Class SpireClientFactory

java.lang.Object

org.apache.kafka.common.security.auth.SpireClientFactory

public class SpireClientFactory
extends Object

Factory for creating and managing SpireX509Client instances.

Each broker has its own SpireX509Client instance, keyed by the broker's session UUID.

Graceful Failure Handling

Use tryInitSpireX509Client(String, String, String, String) for graceful initialization that won't crash the broker on SPIRE infrastructure failures. This method:

• Validates broker configuration (brokerSessionUuid, k8sNamespace, k8sServiceAccount) and throws exceptions for configuration errors - these are broker issues that should fail fast
• Catches SPIRE runtime errors (network issues, SPIRE server unavailable, etc.) and returns false instead of throwing - allowing the broker to continue with fallback authentication

Constructor Summary

Constructors

Constructor	Description
SpireClientFactory()

Method Summary

Modifier and Type	Method	Description
static void	closeAll()	Closes all SpireX509Client instances.
static int	getInstanceCount()	Returns the number of active SpireX509Client instances.
static io.confluent.srj.spire.SpireX509Client	getSpireX509ClientInstance(String brokerSessionUuid)	Gets the SpireX509Client instance for the specified broker session.
static boolean	hasInstance(String brokerSessionUuid)	Checks if a SpireX509Client instance exists for the specified broker session.
static boolean	tryInitSpireX509Client(String brokerSessionUuid, String k8sNamespace, String k8sServiceAccount, String spiffeIdPatterns)	Attempts to initialize a SpireX509Client with graceful failure handling.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SpireClientFactory

public SpireClientFactory()

Method Details

tryInitSpireX509Client

public static boolean tryInitSpireX509Client(String brokerSessionUuid,
 String k8sNamespace,
 String k8sServiceAccount,
 String spiffeIdPatterns)

Attempts to initialize a SpireX509Client with graceful failure handling.

This method separates configuration validation from SPIRE runtime initialization:

• Configuration errors (null/empty brokerSessionUuid, missing K8s config): Throws exception immediately - these are broker misconfigurations that should fail fast
• SPIRE runtime errors (network issues, SPIRE server unavailable): Logs error and returns false - broker can continue with fallback authentication

Parameters:

brokerSessionUuid - the unique identifier for this broker session (required)

k8sNamespace - the Kubernetes namespace for SPIRE secrets (required)

k8sServiceAccount - the Kubernetes service account (required)

spiffeIdPatterns - comma-separated list of authorized SPIFFE ID patterns (optional)

Returns:

true if SPIRE client was successfully initialized, false if SPIRE runtime failed

Throws:

IllegalArgumentException - if brokerSessionUuid is null or empty

IllegalStateException - if k8sNamespace or k8sServiceAccount is null

getSpireX509ClientInstance

public static io.confluent.srj.spire.SpireX509Client getSpireX509ClientInstance(String brokerSessionUuid)

Gets the SpireX509Client instance for the specified broker session.

Parameters:

brokerSessionUuid - the unique identifier for this broker session

Returns:

the SpireX509Client instance

Throws:

IllegalStateException - if the client has not been initialized for this session

hasInstance

public static boolean hasInstance(String brokerSessionUuid)

Checks if a SpireX509Client instance exists for the specified broker session. Visible for testing

Parameters:

brokerSessionUuid - the unique identifier for this broker session

Returns:

true if an instance exists, false otherwise

closeAll

public static void closeAll()

Closes all SpireX509Client instances. This should be called during broker shutdown.

getInstanceCount

public static int getInstanceCount()

Returns the number of active SpireX509Client instances. Useful for testing and monitoring.

Returns:

the number of active instances