|
| 1 | +#include "logging.h" |
| 2 | +#include "private_events.h" |
| 3 | +#include "secret_resolver.h" |
| 4 | + |
| 5 | +#include <ydb/core/tx/scheme_cache/scheme_cache.h> |
| 6 | +#include <ydb/library/actors/core/actor_bootstrapped.h> |
| 7 | +#include <ydb/library/actors/core/hfunc.h> |
| 8 | +#include <ydb/services/metadata/secret/fetcher.h> |
| 9 | +#include <ydb/services/metadata/secret/secret.h> |
| 10 | +#include <ydb/services/metadata/secret/snapshot.h> |
| 11 | +#include <ydb/services/metadata/service.h> |
| 12 | + |
| 13 | +namespace NKikimr::NReplication::NController { |
| 14 | + |
| 15 | +class TSecretResolver: public TActorBootstrapped<TSecretResolver> { |
| 16 | + static NMetadata::NFetcher::ISnapshotsFetcher::TPtr SnapshotFetcher() { |
| 17 | + return std::make_shared<NMetadata::NSecret::TSnapshotsFetcher>(); |
| 18 | + } |
| 19 | + |
| 20 | + void Handle(TEvTxProxySchemeCache::TEvNavigateKeySetResult::TPtr& ev) { |
| 21 | + const auto* response = ev->Get()->Request.Get(); |
| 22 | + |
| 23 | + Y_ABORT_UNLESS(response->ResultSet.size() == 1); |
| 24 | + const auto& entry = response->ResultSet.front(); |
| 25 | + |
| 26 | + LOG_T("Handle " << ev->Get()->ToString() |
| 27 | + << ": entry# " << entry.ToString()); |
| 28 | + |
| 29 | + switch (entry.Status) { |
| 30 | + case NSchemeCache::TSchemeCacheNavigate::EStatus::Ok: |
| 31 | + break; |
| 32 | + default: |
| 33 | + LOG_W("Unexpected status" |
| 34 | + << ": entry# " << entry.ToString()); |
| 35 | + return Schedule(RetryInterval, new TEvents::TEvWakeup); |
| 36 | + } |
| 37 | + |
| 38 | + if (!entry.SecurityObject) { |
| 39 | + return Reply(false, "Empty security object"); |
| 40 | + } |
| 41 | + |
| 42 | + SecretId = NMetadata::NSecret::TSecretId(entry.SecurityObject->GetOwnerSID(), SecretName); |
| 43 | + Send(NMetadata::NProvider::MakeServiceId(SelfId().NodeId()), |
| 44 | + new NMetadata::NProvider::TEvAskSnapshot(SnapshotFetcher())); |
| 45 | + } |
| 46 | + |
| 47 | + void Handle(NMetadata::NProvider::TEvRefreshSubscriberData::TPtr& ev) { |
| 48 | + const auto* snapshot = ev->Get()->GetSnapshotAs<NMetadata::NSecret::TSnapshot>(); |
| 49 | + |
| 50 | + TString secretValue; |
| 51 | + if (!snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(SecretId), secretValue)) { |
| 52 | + return Reply(false, TStringBuilder() << "Secret '" << SecretName << "' not found"); |
| 53 | + } |
| 54 | + |
| 55 | + Reply(secretValue); |
| 56 | + } |
| 57 | + |
| 58 | + template <typename... Args> |
| 59 | + void Reply(Args&&... args) { |
| 60 | + Send(Parent, new TEvPrivate::TEvResolveSecretResult(ReplicationId, std::forward<Args>(args)...)); |
| 61 | + PassAway(); |
| 62 | + } |
| 63 | + |
| 64 | +public: |
| 65 | + static constexpr NKikimrServices::TActivity::EType ActorActivityType() { |
| 66 | + return NKikimrServices::TActivity::REPLICATION_CONTROLLER_SECRET_RESOLVER; |
| 67 | + } |
| 68 | + |
| 69 | + explicit TSecretResolver(const TActorId& parent, ui64 rid, const TPathId& pathId, const TString& secretName) |
| 70 | + : Parent(parent) |
| 71 | + , ReplicationId(rid) |
| 72 | + , PathId(pathId) |
| 73 | + , SecretName(secretName) |
| 74 | + , LogPrefix("SecretResolver", ReplicationId) |
| 75 | + { |
| 76 | + } |
| 77 | + |
| 78 | + void Bootstrap() { |
| 79 | + if (!NMetadata::NProvider::TServiceOperator::IsEnabled()) { |
| 80 | + return Reply(false, "Metadata service is not active"); |
| 81 | + } |
| 82 | + |
| 83 | + auto request = MakeHolder<NSchemeCache::TSchemeCacheNavigate>(); |
| 84 | + |
| 85 | + auto& entry = request->ResultSet.emplace_back(); |
| 86 | + entry.TableId = PathId; |
| 87 | + entry.RequestType = NSchemeCache::TSchemeCacheNavigate::TEntry::ERequestType::ByTableId; |
| 88 | + entry.Operation = NSchemeCache::TSchemeCacheNavigate::OpPath; |
| 89 | + entry.RedirectRequired = false; |
| 90 | + |
| 91 | + Send(MakeSchemeCacheID(), new TEvTxProxySchemeCache::TEvNavigateKeySet(request.Release())); |
| 92 | + Become(&TThis::StateWork); |
| 93 | + } |
| 94 | + |
| 95 | + STATEFN(StateWork) { |
| 96 | + switch (ev->GetTypeRewrite()) { |
| 97 | + hFunc(TEvTxProxySchemeCache::TEvNavigateKeySetResult, Handle); |
| 98 | + hFunc(NMetadata::NProvider::TEvRefreshSubscriberData, Handle); |
| 99 | + sFunc(TEvents::TEvWakeup, Bootstrap); |
| 100 | + sFunc(TEvents::TEvPoison, PassAway); |
| 101 | + } |
| 102 | + } |
| 103 | + |
| 104 | +private: |
| 105 | + const TActorId Parent; |
| 106 | + const ui64 ReplicationId; |
| 107 | + const TPathId PathId; |
| 108 | + const TString SecretName; |
| 109 | + const TActorLogPrefix LogPrefix; |
| 110 | + |
| 111 | + static constexpr auto RetryInterval = TDuration::Seconds(1); |
| 112 | + NMetadata::NSecret::TSecretId SecretId; |
| 113 | + |
| 114 | +}; // TSecretResolver |
| 115 | + |
| 116 | +IActor* CreateSecretResolver(const TActorId& parent, ui64 rid, const TPathId& pathId, const TString& secretName) { |
| 117 | + return new TSecretResolver(parent, rid, pathId, secretName); |
| 118 | +} |
| 119 | + |
| 120 | +} |
0 commit comments