feat(mesh): per-cluster PSK provider + central interceptor

2026-08-06 03:43:05 -04:00
parent fbda015c6e
commit 68a416e4fc
6 changed files with 1000 additions and 5 deletions
@@ -19,6 +19,10 @@
             Google.Protobuf + Grpc.Core.Api flow transitively from Commons (the generated client). -->
        <PackageReference Include="Grpc.Net.Client"/>
        <PackageReference Include="ZB.MOM.WW.Audit"/>
+        <!-- ClusterClient→gRPC: MeshPskProvider resolves OT-MESH-PSK-{clusterId} from the shared
+             secret store when MeshTransport:ClusterPsks carries no override. Abstractions only —
+             the concrete store is the host's choice (SecretsRegistration), not the control plane's. -->
+        <PackageReference Include="ZB.MOM.WW.Secrets.Abstractions"/>
        <!-- For ClusterActiveNode — the shared "oldest Up member of role X" primitive. The control
             plane and the /health/active tier must give the SAME answer for which node is in charge,
             or the tier reports one node active while the Primary-gated data plane runs on another;