rustfs_targets/runtime/tls/
trait.rs

1// Copyright 2024 RustFS Team
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! The `ReloadableTargetTls` trait — the public protocol each TLS-capable
16//! target implements to participate in coordinated hot-reload.
17
18use crate::error::TargetError;
19use async_trait::async_trait;
20use std::sync::Arc;
21
22use super::config::ReloadApplyMode;
23use super::fingerprint::TargetTlsGeneration;
24use super::state::TargetTlsInputSet;
25
26/// Protocol that each TLS-capable target implements so the reload coordinator
27/// can drive certificate hot-reload without knowing the target's internals.
28///
29/// The target is responsible for:
30/// - Declaring which TLS files it reads (`tls_input_set`)
31/// - Building a new client/pool/connector from current files (`build_tls_material`)
32/// - Atomically swapping the active connection state (`apply_tls_material`)
33///
34/// The coordinator is responsible for:
35/// - Deciding *when* to check
36/// - Detecting *whether* material changed
37/// - Ensuring *safety* (validate, build-then-apply, fallback on failure)
38#[async_trait]
39pub trait ReloadableTargetTls: Send + Sync + 'static {
40    /// The rebuilt connection/client/pool object this target uses.
41    type Material: Send + Sync + 'static;
42
43    /// Returns the TLS file paths this target reads.
44    fn tls_input_set(&self) -> TargetTlsInputSet;
45
46    /// Build a fresh TLS material object from current files on disk.
47    ///
48    /// Called by the coordinator on the reload path only — never on the send hot path.
49    async fn build_tls_material(&self) -> Result<Self::Material, TargetError>;
50
51    /// Atomically apply new TLS material, replacing the current active connection state.
52    ///
53    /// On success, the target's internal state must point to the new material.
54    /// On failure, the target must keep its current state unchanged.
55    async fn apply_tls_material(
56        &self,
57        generation: TargetTlsGeneration,
58        material: Arc<Self::Material>,
59        mode: ReloadApplyMode,
60    ) -> Result<(), TargetError>;
61
62    /// Optional pre-check: validate that TLS files on disk are self-consistent
63    /// (cert/key pair parseable, CA loadable) before attempting `build_tls_material`.
64    /// Default implementation returns `Ok(())`.
65    async fn validate_tls_files(&self) -> Result<(), TargetError> {
66        Ok(())
67    }
68}
rustfs_targets/runtime/tls/trait.rs

rustfs_targets/runtime/tls/
trait.rs
