TQ: omdb support for listing trust quorum configs per rack (#9792)

Tested on a4x2:

```
root@oxz_switch:~# omdb db trust-quorum list-configs --rack-id 18594251-205a-47f1-926f-7c5230ab2735
note: database URL not specified.  Will search DNS.
note: (override with --db-url or OMDB_DB_URL)
note: using DNS from system config (typically /etc/resolv.conf)
note: (if this is not right, use --dns-server to specify an alternate DNS server)
note: using database URL postgresql://root@[fd00:17:1:d03::3]:32221,[fd00:17:1:d01::3]:32221,[fd00:17:1:d04::4]:32221,[fd00:17:1:d02::3]:32221,[fd00:17:1:d04::3]:32221/omicron?sslmode=disable
note: database schema version matches expected (228.0.0)
EPOCH LAST_COMMITTED_EPOCH STATE     THRESHOLD COMMIT_CRASH_TOLERANCE COORDINATOR                          TIME_CREATED             TIME_COMMITTING          TIME_COMMITTED           TIME_ABORTED ABORT_REASON
1     n/a                  Committed 3         1                      3ad41e1a-faa0-47dd-9ec3-e75575ec4388 2026-02-03T21:28:15.740Z 2026-02-03T21:28:15.740Z 2026-02-03T21:28:15.740Z
```

This is just the raw data. You can match the coordinator to the actual
part and serial with:

```
root@oxz_switch:~# omdb db inventory baseboard-ids
note: database URL not specified.  Will search DNS.
note: (override with --db-url or OMDB_DB_URL)
note: using DNS from system config (typically /etc/resolv.conf)
note: (if this is not right, use --dns-server to specify an alternate DNS server)
note: using database URL postgresql://root@[fd00:17:1:d03::3]:32221,[fd00:17:1:d01::3]:32221,[fd00:17:1:d04::4]:32221,[fd00:17:1:d02::3]:32221,[fd00:17:1:d04::3]:32221/omicron?sslmode=disable
note: database schema version matches expected (228.0.0)
ID                                   PART_NUMBER      SERIAL_NUMBER
3ad41e1a-faa0-47dd-9ec3-e75575ec4388 913-0000019      20000000
4d75005c-6fa3-40df-af8c-c41b3f3fad17 913-0000019      20000001
ca0f623c-7260-4b00-91e6-6d2a2b68f06e 913-0000019      20000002
40b8965d-89ab-4957-86af-68b11533ffb8 913-0000019      20000003
befe71ec-e7ca-4ee3-b750-fcb9ffd6d68c FAKE_SIM_SIDECAR SimSidecar0
```

Author: andrewjstone

dev-tools/omdb/src/bin/omdb/db.rs

@@ -161,6 +161,7 @@ use omicron_uuid_kinds::InstanceUuid;
 use omicron_uuid_kinds::ParseError;
 use omicron_uuid_kinds::PhysicalDiskUuid;
 use omicron_uuid_kinds::PropolisUuid;
+use omicron_uuid_kinds::RackUuid;
 use omicron_uuid_kinds::SledUuid;
 use omicron_uuid_kinds::VolumeUuid;
 use omicron_uuid_kinds::ZpoolUuid;
@@ -435,6 +436,8 @@ enum DbCommands {
     /// More precisely, `omdb db whatis` reports tables containing a unique UUID
     /// column with the specified value.
     Whatis(whatis::WhatisArgs),
+    /// Print information about trust quorum configurations
+    TrustQuorum(TrustQuorumArgs),
 }
 
 #[derive(Debug, Args, Clone)]
@@ -1162,6 +1165,25 @@ struct SetStorageBufferArgs {
     storage_buffer: i64,
 }
 
+#[derive(Debug, Args, Clone)]
+struct TrustQuorumArgs {
+    #[command(subcommand)]
+    command: TrustQuorumCommands,
+}
+
+#[derive(Debug, Subcommand, Clone)]
+enum TrustQuorumCommands {
+    /// List trust quorum configurations for a rack
+    ListConfigs(TrustQuorumListConfigsArgs),
+}
+
+#[derive(Debug, Args, Clone)]
+struct TrustQuorumListConfigsArgs {
+    /// Rack ID to list configurations for
+    #[arg(long)]
+    rack_id: RackUuid,
+}
+
 impl DbArgs {
     /// Run a `omdb db` subcommand.
     ///
@@ -1532,6 +1554,11 @@ impl DbArgs {
                     DbCommands::Whatis(args) => {
                         whatis::cmd_db_whatis(&datastore, args).await
                     }
+                    DbCommands::TrustQuorum(TrustQuorumArgs {
+                        command: TrustQuorumCommands::ListConfigs(args),
+                    }) => {
+                        cmd_db_trust_quorum_list_configs(&opctx, &datastore, &fetch_opts, &args).await
+                    }
                 }
             }
         }).await
@@ -8108,3 +8135,69 @@ async fn cmd_db_zpool_set_storage_buffer(
 
     Ok(())
 }
+
+/// Run `omdb db trust-quorum list-configs`.
+async fn cmd_db_trust_quorum_list_configs(
+    opctx: &OpContext,
+    datastore: &DataStore,
+    fetch_opts: &DbFetchOptions,
+    args: &TrustQuorumListConfigsArgs,
+) -> Result<(), anyhow::Error> {
+    #[derive(Tabled)]
+    #[tabled(rename_all = "SCREAMING_SNAKE_CASE")]
+    struct TqConfigRow {
+        epoch: i64,
+        #[tabled(display_with = "option_impl_display")]
+        last_committed_epoch: Option<i64>,
+        state: String,
+        threshold: u8,
+        commit_crash_tolerance: u8,
+        coordinator_hardware_baseboard_id: Uuid,
+        #[tabled(display_with = "datetime_rfc3339_concise")]
+        time_created: DateTime<Utc>,
+        #[tabled(display_with = "option_datetime_rfc3339_concise")]
+        time_committing: Option<DateTime<Utc>>,
+        #[tabled(display_with = "option_datetime_rfc3339_concise")]
+        time_committed: Option<DateTime<Utc>>,
+        #[tabled(display_with = "option_datetime_rfc3339_concise")]
+        time_aborted: Option<DateTime<Utc>>,
+        #[tabled(display_with = "display_option_blank")]
+        abort_reason: Option<String>,
+    }
+
+    let limit = fetch_opts.fetch_limit;
+    let configs = datastore
+        .tq_list_config(opctx, args.rack_id, &first_page::<i64>(limit))
+        .await
+        .context("listing trust quorum configurations")?;
+
+    check_limit(&configs, limit, || {
+        String::from("listing trust quorum configurations")
+    });
+
+    let rows: Vec<TqConfigRow> = configs
+        .into_iter()
+        .map(|config| TqConfigRow {
+            epoch: config.epoch,
+            last_committed_epoch: config.last_committed_epoch,
+            state: format!("{:?}", config.state),
+            threshold: config.threshold.into(),
+            commit_crash_tolerance: config.commit_crash_tolerance.into(),
+            coordinator_hardware_baseboard_id: config.coordinator,
+            time_created: config.time_created,
+            time_committing: config.time_committing,
+            time_committed: config.time_committed,
+            time_aborted: config.time_aborted,
+            abort_reason: config.abort_reason,
+        })
+        .collect();
+
+    let table = tabled::Table::new(rows)
+        .with(tabled::settings::Style::empty())
+        .with(tabled::settings::Padding::new(0, 1, 0, 0))
+        .to_string();
+
+    println!("{}", table);
+
+    Ok(())
+}

dev-tools/omdb/tests/usage_errors.out

@@ -152,6 +152,7 @@ Commands:
   zpool                        Commands for querying and interacting with pools
   user-data-export             Commands for querying and interacting with user data export objects
   whatis                       Given a UUID, try to figure out what type of object it refers to
+  trust-quorum                 Print information about trust quorum configurations
   help                         Print this message or the help of the given subcommand(s)
 
 Options:
@@ -218,6 +219,7 @@ Commands:
   zpool                        Commands for querying and interacting with pools
   user-data-export             Commands for querying and interacting with user data export objects
   whatis                       Given a UUID, try to figure out what type of object it refers to
+  trust-quorum                 Print information about trust quorum configurations
   help                         Print this message or the help of the given subcommand(s)
 
 Options:

nexus/db-queries/src/db/datastore/trust_quorum.rs

@@ -7,6 +7,7 @@
 use super::DataStore;
 use crate::authz;
 use crate::context::OpContext;
+use crate::db::pagination::paginated;
 use async_bb8_diesel::AsyncRunQueryDsl;
 use chrono::Utc;
 use diesel::prelude::*;
@@ -27,7 +28,9 @@ use nexus_types::trust_quorum::{
     TrustQuorumConfig, TrustQuorumConfigState, TrustQuorumMemberData,
     TrustQuorumMemberState,
 };
+use omicron_common::api::external::DataPageParams;
 use omicron_common::api::external::Error;
+use omicron_common::api::external::ListResultVec;
 use omicron_common::api::external::LookupType;
 use omicron_common::api::external::OptionalLookupResult;
 use omicron_common::bail_unless;
@@ -177,6 +180,29 @@ impl DataStore {
             .map_err(|err| err.into_public_ignore_retries())
     }
 
+    pub async fn tq_list_config(
+        &self,
+        opctx: &OpContext,
+        rack_id: RackUuid,
+        pagparams: &DataPageParams<'_, i64>,
+    ) -> ListResultVec<DbTrustQuorumConfiguration> {
+        let authz_rack = authz::Rack::new(
+            authz::FLEET,
+            rack_id.into_untyped_uuid(),
+            LookupType::ById(rack_id.into_untyped_uuid()),
+        );
+        opctx.authorize(authz::Action::Read, &authz_rack).await?;
+        let conn = &*self.pool_connection_authorized(opctx).await?;
+
+        use nexus_db_schema::schema::trust_quorum_configuration::dsl;
+        paginated(dsl::trust_quorum_configuration, dsl::epoch, pagparams)
+            .filter(dsl::rack_id.eq(DbTypedUuid::<RackKind>::from(rack_id)))
+            .select(DbTrustQuorumConfiguration::as_select())
+            .load_async(conn)
+            .await
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))
+    }
+
     /// Get the trust quorum configuration from the database for the given Epoch
     pub async fn tq_get_config(
         &self,