Class CedarPolicyStore

java.lang.Object
io.confluent.security.auth.s2s.CedarPolicyStore
public class CedarPolicyStore extends Object
In-memory snapshot of the two-category Cedar policy bundle, {"L2": {policyId -> cedar}, "L3": {policyId -> cedar}}, loaded from the broker config key ConfluentConfigs.S2S_AUTHZ_POLICIES. Re-loadable via configure(Map).

L2 policies drive the connection-level gate (evaluated on the cert SPIFFE); L3 policies drive the service-level verdict (evaluated on the token-sub SPIFFE). Threading: the volatile snapshot holder is a copy-on-write snapshot.

  • Constructor Details

    • CedarPolicyStore

      public CedarPolicyStore()

  • Method Details

    • parseOrThrow

      public static io.confluent.security.auth.s2s.CedarPolicyStore.TwoCategory parseOrThrow(Map<String,?> configs) throws Exception
      Strict parse used by S2SConnectionLevelAuthZProvider.validateReconfiguration(). Throws on malformed JSON, or on a top-level category that is not a JSON object of string -> string, so the framework can reject the candidate config and keep the previously-installed policies in place. Stateless -- does not mutate the store.

      Missing L2/L3 keys parse to an empty map for that category. Unknown top-level keys are rejected (strict) rather than silently ignored, since a typo'd category (e.g. "l2") would otherwise silently install no policies.

      Throws:
      Exception

    • configure

      public void configure(Map<String,?> configs)
      (Re)loads policies from broker config. Called at startup (via provider.configure()) and on every dynamic reconfigure().

      A blank/absent value is a valid "no policies" state and installs the CedarPolicyStore.TwoCategory.EMPTY snapshot.

      A malformed value throws ConfigException without touching the current snapshot, so the active policy set can never silently degrade to empty. The caller decides how to handle the throw: cold start (provider.configure) lets it propagate and fails broker startup closed; a dynamic reload (provider.reconfigure) catches it and keeps the last-good snapshot. In practice a reload rarely reaches the throw, since validateReconfiguration() -- which also calls parseOrThrow(Map) -- rejects a malformed payload upstream first.

    • l2Policies

      public Map<String,String> l2Policies()
      Immutable snapshot of the L2 (connection-level gate) policies.

    • l3Policies

      public Map<String,String> l3Policies()
      Immutable snapshot of the L3 (service-level verdict) policies.