Struct WrappedDek 

pub struct WrappedDek {
    pub dek_generation: u64,
    pub wraps: HashMap<String, Vec<u8>>,
}

The cluster data-encryption key (DEK), wrapped per-node so each member can decrypt without ever holding a shared cluster-wide private key.

The DEK itself is never stored anywhere; only the per-node sealed-box wraps live in Raft. A node decrypts its own wrap on startup using its node X25519 private key, and holds the unwrapped DEK in zeroized memory.

Generation increments on every rotation (e.g. node revocation, scheduled rotation, suspected compromise). Every ReplicatedSecret records the dek_generation it was encrypted under so re-encrypts can be batched.

Fields

dek_generation: u64

Monotonically increasing generation counter.

wraps: HashMap<String, Vec<u8>>

Map from node_id to that node’s sealed-box-wrapped copy of the DEK. A node missing from this map cannot decrypt any secret encrypted under this generation and must be re-wrapped via RegisterNode (or through a RotateDek that includes it).

Trait Implementations

impl Clone for WrappedDek

fn clone(&self) -> WrappedDek

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ComposeSchema for WrappedDek

fn compose(generics: Vec<RefOr<Schema>>) -> RefOr<Schema>

impl Debug for WrappedDek

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WrappedDek

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for WrappedDek

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToSchema for WrappedDek

fn name() -> Cow<'static, str>

Return name of the schema.

fn schemas(schemas: &mut Vec<(String, RefOr<Schema>)>)

Implement reference utoipa::openapi::schema::Schemas for this type.