public class EncryptionKeyManager extends Object
Modifier and Type | Class and Description |
---|---|
static interface |
EncryptionKeyManager.WellKnownKeypathHook
Hook for writing newly created keys to a "well-known" path.
|
Constructor and Description |
---|
EncryptionKeyManager(org.apache.kafka.common.utils.Time time,
org.apache.kafka.common.metrics.Metrics metrics,
com.google.crypto.tink.Aead masterKeyAead,
Duration maxKeyAge) |
Modifier and Type | Method and Description |
---|---|
KeySha |
activeKeySha()
Returns the current active KeySha.
|
void |
bindHook(EncryptionKeyManager.WellKnownKeypathHook hook)
Bind a WellKnownKeypathHook instance to this EncryptionKeyManager.
|
void |
clear()
Clear the key cache, this is used only for testing.
|
void |
close() |
KeyContext |
keyContext(KeySha keySha)
Returns the context necessary to upload or download an encrypted object.
|
KeySha |
registerKeyFromObjectMetadata(Map<String,String> metadata) |
public EncryptionKeyManager(org.apache.kafka.common.utils.Time time, org.apache.kafka.common.metrics.Metrics metrics, com.google.crypto.tink.Aead masterKeyAead, Duration maxKeyAge)
time
- Time source used for calculating key age with respect to the maxKeyAge.masterKeyAead
- The master key Aead.maxKeyAge
- The maximum age for a key.public void bindHook(EncryptionKeyManager.WellKnownKeypathHook hook)
hook
- Callback interfaces for writing and reading newly refreshed keys. This allows for an
optimization where upon key refresh, the broker can first check for a newer key at a
"well-known" keypath, and replace the "well-known" key if it is too old. The intent
is to reduce the number of unique keys used across the cluster without introducing
additional coordination.public void close()
public KeyContext keyContext(KeySha keySha)
public KeySha registerKeyFromObjectMetadata(Map<String,String> metadata)
public KeySha activeKeySha()
public void clear()