RSS -> Nexus handoff plumbing

[smklein]

RSS must provide operators a way to "add sufficient networking configuration to be able to launch Nexus, and continue setup through the web console".

The current implementation is somewhat limited in this regard - although config-rss.toml - representing user input - can contain an external address for Nexus, there are shortcomings:

• It's limited to a single address
• There is no mechanism to supply server certificates to encrypt traffic

[smklein]

See: sled-agent/src/rack_setup/config.rs

[smklein]

#1959 provides more detail about the x509 transfer

[davepacheco]

I'm putting this on the MVP board because I think it covers work that we plan to do for then. I think all that's missing here is to plumb the certificate list from RSS's API to Nexus's. That is, it's already in Nexus's API. What's left is accepting this in RSS's API, which means figuring out what should go into the config files we use in dev/test.

[smklein]

RSS is already passing TLS certs to Nexus, through the internal API:

omicron/nexus/types/src/internal_api/params.rs

Lines 242 to 243 in 9070c6b

	/// x.509 Certificates used to encrypt communication with the external API.
	pub certs: Vec<Certificate>,

[smklein]

Ah, luqman corrected me, there is still this TODO:

omicron/sled-agent/src/rack_setup/service.rs

Lines 745 to 759 in 9070c6b

	let request = NexusTypes::RackInitializationRequest {
	services,
	datasets,
	internal_services_ip_pool_ranges,
	// TODO(https://github.com/oxidecomputer/omicron/issues/1959): Plumb
	// these paths through RSS's API.
	//
	// These certificates CAN be updated through Nexus' HTTP API, but
	// should be bootstrapped during the rack setup process to avoid
	// the need for unencrypted communication.
	certs: vec![],
	internal_dns_zone_config: d2n_params(&service_plan.dns_config),
	external_dns_zone_name: config.external_dns_zone_name.clone(),
	recovery_silo: config.recovery_silo.clone(),
	};

So this part is still to-do -- it's the handoff of the TLS certs from wicket/wicketd (via the bootstrap network) to RSS itself