Enum SecretsRaftOp 

pub enum SecretsRaftOp {
    RegisterNode {
        identity: NodeIdentity,
    },
    RevokeNode {
        node_id: String,
    },
    RotateDek {
        new_wraps: WrappedDek,
    },
    PutSecret {
        secret: ReplicatedSecret,
    },
    DeleteSecret {
        storage_key: String,
    },
}

Op type for the secrets Raft state machine.

Replicated through openraft alongside the existing scheduler ops. zlayer-consensus carries the bytes; zlayer-secrets’s raft_sm.rs applies them. The variants intentionally mirror the structure of crate::storage::NodeIdentity, crate::storage::WrappedDek, and crate::storage::ReplicatedSecret so the wire shape is identical to the stored shape.

Variants

RegisterNode

Register a new node. Triggers an automatic re-wrap of the current DEK so the new node can decrypt secrets going forward.

Fields

identity: NodeIdentity

Identity payload (uuid, X25519 pubkey, WG pubkey, joined_at).

RevokeNode

Soft-revoke a node. Followers stop including it in DEK wraps; the next RotateDek excludes it permanently.

Fields

node_id: String

Cluster-wide node UUID being revoked.

RotateDek

Rotate the cluster DEK. The leader proposes a new generation with fresh per-node wraps; followers re-encrypt every ReplicatedSecret from the previous generation to the new one.

Fields

new_wraps: WrappedDek

New wrapped-DEK envelope (generation + per-node wraps).

PutSecret

Insert or update a secret. The ciphertext is encrypted under the dek_generation recorded inside the payload.

Fields

secret: ReplicatedSecret

The full replicated secret record.

DeleteSecret

Remove a secret entirely. Hard delete — re-encryption skips it.

Fields

storage_key: String

"{scope}:{name}" storage key, same shape as elsewhere.

Trait Implementations

impl Clone for SecretsRaftOp

fn clone(&self) -> SecretsRaftOp

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ComposeSchema for SecretsRaftOp

fn compose(generics: Vec<RefOr<Schema>>) -> RefOr<Schema>

impl Debug for SecretsRaftOp

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretsRaftOp

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretsRaftOp

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToSchema for SecretsRaftOp

fn name() -> Cow<'static, str>

Return name of the schema.

fn schemas(schemas: &mut Vec<(String, RefOr<Schema>)>)

Implement reference utoipa::openapi::schema::Schemas for this type.