Skip to content

Remove redundant plumb_service_firewall_rules call from rack_initialize #9764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smklein merged 1 commit into from
Feb 2, 2026
Merged

Remove redundant plumb_service_firewall_rules call from rack_initialize #9764

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions nexus/src/app/rack.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -740,8 +740,10 @@ impl super::Nexus {
)
.await?;

// Plumb the firewall rules for the built-in services
self.plumb_service_firewall_rules(opctx, &[]).await?;
// Note: Service firewall rules are plumbed in Server::start() via
// await_ip_allowlist_plumbing(), which runs before the external HTTP
// server starts. This ensures rules are in place for both fresh rack
// initialization and Nexus restart scenarios.

// We've potentially updated the list of DNS servers and the DNS
// configuration for both internal and external DNS, plus the Silo
Expand Down
16 changes: 0 additions & 16 deletions nexus/src/app/sled.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,20 +363,4 @@ impl super::Nexus {
self.db_datastore.crucible_dataset_upsert(dataset).await?;
Ok(())
}

/// Ensure firewall rules for internal services get reflected on all the relevant sleds.
pub(crate) async fn plumb_service_firewall_rules(
&self,
opctx: &OpContext,
sleds_filter: &[SledUuid],
) -> Result<(), Error> {
nexus_networking::plumb_service_firewall_rules(
&self.db_datastore,
opctx,
sleds_filter,
&self.opctx_alloc,
&self.log,
)
.await
}
}
Loading