aikido-zen 1.6.0.beta.2-x86_64-linux → 1.6.0.beta.3-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3d8de55879068a1e6a493f92249e0fa45eb81f6c62e0d9cd394a5d5fdfaf67b
-  data.tar.gz: 3855e4258a4f0b2f5460e3fe7e8b01aee2411768caea73e4474c948049064663
+  metadata.gz: 0cfb69a5bed0b27963e8ce425a3d33d666ba0ade8a66e2200bfcd60e1e20b31e
+  data.tar.gz: 9b47e0050d128414e54364832feb39fe2b2c1369bbc98b5577e698b614ea3f43
 SHA512:
-  metadata.gz: 6c75e5dca4aaca6990f4345717b16d3bde23c50697d286b21db5add90c2739994a2d18713fec73ccf18fe60f1a62cefcee929c42e5f97ea2f59219e620698916
-  data.tar.gz: 66068d2a681434dc75baaf64c9dd4cd2128fac15deacdfbb9c1551903c7b437fa9f5bcf5ff8975bc60d43e523cb175a9cf9e91ba5f4b0085613933f83a864c3c
+  metadata.gz: 84b6bc153690841b5248cf967895d3fac2c1a156875f5aeac99c5fde73dfa0b4f90a77cd433caf5e08903fdba09f460480fd99f3f3aa82af42da7ce344ba5dd1
+  data.tar.gz: a959daa6efaa89679897a7d402b3b051b1e9a289e3d9d0ad6ce3c2c2bb4e23f6cdc163df1583cd92a6f0adcd7654c159bd6ec9fc647547d6c98411340b3b0939

data/lib/aikido/zen/agent.rb

@@ -59,26 +59,36 @@ module Aikido::Zen
         return
       end
 
+      # Code coverage is disabled here because the block is only called when
+      # the process exits.
+      # :nocov:
       at_exit { stop! if started? }
+      # :nocov:
 
       report(Events::Started.new(time: @started_at)) do |response|
-        if update_settings_from_runtime_config!(response)
+        if update_settings_from_runtime_config!(response, reason: "after start")
           updated_settings!
-          @config.logger.info("Updated runtime settings")
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       rescue => err
         @config.logger.error(err.message)
       end
 
       begin
-        update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-        @config.logger.info("Updated runtime firewall list")
+        update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after start")
       rescue => err
         @config.logger.error(err.message)
       end
 
       if @config.realtime_settings_updates_enabled?
-        @api_stream.handle("config-updated") { |event| settings_updated(event) }
+        @api_stream.handle("config-updated") do |event|
+          @config.logger.debug("Received server-sent event: config-updated")
+          settings_updated(event)
+        end
+
         @api_stream.start!
       end
 
@@ -167,13 +177,15 @@ module Aikido::Zen
 
       heartbeat = @collector.flush
       report(heartbeat) do |response|
-        if update_settings_from_runtime_config!(response)
+        if update_settings_from_runtime_config!(response, reason: "after heartbeat")
           updated_settings!
-          @config.logger.info("Updated runtime settings after heartbeat")
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after heartbeat")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after heartbeat")
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       end
     end
 
@@ -187,13 +199,15 @@ module Aikido::Zen
     def poll_for_setting_updates
       @worker.every(@config.polling_interval) do
         if @api_client.should_fetch_settings?
-          if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
+          if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after polling")
             updated_settings!
-            @config.logger.info("Updated runtime settings after polling")
+          # :nocov:
+          else
+            # empty
           end
+          # :nocov:
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after polling")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after polling")
         end
       end
     end
@@ -204,13 +218,15 @@ module Aikido::Zen
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 
       if should_fetch_settings?(updated_at)
-        if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
+        if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after server-sent event")
           updated_settings!
-          @config.logger.info("Updated runtime settings after server-side event")
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after server-side event")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after server-sent event")
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       end
     end
 
@@ -229,24 +245,44 @@ module Aikido::Zen
     end
 
     # @param data [Hash]
-    # @return [Boolean]
-    def update_settings_from_runtime_config!(data)
+    # @param reason [String] context appended to the log message when logged
+    # @return [Boolean] whether the settings were updated; or nil if another
+    #   thread is already applying an update.
+    def update_settings_from_runtime_config!(data, reason:)
+      # :nocov:
       return unless @runtime_config_update_mutex.try_lock
+      # :nocov:
       begin
-        Aikido::Zen.api_cache.runtime_config = data
-        Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+        return false unless Aikido::Zen.api_cache.update_runtime_config(data)
+
+        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+          @config.logger.info("Updated runtime settings #{reason}")
+          true
+        else
+          false
+        end
       ensure
         @runtime_config_update_mutex.unlock
       end
     end
 
     # @param data [Hash]
-    # @return [Boolean]
-    def update_settings_from_runtime_firewall_lists!(data)
+    # @param reason [String] context appended to the log message when logged
+    # @return [Boolean] whether the settings were updated; or nil if another
+    #   thread is already applying an update.
+    def update_settings_from_runtime_firewall_lists!(data, reason:)
+      # :nocov:
       return unless @runtime_firewall_lists_update_mutex.try_lock
+      # :nocov:
       begin
-        Aikido::Zen.api_cache.runtime_firewall_lists = data
-        Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+        return false unless Aikido::Zen.api_cache.update_runtime_firewall_lists(data)
+
+        if Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+          @config.logger.info("Updated runtime firewall list #{reason}")
+          true
+        else
+          false
+        end
       ensure
         @runtime_firewall_lists_update_mutex.unlock
       end

data/lib/aikido/zen/api_cache.rb

@@ -2,7 +2,60 @@
 
 module Aikido::Zen
   class APICache
-    attr_accessor :runtime_config
-    attr_accessor :runtime_firewall_lists
+    attr_reader :runtime_config
+    attr_reader :runtime_firewall_lists
+    attr_reader :runtime_config_generation
+    attr_reader :runtime_firewall_lists_generation
+
+    def initialize
+      @runtime_config_generation = 0
+      @runtime_firewall_lists_generation = 0
+    end
+
+    def runtime_config=(value)
+      update_runtime_config(value)
+    end
+
+    def runtime_firewall_lists=(value)
+      update_runtime_firewall_lists(value)
+    end
+
+    # @param value [Hash, nil]
+    # @return [Boolean] whether the value actually changed
+    def update_runtime_config(value)
+      return false if value == @runtime_config
+
+      @runtime_config_generation += 1
+      @runtime_config = value
+
+      true
+    end
+
+    # @param value [Hash, nil]
+    # @return [Boolean] whether the value actually changed
+    def update_runtime_firewall_lists(value)
+      return false if value == @runtime_firewall_lists
+
+      @runtime_firewall_lists_generation += 1
+      @runtime_firewall_lists = value
+
+      true
+    end
+
+    # @param known_generation [Integer, nil]
+    # @return [Array(Object, Integer), nil] the current value and generation,
+    #   or nil if the known generation is already current.
+    def config_if_changed(known_generation)
+      return nil if known_generation == runtime_config_generation
+      [runtime_config, runtime_config_generation]
+    end
+
+    # @param known_generation [Integer, nil]
+    # @return [Array(Object, Integer), nil] the current value and generation,
+    #   or nil if the known generation is already current.
+    def firewall_lists_if_changed(known_generation)
+      return nil if known_generation == runtime_firewall_lists_generation
+      [runtime_firewall_lists, runtime_firewall_lists_generation]
+    end
   end
 end

data/lib/aikido/zen/api_stream.rb

@@ -116,12 +116,18 @@ module Aikido::Zen
       http.open_timeout = @open_timeout
       http.write_timeout = @write_timeout
       http.read_timeout = @read_timeout
+      # Working around Net::HTTP cleverness; retries GET requests once by default.
       http.max_retries = 0
 
       request = Net::HTTP::Get.new("/api/runtime/stream")
       request["Authorization"] = @token
       request["Accept"] = "text/event-stream"
       request["Cache-Control"] = "no-cache"
+      request["X-Agent-Platform"] = "ruby"
+      request["X-Agent-Version"] = Aikido::Zen::VERSION
+      # Working around Net::HTTP cleverness; auto-negotiates gzip and buffers
+      # decompressed output internally.
+      request["Accept-Encoding"] = "identity"
 
       @config.logger.debug("API stream connecting")
       http.start

data/lib/aikido/zen/config.rb

@@ -60,6 +60,10 @@ module Aikido::Zen
     #   poll the parent process for updated runtime settings. Defaults to 10 seconds.
     attr_accessor :worker_process_polling_interval
 
+    # @return [Integer] the maximum random delay in seconds before a forked
+    #   worker process starts polling. Defaults to 10 seconds.
+    attr_accessor :worker_process_polling_jitter
+
     # @return [Integer] the interval in seconds at which forked worker processes
     #   flush their collected stats to the parent process. Defaults to 10 seconds.
     attr_accessor :worker_process_heartbeat_interval
@@ -237,6 +241,7 @@ module Aikido::Zen
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
       self.worker_process_polling_interval = 10
+      self.worker_process_polling_jitter = 10
       self.worker_process_heartbeat_interval = 10
       self.json_encoder = DEFAULT_JSON_ENCODER
       self.json_decoder = DEFAULT_JSON_DECODER

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.6.0.beta.2"
+    VERSION = "1.6.0.beta.3"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -16,6 +16,7 @@ module Aikido::Zen::WorkerProcess
         worker: Aikido::Zen::Worker.new(config: config),
         keepalive_worker: Aikido::Zen::Worker.new(config: config),
         polling_interval: config.worker_process_polling_interval,
+        polling_jitter: config.worker_process_polling_jitter,
         heartbeat_interval: config.worker_process_heartbeat_interval,
         collector: Aikido::Zen.collector
       )
@@ -23,10 +24,14 @@ module Aikido::Zen::WorkerProcess
         @worker = worker
         @keepalive_worker = keepalive_worker
         @polling_interval = polling_interval
+        @polling_jitter = polling_jitter
         @heartbeat_interval = heartbeat_interval
         @collector = collector
 
         @rpc_client = Aikido::Zen::RPC::Client.new(secret, host, port, reconnect: true)
+
+        @known_config_generation = nil
+        @known_firewall_lists_generation = nil
       end
 
       def close
@@ -34,14 +39,7 @@ module Aikido::Zen::WorkerProcess
       end
 
       def start
-        @rpc_client.start do
-          @worker.perform do
-            update_settings(updated_settings)
-          rescue => err
-            @config.logger.error("Forked worker process #{Process.pid}: failed to get settings after connecting to parent: #{err.message}")
-          end
-        end
-
+        @rpc_client.start
         schedule_tasks
       end
 
@@ -73,35 +71,66 @@ module Aikido::Zen::WorkerProcess
       private
 
       def updated_settings
-        @rpc_client.invoke("updated_settings", KEEPALIVE_INTERVAL)
+        @rpc_client.invoke(
+          "updated_settings",
+          KEEPALIVE_INTERVAL,
+          @known_config_generation,
+          @known_firewall_lists_generation
+        )
       end
 
-      def update_settings(settings)
-        return unless settings
+      def update_settings
+        settings = updated_settings
+        return false unless settings
+        return false unless settings["config"] || settings["firewall_lists"]
+
+        @config.logger.debug("Forked worker process #{Process.pid}: starting runtime settings update")
 
         if settings["config"]
+          @config.logger.debug("Forked worker process #{Process.pid}: starting config update")
           Aikido::Zen.runtime_settings.update_from_runtime_config_json(settings["config"])
+          @known_config_generation = settings["config_generation"]
+          @config.logger.debug("Forked worker process #{Process.pid}: finished config update")
         end
 
         if settings["firewall_lists"]
+          @config.logger.debug("Forked worker process #{Process.pid}: starting firewall_lists update")
           Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(settings["firewall_lists"])
+          @known_firewall_lists_generation = settings["firewall_lists_generation"]
+          @config.logger.debug("Forked worker process #{Process.pid}: finished firewall_lists update")
         end
+
+        @config.logger.debug("Forked worker process #{Process.pid}: finished runtime settings update")
+
+        true
+      rescue => err
+        @config.logger.error("Forked worker process #{Process.pid}: failed to get settings from parent: #{err.message}")
+        false
       end
 
       def schedule_tasks
         @keepalive_worker.every(KEEPALIVE_INTERVAL, run_now: false) { keepalive }
 
-        @worker.every(@polling_interval, run_now: false) do
-          update_settings(updated_settings)
-
-          @config.logger.debug("Forked worker process #{Process.pid}: updated runtime settings from parent")
-        rescue => err
-          @config.logger.error("Forked worker process #{Process.pid}: failed to get settings from parent: #{err.message}")
-        end
+        # Delay start polling to reduce the chance of workers polling in lockstep.
+        delay = polling_start_delay
+        @config.logger.debug("Forked worker process #{Process.pid}: will start polling in #{delay}s")
+        @worker.delay(delay) { start_polling }
 
         @worker.every(@heartbeat_interval, run_now: false) { send_collector_events }
       end
 
+      def start_polling
+        @config.logger.debug("Forked worker process #{Process.pid}: started polling")
+        @worker.every(@polling_interval, run_now: true) { update_settings }
+      end
+
+      def polling_start_delay
+        return 0 if @polling_jitter < 1
+
+        # Seed by pid because forked processes inherit identical PRNG state.
+        Random.new(Process.pid).rand(1..@polling_jitter)
+      end
+
       def keepalive
         @rpc_client.invoke("ping", KEEPALIVE_INTERVAL)
       rescue => err

data/lib/aikido/zen/worker_process/agent/server.rb

@@ -12,8 +12,8 @@ module Aikido::Zen::WorkerProcess
           respond.call(nil)
         end
 
-        @rpc_server.handle("updated_settings") do |respond|
-          respond.call(updated_settings)
+        @rpc_server.handle("updated_settings") do |respond, known_config_generation = nil, known_firewall_lists_generation = nil|
+          respond.call(updated_settings(known_config_generation, known_firewall_lists_generation))
         end
 
         @rpc_server.handle("send_collector_events") do |respond, events_data|
@@ -64,11 +64,20 @@ module Aikido::Zen::WorkerProcess
       # Visible for testing.
       RequestKind = Struct.new(:route, :schema, :client_ip, :actor)
 
-      def updated_settings
-        {
-          "config" => Aikido::Zen.api_cache.runtime_config,
-          "firewall_lists" => Aikido::Zen.api_cache.runtime_firewall_lists
-        }
+      def updated_settings(known_config_generation = nil, known_firewall_lists_generation = nil)
+        result = {}
+
+        config_change = Aikido::Zen.api_cache.config_if_changed(known_config_generation)
+        if config_change
+          result["config"], result["config_generation"] = config_change
+        end
+
+        firewall_lists_change = Aikido::Zen.api_cache.firewall_lists_if_changed(known_firewall_lists_generation)
+        if firewall_lists_change
+          result["firewall_lists"], result["firewall_lists_generation"] = firewall_lists_change
+        end
+
+        result
       end
 
       def send_collector_events(events_data)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.6.0.beta.2
+  version: 1.6.0.beta.3
 platform: x86_64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-16 00:00:00.000000000 Z
+date: 2026-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby