dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(site): artifact apply writes deployed secrets and answers SecretsApplied

Browse Source
This commit is contained in:
Joseph Doherty
2026-09-28 19:29:55 -04:00
parent 838fb4177b
commit 52cd4fb096
5 changed files with 466 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Secrets/DeployedSecretsMirror.cs
+34 -13
View File
@@ -17,8 +17,20 @@ namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
/// <param name="Applied">Names applied (inserted or updated) this pass.</param>
/// <param name="Removed">Names deleted this pass because they were previously mirrored and are now tombstoned upstream.</param>
/// <param name="Failed">One message per live secret that failed to apply and/or decrypt on this node — never includes secret values.</param>
/// <param name="FailedNames">
/// The secret name behind each <paramref name="Failed"/> entry, in the SAME order (index-for-
/// index — each pass reports at most one failure per row, so the two lists always stay in
/// lockstep). Added for <c>DeploymentManagerActor.HandleDeployArtifacts</c> (Task 10): this
/// mirror reconciles the WHOLE site-wide <c>deployed_secrets</c> table every pass, not only the
/// names a particular deploy just shipped, so a caller that needs to know whether a failure
/// belongs to ITS OWN shipped names — as opposed to some other, previously-deployed secret, or a
/// removal of a now-unreferenced one — cannot recover that from the message strings alone.
/// </param>
public sealed record MirrorResult(
IReadOnlyList<string> Applied, IReadOnlyList<string> Removed, IReadOnlyList<string> Failed)
IReadOnlyList<string> Applied,
IReadOnlyList<string> Removed,
IReadOnlyList<string> Failed,
IReadOnlyList<string> FailedNames)
{
/// <summary>Whether this pass applied or removed anything (used to decide the summary log level).</summary>
public bool Changed => Applied.Count > 0 || Removed.Count > 0;
@@ -209,6 +221,7 @@ public sealed class DeployedSecretsMirror : BackgroundService
List<string> applied = [];
List<string> removed = [];
List<string> failed = [];
List<string> failedNames = [];
foreach (var row in rows)
{
@@ -220,7 +233,7 @@ public sealed class DeployedSecretsMirror : BackgroundService
}
else
{
await ProcessLiveRowAsync(row, mirrored, applied, failed, ct).ConfigureAwait(false);
await ProcessLiveRowAsync(row, mirrored, applied, failed, failedNames, ct).ConfigureAwait(false);
}
}
catch (Exception ex) when (!ct.IsCancellationRequested)
@@ -229,11 +242,12 @@ public sealed class DeployedSecretsMirror : BackgroundService
row.Name,
$"error:{row.Secret.Revision}:{ex.GetType().Name}:{ex.Message}",
$"Secret '{row.Name}' failed to process on this node ({ex.GetType().Name}: {ex.Message})",
failed);
failed,
failedNames);
}
}
var result = new MirrorResult(applied, removed, failed);
var result = new MirrorResult(applied, removed, failed, failedNames);
if (result.Changed)
{
@@ -290,6 +304,7 @@ public sealed class DeployedSecretsMirror : BackgroundService
Dictionary<string, long> mirrored,
List<string> applied,
List<string> failed,
List<string> failedNames,
CancellationToken ct)
{
var name = new SecretName(row.Name);
@@ -323,7 +338,8 @@ public sealed class DeployedSecretsMirror : BackgroundService
$"outofband:{row.Secret.Revision}",
$"Secret '{row.Name}' exists on this node with a newer local value; " +
"the deployed revision was not applied",
failed);
failed,
failedNames);
return; // Do not verify — that would decrypt the operator's own value.
case ApplyOutcome.Unconfirmed:
@@ -332,12 +348,13 @@ public sealed class DeployedSecretsMirror : BackgroundService
$"unconfirmed:{row.Secret.Revision}",
$"Secret '{row.Name}' could not be confirmed applied on this node " +
"after a re-apply attempt",
failed);
failed,
failedNames);
return;
}
}
await VerifyAsync(row, failed, ct).ConfigureAwait(false);
await VerifyAsync(row, failed, failedNames, ct).ConfigureAwait(false);
}
/// <summary>The confirmed outcome of applying one shipped row into this node's store. See the class remarks.</summary>
@@ -419,7 +436,8 @@ public sealed class DeployedSecretsMirror : BackgroundService
/// verify it decrypts on this node. On failure, appends a message to
/// <paramref name="failed"/> and logs with the shared de-spam rule (see the class remarks).
/// </summary>
private async Task VerifyAsync(DeployedSecretRow row, List<string> failed, CancellationToken ct)
private async Task VerifyAsync(
DeployedSecretRow row, List<string> failed, List<string> failedNames, CancellationToken ct)
{
bool resolved;
try
@@ -444,17 +462,20 @@ public sealed class DeployedSecretsMirror : BackgroundService
var message =
$"Secret '{row.Name}' (kek {row.Secret.KekId}) did not decrypt on this node — " +
"the node's master key differs from central's";
ReportFailure(row.Name, $"decrypt:{row.Secret.Revision}:{row.Secret.KekId}", message, failed);
ReportFailure(row.Name, $"decrypt:{row.Secret.Revision}:{row.Secret.KekId}", message, failed, failedNames);
}
/// <summary>
/// Appends <paramref name="message"/> to <paramref name="failed"/> and logs it — Error the
/// first time <paramref name="fingerprint"/> is seen for <paramref name="name"/> since it
/// last succeeded, Debug on every identical repeat.
/// Appends <paramref name="message"/> to <paramref name="failed"/> (and <paramref name="name"/>
/// to <paramref name="failedNames"/>, in lockstep) and logs it — Error the first time
/// <paramref name="fingerprint"/> is seen for <paramref name="name"/> since it last
/// succeeded, Debug on every identical repeat.
/// </summary>
private void ReportFailure(string name, string fingerprint, string message, List<string> failed)
private void ReportFailure(
string name, string fingerprint, string message, List<string> failed, List<string> failedNames)
{
failed.Add(message);
failedNames.Add(name);
if (_lastLoggedFailure.TryGetValue(name, out var previous) && previous == fingerprint)
{