feat: Introduce separate replica version

ic-os/components/guestos/ic-replica.service

@@ -20,7 +20,7 @@ User=ic-replica
 
 Environment=RUST_BACKTRACE=1
 Environment=RUST_MIN_STACK=8192000
-ExecStart=/opt/ic/bin/orchestrator --replica-binary-dir /var/lib/ic/data/images --cup-dir /var/lib/ic/data/cups --replica-config-file /run/ic-node/config/ic.json5 --ic-boundary-env-file /opt/ic/share/ic-boundary.env --ic-gateway-env-file /opt/ic/share/ic-gateway.env --enable-provisional-registration --ic-binary-directory /opt/ic/bin --orchestrator-data-directory /var/lib/ic/data/orchestrator --version-file /opt/ic/share/version.txt
+ExecStart=/opt/ic/bin/orchestrator --replica-binary-dir /var/lib/ic/data/images --cup-dir /var/lib/ic/data/cups --replica-config-file /run/ic-node/config/ic.json5 --ic-boundary-env-file /opt/ic/share/ic-boundary.env --ic-gateway-env-file /opt/ic/share/ic-gateway.env --enable-provisional-registration --ic-binary-directory /opt/ic/bin --orchestrator-data-directory /var/lib/ic/data/orchestrator --version-file /opt/ic/share/binary_version.txt --guestos-version-file /opt/ic/share/version.txt
 LimitNOFILE=16777216
 Restart=always
 RestartSec=10

ic-os/components/monitoring/guestos/custom-metrics.sh

@@ -10,6 +10,7 @@ source /opt/ic/bin/config.sh
 
 MICROCODE_FILE="/sys/devices/system/cpu/cpu0/microcode/version"
 GUESTOS_VERSION_FILE="/opt/ic/share/version.txt"
+BINARY_VERSION_FILE="/opt/ic/share/binary_version.txt"
 STATE_ROOT_PATH="/var/lib/ic"
 
 function update_guestos_version_metric() {
@@ -28,6 +29,22 @@ function update_guestos_version_metric() {
         "gauge"
 }
 
+function update_binary_version_metric() {
+    if [ -r ${BINARY_VERSION_FILE} ]; then
+        BINARY_VERSION=$(cat ${BINARY_VERSION_FILE})
+        BINARY_VERSION_OK=1
+    else
+        BINARY_VERSION="unknown"
+        BINARY_VERSION_OK=0
+    fi
+    write_log "Binary version ${BINARY_VERSION}"
+    write_metric_attr "binary_version" \
+        "{version=\"${BINARY_VERSION}\"}" \
+        "${BINARY_VERSION_OK}" \
+        "Replica binary version string" \
+        "gauge"
+}
+
 function update_guestos_boot_action_metric() {
     write_metric_attr "guestos_boot_action" \
         "{successful_boot=\"true\"}" \
@@ -77,6 +94,7 @@ function update_tee_metrics() {
 
 function main() {
     update_guestos_version_metric
+    update_binary_version_metric
     update_guestos_boot_action_metric
     update_config_version_metric
     update_tee_metrics

ic-os/components/monitoring/metrics-proxy/guestos/metrics-proxy.yaml

@@ -44,6 +44,10 @@ proxies:
       - regex: guestos_version
         actions:
           - keep
+      # Replica binary version metric.
+      - regex: binary_version
+        actions:
+          - keep
       # Clock synchronization status.
       - regex: node_timex_sync_status
         actions:

ic-os/defs.bzl

@@ -80,6 +80,30 @@ def icos_build(
             tags = ["manual"],
         )
 
+    # A separate copy of the version file installed as binary_version.txt in
+    # the rootfs, holding the replica binary version. During a fast upgrade,
+    # the overlay ships a new version and the file will be mounted over.
+    # version.txt above is not mounted over so it can be used to read the base
+    # GuestOS version.
+    copy_file(
+        name = "copy_binary_version_txt",
+        src = ic_version,
+        out = "binary_version.txt",
+        allow_symlink = True,
+        visibility = ["//visibility:public"],
+        tags = ["manual"],
+    )
+
+    if upgrades:
+        native.genrule(
+            name = "test_binary_version_txt",
+            srcs = [":copy_binary_version_txt"],
+            outs = ["binary_version-test.txt"],
+            cmd = "sed -e 's/.*/&-test/' < $< > $@",
+            visibility = ["//visibility:public"],
+            tags = ["manual"],
+        )
+
     # -------------------- Build grub partition --------------------
 
     build_grub_partition("partition-grub.tzst", grub_config = image_deps.get("grub_config", default = None), tags = ["manual"])
@@ -214,6 +238,7 @@ tar --create --file "$@" --numeric-owner -C "$$tmpdir/bootfs" .
         partition_root_hash = partition_root + "-hash"
         partition_boot_tzst = "partition-boot" + test_suffix + ".tzst"
         version_txt = "version" + test_suffix + ".txt"
+        binary_version_txt = "binary_version" + test_suffix + ".txt"
         boot_args = "boot" + test_suffix + "_args"
         launch_measurements = "launch-measurements" + test_suffix + ".json"
 
@@ -226,7 +251,10 @@ tar --create --file "$@" --numeric-owner -C "$$tmpdir/bootfs" .
             strip_paths = PARTITION_ROOT_STRIP_PATHS,
             extra_files = {
                 k: v
-                for k, v in (image_deps["rootfs"].items() + [(version_txt, "/opt/ic/share/version.txt:0644")])
+                for k, v in (image_deps["rootfs"].items() + [
+                    (version_txt, "/opt/ic/share/version.txt:0644"),
+                    (binary_version_txt, "/opt/ic/share/binary_version.txt:0644"),
+                ])
             },
             target_compatible_with = ["@platforms//os:linux"],
             tags = ["manual", "no-cache"],

rs/boundary_node/ic_boundary/src/http/handlers.rs

@@ -206,6 +206,7 @@ pub async fn status(
     let status = HttpStatusResponse {
         root_key: rk.root_key().map(|x| x.into()),
         impl_version: None,
+        guestos_version: None,
         impl_hash: None,
         replica_health_status: Some(health),
         certified_height: None,

rs/consensus/dkg/src/dkg_key_manager.rs

@@ -665,7 +665,7 @@ mod tests {
     use ic_registry_keys::make_catch_up_package_contents_key;
     use ic_test_utilities_logger::with_test_replica_logger;
     use ic_test_utilities_registry::SubnetRecordBuilder;
-    use ic_test_utilities_types::ids::{node_test_id, subnet_test_id, test_replica_version};
+    use ic_test_utilities_types::ids::{node_test_id, subnet_test_id, test_platform_version};
     use ic_types::{
         NodeId, RegistryVersion, SubnetId,
         consensus::{
@@ -856,7 +856,7 @@ mod tests {
                     node_id: local_node_id,
                     // The local node always starts in the source subnet.
                     subnet_id: source_subnet_id,
-                    replica_version: test_replica_version(),
+                    platform_version: test_platform_version(),
                 })
                 .build();
 

rs/consensus/dkg/src/lib.rs

@@ -90,12 +90,13 @@ impl DkgImpl {
         let ReplicaConfig {
             node_id,
             subnet_id,
-            replica_version,
+            platform_version,
+            ..
         } = replica_config;
         Self {
             node_id,
             subnet_id,
-            replica_version,
+            replica_version: platform_version.replica_version,
             registry_client,
             state_reader,
             crypto,
@@ -450,7 +451,7 @@ mod tests {
     use ic_test_utilities_logger::with_test_replica_logger;
     use ic_test_utilities_registry::{SubnetRecordBuilder, add_subnet_record};
     use ic_test_utilities_state::get_initial_state;
-    use ic_test_utilities_types::ids::{node_test_id, subnet_test_id, test_replica_version};
+    use ic_test_utilities_types::ids::{node_test_id, subnet_test_id, test_platform_version};
     use ic_types::{
         RegistryVersion, ReplicaVersion,
         batch::ValidationContext,
@@ -835,7 +836,7 @@ mod tests {
                         // Node Id = 1, who is a dealer
                         node_id: node_test_id(1),
                         subnet_id: subnet_test_id(0),
-                        replica_version: test_replica_version(),
+                        platform_version: test_platform_version(),
                     })
                     .without_state_manager_expectations()
                     .build();
@@ -1113,7 +1114,7 @@ mod tests {
                     .with_replica_config(ReplicaConfig {
                         node_id: node_test_id(1),
                         subnet_id: subnet_test_id(0),
-                        replica_version: test_replica_version(),
+                        platform_version: test_platform_version(),
                     })
                     .build();
                 let Dependencies {
@@ -1127,7 +1128,7 @@ mod tests {
                         // This is not a dealer!
                         node_id: node_test_id(0),
                         subnet_id: subnet_test_id(0),
-                        replica_version: test_replica_version(),
+                        platform_version: test_platform_version(),
                     })
                     .build();
                 for state_manager in [&state_manager_1, &state_manager_2] {
@@ -1575,7 +1576,7 @@ mod tests {
                         .with_replica_config(ReplicaConfig {
                             node_id: node_test_id(1),
                             subnet_id: subnet_test_id(0),
-                            replica_version: test_replica_version(),
+                            platform_version: test_platform_version(),
                         })
                         .without_state_manager_expectations()
                         .build();
@@ -1584,7 +1585,7 @@ mod tests {
                         .with_replica_config(ReplicaConfig {
                             node_id: node_test_id(2),
                             subnet_id: subnet_test_id(0),
-                            replica_version: test_replica_version(),
+                            platform_version: test_platform_version(),
                         })
                         .without_state_manager_expectations()
                         .build();
@@ -2167,7 +2168,7 @@ mod tests {
                         // Node 2 is a non-dealer receiver
                         node_id: node_test_id(2),
                         subnet_id: subnet_test_id(0),
-                        replica_version: test_replica_version(),
+                        platform_version: test_platform_version(),
                     })
                     .with_dkg_interval_length(dkg_interval_length)
                     .without_state_manager_expectations()

rs/consensus/dkg/src/payload_validator.rs

@@ -274,7 +274,7 @@ mod tests {
     use ic_test_utilities_state::get_initial_state;
     use ic_test_utilities_types::ids::{
         NODE_1, NODE_2, NODE_3, SUBNET_1, SUBNET_2, node_test_id, subnet_test_id,
-        test_replica_version,
+        test_platform_version, test_replica_version,
     };
     use ic_types::{
         Height, NodeId, RegistryVersion,
@@ -809,7 +809,7 @@ mod tests {
             .with_replica_config(ReplicaConfig {
                 node_id,
                 subnet_id,
-                replica_version: test_replica_version(),
+                platform_version: test_platform_version(),
             })
             .build();
             state_manager

rs/consensus/mocks/src/lib.rs

@@ -26,7 +26,7 @@ use ic_test_utilities_registry::{
 use ic_test_utilities_time::FastForwardTimeSource;
 use ic_test_utilities_types::ids::{node_test_id, subnet_test_id};
 use ic_types::{
-    Height, RegistryVersion, ReplicaVersion, SubnetId, Time,
+    Height, PlatformVersion, RegistryVersion, ReplicaVersion, SubnetId, Time,
     batch::{BatchPayload, ValidationContext},
     consensus::{Payload, block_maker::SubnetRecords},
     replica_config::ReplicaConfig,
@@ -176,11 +176,18 @@ impl DependenciesBuilder {
 
         Self {
             pool_config,
-            replica_config: ReplicaConfig {
-                node_id: node_test_id(0),
-                subnet_id: subnet_records[0].1,
-                replica_version: ReplicaVersion::from_str(&subnet_records[0].2.replica_version_id)
-                    .expect("Invalid replica_version_id"),
+            replica_config: {
+                let replica_version =
+                    ReplicaVersion::from_str(&subnet_records[0].2.replica_version_id)
+                        .expect("Invalid replica_version_id");
+                ReplicaConfig {
+                    node_id: node_test_id(0),
+                    subnet_id: subnet_records[0].1,
+                    platform_version: PlatformVersion {
+                        guestos_version: replica_version.clone(),
+                        replica_version,
+                    },
+                }
             },
             sorted_subnet_records: subnet_records,
             with_state_manager_expectations: true,
@@ -283,7 +290,7 @@ impl DependenciesBuilder {
         let pool = TestConsensusPool::new(
             self.replica_config.node_id,
             self.replica_config.subnet_id,
-            self.replica_config.replica_version.clone(),
+            self.replica_config.platform_version.replica_version.clone(),
             self.pool_config,
             time_source.clone(),
             registry.clone(),

rs/consensus/src/consensus/batch_delivery.rs

@@ -644,7 +644,9 @@ mod tests {
     use ic_management_canister_types_private::{SetupInitialDKGResponse, VetKdCurve, VetKdKeyId};
     use ic_test_utilities::message_routing::FakeMessageRouting;
     use ic_test_utilities_registry::SubnetRecordBuilder;
-    use ic_test_utilities_types::ids::{subnet_test_id, test_replica_version};
+    use ic_test_utilities_types::ids::{
+        subnet_test_id, test_platform_version, test_replica_version,
+    };
     use ic_types::{
         PrincipalId, RegistryVersion, SubnetId,
         batch::{BatchPayload, ValidationContext},
@@ -901,7 +903,7 @@ mod tests {
             .with_replica_config(ReplicaConfig {
                 node_id,
                 subnet_id: SOURCE_SUBNET_ID,
-                replica_version: test_replica_version(),
+                platform_version: test_platform_version(),
             })
             .build();
 

rs/consensus/src/consensus/block_maker.rs

@@ -379,7 +379,7 @@ impl BlockMaker {
                         self.registry_client.as_ref(),
                         self.replica_config.subnet_id,
                         pool,
-                        &self.replica_config.replica_version,
+                        &self.replica_config.platform_version.replica_version,
                         &self.log,
                     )? {
                         // Don't propose any block if the replica is halted.
@@ -445,7 +445,7 @@ impl BlockMaker {
             height,
             rank,
             context,
-            self.replica_config.replica_version.clone(),
+            self.replica_config.platform_version.replica_version.clone(),
         );
         let hashed_block = hashed::Hashed::new(ic_types::crypto::crypto_hash, block);
         let metadata = BlockMetadata::from_block(&hashed_block, self.replica_config.subnet_id);
@@ -744,7 +744,9 @@ mod tests {
     use ic_registry_keys::make_catch_up_package_contents_key;
     use ic_test_utilities_consensus::fake::FromParent;
     use ic_test_utilities_registry::{SubnetRecordBuilder, add_subnet_record};
-    use ic_test_utilities_types::ids::{node_test_id, subnet_test_id, test_replica_version};
+    use ic_test_utilities_types::ids::{
+        node_test_id, subnet_test_id, test_platform_version, test_replica_version,
+    };
     use ic_types::{
         consensus::{
             CatchUpContent, CatchUpPackage, HasHeight, HasVersion, HashedRandomBeacon, dkg,
@@ -799,7 +801,7 @@ mod tests {
             .with_replica_config(ReplicaConfig {
                 node_id: node_test_id(1),
                 subnet_id,
-                replica_version: test_replica_version(),
+                platform_version: test_platform_version(),
             })
             .build();
 
@@ -869,7 +871,7 @@ mod tests {
                 next_height,
                 Rank(4),
                 expected_context.clone(),
-                replica_config.replica_version.clone(),
+                replica_config.platform_version.replica_version.clone(),
             );
 
             payload_builder
@@ -892,7 +894,7 @@ mod tests {
                     })
                     .unwrap(),
                 subnet_id: replica_config.subnet_id,
-                replica_version: replica_config.replica_version,
+                platform_version: replica_config.platform_version.clone(),
             };
 
             let block_maker = BlockMaker::new(
@@ -1019,7 +1021,7 @@ mod tests {
                     })
                     .unwrap(),
                 subnet_id: replica_config.subnet_id,
-                replica_version: replica_config.replica_version,
+                platform_version: replica_config.platform_version.clone(),
             };
 
             let block_maker = BlockMaker::new(
@@ -1223,7 +1225,10 @@ mod tests {
             let proposal = proposal.unwrap();
             let block = proposal.content.as_ref();
             // The block still uses the old version, not the new version.
-            assert_eq!(block.version(), &replica_config.replica_version);
+            assert_eq!(
+                block.version(),
+                &replica_config.platform_version.replica_version
+            );
             // registry version 10 becomes effective.
             assert_eq!(
                 PoolReader::new(&pool).registry_version(proposal.height()),