dohertj2/lmxopcua
1
0
Fork 0
Code Issues 12 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(mesh-phase4): DriverHostActor runs ConfigDb-free (LocalDb alarm store, guarded acks)

Browse Source 
Nullable ConfigDb factory; UpsertNodeDeploymentState no-ops when absent
(central persists acks from the ApplyAck); scripted-alarm condition state
served from the LocalDb store instead of the ConfigDb-backed Ef store.
Combines Phase-4 Tasks 4 + 6. Removes the interim dbFactory! cast.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
This commit is contained in:
Joseph Doherty
2026-07-23 12:39:41 -04:00
parent 4f4cdd05ec
commit d907160747
7 changed files with 466 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LocalDbRegistration.cs
+9
View File
@@ -2,7 +2,9 @@ using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using ZB.MOM.WW.LocalDb;
using ZB.MOM.WW.LocalDb.Replication;
using ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
using ZB.MOM.WW.OtOpcUa.Runtime.DeploymentCache;
using ZB.MOM.WW.OtOpcUa.Runtime.ScriptedAlarms;
namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
@@ -96,6 +98,13 @@ public static class LocalDbRegistration
// replicating, and never written to.
services.AddSingleton<IDeploymentArtifactCache, LocalDbDeploymentArtifactCache>();
// Per-cluster mesh Phase 4: scripted-alarm condition state served from the replicated LocalDb
// store instead of the ConfigDb-backed EF store, so a driver-only node (no ConfigDb) keeps its
// Part 9 condition state and mirrors it to its pair peer. Driver-role only, alongside the cache —
// admin-only nodes never register LocalDb. WithOtOpcUaRuntimeActors resolves it optionally and
// threads it into DriverHostActor's ScriptedAlarm engine. Singleton to match ILocalDb + the cache.
services.AddSingleton<IAlarmStateStore, LocalDbAlarmConditionStateStore>();
return services;
}
}
src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs
+112 -10
View File
@@ -97,7 +97,28 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
/// </remarks>
private bool _isRunningFromCache;
private readonly IDbContextFactory<OtOpcUaConfigDbContext> _dbFactory;
/// <summary>Latches after the first no-op ack-write on a DB-less node so the explanatory Debug line
/// is logged once, not on every apply state transition.</summary>
private bool _loggedNoConfigDbAck;
/// <summary>
/// Config database context factory, or <see langword="null"/> on a driver-only node (per-cluster
/// mesh Phase 4). A driver-only node has NO ConfigDb — LocalDb is its config store and central is
/// the ack system of record — so every ConfigDb-touching path here is guarded on this being
/// non-null. Non-null on a fused admin+driver node and in the Direct-mode/EF test harnesses.
/// </summary>
private readonly IDbContextFactory<OtOpcUaConfigDbContext>? _dbFactory;
/// <summary>
/// Scripted-alarm condition-state store handed to the ScriptedAlarm engine, or
/// <see langword="null"/> when none was wired (per-cluster mesh Phase 4). On a driver-role node
/// this is the replicated LocalDb store (<c>LocalDbAlarmConditionStateStore</c>) so condition
/// state survives without central SQL; when null the actor falls back to an
/// <see cref="EfAlarmConditionStateStore"/> over <see cref="_dbFactory"/> (legacy admin/Direct +
/// test harnesses), or — when there is no ConfigDb either — skips spawning the alarm host.
/// </summary>
private readonly IAlarmStateStore? _alarmStateStore;
private readonly CommonsNodeId _localNode;
private readonly IActorRef? _ackRouter;
private readonly IDriverFactory _driverFactory;
@@ -375,9 +396,14 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
/// <param name="invokerFactory">Optional Phase 6.1 resilience-invoker factory used to attach an
/// <see cref="IDriverCapabilityInvoker"/> to each spawned driver; defaults to
/// <see cref="NullDriverCapabilityInvokerFactory"/> (pass-through) when not supplied.</param>
/// <param name="alarmStateStore">Per-cluster mesh Phase 4: scripted-alarm condition-state store. On a
/// driver-role node this is the replicated LocalDb store, so condition state persists with no
/// ConfigDb; null falls back to an <see cref="EfAlarmConditionStateStore"/> over
/// <paramref name="dbFactory"/> (legacy admin/Direct + test harnesses), or skips the alarm host when
/// there is no ConfigDb either. Defaults to null.</param>
/// <returns>The Akka.NET <see cref="Akka.Actor.Props"/> used to spawn this actor.</returns>
public static Props Props(
IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
CommonsNodeId localNode,
IActorRef? ackRouter = null,
IDriverFactory? driverFactory = null,
@@ -397,7 +423,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
IRedundancyRoleView? redundancyRoleView = null,
string? replicationPeerHost = null,
bool fetchAndCacheMode = false,
IDeploymentArtifactFetcher? artifactFetcher = null) =>
IDeploymentArtifactFetcher? artifactFetcher = null,
IAlarmStateStore? alarmStateStore = null) =>
// WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
// expression tree. Six IActorRef? parameters and several interface-typed ones mean a
// mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -407,7 +434,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
dbFactory, localNode, ackRouter, driverFactory, localRoles, dependencyMux, opcUaPublishActor,
healthPublisher, virtualTagEvaluator, historyWriter, virtualTagHostOverride,
loggerFactory, scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher));
deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
alarmStateStore));
/// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
/// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -442,8 +470,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
/// When supplied, each successful apply stores its artifact so the node can boot from its
/// last-known-good configuration while central SQL is unreachable. Null on admin-only nodes and in
/// tests that do not exercise the cache — caching is then simply skipped.</param>
/// <param name="alarmStateStore">Per-cluster mesh Phase 4: scripted-alarm condition-state store. On a
/// driver-role node this is the replicated LocalDb store; null falls back to an
/// <see cref="EfAlarmConditionStateStore"/> over <paramref name="dbFactory"/>, or skips the alarm
/// host when there is no ConfigDb either.</param>
public DriverHostActor(
IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
CommonsNodeId localNode,
IActorRef? ackRouter,
IDriverFactory? driverFactory = null,
@@ -463,13 +495,15 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
IRedundancyRoleView? redundancyRoleView = null,
string? replicationPeerHost = null,
bool fetchAndCacheMode = false,
IDeploymentArtifactFetcher? artifactFetcher = null)
IDeploymentArtifactFetcher? artifactFetcher = null,
IAlarmStateStore? alarmStateStore = null)
{
_deploymentArtifactCache = deploymentArtifactCache;
_redundancyRoleView = redundancyRoleView;
_replicationPeerHost = replicationPeerHost;
_fetchAndCacheMode = fetchAndCacheMode;
_artifactFetcher = artifactFetcher;
_alarmStateStore = alarmStateStore;
_dbFactory = dbFactory;
_localNode = localNode;
_ackRouter = ackRouter;
@@ -583,9 +617,31 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
return;
}
// Per-cluster mesh Phase 4: prefer the wired condition-state store (the replicated LocalDb store
// on a driver-role node — it persists with no ConfigDb). Only when no store was wired do we fall
// back to the ConfigDb-backed EF store, and only if there IS a ConfigDb (legacy admin/Direct +
// test harnesses). A driver-only node has neither — nowhere to persist condition state — so it
// skips the alarm host outright rather than constructing an EF store over a null factory that
// would NRE the moment the engine touched it (mirrors the _opcUaPublishActor-null skip above).
IAlarmStateStore store;
if (_alarmStateStore is not null)
{
store = _alarmStateStore;
}
else if (_dbFactory is not null)
{
store = new EfAlarmConditionStateStore(
_dbFactory, _loggerFactory.CreateLogger<EfAlarmConditionStateStore>());
}
else
{
_log.Debug(
"DriverHost {Node}: skipping ScriptedAlarm host spawn (no condition-state store and no ConfigDb)",
_localNode);
return;
}
var upstream = new DependencyMuxTagUpstreamSource();
var store = new EfAlarmConditionStateStore(
_dbFactory, _loggerFactory.CreateLogger<EfAlarmConditionStateStore>());
var engine = new ScriptedAlarmEngine(
upstream, store, new ScriptLoggerFactory(_scriptRootLogger.Logger), _scriptRootLogger.Logger);
_scriptedAlarmHost = Context.ActorOf(
@@ -603,6 +659,17 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
return;
}
// Belt-and-suspenders (Phase 4): every ConfigDb read below is on the Direct path only — a
// FetchAndCache node already returned via BootstrapFromCache above, and only a FetchAndCache node
// runs DB-less. If a null factory ever reaches a Direct path it is a misconfiguration; enter
// Steady with no revision rather than NRE, and let the first dispatch drive the apply.
if (_dbFactory is null)
{
_log.Info("DriverHost {Node}: no ConfigDb on the Direct bootstrap path; entering Steady (no revision)", _localNode);
Become(Steady);
return;
}
// Read the most-recent NodeDeploymentState for this node; if it's Applied, jump
// to Steady with that revision. If Applying (orphan from a crash), discard and replay.
// If the DB is unreachable, fall back to Stale and start the reconnect loop.
@@ -1914,6 +1981,15 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
/// </remarks>
private byte[]? ReconcileDrivers(DeploymentId deploymentId)
{
// Phase 4 belt-and-suspenders: this ConfigDb read is Direct-only (the FetchAndCache apply uses
// ReconcileDriversFromBlob with bytes in hand). A null factory can't read, so return null — the
// caller treats that as "artifact could not be read" (#486) and keeps last-known-good.
if (_dbFactory is null)
{
_log.Warning("DriverHost {Node}: no ConfigDb to load artifact for {Id}; skipping reconcile", _localNode, deploymentId);
return null;
}
byte[] blob;
try
{
@@ -2090,6 +2166,14 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
/// </summary>
private void PushDesiredSubscriptions(DeploymentId deploymentId)
{
// Phase 4 belt-and-suspenders: Direct-only read (the FetchAndCache path calls
// PushDesiredSubscriptionsFromArtifact with bytes in hand). No ConfigDb ⇒ nothing to load.
if (_dbFactory is null)
{
_log.Warning("DriverHost {Node}: no ConfigDb to load artifact for SubscribeBulk ({Id}); skipping", _localNode, deploymentId);
return;
}
byte[] blob;
try
{
@@ -2575,8 +2659,9 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
{
// Defensive: FetchAndCache never enters Stale (BootstrapFromCache always Becomes Steady, so
// the retry-db timer that drives this is never started), and its recovery must NOT read
// central SQL. If we somehow land here, leave Steady rather than re-reading Deployments.
if (_fetchAndCacheMode)
// central SQL. A DB-less node (null factory, Phase 4) likewise has nothing to recover from. If
// we somehow land here, leave Steady rather than re-reading Deployments.
if (_fetchAndCacheMode || _dbFactory is null)
{
Timers.Cancel("retry-db");
Become(Steady);
@@ -2612,6 +2697,23 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
private void UpsertNodeDeploymentState(DeploymentId deploymentId, NodeDeploymentStatus status, string? failureReason)
{
// Per-cluster mesh Phase 4: a driver-only node has NO ConfigDb. Central is the ack system of
// record — ConfigPublishCoordinator.PersistNodeAck already writes NodeDeploymentState from every
// ApplyAck it receives (and seeds the Applying rows at dispatch) — so this node's own upsert is
// redundant and simply no-ops here with no loss of information. Logged once to keep the reason
// discoverable without spamming every apply transition.
if (_dbFactory is null)
{
if (!_loggedNoConfigDbAck)
{
_loggedNoConfigDbAck = true;
_log.Debug(
"DriverHost {Node}: no ConfigDb — NodeDeploymentState written by central from the ApplyAck",
_localNode);
}
return;
}
try
{
using var db = _dbFactory.CreateDbContext();
src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs
+15 -9
View File
@@ -18,6 +18,7 @@ using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
using ZB.MOM.WW.OtOpcUa.Configuration;
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
using ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian;
using ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
using ZB.MOM.WW.OtOpcUa.Core.Scripting;
using ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
using ZB.MOM.WW.OtOpcUa.OpcUaServer;
@@ -282,6 +283,12 @@ public static class ServiceCollectionExtensions
// harnesses) rather than given a null-object, so DriverHostActor skips caching outright
// instead of pretending to cache into a sink that drops everything.
var deploymentArtifactCache = resolver.GetService<IDeploymentArtifactCache>();
// Per-cluster mesh Phase 4: scripted-alarm condition-state store. Registered by the Host's
// AddOtOpcUaLocalDb on driver-role nodes (the replicated LocalDb store), so condition state
// persists with no ConfigDb; null elsewhere (admin-only graphs, test harnesses) → the actor
// falls back to an EfAlarmConditionStateStore over dbFactory, or skips the alarm host when
// there is no ConfigDb either.
var alarmStateStore = resolver.GetService<IAlarmStateStore>();
// Per-cluster mesh Phase 3: ConfigSource:Mode selects where this driver reads config.
// FetchAndCache pulls the artifact from central over gRPC and reads only the LocalDb cache;
// Direct (default) reads central SQL as before. The fetcher is resolved only in FetchAndCache
@@ -462,14 +469,12 @@ public static class ServiceCollectionExtensions
// ackRouter: under ClusterClient mode the node comm actor relays ApplyAcks across
// the boundary; under Dps it stays null and the host publishes on the
// deployment-acks topic exactly as before.
// dbFactory! — KNOWN INTERIM. A driver-only node genuinely passes a null factory here
// (ConfigDb is now gated on hasAdmin, and driver-only nodes are forced to FetchAndCache),
// so DriverHostActor's ConfigDb-touching paths — scripted-alarm state persistence
// (EfAlarmConditionStateStore) and UpsertNodeDeploymentState — fault-and-swallow until
// Task 4 makes the factory nullable + guards those sites (and removes this !) and Task 6
// re-homes the alarm store to LocalDb. Inert in practice: no driver-only node is
// configured to boot until the Task 10 rig change.
DriverHostActor.Props(dbFactory!, roleInfo.LocalNode,
// dbFactory is nullable (Phase 4): a driver-only node passes null here — ConfigDb is
// gated on hasAdmin and driver-only nodes are forced to FetchAndCache. DriverHostActor
// guards every ConfigDb-touching path on it (UpsertNodeDeploymentState no-ops; central
// persists acks from the ApplyAck) and serves scripted-alarm state from the LocalDb
// alarmStateStore instead of an EfAlarmConditionStateStore.
DriverHostActor.Props(dbFactory, roleInfo.LocalNode,
ackRouter: useClusterClient ? nodeComm : null,
driverFactory: driverFactory, localRoles: roleInfo.LocalRoles,
dependencyMux: mux,
@@ -484,7 +489,8 @@ public static class ServiceCollectionExtensions
redundancyRoleView: redundancyRoleView,
replicationPeerHost: replicationPeerHost,
fetchAndCacheMode: fetchAndCacheMode,
artifactFetcher: artifactFetcher),
artifactFetcher: artifactFetcher,
alarmStateStore: alarmStateStore),
DriverHostActorName);
registry.Register<DriverHostActorKey>(driverHost);