Class S2SConnectionLevelDecisionSource

java.lang.Object
io.confluent.security.auth.s2s.S2SConnectionLevelDecisionSource
All Implemented Interfaces:
S2SDecisionSource
public class S2SConnectionLevelDecisionSource extends Object implements S2SDecisionSource
SRJ Cedar integration point for the L2 connection-level AuthZ provider.

start() builds the CedarS2SPass from the L2 category of the in-memory policy snapshot held by CedarPolicyStore and wraps it in a GATE-role MeteredPass (s2s-gate), which records the per-pass S2S AuthZ metric on each applicable evaluation and returns the delegate's raw Decision unchanged. evaluate(EvaluationInput) calls Pass.appliesTo(Request)/Pass.evaluate(Request) directly per request — ce-kafka owns the gate/verdict interpretation itself. The SPIFFE-ID principal entity (S2S::Client) and its schema are owned by the SRJ provider; this adapter authors only the request-side action/resource vocabulary (see toRequest(EvaluationInput)).

Deny-overlay GATE (tri-state). L2 runs as a deny-overlay GATE in Kafka's provider chain, so this source only ever vetoes. Only Effect.DENY maps to Decision.DENY; Effect.ALLOW and Effect.ABSTAIN (nothing matched) both map to NEUTRAL (the gate continues). Policy authors therefore write only forbids — no baseline permit is required (a permit at L2 is a no-op).

Lifecycle / failure semantics (fail-closed):

  • empty L2 policy snapshot → install null (a valid "no forbids" state → every request is NEUTRAL).
  • pass build throws on cold start (start()) → rethrow → broker startup FAILS. A fresh process has no last-good pass; coming up with L2 enforcement silently disabled would be fail-open (traffic L2 should veto would be allowed), so we refuse to serve and let the rolling deploy halt on the old (still-good) pods.
  • pass build throws on reload (reload()) → log + keep the previously installed pass (last-good); the running broker is never taken down by a bad live update.

  • Constructor Details

    • S2SConnectionLevelDecisionSource

      public S2SConnectionLevelDecisionSource(CedarPolicyStore policyStore)

  • Method Details

    • start

      public void start()
      Description copied from interface: S2SDecisionSource
      Cold-start lifecycle hook invoked once at broker/controller startup AFTER the config snapshot has been loaded into any backing store. Implementations pre-build/validate state (e.g., hand policies to an underlying evaluator).

      Fail-closed: a present-but-unbuildable policy set MUST throw here so broker startup fails. A fresh process has no last-good state to fall back on, so coming up with enforcement silently disabled/degraded is not an option. Default is no-op.

      Specified by:
      start in interface S2SDecisionSource

    • reload

      public void reload()
      Description copied from interface: S2SDecisionSource
      Dynamic-reload lifecycle hook invoked on every config reload, AFTER the backing store has swapped in the new snapshot. Unlike S2SDecisionSource.start(), a build failure here MUST NOT throw: the broker is already serving, so it keeps the last-good state in place rather than being taken down by a bad live update (which validateReconfiguration() should have rejected upstream anyway). Default is no-op.
      Specified by:
      reload in interface S2SDecisionSource

    • evaluate

      public S2SDecisionSource.Result evaluate(EvaluationInput input)
      Specified by:
      evaluate in interface S2SDecisionSource