A source of crypto keys. This is usually backed by a Ranger KMS.
| 29 | * A source of crypto keys. This is usually backed by a Ranger KMS. |
| 30 | */ |
| 31 | public interface KeyProvider { |
| 32 | |
| 33 | /** |
| 34 | * Get the list of key names from the key provider. |
| 35 | * @return a list of key names |
| 36 | */ |
| 37 | List<String> getKeyNames() throws IOException; |
| 38 | |
| 39 | /** |
| 40 | * Get the current metadata for a given key. This is used when encrypting |
| 41 | * new data. |
| 42 | * |
| 43 | * @param keyName the name of a key |
| 44 | * @return metadata for the current version of the key |
| 45 | * @throws IllegalArgumentException if the key is unknown |
| 46 | */ |
| 47 | HadoopShims.KeyMetadata getCurrentKeyVersion(String keyName) throws IOException; |
| 48 | |
| 49 | /** |
| 50 | * Create a local key for the given key version. This local key will be |
| 51 | * randomly generated and encrypted with the given version of the master |
| 52 | * key. The encryption and decryption is done with the local key and the |
| 53 | * user process never has access to the master key, because it stays on the |
| 54 | * Ranger KMS. |
| 55 | * |
| 56 | * @param key the master key version |
| 57 | * @return the local key's material both encrypted and unencrypted |
| 58 | */ |
| 59 | LocalKey createLocalKey(HadoopShims.KeyMetadata key) throws IOException; |
| 60 | |
| 61 | /** |
| 62 | * Decrypt a local key for reading a file. |
| 63 | * |
| 64 | * @param key the master key version |
| 65 | * @param encryptedKey the encrypted key |
| 66 | * @return the decrypted local key's material or null if the key is not |
| 67 | * available |
| 68 | */ |
| 69 | Key decryptLocalKey(HadoopShims.KeyMetadata key, byte[] encryptedKey) throws IOException; |
| 70 | |
| 71 | /** |
| 72 | * Get the kind of this provider. |
| 73 | */ |
| 74 | HadoopShims.KeyProviderKind getKind(); |
| 75 | |
| 76 | /** |
| 77 | * A service loader factory interface. |
| 78 | */ |
| 79 | interface Factory { |
| 80 | /** |
| 81 | * Create a key provider. |
| 82 | * @param kind the kind of key provider |
| 83 | * @param conf the configuration |
| 84 | * @param random a random number generator |
| 85 | * @return the key provider |
| 86 | * @throws IOException if there is an error |
| 87 | */ |
| 88 | KeyProvider create(String kind, |
no outgoing calls
no test coverage detected