[ORC] Split RTBridge Proxy headers by operation family (NFC) (#215467)
Break the monolithic RTBridge/Proxy.h and RTBridge/SPS/ProxySpecs.h into
a core header plus per-family sibling headers, so a client pays only for
the proxy families it uses. In particular Proxy.h no longer pulls in
TargetProcessControlTypes.h -- that was needed only by the memory-access
alias set -- so consumers of the core Proxy class (e.g. clients that
define their own proxies) no longer depend on it transitively.
Layout:
* RTBridge/Proxy.h -- core only: ProxyBase, Proxy, proxyInit,
buildProxies.
* RTBridge/CallProxies.h, RTBridge/MemoryAccessProxies.h -- the named
proxy alias sets.
* RTBridge/SPS/ProxySpec.h -- the SPS ProxySpec template.
* RTBridge/SPS/CallProxySpecs.h, RTBridge/SPS/MemoryAccessProxySpecs.h
-- the SPS signatures, controller-interface names, and specs.
Gate the enterprise apps train through the entitlement engine
This commit adds changes to gate the enterprise application train on its matrix vector instead of product_type. The vector only grants on iX hardware holding the key, so licensed Minis, keyed whiteboxes and HA-capable systems with no license stop having the train pinned for them -- they can still select it by hand, since preferred_trains only filters what app.available browses.
Legacy injection stays enterprise-only on purpose: the vector's community-side key cell is zero, so injecting the key into every legacy license would move a holder from one denying cell to another. The TRUENAS-R check sitting next to the gate was dead as well, because failover.hardware can never return a value with that prefix.
Gate the zfs.tier tests on the ZFSTIER entitlement
This commit fixes an issue where three tests under tests/api2/zfs_tier still called system.is_enterprise after it was removed, so the module scoped pool fixture errored and took the rest of the directory with it. They now ask the engine for ZFSTIER, which is the question zfs.tier.update itself asks.
The old predicate was wrong in both directions anyway. ZFSTIER grants on the two key columns whichever hardware side you are on, so an appliance licensed without the key used to build a six disk pool and then fail, while a CE box whose licence carried the key skipped a test it should have been running.
Fold platform detection into the hardware package
This commit adds changes to move detect_platform into middlewared.utils.hardware and have the classifier consult it first, so the QEMU and bhyve rules live in one place rather than two copies that can drift apart. The function is moved verbatim; MANUAL is not treated as an answer and falls through to the chassis tag, so R-series, Z-series, Minis and whiteboxes classify exactly as they did before.
One population changes: a QEMU virtual machine stamped as an HA node now classifies as IXKVM even when its chassis tag names a Mini, so it lands in the appliance column instead of the Mini one. detect_platform also picks up its first test coverage, having had none.
Key the SNMP sysObjectID off hardware rather than the license
This commit adds changes to derive the sysObjectID suffix from the new hardware identity package instead of system.is_enterprise. sysObjectID is meant to tell a monitoring station what kind of box it is talking to, so a licensing predicate was never the right input - the same physical chassis was advertising a different identity depending on whether a license happened to be installed.
The emitted value changes for some systems: a licensed Mini or whitebox now reports 1 instead of 2, and an unlicensed single-controller iX box reports 2 instead of 1. Physical iX hardware and HA VMs are unaffected. That is observable to anything polling us over SNMP, since a station keys its polling template off this value, so it wants a release note.
Worth noting this file has no test coverage and etc_files is excluded from mypy, so CI says nothing about it. The template was compiled and rendered locally against each hardware class to confirm the polarity and that the OID prefix is unchanged.
Key HA capability off the hardware probe
This commit adds changes to answer system.is_ha_capable and ha_panic's HA check from the cached hardware probe rather than from failover.hardware and a second open-coded MANUAL comparison, so one rule lives in one place. The value is unchanged: both paths read the HARDWARE half of the same cached detect_platform, and the 28 callers of system.is_ha_capable are untouched.
failover.hardware stays for the callers that want the platform codename rather than the boolean.
Let hardware detection failures surface
This commit adds changes to stop swallowing detect_platform exceptions in the hardware probe, so a detector that fails raises instead of degrading to a chassis-only classification. A chassis tag cannot say whether a machine is one half of an HA pair, so answering from it alone invents an answer that was never obtained.
This restores the behaviour every existing caller already has: failover.hardware has reached detect_platform on the boot path for years with no handling of its own.
Flip SED onto its matrix vector
This commit adds changes to bind SED to its product-matrix vector instead of the transitional legacy shim, which was the last live LegacyRule. The shim required the feature key in every column while the matrix grants SED on iX hardware alone and on any licensed system, so this widens access rather than withdrawing it - no existing system loses SED, and no key injection is needed because all four license-present columns already grant.
Worth noting stable/26 gates SED on a v2 daemon license with no legacy fallback, so every legacy-licensed system in the field currently reads as unlicensed for SED even if it bought the bit. This restores those systems.
The LegacyRule kind, its dispatch branch and the legacy module all stay put for whatever needs a shim next; only the SED binding moves. The docstrings that promised to delete them once the last feature flipped have been corrected to match.
Reconcile license derived config when the license changes
This commit adds changes to converge every subsystem whose configuration is derived from the license once that license changes. `truenas.license.upload` regenerated exactly one etc group and then fired `system.post_license_update` detached. That was survivable while gates asked `is_enterprise`, which expanded to `is_ha_capable OR (licence AND model AND not freenas)` -- on appliance hardware the first limb was already true before any license was installed, so those gates did not change their answer when one arrived and never re-rendering them cost nothing. Now that they are feature key checks they do change their answer, and a spread of etc groups were left silently stale until something unrelated regenerated them or the box rebooted. The plainest case is sudoers, where sudo command auditing simply did not turn on when an appliance was licensed.
Each affected subsystem now registers a LicenseReconcileDelegate from its own setup, naming the etc groups it owns and what should happen once they have been re-rendered, and a runner walks the eight of them on the hook. Doing this per plugin rather than centrally in etc matters because the right action differs between them, and not always for the obvious reason. The block target delegates only render, but they still decline to run when their service is stopped, because for nvmet and LIO writing the config is itself the reconfiguration rather than a file something reads later. smb and discovery reload a real daemon. The user delegate reloads a pseudo service that has no daemon behind it at all, so there the reload is simply how the group gets regenerated. And ctdb gets a restart because the presence of its config file is what decides whether the daemon can start. Registration refuses a duplicate name or a group another delegate already claims, so two plugins cannot quietly both own one.
The hook is still fired detached, so the upload itself does not wait on the pass. failover.status is dropped from its cache ahead of it, since a good half of these groups read that while rendering and would otherwise reconcile against the status cached under the old license, and truesearch is registered async so that waiting on its service job cannot hold the other consumers up behind it.
The cron template also goes back to rendering unless failover.status is definitively BACKUP. Keying it on SINGLE or MASTER instead, which is where it had drifted to, meant a transient ELECTING, IMPORTING or ERROR read emptied the whole schedule -- every user cronjob, rsync task, cloud sync, scrub and update check -- with nothing to put it back until the group happened to be regenerated again.
Resolve tier entitlements against their matrix row
This commit adds changes to make TierRule resolve against its product matrix cells instead of ignoring them, so a tier row that grants on one hardware side and not the other actually takes effect. The cell is read before the tier qualifier because the matrix is authoritative and a sufficient tier should not rescue a cell the product never granted. The column also resolves against the feature carrying the tier rather than the policy key, which no license holds, so the key columns had been unreachable.
A tier is read off a feature key and cannot be evaluated without one, so cells outside the two key columns are now rejected at construction instead of being silently ignored. Proactive support's row is corrected to key-only accordingly: the old cells granted it on a license alone with no tier consulted, which only looked right because a missing key was denied before any cell was read. Nothing moves behaviourally, entitled, reason and message are identical in all six columns, and the spreadsheet row still needs the same correction.
Record the detected HA platform on HardwareInfo
This commit adds changes to carry the HARDWARE half of detect_platform through classification onto HardwareInfo, with an is_ha_capable predicate reading MANUAL as "not one half of an HA pair", so that question can be answered off the same cached probe everything else already asks. The field is required rather than defaulted, because the only sensible default is MANUAL and every site that forgot to pass it would silently receive the not-HA-capable answer.
is_ha_capable is deliberately not hardware_class.is_appliance, which is true of every iX appliance including the single-controller ones. Nothing reads the new field yet, so no behaviour moves.
Split get_facts out of get_entitlement
This commit adds changes to expose the entitlement facts for the running system as a public get_facts, so a caller that needs the facts themselves rather than a policy answer has one sanctioned way to read them instead of building EntitlementFacts by hand.
It also records, next to get_license, that a caller currently cannot tell "this system has no license" from "we could not find out" -- the fallback codes collapse an unreachable daemon into the same bare None a genuinely unlicensed system produces.
Give HardwareClass an is_appliance predicate
This commit adds changes to move the appliance-vs-not test onto HardwareClass itself so the entitlement engine stops open-coding the TRUENAS_HW comparison, and to declare the hardware, entitlement and license package layerings as import-linter contracts.
Key network config hostname fields off HA hardware
This commit adds changes to swap system.is_enterprise for system.is_ha_capable in network_config_extend, so hostname_b and hostname_virtual are exposed based on whether the box is HA hardware rather than on how it is licensed. Those fields only mean anything on a two-node system, and the failover.node lookup in the same branch already assumed as much.
Note this narrows the payload on one population: a licensed non-freenas system on a MANUAL chassis used to get both fields and no longer does. That is an API shape change for those systems, though the fields were never meaningful there.
Give truenas.entitlements.check a wire shape
This commit adds changes to make `truenas.entitlements.check` usable over the API instead of only in process. It returned the engine's frozen dataclass, which does not serialize, so a caller could reach the method but never read the answer back. It now declares api_method models with check_annotations on and converts the dataclass at the plugin boundary, which keeps the engine a pure package that still hands its own type to in-process callers such as failover_/ha_hardware.py.
Every stub of the method has to move with it. Six unit suites and twelve mock declarations across nine integration test files were building the engine dataclass, and each would have gone on passing while standing in for a method that no longer returns one, since consumers only ever read entitled and message.
Ignore legacy licenses issued for freenas models
This commit adds changes to drop a legacy license whose model is freenas prefixed, so a FreeNAS Certified or FreeNAS Mini blob no longer normalizes into a LicenseInfo at all and the system reads as unlicensed. Those units bought none of the functionality the injection below hands out, there is no useful subset to inject for them instead, and the rejection is deliberately silent.
With freenas models rejected outright the enterprise only injection condition could only ever exclude a legacy blob carrying no model at all, so the two injection buckets collapse into one. That does hand a model less blob the SMB fastpath and Veeam flags it did not get before, which is accepted -- such a license cannot exist in the field without stable/26 already tripping over it in product_type.
Key product type off hardware rather than the license
This commit adds changes to make system.product_type a pure hardware question — enterprise now means iX hardware excluding Minis, with no license input at all, matching how the entitlement engine already classifies systems. The process-wide product type memo and its reset on license upload go away with it, and disable-rootfs-protection asks the hardware directly so the gate still works with middlewared stopped.
The sudo audit gate in sudoers.mako moved onto the etc render context because a module level get_entitlement call cannot be mocked from integration tests, and the five test files still importing the removed product_type helper are fixed. Those mocks were already inert — the gates they targeted key off fips_available now — so this drops dead fixtures rather than preserving anything.
Add a hardware identity package and route entitlements through it
This commit adds changes to pull hardware detection out of the entitlement engine into utils/hardware, split into a pure classifier that takes DMI values as arguments and a probe that owns the one impure step. Detecting what a machine is was never an entitlement concern, and keeping the classifier pure means it is testable without mocking anything.
HA virtual machines are now recognised. IXKVM comes out of the QEMU manufacturer plus the node serial convention, and bhyve is only treated as HA when the TrueNAS_A/TrueNAS_B backplane device is actually attached, so ordinary development bhyve VMs are not swept in. Both map to TrueNAS hardware, which moves them from the community to the hardware side of the feature matrix: an unlicensed HA VM loses dedup and gains SED, and a licensed HA VM without the fibre channel key gains fibre channel. That is a deliberate call - an HA VM stands in for an appliance and should be entitled as one.
The whole answer is cached for the life of the process since nothing it reads can change without a reboot, and the backplane scan only runs when DMI already says the guest is bhyve. The backplane probe reads sysfs rather than going through udev; the two resolve to the same file and sysfs does not need udevd running. The mypy workflow picks up the new package, without which it would not be type checked at all.
Drop the redundant enterprise check from the ALUA gate
This commit adds changes to remove the system.is_enterprise conjunct from iscsi.global.alua_enabled, leaving failover.licensed as the entitlement term. That check now resolves through the entitlement engine, so ALUA is already gated on the HA license type and the enterprise term was a licensing proxy sitting in front of it.
It was also near-redundant: given an ENTERPRISE_HA license the only system it could reject is a MANUAL chassis with a null or freenas model, which has no failover pair and cannot run ALUA anyway. Removing it drops a real hazard too, since product_type is memoized for the life of the process over a chassis probe that can transiently read MANUAL at boot, and a poisoned memo would silently disable ALUA on a licensed HA pair until restart. NVMe-oF ANA already gates on bare failover.licensed, so this matches its neighbour.
Phase out system.is_enterprise from HA and alert plumbing
This commit adds changes to replace system.is_enterprise with system.is_ha_capable wherever the decision is really about HA hardware rather than licensing, and to route the two decisions that genuinely are licensed - sudo audit logging and the force_topology guard - through the entitlement engine instead.
The cron template drops its product check entirely since failover.status already returns SINGLE on anything without an HA license, and the alert base and failover hooks it touches all guard on failover.licensed internally, so widening them to HA-capable hardware is inert on unlicensed boxes.
The force_topology error message and its API field description said "Enterprise-licensed systems", which stopped being accurate once the gate moved onto the support entitlement - a licensed Mini would have been told it was Enterprise. Both now say what the gate actually checks.
