Enum SecretsRaftOp 

pub enum SecretsRaftOp {
    RegisterNode {
        identity: NodeIdentity,
    },
    RevokeNode {
        node_id: String,
    },
    RotateDek {
        new_wraps: WrappedDek,
    },
    PutSecret {
        secret: ReplicatedSecret,
    },
    DeleteSecret {
        storage_key: String,
    },
    RevokeToken {
        token_hash: String,
        expires_at: DateTime<Utc>,
    },
    ImportTrustBundle {
        bundle: TrustBundle,
    },
    RemoveTrustBundle {
        cluster_domain: String,
    },
    SetJwtAlgorithm {
        algorithm: JwtAlgorithm,
    },
    WipeJoinSecret,
}

Op type for the secrets Raft state machine.

Replicated through openraft alongside the existing scheduler ops. zlayer-consensus carries the bytes; zlayer-secrets’s raft_sm.rs applies them. The variants intentionally mirror the structure of crate::storage::NodeIdentity, crate::storage::WrappedDek, and crate::storage::ReplicatedSecret so the wire shape is identical to the stored shape.

Variants

RegisterNode

Register a new node. Triggers an automatic re-wrap of the current DEK so the new node can decrypt secrets going forward.

Fields

identity: NodeIdentity

Identity payload (uuid, X25519 pubkey, WG pubkey, joined_at).

RevokeNode

Soft-revoke a node. Followers stop including it in DEK wraps; the next RotateDek excludes it permanently.

Fields

node_id: String

Cluster-wide node UUID being revoked.

RotateDek

Rotate the cluster DEK. The leader proposes a new generation with fresh per-node wraps; followers re-encrypt every ReplicatedSecret from the previous generation to the new one.

Fields

new_wraps: WrappedDek

New wrapped-DEK envelope (generation + per-node wraps).

PutSecret

Insert or update a secret. The ciphertext is encrypted under the dek_generation recorded inside the payload.

Fields

secret: ReplicatedSecret

The full replicated secret record.

DeleteSecret

Remove a secret entirely. Hard delete — re-encryption skips it.

Fields

storage_key: String

"{scope}:{name}" storage key, same shape as elsewhere.

RevokeToken

Revoke a specific issued join token (cannot be unrevoked).

The token is identified by token_hash, which is the lowercase hex SHA-256 of the full token envelope b64 string (same hash form regardless of token format — Ed25519-signed envelope, HS256-JWT, or future EdDSA-JWT). The entry auto-expires at expires_at so the revocation table stays bounded by the un-expired token horizon.

Fields

token_hash: String

Lowercase hex SHA-256 of the full token b64 envelope string.

expires_at: DateTime<Utc>

Wall-clock instant at which the revocation entry may be pruned. Should match the token’s own exp claim so the entry is no longer needed once the token would have expired anyway.

ImportTrustBundle

Import a foreign cluster’s trust bundle so its tokens can be accepted by validators on this cluster.

Idempotent: re-importing the same cluster_domain overwrites the previous entry. Keyed by cluster_domain to enforce one trust relationship per foreign cluster.

Fields

bundle: TrustBundle

The bundle to record in SecretsState::trusted_bundles.

RemoveTrustBundle

Remove a previously-imported trust bundle.

No-op if cluster_domain was not present. Used by the operator when revoking trust in a federated cluster.

Fields

cluster_domain: String

Cluster domain of the bundle to remove.

SetJwtAlgorithm

Set the cluster-wide JWT algorithm policy.

Replicated through Raft so every node enforces the same policy within one commit. Idempotent — re-applying with the same value is a no-op.

Fields

algorithm: JwtAlgorithm

New policy.

WipeJoinSecret

Mark {data_dir}/join_secret as wiped on every node.

Operator-driven cleanup after migrating to eddsa. The actual file-system delete happens locally on each node when this op applies; the state machine records the wipe timestamp so re-applies are no-ops. Idempotent.

Trait Implementations

impl Clone for SecretsRaftOp

fn clone(&self) -> SecretsRaftOp

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ComposeSchema for SecretsRaftOp

fn compose(generics: Vec<RefOr<Schema>>) -> RefOr<Schema>

impl Debug for SecretsRaftOp

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretsRaftOp

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretsRaftOp

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToSchema for SecretsRaftOp

fn name() -> Cow<'static, str>

Return name of the schema.

fn schemas(schemas: &mut Vec<(String, RefOr<Schema>)>)

Implement reference utoipa::openapi::schema::Schemas for this type.