Recover interrupted certificate replacement

dns_sync/executor.py

@@ -321,6 +321,7 @@ def _preflight(
     dict[str, ExecutionAdapter],
     list[PlanAction],
     list[PlanAction],
+    list[tuple[str, RetireRequest]],
 ]:
     adapters_by_endpoint: dict[str, ExecutionAdapter] = {}
     for adapter in adapters:
@@ -333,6 +334,9 @@ def _preflight(
 
     executable: list[PlanAction] = []
     skipped: list[PlanAction] = []
+    planned_retirements: list[
+        tuple[str, RetireRequest]
+    ] = []
 
     for plan in plans:
         adapter = adapters_by_endpoint.get(plan.endpoint_id)
@@ -341,6 +345,14 @@ def _preflight(
                 f"No adapter for endpoint plan {plan.endpoint_id}"
             )
 
+        for retirement in plan.retirements:
+            planned_retirements.append(
+                (
+                    plan.endpoint_id,
+                    retirement,
+                )
+            )
+
         for action in plan.actions:
             if action.endpoint_id != plan.endpoint_id:
                 raise RuntimeError(
@@ -382,7 +394,12 @@ def _preflight(
             )
             executable.append(action)
 
-    return adapters_by_endpoint, executable, skipped
+    return (
+        adapters_by_endpoint,
+        executable,
+        skipped,
+        planned_retirements,
+    )
 
 
 def execute_endpoint_plans(
@@ -399,14 +416,20 @@ def execute_endpoint_plans(
         )
     timestamp = timestamp.astimezone(timezone.utc)
 
-    adapters_by_endpoint, executable, skipped = _preflight(
+    (
+        adapters_by_endpoint,
+        executable,
+        skipped,
+        planned_retirements,
+    ) = _preflight(
         adapters,
         plans,
     )
+
     applied: list[ExecutedAction] = []
     pending_retirements: list[
         tuple[str, RetireRequest]
-    ] = []
+    ] = list(planned_retirements)
 
     local_references: dict[
         str,
@@ -421,6 +444,18 @@ def execute_endpoint_plans(
             )
         )
 
+    for action in skipped:
+        if (
+            action.operation == PlanOperation.NOOP
+            and action.current is not None
+            and action.current.local_key is not None
+        ):
+            _remember_local_object(
+                local_references[action.endpoint_id],
+                action.current,
+                authoritative=True,
+            )
+
     for action in order_plan_actions(executable):
         adapter = adapters_by_endpoint[action.endpoint_id]
         resolved_action = _resolve_action_references(
@@ -500,7 +535,23 @@ def execute_endpoint_plans(
             )
         )
 
+    retired_identities: set[
+        tuple[str, str, str]
+    ] = set()
+
     for endpoint_id, retirement in pending_retirements:
+        retired = retirement.object
+        identity = (
+            endpoint_id,
+            retired.object_type,
+            retired.local_key,
+        )
+
+        if identity in retired_identities:
+            continue
+
+        retired_identities.add(identity)
+
         adapter = adapters_by_endpoint[endpoint_id]
 
         retire = getattr(adapter, "retire", None)