Package io.confluent.kafka.schemaregistry.encryption.tink

Interface KmsDriver

public interface KmsDriver

  • Field Details

  • Method Details

    • getKeyUrlPrefix

      String getKeyUrlPrefix()

    • newKmsClient

      com.google.crypto.tink.KmsClient newKmsClient(Map<String,?> configs, Optional<String> kekUrl) throws GeneralSecurityException
      Throws:
      GeneralSecurityException

    • doesSupport

      default boolean doesSupport(String keyUri)
      Returns:
      true if this client does support keyUri

    • isAccessDenied

      default boolean isAccessDenied(Throwable t)
      Returns true if the given throwable, or any of its causes, indicates that the KMS rejected the request because the caller is not authenticated or not authorized (i.e. a 401 or 403), so that such failures can be surfaced as a 4xx rather than a 5xx. Walks the cause chain and delegates to isAccessDeniedException(Throwable), which drivers override to inspect their own provider-specific exception types.

    • isAccessDeniedException

      default boolean isAccessDeniedException(Throwable t)
      Returns true if this single throwable (not its causes) is a provider-specific exception that represents an authentication or authorization failure. Defaults to false.

    • isAccessDeniedStatus

      default boolean isAccessDeniedStatus(int statusCode)
      Returns true if the given HTTP status code denotes an authentication/authorization failure (401 or 403). Single source of truth for the access-denied status set shared by drivers.

    • getKmsClient

      default com.google.crypto.tink.KmsClient getKmsClient(String kekUrl) throws GeneralSecurityException
      Throws:
      GeneralSecurityException

    • registerKmsClient

      default com.google.crypto.tink.KmsClient registerKmsClient(Map<String,?> configs, Optional<String> kekUrl) throws GeneralSecurityException
      Throws:
      GeneralSecurityException

    • getTestClient

      default Object getTestClient(Map<String,?> configs)