feat(compute): provision a node encryption key for local hypervisor agents

The local-pool-agent's self-registration to status_api/orch_api was
failing with a 500: unencrypted communication never sends the
X-Genesis-Node-UUID header the SDK middleware requires, so it can't
work regardless of endpoint. Provision a NodeEncryptionKey for the
agent's node uuid when a MachinePool is created for the
exordos_local_hyper kind, accepting a pre-generated key so the
bootstrap flow (which writes the same key to the agent's disk) stays
in sync instead of getting a mismatched one. Also expose the key via
a get_agent_private_key action for the non-bootstrap registration path.

Author: VasilyStepanov

exordos_core/bootstrap/defaults.py

@@ -393,6 +393,10 @@ def apply_startup_db(spec: dict[str, tp.Any]) -> None:
 
     for hypervisor in stand.get("hypervisors", []):
         hypervisor["iface_mtu"] = 1500
+        # The agent encryption key isn't part of the driver spec, it's the
+        # symmetric key already written to the local agent's disk by the
+        # CLI, so it must be popped off before the driver spec is built.
+        agent_private_key = hypervisor.pop("private_key", None)
         # Drop unset optional fields (e.g. `node`, only used by the
         # "exordos_local_hyper" kind) so they don't trip up spec kinds
         # that don't define them.
@@ -411,7 +415,7 @@ def apply_startup_db(spec: dict[str, tp.Any]) -> None:
         else:
             # Pool does not exist, create it
             try:
-                pool.insert()
+                pool.insert(agent_private_key=agent_private_key)
             except ra_exceptions.ConflictRecords:
                 LOG.info("Machine pool %s already exists", pool.uuid)
             else:

exordos_core/compute/dm/models.py

@@ -110,6 +110,30 @@ class MachinePool(
         default=list,
     )
 
+    def insert(self, session=None, agent_private_key: str | None = None):
+        super().insert(session=session)
+
+        # A local hypervisor's agent authenticates to the orch/status APIs
+        # with a node encryption key, so provision one for its node uuid.
+        # `agent_private_key` lets a caller that already generated and
+        # deployed a key to the agent (e.g. the bootstrap flow) keep both
+        # sides in sync instead of getting a fresh, mismatched one here.
+        if isinstance(self.driver_spec, ExordosLocalHyperDriverSpec):
+            if agent_private_key is None:
+                _, agent_private_key = ua_crypto.generate_key_base64()
+            private_key = ua_models.NodeEncryptionKey(
+                uuid=self.driver_spec.node,
+                private_key=agent_private_key,
+            )
+            private_key.insert(session=session)
+
+    def get_agent_private_key(self):
+        enc_key = ua_models.NodeEncryptionKey.objects.get_one(
+            filters={"uuid": dm_filters.EQ(self.driver_spec.node)}
+        )
+
+        return enc_key.private_key
+
 
 class Volume(
     infra_models.Volume,

exordos_core/user_api/compute/api/controllers.py

@@ -235,3 +235,9 @@ def _validate_driver_spec_uniqueness(self, kwargs: dict) -> None:
                         model="MachinePool",
                         msg=f"node={node}",
                     )
+
+    @actions.get
+    def get_agent_private_key(self, resource: models.MachinePool):
+        self._enforce("get_agent_private_key")
+
+        return resource.get_agent_private_key()

exordos_core/user_api/compute/api/routes.py

@@ -54,11 +54,19 @@ class NodeRoute(routes.Route):
     get_private_key = routes.action(NodePrivateKeyActionRoute)
 
 
+class HypervisorAgentPrivateKeyActionRoute(routes.Action):
+    """Handler for /v1/compute/hypervisors/<uuid>/actions/get_agent_private_key/invoke endpoint"""
+
+    __controller__ = controllers.HypervisorsController
+
+
 class HypervisorRoute(routes.Route):
     """Handler for /v1/compute/hypervisors/ endpoint"""
 
     __controller__ = controllers.HypervisorsController
 
+    get_agent_private_key = routes.action(HypervisorAgentPrivateKeyActionRoute)
+
 
 class NodeSetPrivateKeyActionRoute(routes.Action):
     """Handler for /v1/compute/sets/<uuid>/actions/get_private_keys/invoke endpoint"""