feat(site): artifact apply writes deployed secrets and answers SecretsApplied
This commit is contained in:
Joseph Doherty
@@ -18,6 +18,7 @@ using ZB.MOM.WW.ScadaBridge.SiteRuntime.Messages;
|
||||
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
|
||||
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Repositories;
|
||||
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Scripts;
|
||||
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
|
||||
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Streaming;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Actors;
|
||||
@@ -49,6 +50,15 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
|
||||
/// external-system caching — the invalidation call is then simply skipped.
|
||||
/// </summary>
|
||||
private readonly ExternalSystemDefinitionCache? _externalSystemCache;
|
||||
/// <summary>
|
||||
/// Task 10 (site-secrets artifact deploy): per-node mirror reconciled synchronously by
|
||||
/// <see cref="HandleDeployArtifacts"/> right after the shipped secrets are written to
|
||||
/// <c>deployed_secrets</c>, so the reply's <c>SecretsApplied</c> reflects this node's own
|
||||
/// apply/verify outcome rather than the next periodic pass. Optional/null on nodes/tests
|
||||
/// that never register secret deployment — a shipped <c>command.Secrets</c> with no mirror
|
||||
/// registered fails the deploy (see <see cref="HandleDeployArtifacts"/>).
|
||||
/// </summary>
|
||||
private readonly DeployedSecretsMirror? _secretsMirror;
|
||||
private readonly SiteStreamManager? _streamManager;
|
||||
private readonly SiteRuntimeOptions _options;
|
||||
private readonly ILogger<DeploymentManagerActor> _logger;
|
||||
@@ -306,6 +316,12 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
|
||||
/// ensure-started heal uses; defaults to reading from <paramref name="storage"/>. Primarily
|
||||
/// for tests that need to hold the read open mid-flight to drive the row-101 race.
|
||||
/// </param>
|
||||
/// <param name="secretsMirror">
|
||||
/// Task 10 (site-secrets artifact deploy): this node's <see cref="DeployedSecretsMirror"/>,
|
||||
/// reconciled synchronously by <see cref="HandleDeployArtifacts"/> right after a shipped
|
||||
/// <c>command.Secrets</c> set is written to <c>deployed_secrets</c>. Optional/null on
|
||||
/// nodes/tests that never register secret deployment.
|
||||
/// </param>
|
||||
public DeploymentManagerActor(
|
||||
SiteStorageService storage,
|
||||
ScriptCompilationService compilationService,
|
||||
@@ -323,9 +339,11 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
|
||||
ExternalSystemDefinitionCache? externalSystemCache = null,
|
||||
ScriptExecutionScheduler? scriptScheduler = null,
|
||||
Func<Task<List<StoredDataConnectionDefinition>>>? connectionDefinitionLoader = null,
|
||||
Func<string, Task<DeployedInstance?>>? deployedConfigLoader = null)
|
||||
Func<string, Task<DeployedInstance?>>? deployedConfigLoader = null,
|
||||
DeployedSecretsMirror? secretsMirror = null)
|
||||
{
|
||||
_scriptScheduler = scriptScheduler;
|
||||
_secretsMirror = secretsMirror;
|
||||
_storage = storage;
|
||||
_compilationService = compilationService;
|
||||
_deployCompileValidator = new DeployCompileValidator(compilationService);
|
||||
@@ -3317,10 +3335,82 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
|
||||
// SMTP configuration is
|
||||
// central-only and is never stored on a site (see the purge above).
|
||||
|
||||
// Site-secrets artifact deploy (Task 10): write the shipped secrets to the
|
||||
// replicated deployed_secrets table, then reconcile THIS node's own mirror
|
||||
// synchronously — the reply's SecretsApplied must reflect this node's own
|
||||
// apply/verify outcome, not whatever the next periodic pass finds. A null
|
||||
// command.Secrets means "central didn't ship secrets" (old-central
|
||||
// compatible) and touches nothing; a non-null Secrets with no mirror
|
||||
// registered on this node fails the deploy rather than silently applying
|
||||
// nothing.
|
||||
int? secretsApplied = null;
|
||||
string? secretError = null;
|
||||
if (command.Secrets != null)
|
||||
{
|
||||
if (_secretsMirror == null)
|
||||
{
|
||||
if (command.Secrets.Count > 0)
|
||||
{
|
||||
secretError = "Secret deployment is not enabled on this site node";
|
||||
}
|
||||
else
|
||||
{
|
||||
secretsApplied = 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
_logger.LogInformation(
|
||||
"Applying {Count} deployed secret(s), deploymentId={DeploymentId}",
|
||||
command.Secrets.Count, command.DeploymentId);
|
||||
await _storage.UpsertDeployedSecretsAsync(command.Secrets, command.DeploymentId);
|
||||
var mirror = await _secretsMirror.ReconcileAsync(CancellationToken.None);
|
||||
|
||||
// The mirror reconciles the WHOLE site-wide deployed_secrets table
|
||||
// every pass — not only the names THIS deploy just shipped — so a
|
||||
// failure unrelated to this deploy's own secrets (another instance's
|
||||
// already-deployed secret still failing, or the removal of a
|
||||
// no-longer-referenced one) must never fail THIS response or show up
|
||||
// in its ErrorMessage. Only failures among the SHIPPED names count.
|
||||
var shippedNames = new HashSet<string>(
|
||||
command.Secrets.Select(s => s.Name), StringComparer.Ordinal);
|
||||
var shippedFailureMessages = new List<string>();
|
||||
var shippedFailedNames = new HashSet<string>(StringComparer.Ordinal);
|
||||
|
||||
for (var i = 0; i < mirror.FailedNames.Count; i++)
|
||||
{
|
||||
var failedName = mirror.FailedNames[i];
|
||||
var failedMessage = mirror.Failed[i];
|
||||
if (shippedNames.Contains(failedName))
|
||||
{
|
||||
shippedFailedNames.Add(failedName);
|
||||
shippedFailureMessages.Add(failedMessage);
|
||||
}
|
||||
else
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Deployed secrets mirror reported a failure unrelated to " +
|
||||
"this deploy ({DeploymentId}): {Failure}",
|
||||
command.DeploymentId, failedMessage);
|
||||
}
|
||||
}
|
||||
|
||||
// Never negative (ruling): shippedFailedNames is a set intersected
|
||||
// against the shipped names, so this can only go below zero if the
|
||||
// shipped list itself contains duplicate names.
|
||||
secretsApplied = Math.Max(0, command.Secrets.Count - shippedFailedNames.Count);
|
||||
if (shippedFailureMessages.Count > 0)
|
||||
{
|
||||
secretError = string.Join("; ", shippedFailureMessages);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Replicate artifacts to standby node
|
||||
|
||||
return new ArtifactDeploymentResponse(
|
||||
command.DeploymentId, "", true, null, DateTimeOffset.UtcNow);
|
||||
command.DeploymentId, "", secretError is null, secretError, DateTimeOffset.UtcNow,
|
||||
secretsApplied);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user