Package io.confluent.dekregistry.storage

Class DekRegistry

java.lang.Object

io.confluent.dekregistry.storage.DekRegistry

All Implemented Interfaces:

Closeable, AutoCloseable

public class DekRegistry
extends Object
implements Closeable

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AWS_KMS
static final String	AZURE_KMS
static final byte[]	EMPTY_AAD
static final String	GCP_KMS
static final String	KEY
static final int	LATEST_VERSION
static final int	MIN_VERSION
static final String	X_FORWARD_HEADER

Constructor Summary

Constructors

Constructor	Description
DekRegistry(SchemaRegistry schemaRegistry, MetricsManager metricsManager)

Method Summary

Modifier and Type	Method	Description
void	close()
DekRegistryConfig	config()
protected <K, V> io.kcache.Cache<K,V>	createCache(org.apache.kafka.common.serialization.Serde<K> keySerde, org.apache.kafka.common.serialization.Serde<V> valueSerde, String topic, io.kcache.CacheUpdateHandler<K,V> cacheUpdateHandler)
DataEncryptionKey	createDek(String kekName, boolean rewrap, CreateDekRequest request)
Dek	createDekOrForward(String kekName, boolean rewrap, CreateDekRequest request, Map<String,String> headerProperties)
KeyEncryptionKey	createKek(CreateKekRequest request)
Kek	createKekOrForward(CreateKekRequest request, Map<String,String> headerProperties)
void	deleteDek(String name, String subject, DekFormat algorithm, boolean permanentDelete)
void	deleteDekOrForward(String name, String subject, DekFormat algorithm, boolean permanentDelete, Map<String,String> headerProperties)
void	deleteDekVersion(String name, String subject, int version, DekFormat algorithm, boolean permanentDelete)
void	deleteDekVersionOrForward(String name, String subject, int version, DekFormat algorithm, boolean permanentDelete, Map<String,String> headerProperties)
void	deleteKek(String name, boolean permanentDelete)
void	deleteKekOrForward(String name, boolean permanentDelete, Map<String,String> headerProperties)
protected DataEncryptionKey	generateEncryptedDek(KeyEncryptionKey kek, DataEncryptionKey key)
protected DataEncryptionKey	generateRawDek(KeyEncryptionKey kek, DataEncryptionKey key)
protected com.google.crypto.tink.Aead	getAead(KeyEncryptionKey kek)
protected Cryptor	getCryptor(DekFormat dekFormat)
DataEncryptionKey	getDek(String kekName, String subject, int version, DekFormat algorithm, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, String kekName, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, String minKekName, String maxKekName, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
List<String>	getDekSubjects(String kekName, boolean lookupDeleted)
List<Integer>	getDekVersions(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
KeyEncryptionKey	getKek(String name, boolean lookupDeleted)
List<String>	getKekNames(List<String> subjectPrefix, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getKeks(String tenant, boolean lookupDeleted)
DataEncryptionKey	getLatestDek(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
DataEncryptionKey	getLatestDek(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted, boolean maybeGenerateRawDek)
MetricsManager	getMetricsManager()
SchemaRegistry	getSchemaRegistry()
protected com.google.common.collect.SetMultimap<String,KeyEncryptionKeyId>	getSharedKeys()
void	init()
boolean	initialized()
boolean	isLeader()
io.kcache.Cache<EncryptionKeyId,EncryptionKey>	keys()
protected Lock	lockFor(String tenant)
int	normalizeDekSubjectLimit(int suppliedLimit)
int	normalizeDekVersionLimit(int suppliedLimit)
int	normalizeKekLimit(int suppliedLimit)
int	normalizeLimit(int suppliedLimit, int defaultLimit, int maxLimit)
KeyEncryptionKey	putKek(String name, UpdateKekRequest request)
Kek	putKekOrForward(String name, UpdateKekRequest request, Map<String,String> headerProperties)
void	testKek(KeyEncryptionKey kek)
Kek	toKekEntity(KeyEncryptionKey kek)
void	undeleteDek(String name, String subject, DekFormat algorithm)
void	undeleteDekOrForward(String name, String subject, DekFormat algorithm, Map<String,String> headerProperties)
void	undeleteDekVersion(String name, String subject, int version, DekFormat algorithm)
void	undeleteDekVersionOrForward(String name, String subject, int version, DekFormat algorithm, Map<String,String> headerProperties)
void	undeleteKek(String name)
void	undeleteKekOrForward(String name, Map<String,String> headerProperties)
void	waitForInit()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

KEY

public static final String KEY

See Also:

• Constant Field Values

LATEST_VERSION

public static final int LATEST_VERSION

See Also:

• Constant Field Values

MIN_VERSION

public static final int MIN_VERSION

See Also:

• Constant Field Values

EMPTY_AAD

public static final byte[] EMPTY_AAD

X_FORWARD_HEADER

public static final String X_FORWARD_HEADER

See Also:

• Constant Field Values

AWS_KMS

public static final String AWS_KMS

See Also:

• Constant Field Values

AZURE_KMS

public static final String AZURE_KMS

See Also:

• Constant Field Values

GCP_KMS

public static final String GCP_KMS

See Also:

• Constant Field Values

Constructor Details

DekRegistry

@Inject
public DekRegistry(SchemaRegistry schemaRegistry,
 MetricsManager metricsManager)

Method Details

getSchemaRegistry

public SchemaRegistry getSchemaRegistry()

getMetricsManager

public MetricsManager getMetricsManager()

createCache

protected <K,
V> io.kcache.Cache<K,V> createCache(org.apache.kafka.common.serialization.Serde<K> keySerde,
 org.apache.kafka.common.serialization.Serde<V> valueSerde,
 String topic,
 io.kcache.CacheUpdateHandler<K,V> cacheUpdateHandler)
                                          throws io.kcache.exceptions.CacheInitializationException

Throws:

io.kcache.exceptions.CacheInitializationException

keys

public io.kcache.Cache<EncryptionKeyId,EncryptionKey> keys()

config

public DekRegistryConfig config()

getSharedKeys

protected com.google.common.collect.SetMultimap<String,KeyEncryptionKeyId> getSharedKeys()

getCryptor

protected Cryptor getCryptor(DekFormat dekFormat)

init

@PostConstruct
public void init()

waitForInit

public void waitForInit()
                 throws InterruptedException

Throws:

InterruptedException

initialized

public boolean initialized()

isLeader

public boolean isLeader()

lockFor

protected Lock lockFor(String tenant)

getKekNames

public List<String> getKekNames(List<String> subjectPrefix,
 boolean lookupDeleted)

getKeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getKeks(String tenant,
 boolean lookupDeleted)

getKek

public KeyEncryptionKey getKek(String name,
 boolean lookupDeleted)

toKekEntity

public Kek toKekEntity(KeyEncryptionKey kek)

getDekSubjects

public List<String> getDekSubjects(String kekName,
 boolean lookupDeleted)

getDekVersions

public List<Integer> getDekVersions(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 boolean lookupDeleted)

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 String kekName,
 boolean lookupDeleted)

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 String minKekName,
 String maxKekName,
 boolean lookupDeleted)

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)

getLatestDek

public DataEncryptionKey getLatestDek(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

getLatestDek

public DataEncryptionKey getLatestDek(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted,
 boolean maybeGenerateRawDek)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

getDek

public DataEncryptionKey getDek(String kekName,
 String subject,
 int version,
 DekFormat algorithm,
 boolean lookupDeleted)
                         throws SchemaRegistryException

Throws:

SchemaRegistryException

createKekOrForward

public Kek createKekOrForward(CreateKekRequest request,
 Map<String,String> headerProperties)
                       throws SchemaRegistryException

Throws:

SchemaRegistryException

createKek

public KeyEncryptionKey createKek(CreateKekRequest request)
                           throws SchemaRegistryException

Throws:

SchemaRegistryException

testKek

public void testKek(KeyEncryptionKey kek)
             throws SchemaRegistryException

Throws:

SchemaRegistryException

createDekOrForward

public Dek createDekOrForward(String kekName,
 boolean rewrap,
 CreateDekRequest request,
 Map<String,String> headerProperties)
                       throws SchemaRegistryException

Throws:

SchemaRegistryException

createDek

public DataEncryptionKey createDek(String kekName,
 boolean rewrap,
 CreateDekRequest request)
                            throws SchemaRegistryException

Throws:

SchemaRegistryException

generateEncryptedDek

protected DataEncryptionKey generateEncryptedDek(KeyEncryptionKey kek,
 DataEncryptionKey key)
                                          throws DekGenerationException

Throws:

DekGenerationException

generateRawDek

protected DataEncryptionKey generateRawDek(KeyEncryptionKey kek,
 DataEncryptionKey key)
                                    throws DekGenerationException

Throws:

DekGenerationException

getAead

protected com.google.crypto.tink.Aead getAead(KeyEncryptionKey kek)
                                       throws GeneralSecurityException

Throws:

GeneralSecurityException

putKekOrForward

public Kek putKekOrForward(String name,
 UpdateKekRequest request,
 Map<String,String> headerProperties)
                    throws SchemaRegistryException

Throws:

SchemaRegistryException

putKek

public KeyEncryptionKey putKek(String name,
 UpdateKekRequest request)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteKekOrForward

public void deleteKekOrForward(String name,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteKek

public void deleteKek(String name,
 boolean permanentDelete)
               throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekOrForward

public void deleteDekOrForward(String name,
 String subject,
 DekFormat algorithm,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDek

public void deleteDek(String name,
 String subject,
 DekFormat algorithm,
 boolean permanentDelete)
               throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekVersionOrForward

public void deleteDekVersionOrForward(String name,
 String subject,
 int version,
 DekFormat algorithm,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekVersion

public void deleteDekVersion(String name,
 String subject,
 int version,
 DekFormat algorithm,
 boolean permanentDelete)
                      throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteKekOrForward

public void undeleteKekOrForward(String name,
 Map<String,String> headerProperties)
                          throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteKek

public void undeleteKek(String name)
                 throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekOrForward

public void undeleteDekOrForward(String name,
 String subject,
 DekFormat algorithm,
 Map<String,String> headerProperties)
                          throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDek

public void undeleteDek(String name,
 String subject,
 DekFormat algorithm)
                 throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekVersionOrForward

public void undeleteDekVersionOrForward(String name,
 String subject,
 int version,
 DekFormat algorithm,
 Map<String,String> headerProperties)
                                 throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekVersion

public void undeleteDekVersion(String name,
 String subject,
 int version,
 DekFormat algorithm)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

normalizeLimit

public int normalizeLimit(int suppliedLimit,
 int defaultLimit,
 int maxLimit)

normalizeKekLimit

public int normalizeKekLimit(int suppliedLimit)

normalizeDekSubjectLimit

public int normalizeDekSubjectLimit(int suppliedLimit)

normalizeDekVersionLimit

public int normalizeDekVersionLimit(int suppliedLimit)

close

@PreDestroy
public void close()
           throws IOException

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Throws:

IOException