fix(compute): reuse an existing node key when registering a Node

Node.insert() unconditionally created a NodeEncryptionKey for its
uuid, so registering a compute Node for a machine that was already a
local hypervisor's node (which provisions its own key the same way)
crashed on the unique node uuid. Route through get_or_create like
MachinePool already does.

Author: VasilyStepanov

exordos_core/compute/dm/models.py

@@ -18,7 +18,6 @@
 import typing as tp
 import uuid as sys_uuid
 
-from gcl_sdk.agents.universal.api import crypto as ua_crypto
 from gcl_sdk.agents.universal.dm import models as ua_models
 from gcl_sdk.infra.dm import models as infra_models
 import netaddr
@@ -427,13 +426,10 @@ def insert(self, session=None):
             volume = Volume.restore_from_simple_view(**view)
             volume.insert(session=session)
 
-        # Generate private key for the node
-        _, key_base64 = ua_crypto.generate_key_base64()
-        private_key = ua_models.NodeEncryptionKey(
-            uuid=self.uuid,
-            private_key=key_base64,
-        )
-        private_key.insert(session=session)
+        # A key may already exist for this uuid (e.g. it's also
+        # registered as a local hypervisor's node, which provisions its
+        # own key the same way) - reuse it instead of conflicting.
+        ua_models.NodeEncryptionKey.get_or_create(self.uuid, session=session)
 
     def get_agent_private_key(self):
         enc_key = ua_models.NodeEncryptionKey.objects.get_one(

exordos_core/tests/functional/restapi/compute/test_hypervisor_api.py

@@ -15,10 +15,14 @@
 #    under the License.
 
 import typing as tp
+import uuid as sys_uuid
 
 from bazooka import exceptions as bazooka_exc
 from gcl_iam.tests.functional import clients as iam_clients
+from gcl_sdk.agents.universal.api import crypto as ua_crypto
+from gcl_sdk.agents.universal.dm import models as ua_models
 import pytest
+from restalchemy.dm import filters as dm_filters
 
 from exordos_core.compute import constants as nc
 
@@ -312,3 +316,34 @@ def test_hypervisors_add_same_connection_uri(
         client.delete(
             client.build_resource_uri(["compute", "hypervisors", hypervisor1["uuid"]])
         )
+
+    def test_node_reuses_an_existing_node_key(
+        self,
+        node_factory: tp.Callable,
+        user_api_client: iam_clients.GenesisCoreTestRESTClient,
+        auth_user_admin: iam_clients.GenesisCoreAuth,
+    ):
+        # A key may already exist for a node's uuid from another source
+        # (e.g. it's also registered as a local hypervisor's node) -
+        # registering the Node must reuse it instead of conflicting on
+        # insert.
+        node_uuid = sys_uuid.uuid4()
+        _, private_key = ua_crypto.generate_key_base64()
+        existing_key = ua_models.NodeEncryptionKey(
+            uuid=node_uuid, private_key=private_key
+        )
+        existing_key.insert()
+
+        client = user_api_client(auth_user_admin)
+        node = node_factory(uuid=node_uuid)
+        response = client.post(
+            client.build_collection_uri(["compute", "nodes"]), json=node
+        )
+        assert response.status_code == 201
+
+        key = ua_models.NodeEncryptionKey.objects.get_one(
+            filters={"uuid": dm_filters.EQ(node_uuid)}
+        )
+        assert key.private_key == private_key
+
+        client.delete(client.build_resource_uri(["compute", "nodes", str(node_uuid)]))

exordos_core/tests/unit/compute/test_models.py

@@ -0,0 +1,44 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+import uuid as sys_uuid
+from unittest.mock import patch
+
+from gcl_sdk.agents.universal.dm import models as ua_models
+from gcl_sdk.infra.dm import models as infra_models
+
+from exordos_core.compute.dm import models
+
+
+class TestNodeInsert:
+    def test_reuses_an_existing_key(self):
+        # A key may already exist for this uuid (e.g. it's also a local
+        # hypervisor's node, which provisions its own key the same way) -
+        # go through get_or_create instead of blindly inserting a fresh
+        # one and conflicting on the unique node uuid.
+        node = models.Node(
+            cores=1,
+            ram=1024,
+            disk_spec=infra_models.RootDiskSpec(image="ubuntu_24.04"),
+            project_id=sys_uuid.uuid4(),
+        )
+
+        with (
+            patch.object(models.orm.SQLStorableMixin, "insert"),
+            patch.object(ua_models.NodeEncryptionKey, "get_or_create") as get_or_create,
+        ):
+            node.insert()
+
+        get_or_create.assert_called_once_with(node.uuid, session=None)