], edns: Some( Edns { rcode_high: 0, version: 0, flags: EdnsFlags { dnssec_ok: false, z: 0, }, max_payload: 1232, options: OPT { options: [], }, }, ), } SERVFAIL: server is not authoritative for name: "_crucible-pantry._tcp.control-plane.oxide.internal." kind = dns peer_addr = [::1]:55140 req_id = 20f65856-97a3-4a88-825f-a7b518347e5d
2062026-01-27T01:14:08.484ZINFOtest_event_delivery (DataLoader): created 5 built-in users
2072026-01-27T01:14:08.484ZTRACtest_event_delivery (DataLoader): authorize begin action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2082026-01-27T01:14:08.484ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2092026-01-27T01:14:08.488ZDEBGtest_event_delivery (DataLoader): authorize result action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2102026-01-27T01:14:08.488ZDEBGtest_event_delivery (DataLoader): attempting to create built-in role assignments
2112026-01-27T01:14:08.488ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2122026-01-27T01:14:08.488ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2132026-01-27T01:14:08.489ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2142026-01-27T01:14:08.868ZINFOtest_event_delivery (DataLoader): created 4 built-in role assignments
2152026-01-27T01:14:08.868ZTRACtest_event_delivery (DataLoader): authorize begin action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2162026-01-27T01:14:08.868ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2172026-01-27T01:14:08.871ZDEBGtest_event_delivery (DataLoader): authorize result action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2182026-01-27T01:14:08.871ZDEBGtest_event_delivery (DataLoader): attempting to create built-in silos
2192026-01-27T01:14:08.872ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2202026-01-27T01:14:08.872ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2212026-01-27T01:14:08.872ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2222026-01-27T01:14:09.013ZINFOtest_event_delivery (DataLoader): created 2 built-in silos
2232026-01-27T01:14:09.013ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2242026-01-27T01:14:09.014ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2252026-01-27T01:14:09.014ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2262026-01-27T01:14:09.030ZTRACtest_event_delivery (DataLoader): authorize begin action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2272026-01-27T01:14:09.031ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2282026-01-27T01:14:09.033ZDEBGtest_event_delivery (DataLoader): authorize result action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2292026-01-27T01:14:09.033ZDEBGtest_event_delivery (DataLoader): attempting to create built-in projects
2302026-01-27T01:14:09.033ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2312026-01-27T01:14:09.033ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2322026-01-27T01:14:09.035ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2332026-01-27T01:14:09.057ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }
2342026-01-27T01:14:09.057ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
2352026-01-27T01:14:09.057ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2362026-01-27T01:14:09.058ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2372026-01-27T01:14:09.064ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2382026-01-27T01:14:09.173ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
2392026-01-27T01:14:09.174ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2402026-01-27T01:14:09.174ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2412026-01-27T01:14:09.175ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2422026-01-27T01:14:09.185ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2432026-01-27T01:14:09.195ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) } result = Ok(())
2442026-01-27T01:14:09.196ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }
2452026-01-27T01:14:09.196ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
2462026-01-27T01:14:09.196ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2472026-01-27T01:14:09.196ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2482026-01-27T01:14:09.197ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2492026-01-27T01:14:09.204ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
2502026-01-27T01:14:09.204ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2512026-01-27T01:14:09.204ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2522026-01-27T01:14:09.207ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2532026-01-27T01:14:09.213ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2542026-01-27T01:14:09.219ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) } result = Ok(())
2552026-01-27T01:14:09.219ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2562026-01-27T01:14:09.220ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2572026-01-27T01:14:09.220ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2582026-01-27T01:14:09.266ZINFOtest_event_delivery (DataLoader): created built-in services project
2592026-01-27T01:14:09.267ZTRACtest_event_delivery (DataLoader): authorize begin action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2602026-01-27T01:14:09.267ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2612026-01-27T01:14:09.270ZDEBGtest_event_delivery (DataLoader): authorize result action = Modify actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2622026-01-27T01:14:09.270ZDEBGtest_event_delivery (DataLoader): attempting to create built-in VPCs
2632026-01-27T01:14:09.270ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2642026-01-27T01:14:09.271ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2652026-01-27T01:14:09.271ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2662026-01-27T01:14:09.330ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2672026-01-27T01:14:09.330ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2682026-01-27T01:14:09.331ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2692026-01-27T01:14:09.344ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }
2702026-01-27T01:14:09.344ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-4401-4000-8000-000000000000 resource_type = Project
2712026-01-27T01:14:09.345ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2722026-01-27T01:14:09.345ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2732026-01-27T01:14:09.346ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2742026-01-27T01:14:09.395ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
2752026-01-27T01:14:09.395ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2762026-01-27T01:14:09.395ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2772026-01-27T01:14:09.396ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2782026-01-27T01:14:09.401ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
2792026-01-27T01:14:09.401ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2802026-01-27T01:14:09.401ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2812026-01-27T01:14:09.402ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2822026-01-27T01:14:09.424ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2832026-01-27T01:14:09.437ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) } result = Ok(())
2842026-01-27T01:14:09.438ZTRACtest_event_delivery (DataLoader): successful lookup of siloed resource "Project" using built-in user
2852026-01-27T01:14:09.438ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }
2862026-01-27T01:14:09.438ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-4401-4000-8000-000000000000 resource_type = Project
2872026-01-27T01:14:09.438ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2882026-01-27T01:14:09.438ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2892026-01-27T01:14:09.438ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2902026-01-27T01:14:09.457ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
2912026-01-27T01:14:09.457ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2922026-01-27T01:14:09.457ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2932026-01-27T01:14:09.458ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2942026-01-27T01:14:09.463ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
2952026-01-27T01:14:09.463ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
2962026-01-27T01:14:09.464ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2972026-01-27T01:14:09.464ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
2982026-01-27T01:14:09.470ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
2992026-01-27T01:14:09.503ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) } result = Ok(())
3002026-01-27T01:14:09.503ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3012026-01-27T01:14:09.503ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3022026-01-27T01:14:09.503ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3032026-01-27T01:14:09.522ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Vpc { parent: Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }, key: 001de000-074c-4000-8000-000000000000, lookup_type: ByName("oxide-services") }
3042026-01-27T01:14:09.522ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-4401-4000-8000-000000000000 resource_type = Project
3052026-01-27T01:14:09.522ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3062026-01-27T01:14:09.522ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3072026-01-27T01:14:09.532ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3082026-01-27T01:14:09.543ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
3092026-01-27T01:14:09.543ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3102026-01-27T01:14:09.543ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3112026-01-27T01:14:09.544ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3122026-01-27T01:14:09.558ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
3132026-01-27T01:14:09.574ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3142026-01-27T01:14:09.574ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3152026-01-27T01:14:09.574ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3162026-01-27T01:14:09.577ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3172026-01-27T01:14:09.587ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Vpc { parent: Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }, key: 001de000-074c-4000-8000-000000000000, lookup_type: ByName("oxide-services") } result = Ok(())
3182026-01-27T01:14:09.587ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3192026-01-27T01:14:09.587ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3202026-01-27T01:14:09.589ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3212026-01-27T01:14:09.610ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3222026-01-27T01:14:09.610ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3232026-01-27T01:14:09.612ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3242026-01-27T01:14:09.630ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3252026-01-27T01:14:09.630ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3262026-01-27T01:14:09.631ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3272026-01-27T01:14:09.639ZTRACtest_event_delivery (DataLoader): authorize begin action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Vpc { parent: Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }, key: 001de000-074c-4000-8000-000000000000, lookup_type: ByName("oxide-services") }
3282026-01-27T01:14:09.639ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-4401-4000-8000-000000000000 resource_type = Project
3292026-01-27T01:14:09.639ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3302026-01-27T01:14:09.639ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3312026-01-27T01:14:09.640ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3322026-01-27T01:14:09.644ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-5110-4000-8000-000000000001 resource_type = Silo
3332026-01-27T01:14:09.644ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3342026-01-27T01:14:09.644ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3352026-01-27T01:14:09.645ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3362026-01-27T01:14:09.649ZTRACtest_event_delivery (DataLoader): loading roles actor = Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. } resource_id = 001de000-1334-4000-8000-000000000000 resource_type = Fleet
3372026-01-27T01:14:09.650ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3382026-01-27T01:14:09.650ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3392026-01-27T01:14:09.651ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())
3402026-01-27T01:14:09.656ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3412026-01-27T01:14:09.663ZDEBGtest_event_delivery (DataLoader): authorize result action = CreateChild actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Vpc { parent: Project { parent: Silo { parent: Fleet, key: 001de000-5110-4000-8000-000000000001, lookup_type: ById(001de000-5110-4000-8000-000000000001) }, key: 001de000-4401-4000-8000-000000000000, lookup_type: ById(001de000-4401-4000-8000-000000000000) }, key: 001de000-074c-4000-8000-000000000000, lookup_type: ByName("oxide-services") } result = Ok(())
3422026-01-27T01:14:09.664ZTRACtest_event_delivery (DataLoader): authorize begin action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database
3432026-01-27T01:14:09.664ZDEBGtest_event_delivery (DataLoader): roles roles = RoleSet { roles: {} }
3442026-01-27T01:14:09.664ZDEBGtest_event_delivery (DataLoader): authorize result action = Query actor = Some(Actor::UserBuiltin { user_builtin_id: 001de000-05e4-4000-8000-000000000001 (built_in_user), .. }) resource = Database result = Ok(())