Implement silo level images

common/src/api/external/mod.rs

@@ -696,6 +696,8 @@ pub enum ResourceType {
     Dataset,
     Disk,
     Image,
+    SiloImage,
+    ProjectImage,
     Instance,
     IpPool,
     InstanceNetworkInterface,

common/src/sql/dbinit.sql

@@ -905,7 +905,9 @@ CREATE TABLE omicron.public.image (
     /* Indicates that the object has been deleted */
     time_deleted TIMESTAMPTZ,
 
-    project_id UUID NOT NULL,
+    silo_id UUID NOT NULL,
+    project_id UUID,
+
     volume_id UUID NOT NULL,
 
     url STRING(8192),
@@ -916,7 +918,51 @@ CREATE TABLE omicron.public.image (
     size_bytes INT NOT NULL
 );
 
+CREATE VIEW omicron.public.project_image AS
+SELECT
+    id,
+    name,
+    description,
+    time_created,
+    time_modified,
+    time_deleted,
+    silo_id,
+    project_id,
+    volume_id,
+    url,
+    os,
+    version,
+    digest,
+    block_size,
+    size_bytes
+FROM 
+    omicron.public.image
+WHERE 
+    project_id IS NOT NULL;
+
+CREATE VIEW omicron.public.silo_image AS
+SELECT
+    id,
+    name,
+    description,
+    time_created,
+    time_modified,
+    time_deleted,
+    silo_id,
+    volume_id,
+    url,
+    os,
+    version,
+    digest,
+    block_size,
+    size_bytes
+FROM 
+    omicron.public.image
+WHERE 
+    project_id IS NULL;
+
 CREATE UNIQUE INDEX on omicron.public.image (
+    silo_id,
     project_id,
     name
 ) WHERE

nexus/authz-macros/src/lib.rs

@@ -136,6 +136,9 @@ enum PolarSnippet {
     /// Generate it as a global resource, manipulable only to administrators
     FleetChild,
 
+    /// Generate it as resource nested under the Silo
+    InSilo,
+
     /// Generate it as a resource nested within a Project (either directly or
     /// indirectly)
     InProject,
@@ -200,6 +203,31 @@ fn do_authz_resource(
             resource_name, resource_name,
         ),
 
+        // If this resource is directly inside a Silo, we only need to define
+        // permissions that are contingent on having roles on that Silo.
+        (PolarSnippet::InSilo, _) => format!(
+            r#"
+                resource {} {{
+                    permissions = [
+                        "list_children",
+                        "modify",
+                        "read",
+                        "create_child",
+                    ];
+
+                    relations = {{ containing_silo: Silo }};
+                    "list_children" if "viewer" on "containing_silo";
+                    "read" if "viewer" on "containing_silo";
+                    "modify" if "collaborator" on "containing_silo";
+                    "create_child" if "collaborator" on "containing_silo";
+                }}
+
+                has_relation(parent: Silo, "containing_silo", child: {})
+                    if child.silo = parent;
+            "#,
+            resource_name, resource_name,
+        ),
+
         // If this resource is directly inside a Project, we only need to define
         // permissions that are contingent on having roles on that Project.
         (PolarSnippet::InProject, "Project") => format!(

nexus/db-model/src/image.rs

@@ -2,15 +2,22 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
+//! Image, ProjectImage, and SiloImage are almost identical. Image is the model
+//! for the underlying table and ProjectImage and SiloImage are backed by views
+//! of that table. They have all the same fields except ProjectImage has both a
+//! silo_id and a project_id, while SiloImage only has a silo_id. Image has a
+//! silo_id and an optional project_id to cover both possibilities.
+
 use super::{BlockSize, ByteCount, Digest};
-use crate::schema::image;
+use crate::schema::{image, project_image, silo_image};
 use db_macros::Resource;
 use nexus_types::external_api::views;
 use nexus_types::identity::Resource;
+use omicron_common::api::external::Error;
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
 
-// Project images
+// Shared image definition
 #[derive(
     Queryable,
     Insertable,
@@ -26,6 +33,29 @@ pub struct Image {
     #[diesel(embed)]
     pub identity: ImageIdentity,
 
+    pub silo_id: Uuid,
+    pub project_id: Option<Uuid>,
+
+    pub volume_id: Uuid,
+    pub url: Option<String>,
+    pub os: String,
+    pub version: String,
+    pub digest: Option<Digest>,
+    pub block_size: BlockSize,
+
+    #[diesel(column_name = size_bytes)]
+    pub size: ByteCount,
+}
+
+#[derive(
+    Queryable, Selectable, Clone, Debug, Resource, Serialize, Deserialize,
+)]
+#[diesel(table_name = project_image)]
+pub struct ProjectImage {
+    #[diesel(embed)]
+    pub identity: ProjectImageIdentity,
+
+    pub silo_id: Uuid,
     pub project_id: Uuid,
     pub volume_id: Uuid,
     pub url: Option<String>,
@@ -38,6 +68,135 @@ pub struct Image {
     pub size: ByteCount,
 }
 
+#[derive(
+    Queryable, Selectable, Clone, Debug, Resource, Serialize, Deserialize,
+)]
+#[diesel(table_name = silo_image)]
+pub struct SiloImage {
+    #[diesel(embed)]
+    pub identity: SiloImageIdentity,
+
+    pub silo_id: Uuid,
+    pub volume_id: Uuid,
+    pub url: Option<String>,
+    pub os: String,
+    pub version: String,
+    pub digest: Option<Digest>,
+    pub block_size: BlockSize,
+
+    #[diesel(column_name = size_bytes)]
+    pub size: ByteCount,
+}
+
+impl TryFrom<Image> for ProjectImage {
+    type Error = Error;
+
+    fn try_from(image: Image) -> Result<Self, Self::Error> {
+        match image.project_id {
+            Some(project_id) => Ok(Self {
+                identity: ProjectImageIdentity {
+                    id: image.id(),
+                    name: image.name().clone().into(),
+                    description: image.description().to_string(),
+                    time_created: image.time_created(),
+                    time_modified: image.time_modified(),
+                    time_deleted: image.time_deleted(),
+                },
+                silo_id: image.silo_id,
+                project_id,
+                volume_id: image.volume_id,
+                url: image.url,
+                os: image.os,
+                version: image.version,
+                digest: image.digest,
+                block_size: image.block_size,
+                size: image.size,
+            }),
+            None => Err(Error::internal_error(
+                "tried to convert non-project image to project image",
+            )),
+        }
+    }
+}
+
+impl TryFrom<Image> for SiloImage {
+    type Error = Error;
+
+    fn try_from(image: Image) -> Result<Self, Self::Error> {
+        match image.project_id {
+            Some(_) => Err(Error::internal_error(
+                "tried to convert non-silo image to silo image",
+            )),
+            None => Ok(Self {
+                identity: SiloImageIdentity {
+                    id: image.id(),
+                    name: image.name().clone().into(),
+                    description: image.description().to_string(),
+                    time_created: image.time_created(),
+                    time_modified: image.time_modified(),
+                    time_deleted: image.time_deleted(),
+                },
+                silo_id: image.silo_id,
+                volume_id: image.volume_id,
+                url: image.url,
+                os: image.os,
+                version: image.version,
+                digest: image.digest,
+                block_size: image.block_size,
+                size: image.size,
+            }),
+        }
+    }
+}
+
+impl From<ProjectImage> for Image {
+    fn from(image: ProjectImage) -> Self {
+        Self {
+            identity: ImageIdentity {
+                id: image.id(),
+                name: image.name().clone().into(),
+                description: image.description().to_string(),
+                time_created: image.time_created(),
+                time_modified: image.time_modified(),
+                time_deleted: image.time_deleted(),
+            },
+            silo_id: image.silo_id,
+            project_id: Some(image.project_id),
+            volume_id: image.volume_id,
+            url: image.url,
+            os: image.os,
+            version: image.version,
+            digest: image.digest,
+            block_size: image.block_size,
+            size: image.size,
+        }
+    }
+}
+
+impl From<SiloImage> for Image {
+    fn from(image: SiloImage) -> Self {
+        Self {
+            identity: ImageIdentity {
+                id: image.id(),
+                name: image.name().clone().into(),
+                description: image.description().to_string(),
+                time_created: image.time_created(),
+                time_modified: image.time_modified(),
+                time_deleted: image.time_deleted(),
+            },
+            silo_id: image.silo_id,
+            project_id: None,
+            volume_id: image.volume_id,
+            url: image.url,
+            os: image.os,
+            version: image.version,
+            digest: image.digest,
+            block_size: image.block_size,
+            size: image.size,
+        }
+    }
+}
+
 impl From<Image> for views::Image {
     fn from(image: Image) -> Self {
         Self {

nexus/db-model/src/project.rs

@@ -2,9 +2,10 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
-use super::{Disk, Generation, Image, Instance, Name, Snapshot, Vpc};
+use super::{Disk, Generation, Instance, Name, Snapshot, Vpc};
 use crate::collection::DatastoreCollectionConfig;
 use crate::schema::{disk, image, instance, project, snapshot, vpc};
+use crate::Image;
 use chrono::{DateTime, Utc};
 use db_macros::Resource;
 use nexus_types::external_api::params;

nexus/db-model/src/schema.rs

@@ -37,6 +37,27 @@ table! {
         time_created -> Timestamptz,
         time_modified -> Timestamptz,
         time_deleted -> Nullable<Timestamptz>,
+        silo_id -> Uuid,
+        project_id -> Nullable<Uuid>,
+        volume_id -> Uuid,
+        url -> Nullable<Text>,
+        os -> Text,
+        version -> Text,
+        digest -> Nullable<Text>,
+        block_size -> crate::BlockSizeEnum,
+        size_bytes -> Int8,
+    }
+}
+
+table! {
+    project_image (id) {
+        id -> Uuid,
+        name -> Text,
+        description -> Text,
+        time_created -> Timestamptz,
+        time_modified -> Timestamptz,
+        time_deleted -> Nullable<Timestamptz>,
+        silo_id -> Uuid,
         project_id -> Uuid,
         volume_id -> Uuid,
         url -> Nullable<Text>,
@@ -48,6 +69,25 @@ table! {
     }
 }
 
+table! {
+    silo_image (id) {
+        id -> Uuid,
+        name -> Text,
+        description -> Text,
+        time_created -> Timestamptz,
+        time_modified -> Timestamptz,
+        time_deleted -> Nullable<Timestamptz>,
+        silo_id -> Uuid,
+        volume_id -> Uuid,
+        url -> Nullable<Text>,
+        os -> Text,
+        version -> Text,
+        digest -> Nullable<Text>,
+        block_size -> crate::BlockSizeEnum,
+        size_bytes -> Int8,
+    }
+}
+
 table! {
     global_image (id) {
         id -> Uuid,
@@ -848,6 +888,9 @@ joinable!(ip_pool_range -> ip_pool (ip_pool_id));
 allow_tables_to_appear_in_same_query!(
     dataset,
     disk,
+    image,
+    project_image,
+    silo_image,
     instance,
     metric_producer,
     network_interface,