Package io.confluent.dekregistry.storage

Class AbstractDekRegistry

java.lang.Object

io.confluent.dekregistry.storage.AbstractDekRegistry

All Implemented Interfaces:

Closeable, AutoCloseable

Direct Known Subclasses:

KafkaDekRegistry

public abstract class AbstractDekRegistry
extends Object
implements Closeable

Abstract base class for DEK Registry implementations. Contains encryption/decryption logic and public API methods. Subclasses implement the storage-specific methods.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AWS_KMS
static final String	AZURE_KMS
protected final Map<DekFormat,Cryptor>	cryptors
protected static final com.fasterxml.jackson.core.type.TypeReference<Dek>	DEK_TYPE
protected final int	dekSubjectSearchDefaultLimit
protected final int	dekSubjectSearchMaxLimit
protected final int	dekVersionSearchDefaultLimit
protected final int	dekVersionSearchMaxLimit
static final byte[]	EMPTY_AAD
static final String	GCP_KMS
protected final AtomicBoolean	initialized
protected final CountDownLatch	initLatch
protected static final com.fasterxml.jackson.core.type.TypeReference<Kek>	KEK_TYPE
protected final int	kekSearchDefaultLimit
protected final int	kekSearchMaxLimit
static final String	KEY
static final int	LATEST_VERSION
static final int	MIN_VERSION
protected final Map<String,Lock>	tenantToLock
protected static final String	TEST_SUBJECT
protected static final com.fasterxml.jackson.core.type.TypeReference<Void>	VOID_TYPE
static final String	X_FORWARD_HEADER

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractDekRegistry(SchemaRegistry schemaRegistry, MetricsManager metricsManager, DekRegistryConfig config)

Method Summary

Modifier and Type	Method	Description
DekRegistryConfig	config()
DataEncryptionKey	createDek(String kekName, boolean rewrap, CreateDekRequest request)
Dek	createDekOrForward(String kekName, boolean rewrap, CreateDekRequest request, Map<String,String> headerProperties)
KeyEncryptionKey	createKek(CreateKekRequest request)
Kek	createKekOrForward(CreateKekRequest request, Map<String,String> headerProperties)
void	deleteDek(String name, String subject, DekFormat algorithm, boolean permanentDelete)
void	deleteDekOrForward(String name, String subject, DekFormat algorithm, boolean permanentDelete, Map<String,String> headerProperties)
void	deleteDekVersion(String name, String subject, int version, DekFormat algorithm, boolean permanentDelete)
void	deleteDekVersionOrForward(String name, String subject, int version, DekFormat algorithm, boolean permanentDelete, Map<String,String> headerProperties)
void	deleteKek(String name, boolean permanentDelete)
void	deleteKekOrForward(String name, boolean permanentDelete, Map<String,String> headerProperties)
protected DataEncryptionKey	generateEncryptedDek(KeyEncryptionKey kek, DataEncryptionKey key)
protected DataEncryptionKey	generateRawDek(KeyEncryptionKey kek, DataEncryptionKey key)
protected com.google.crypto.tink.Aead	getAead(KeyEncryptionKey kek)
protected Cryptor	getCryptor(DekFormat dekFormat)
DataEncryptionKey	getDek(String kekName, String subject, int version, DekFormat algorithm, boolean lookupDeleted)
protected abstract DataEncryptionKey	getDekById(DataEncryptionKeyId keyId)	Get a DEK by its ID.
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, String kekName, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeks(String tenant, String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeksFromStore(String tenant, String minKekName, String maxKekName, boolean lookupDeleted)	Get all DEKs for a tenant within a KEK name range.
protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeksFromStore(String tenant, String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)	Get DEKs for a specific subject and algorithm.
List<String>	getDekSubjects(String kekName, boolean lookupDeleted)
List<Integer>	getDekVersions(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
KeyEncryptionKey	getKek(String name, boolean lookupDeleted)
protected abstract KeyEncryptionKey	getKekById(KeyEncryptionKeyId keyId)	Get a KEK by its ID.
List<String>	getKekNames(List<String> subjectPrefix, boolean lookupDeleted)
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getKeks(String tenant, boolean lookupDeleted)
protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getKeksFromStore(String tenant, boolean lookupDeleted)	Get all KEKs for a tenant.
EncryptionKey	getKey(EncryptionKeyId id)	Returns the encryption key for the given id, or null if not found.
DataEncryptionKey	getLatestDek(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)
DataEncryptionKey	getLatestDek(String kekName, String subject, DekFormat algorithm, boolean lookupDeleted, boolean maybeGenerateRawDek)
MetricsManager	getMetricsManager()
SchemaRegistry	getSchemaRegistry()
void	init()
boolean	initialized()
protected abstract void	initStore()	Perform any initialization required by the storage backend.
boolean	isLeader()	Check if this instance is the leader.
protected boolean	isLeader(Map<String,String> headerProperties)
io.kcache.Cache<EncryptionKeyId,EncryptionKey>	keys()	Deprecated. callers should use getKey(EncryptionKeyId) or rangeKeys(EncryptionKeyId, boolean, EncryptionKeyId, boolean) instead.
protected void	lock(String tenant, Map<String,String> headerProperties)
protected Lock	lockFor(String tenant)
protected DataEncryptionKey	maybeGenerateRawDek(DataEncryptionKey key)
int	normalizeDekSubjectLimit(int suppliedLimit)
int	normalizeDekVersionLimit(int suppliedLimit)
int	normalizeKekLimit(int suppliedLimit)
protected String	normalizeKmsType(String kmsType)
int	normalizeLimit(int suppliedLimit, int defaultLimit, int maxLimit)
KeyEncryptionKey	putKek(String name, UpdateKekRequest request)
Kek	putKekOrForward(String name, UpdateKekRequest request, Map<String,String> headerProperties)
protected abstract void	putKey(EncryptionKeyId id, EncryptionKey key)	Store a key (KEK or DEK).
io.kcache.KeyValueIterator<EncryptionKeyId,EncryptionKey>	rangeKeys(EncryptionKeyId start, boolean startInclusive, EncryptionKeyId end, boolean endInclusive)	Returns an iterator over the encryption keys whose ids fall in the given range.
protected abstract void	removeKey(EncryptionKeyId id)	Remove a key from storage.
protected abstract void	syncStore()	Sync/refresh the store to ensure it's up-to-date.
void	testKek(KeyEncryptionKey kek)
protected static byte[]	toJson(Object o)
Kek	toKekEntity(KeyEncryptionKey kek)
void	undeleteDek(String name, String subject, DekFormat algorithm)
void	undeleteDekOrForward(String name, String subject, DekFormat algorithm, Map<String,String> headerProperties)
void	undeleteDekVersion(String name, String subject, int version, DekFormat algorithm)
void	undeleteDekVersionOrForward(String name, String subject, int version, DekFormat algorithm, Map<String,String> headerProperties)
void	undeleteKek(String name)
void	undeleteKekOrForward(String name, Map<String,String> headerProperties)
protected void	unlock(String tenant)
void	waitForInit()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.io.Closeable

close

Field Details

KEY

public static final String KEY

See Also:

• Constant Field Values

LATEST_VERSION

public static final int LATEST_VERSION

See Also:

• Constant Field Values

MIN_VERSION

public static final int MIN_VERSION

See Also:

• Constant Field Values

EMPTY_AAD

public static final byte[] EMPTY_AAD

X_FORWARD_HEADER

public static final String X_FORWARD_HEADER

See Also:

• Constant Field Values

AWS_KMS

public static final String AWS_KMS

See Also:

• Constant Field Values

AZURE_KMS

public static final String AZURE_KMS

See Also:

• Constant Field Values

GCP_KMS

public static final String GCP_KMS

See Also:

• Constant Field Values

TEST_SUBJECT

protected static final String TEST_SUBJECT

See Also:

• Constant Field Values

KEK_TYPE

protected static final com.fasterxml.jackson.core.type.TypeReference<Kek> KEK_TYPE

DEK_TYPE

protected static final com.fasterxml.jackson.core.type.TypeReference<Dek> DEK_TYPE

VOID_TYPE

protected static final com.fasterxml.jackson.core.type.TypeReference<Void> VOID_TYPE

kekSearchDefaultLimit

protected final int kekSearchDefaultLimit

kekSearchMaxLimit

protected final int kekSearchMaxLimit

dekSubjectSearchDefaultLimit

protected final int dekSubjectSearchDefaultLimit

dekSubjectSearchMaxLimit

protected final int dekSubjectSearchMaxLimit

dekVersionSearchDefaultLimit

protected final int dekVersionSearchDefaultLimit

dekVersionSearchMaxLimit

protected final int dekVersionSearchMaxLimit

cryptors

protected final Map<DekFormat,Cryptor> cryptors

tenantToLock

protected final Map<String,Lock> tenantToLock

initialized

protected final AtomicBoolean initialized

initLatch

protected final CountDownLatch initLatch

Constructor Details

AbstractDekRegistry

protected AbstractDekRegistry(SchemaRegistry schemaRegistry,
 MetricsManager metricsManager,
 DekRegistryConfig config)

Method Details

getKeksFromStore

protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getKeksFromStore(String tenant,
 boolean lookupDeleted)
                                                                                     throws SchemaRegistryStoreException

Get all KEKs for a tenant.

Throws:

SchemaRegistryStoreException

getDeksFromStore

protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeksFromStore(String tenant,
 String minKekName,
 String maxKekName,
 boolean lookupDeleted)
                                                                                     throws SchemaRegistryStoreException

Get all DEKs for a tenant within a KEK name range.

Throws:

SchemaRegistryStoreException

getDeksFromStore

protected abstract List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeksFromStore(String tenant,
 String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)
                                                                                     throws SchemaRegistryStoreException

Get DEKs for a specific subject and algorithm.

Throws:

SchemaRegistryStoreException

getKekById

protected abstract KeyEncryptionKey getKekById(KeyEncryptionKeyId keyId)
                                        throws SchemaRegistryStoreException

Get a KEK by its ID.

Throws:

SchemaRegistryStoreException

getDekById

protected abstract DataEncryptionKey getDekById(DataEncryptionKeyId keyId)
                                         throws SchemaRegistryStoreException

Get a DEK by its ID.

Throws:

SchemaRegistryStoreException

putKey

protected abstract void putKey(EncryptionKeyId id,
 EncryptionKey key)
                        throws SchemaRegistryStoreException

Store a key (KEK or DEK).

Throws:

SchemaRegistryStoreException

removeKey

protected abstract void removeKey(EncryptionKeyId id)
                           throws SchemaRegistryStoreException

Remove a key from storage.

Throws:

SchemaRegistryStoreException

syncStore

protected abstract void syncStore()
                           throws SchemaRegistryStoreException

Sync/refresh the store to ensure it's up-to-date.

Throws:

SchemaRegistryStoreException

initStore

protected abstract void initStore()

Perform any initialization required by the storage backend.

getSchemaRegistry

public SchemaRegistry getSchemaRegistry()

getMetricsManager

public MetricsManager getMetricsManager()

config

public DekRegistryConfig config()

keys

@Deprecated
public io.kcache.Cache<EncryptionKeyId,EncryptionKey> keys()

Deprecated.

callers should use getKey(EncryptionKeyId) or rangeKeys(EncryptionKeyId, boolean, EncryptionKeyId, boolean) instead.

Get the underlying keys kcache (only kafka-based implementations override this). Provides backward compatibility for external components relying on direct cache access.

Returns:

the keys cache

getKey

public EncryptionKey getKey(EncryptionKeyId id)

Returns the encryption key for the given id, or null if not found.

The default implementation delegates to keys() for kafka-based subclasses.

rangeKeys

public io.kcache.KeyValueIterator<EncryptionKeyId,EncryptionKey> rangeKeys(EncryptionKeyId start,
 boolean startInclusive,
 EncryptionKeyId end,
 boolean endInclusive)

Returns an iterator over the encryption keys whose ids fall in the given range. Caller is responsible for closing the returned iterator.

The default implementation delegates to keys() for kafka-based subclasses.

getCryptor

protected Cryptor getCryptor(DekFormat dekFormat)

init

public void init()

waitForInit

public void waitForInit()
                 throws InterruptedException

Throws:

InterruptedException

initialized

public boolean initialized()

isLeader

public boolean isLeader()

Check if this instance is the leader.

isLeader

protected boolean isLeader(Map<String,String> headerProperties)

lockFor

protected Lock lockFor(String tenant)

lock

protected void lock(String tenant,
 Map<String,String> headerProperties)

unlock

protected void unlock(String tenant)

getKekNames

public List<String> getKekNames(List<String> subjectPrefix,
 boolean lookupDeleted)
                         throws SchemaRegistryException

Throws:

SchemaRegistryException

getKeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getKeks(String tenant,
 boolean lookupDeleted)
                                                                   throws SchemaRegistryStoreException

Throws:

SchemaRegistryStoreException

getKek

public KeyEncryptionKey getKek(String name,
 boolean lookupDeleted)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

toKekEntity

public Kek toKekEntity(KeyEncryptionKey kek)

createKekOrForward

public Kek createKekOrForward(CreateKekRequest request,
 Map<String,String> headerProperties)
                       throws SchemaRegistryException

Throws:

SchemaRegistryException

createKek

public KeyEncryptionKey createKek(CreateKekRequest request)
                           throws SchemaRegistryException

Throws:

SchemaRegistryException

normalizeKmsType

protected String normalizeKmsType(String kmsType)

testKek

public void testKek(KeyEncryptionKey kek)
             throws SchemaRegistryException

Throws:

SchemaRegistryException

putKekOrForward

public Kek putKekOrForward(String name,
 UpdateKekRequest request,
 Map<String,String> headerProperties)
                    throws SchemaRegistryException

Throws:

SchemaRegistryException

putKek

public KeyEncryptionKey putKek(String name,
 UpdateKekRequest request)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteKekOrForward

public void deleteKekOrForward(String name,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteKek

public void deleteKek(String name,
 boolean permanentDelete)
               throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteKekOrForward

public void undeleteKekOrForward(String name,
 Map<String,String> headerProperties)
                          throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteKek

public void undeleteKek(String name)
                 throws SchemaRegistryException

Throws:

SchemaRegistryException

getDekSubjects

public List<String> getDekSubjects(String kekName,
 boolean lookupDeleted)
                            throws SchemaRegistryException

Throws:

SchemaRegistryException

getDekVersions

public List<Integer> getDekVersions(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)
                             throws SchemaRegistryException

Throws:

SchemaRegistryException

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 boolean lookupDeleted)
                                                                   throws SchemaRegistryStoreException

Throws:

SchemaRegistryStoreException

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 String kekName,
 boolean lookupDeleted)
                                                                   throws SchemaRegistryStoreException

Throws:

SchemaRegistryStoreException

getDeks

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeks(String tenant,
 String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)
                                                                   throws SchemaRegistryStoreException

Throws:

SchemaRegistryStoreException

getLatestDek

public DataEncryptionKey getLatestDek(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

getLatestDek

public DataEncryptionKey getLatestDek(String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted,
 boolean maybeGenerateRawDek)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

getDek

public DataEncryptionKey getDek(String kekName,
 String subject,
 int version,
 DekFormat algorithm,
 boolean lookupDeleted)
                         throws SchemaRegistryException

Throws:

SchemaRegistryException

maybeGenerateRawDek

protected DataEncryptionKey maybeGenerateRawDek(DataEncryptionKey key)
                                         throws SchemaRegistryException

Throws:

SchemaRegistryException

createDekOrForward

public Dek createDekOrForward(String kekName,
 boolean rewrap,
 CreateDekRequest request,
 Map<String,String> headerProperties)
                       throws SchemaRegistryException

Throws:

SchemaRegistryException

createDek

public DataEncryptionKey createDek(String kekName,
 boolean rewrap,
 CreateDekRequest request)
                            throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekOrForward

public void deleteDekOrForward(String name,
 String subject,
 DekFormat algorithm,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDek

public void deleteDek(String name,
 String subject,
 DekFormat algorithm,
 boolean permanentDelete)
               throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekVersionOrForward

public void deleteDekVersionOrForward(String name,
 String subject,
 int version,
 DekFormat algorithm,
 boolean permanentDelete,
 Map<String,String> headerProperties)
                               throws SchemaRegistryException

Throws:

SchemaRegistryException

deleteDekVersion

public void deleteDekVersion(String name,
 String subject,
 int version,
 DekFormat algorithm,
 boolean permanentDelete)
                      throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekOrForward

public void undeleteDekOrForward(String name,
 String subject,
 DekFormat algorithm,
 Map<String,String> headerProperties)
                          throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDek

public void undeleteDek(String name,
 String subject,
 DekFormat algorithm)
                 throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekVersionOrForward

public void undeleteDekVersionOrForward(String name,
 String subject,
 int version,
 DekFormat algorithm,
 Map<String,String> headerProperties)
                                 throws SchemaRegistryException

Throws:

SchemaRegistryException

undeleteDekVersion

public void undeleteDekVersion(String name,
 String subject,
 int version,
 DekFormat algorithm)
                        throws SchemaRegistryException

Throws:

SchemaRegistryException

generateEncryptedDek

protected DataEncryptionKey generateEncryptedDek(KeyEncryptionKey kek,
 DataEncryptionKey key)
                                          throws DekGenerationException

Throws:

DekGenerationException

generateRawDek

protected DataEncryptionKey generateRawDek(KeyEncryptionKey kek,
 DataEncryptionKey key)
                                    throws DekGenerationException

Throws:

DekGenerationException

getAead

protected com.google.crypto.tink.Aead getAead(KeyEncryptionKey kek)
                                       throws GeneralSecurityException

Throws:

GeneralSecurityException

normalizeLimit

public int normalizeLimit(int suppliedLimit,
 int defaultLimit,
 int maxLimit)

normalizeKekLimit

public int normalizeKekLimit(int suppliedLimit)

normalizeDekSubjectLimit

public int normalizeDekSubjectLimit(int suppliedLimit)

normalizeDekVersionLimit

public int normalizeDekVersionLimit(int suppliedLimit)

toJson

protected static byte[] toJson(Object o)
                        throws com.fasterxml.jackson.core.JsonProcessingException

Throws:

com.fasterxml.jackson.core.JsonProcessingException