Package io.confluent.dekregistry.storage

Class KafkaDekRegistry

java.lang.Object

io.confluent.dekregistry.storage.AbstractDekRegistry

io.confluent.dekregistry.storage.KafkaDekRegistry

All Implemented Interfaces:

Closeable, AutoCloseable

Direct Known Subclasses:

DekRegistry

public class KafkaDekRegistry
extends AbstractDekRegistry

Kafka/KCache-backed implementation of DEK Registry.

Field Summary

Fields inherited from class io.confluent.dekregistry.storage.AbstractDekRegistry

AWS_KMS, AZURE_KMS, cryptors, DEK_TYPE, dekSubjectSearchDefaultLimit, dekSubjectSearchMaxLimit, dekVersionSearchDefaultLimit, dekVersionSearchMaxLimit, EMPTY_AAD, GCP_KMS, initialized, initLatch, KEK_TYPE, kekSearchDefaultLimit, kekSearchMaxLimit, KEY, LATEST_VERSION, MIN_VERSION, tenantToLock, TEST_SUBJECT, VOID_TYPE, X_FORWARD_HEADER

Constructor Summary

Constructors

Modifier	Constructor	Description
	KafkaDekRegistry(SchemaRegistry schemaRegistry, MetricsManager metricsManager)
protected	KafkaDekRegistry(SchemaRegistry schemaRegistry, MetricsManager metricsManager, DekRegistryConfig config)

Method Summary

Modifier and Type	Method	Description
void	close()
protected <K, V> io.kcache.Cache<K,V>	createCache(org.apache.kafka.common.serialization.Serde<K> keySerde, org.apache.kafka.common.serialization.Serde<V> valueSerde, String topic, io.kcache.CacheUpdateHandler<K,V> cacheUpdateHandler)
protected io.kcache.CacheUpdateHandler<EncryptionKeyId,EncryptionKey>	getCacheUpdateHandler(DekRegistryConfig config)
protected DataEncryptionKey	getDekById(DataEncryptionKeyId keyId)	Get a DEK by its ID.
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeksFromStore(String tenant, String minKekName, String maxKekName, boolean lookupDeleted)	Get all DEKs for a tenant within a KEK name range.
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getDeksFromStore(String tenant, String kekName, String subject, DekFormat algorithm, boolean lookupDeleted)	Get DEKs for a specific subject and algorithm.
protected KeyEncryptionKey	getKekById(KeyEncryptionKeyId keyId)	Get a KEK by its ID.
protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>>	getKeksFromStore(String tenant, boolean lookupDeleted)	Get all KEKs for a tenant.
com.google.common.collect.SetMultimap<String,KeyEncryptionKeyId>	getSharedKeys()
void	init()
protected void	initStore()	Perform any initialization required by the storage backend.
io.kcache.Cache<EncryptionKeyId,EncryptionKey>	keys()	Get the underlying keys kcache (only kafka-based implementations override this).
protected void	putKey(EncryptionKeyId id, EncryptionKey key)	Store a key (KEK or DEK).
protected void	removeKey(EncryptionKeyId id)	Remove a key from storage.
protected void	syncStore()	Sync/refresh the store to ensure it's up-to-date.

Methods inherited from class io.confluent.dekregistry.storage.AbstractDekRegistry

config, createDek, createDekOrForward, createKek, createKekOrForward, deleteDek, deleteDekOrForward, deleteDekVersion, deleteDekVersionOrForward, deleteKek, deleteKekOrForward, generateEncryptedDek, generateRawDek, getAead, getCryptor, getDek, getDeks, getDeks, getDeks, getDekSubjects, getDekVersions, getKek, getKekNames, getKeks, getKey, getLatestDek, getLatestDek, getMetricsManager, getSchemaRegistry, initialized, isLeader, isLeader, lock, lockFor, maybeGenerateRawDek, normalizeDekSubjectLimit, normalizeDekVersionLimit, normalizeKekLimit, normalizeKmsType, normalizeLimit, putKek, putKekOrForward, rangeKeys, testKek, toJson, toKekEntity, undeleteDek, undeleteDekOrForward, undeleteDekVersion, undeleteDekVersionOrForward, undeleteKek, undeleteKekOrForward, unlock, waitForInit

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

KafkaDekRegistry

@Inject
public KafkaDekRegistry(SchemaRegistry schemaRegistry,
 MetricsManager metricsManager)

KafkaDekRegistry

protected KafkaDekRegistry(SchemaRegistry schemaRegistry,
 MetricsManager metricsManager,
 DekRegistryConfig config)

Method Details

createCache

protected <K,
V> io.kcache.Cache<K,V> createCache(org.apache.kafka.common.serialization.Serde<K> keySerde,
 org.apache.kafka.common.serialization.Serde<V> valueSerde,
 String topic,
 io.kcache.CacheUpdateHandler<K,V> cacheUpdateHandler)
                                          throws io.kcache.exceptions.CacheInitializationException

Throws:

io.kcache.exceptions.CacheInitializationException

getCacheUpdateHandler

protected io.kcache.CacheUpdateHandler<EncryptionKeyId,EncryptionKey> getCacheUpdateHandler(DekRegistryConfig config)

keys

public io.kcache.Cache<EncryptionKeyId,EncryptionKey> keys()

Description copied from class: AbstractDekRegistry

Get the underlying keys kcache (only kafka-based implementations override this). Provides backward compatibility for external components relying on direct cache access.

Overrides:

keys in class AbstractDekRegistry

Returns:

the keys cache

getKeksFromStore

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getKeksFromStore(String tenant,
 boolean lookupDeleted)

Description copied from class: AbstractDekRegistry

Get all KEKs for a tenant.

Specified by:

getKeksFromStore in class AbstractDekRegistry

getDeksFromStore

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeksFromStore(String tenant,
 String minKekName,
 String maxKekName,
 boolean lookupDeleted)

Description copied from class: AbstractDekRegistry

Get all DEKs for a tenant within a KEK name range.

Specified by:

getDeksFromStore in class AbstractDekRegistry

getDeksFromStore

protected List<io.kcache.KeyValue<EncryptionKeyId,EncryptionKey>> getDeksFromStore(String tenant,
 String kekName,
 String subject,
 DekFormat algorithm,
 boolean lookupDeleted)

Description copied from class: AbstractDekRegistry

Get DEKs for a specific subject and algorithm.

Specified by:

getDeksFromStore in class AbstractDekRegistry

getKekById

protected KeyEncryptionKey getKekById(KeyEncryptionKeyId keyId)

Description copied from class: AbstractDekRegistry

Get a KEK by its ID.

Specified by:

getKekById in class AbstractDekRegistry

getDekById

protected DataEncryptionKey getDekById(DataEncryptionKeyId keyId)

Description copied from class: AbstractDekRegistry

Get a DEK by its ID.

Specified by:

getDekById in class AbstractDekRegistry

putKey

protected void putKey(EncryptionKeyId id,
 EncryptionKey key)

Description copied from class: AbstractDekRegistry

Store a key (KEK or DEK).

Specified by:

putKey in class AbstractDekRegistry

removeKey

protected void removeKey(EncryptionKeyId id)

Description copied from class: AbstractDekRegistry

Remove a key from storage.

Specified by:

removeKey in class AbstractDekRegistry

syncStore

protected void syncStore()

Description copied from class: AbstractDekRegistry

Sync/refresh the store to ensure it's up-to-date.

Specified by:

syncStore in class AbstractDekRegistry

getSharedKeys

public com.google.common.collect.SetMultimap<String,KeyEncryptionKeyId> getSharedKeys()

initStore

protected void initStore()

Description copied from class: AbstractDekRegistry

Perform any initialization required by the storage backend.

Specified by:

initStore in class AbstractDekRegistry

init

@PostConstruct
public void init()

Overrides:

init in class AbstractDekRegistry

close

@PreDestroy
public void close()
           throws IOException

Throws:

IOException