refactor(api): move resource initialization into api crate

[poroh]

Reduce the scope and growth of carbide-api-core by moving process initialization into the carbide-api composition crate. This PR moves database, Vault, credential, certificate, KMS, and secret-import setup without intended functional or configuration changes.

This is the third change in a planned series:

1. Move logging initialization and the top-level run entry point - refactor(api): move logging initialization into api crate #3851.
2. Move metrics initialization, the metrics endpoint, and process task ownership - refactor(api): move metrics initialization into api crate #3860.
3. Move database, Vault, credentials, certificates, KMS, and secret-import setup - this PR.
4. Move dynamic settings, IPMI, Redfish, RMS, InfiniBand, NMX-C, DPF, and component-manager client setup.

The existing credential routing, certificate configuration, KMS validation, Vault import behavior, and database pool configuration are preserved. Dependencies no longer used by api-core move with the implementation.

Related issues

#3851
#3860

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

This PR is stacked on #3860 and should merge after it.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary by CodeRabbit

• New Features

  • Added centralized runtime resource setup for database, certificate, credential, and secrets services.
  • Added support for selecting the IPMI tool implementation at runtime.
  • Added startup configuration handling and Vault import session coordination.

• Improvements

  • Streamlined API startup by reusing preconfigured runtime resources.
  • Added validation for database pool settings and secrets configuration.

Walkthrough

The API crate now initializes shared runtime resources, including Postgres, credentials, certificates, KMS, and optional Vault import state. api-core receives these resources through CoreRunInputs, while startup logging and dynamic settings initialization move into reusable bootstrap wiring.

Changes

Runtime resource initialization

Layer / File(s)	Summary
Resource assembly and database setup crates/api/src/resources.rs, crates/api/src/lib.rs, crates/api/Cargo.toml	Adds RuntimeResources and builds Vault, certificate, Postgres, local credential, and configured fallback-store resources with pool validation and TLS settings.
KMS routing and Vault import crates/api/src/resources.rs, crates/api-core/src/bootstrap.rs	Builds routed KMS providers and performs a session-locked, one-time strict Vault-to-Postgres secrets import.
Injected core startup dependencies crates/api-core/src/bootstrap.rs, crates/api-core/src/run.rs, crates/api-core/src/setup.rs, crates/api/src/run.rs, crates/api-core/Cargo.toml	Adds dynamic-settings startup, changes CoreRunInputs to accept injected resources, wires them from API startup, and removes duplicate pool and secret initialization from api-core.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant API
  participant setup_resources
  participant Postgres
  participant Vault
  participant api_core
  API->>setup_resources: initialize RuntimeResources
  setup_resources->>Postgres: connect and validate pool configuration
  setup_resources->>Vault: build clients and optionally import secrets
  setup_resources-->>API: return injected resources
  API->>api_core: invoke run_core with resources and DynamicSettings

Loading

Possibly related PRs

• NVIDIA/infra-controller#3851: Refactors API startup wiring and CoreRunInputs around externally provided runtime setup.
• NVIDIA/infra-controller#3860: Earlier CoreRunInputs changes provide the basis for externally supplied telemetry and task orchestration.
• NVIDIA/infra-controller#3872: Also modifies the Vault one-time import path in api-core/src/run.rs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: moving resource initialization into the api crate.
Description check	✅ Passed	The description matches the refactor and its scope, including moving database, Vault, credential, certificate, KMS, and secret-import setup.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-3864.docs.buildwithfern.com/infra-controller

[coderabbitai]

🧹 Nitpick comments (1)

crates/api-core/src/bootstrap.rs (1)

67-67: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use % formatting for listen_address.

Avoid eagerly allocating a String and recording it with Debug formatting; pass the existing Display value directly.

Proposed fix

-        listen_address = carbide_config.listen.to_string(),
+        listen_address = %carbide_config.listen,

As per coding guidelines, use % for Display values in structured tracing fields.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/api-core/src/bootstrap.rs` at line 67, Update the structured tracing
field for listen_address in the surrounding bootstrap configuration to use `%`
formatting with carbide_config.listen directly, replacing the eager to_string()
conversion and Debug-style recording while preserving the existing field name.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/api-core/src/bootstrap.rs`:
- Line 67: Update the structured tracing field for listen_address in the
surrounding bootstrap configuration to use `%` formatting with
carbide_config.listen directly, replacing the eager to_string() conversion and
Debug-style recording while preserving the existing field name.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 056220cd-dcf2-4003-a476-35b86c8456f0

📥 Commits

Reviewing files that changed from the base of the PR and between d665b1d and ed195f3.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• crates/api-core/Cargo.toml
• crates/api-core/src/bootstrap.rs
• crates/api-core/src/run.rs
• crates/api-core/src/setup.rs
• crates/api/Cargo.toml
• crates/api/src/lib.rs
• crates/api/src/resources.rs
• crates/api/src/run.rs

🚧 Files skipped from review as they are similar to previous changes (7)

• crates/api/src/lib.rs
• crates/api-core/Cargo.toml
• crates/api/Cargo.toml
• crates/api/src/run.rs
• crates/api-core/src/setup.rs
• crates/api-core/src/run.rs
• crates/api/src/resources.rs