org.apache.hadoop.crypto.key.kms.server

Class EagerKeyGeneratorKeyProviderCryptoExtension

java.lang.Object

org.apache.hadoop.crypto.key.KeyProvider

org.apache.hadoop.crypto.key.KeyProviderExtension<org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.CryptoExtension>

org.apache.hadoop.crypto.key.KeyProviderCryptoExtension

org.apache.hadoop.crypto.key.kms.server.EagerKeyGeneratorKeyProviderCryptoExtension

@InterfaceAudience.Private
public class EagerKeyGeneratorKeyProviderCryptoExtension
extends org.apache.hadoop.crypto.key.KeyProviderCryptoExtension

A KeyProviderCryptoExtension that pre-generates and caches encrypted keys.

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.hadoop.crypto.key.KeyProviderCryptoExtension

org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.EncryptedKeyVersion

Nested classes/interfaces inherited from class org.apache.hadoop.crypto.key.KeyProviderExtension

org.apache.hadoop.crypto.key.KeyProviderExtension.Extension

Nested classes/interfaces inherited from class org.apache.hadoop.crypto.key.KeyProvider

org.apache.hadoop.crypto.key.KeyProvider.KeyVersion, org.apache.hadoop.crypto.key.KeyProvider.Metadata, org.apache.hadoop.crypto.key.KeyProvider.Options

Field Summary

Fields

Modifier and Type	Field and Description
static int	KMS_KEY_CACHE_EXPIRY_DEFAULT
static String	KMS_KEY_CACHE_EXPIRY_MS
static String	KMS_KEY_CACHE_LOW_WATERMARK
static float	KMS_KEY_CACHE_LOW_WATERMARK_DEFAULT
static String	KMS_KEY_CACHE_NUM_REFILL_THREADS
static int	KMS_KEY_CACHE_NUM_REFILL_THREADS_DEFAULT
static String	KMS_KEY_CACHE_SIZE
static int	KMS_KEY_CACHE_SIZE_DEFAULT

Fields inherited from class org.apache.hadoop.crypto.key.KeyProviderCryptoExtension

EEK, EK

Fields inherited from class org.apache.hadoop.crypto.key.KeyProvider

DEFAULT_BITLENGTH, DEFAULT_BITLENGTH_NAME, DEFAULT_CIPHER, DEFAULT_CIPHER_NAME, JCEKS_KEY_SERIAL_FILTER, JCEKS_KEY_SERIALFILTER_DEFAULT

Constructor Summary

Constructors

Constructor and Description
EagerKeyGeneratorKeyProviderCryptoExtension(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.crypto.key.KeyProviderCryptoExtension keyProviderCryptoExtension) This class is a proxy for a KeyProviderCryptoExtension that decorates the underlying CryptoExtension with one that eagerly caches pre-generated Encrypted Keys using a ValueQueue

Method Summary

Modifier and Type	Method and Description
void	invalidateCache(String name)
org.apache.hadoop.crypto.key.KeyProvider.KeyVersion	rollNewVersion(String name) Roll a new version of the given key generating the material for it.
org.apache.hadoop.crypto.key.KeyProvider.KeyVersion	rollNewVersion(String name, byte[] material)

Methods inherited from class org.apache.hadoop.crypto.key.KeyProviderCryptoExtension

close, createKeyProviderCryptoExtension, decryptEncryptedKey, drain, generateEncryptedKey, reencryptEncryptedKey, reencryptEncryptedKeys, warmUpEncryptedKeys

Methods inherited from class org.apache.hadoop.crypto.key.KeyProviderExtension

createKey, createKey, deleteKey, flush, getCurrentKey, getExtension, getKeyProvider, getKeys, getKeysMetadata, getKeyVersion, getKeyVersions, getMetadata, isTransient, toString

Methods inherited from class org.apache.hadoop.crypto.key.KeyProvider

buildVersionName, findProvider, generateKey, getBaseName, getConf, needsPassword, noPasswordError, noPasswordWarning, options

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

KMS_KEY_CACHE_SIZE

public static final String KMS_KEY_CACHE_SIZE

See Also:

Constant Field Values

KMS_KEY_CACHE_SIZE_DEFAULT

public static final int KMS_KEY_CACHE_SIZE_DEFAULT

See Also:

Constant Field Values

KMS_KEY_CACHE_LOW_WATERMARK

public static final String KMS_KEY_CACHE_LOW_WATERMARK

See Also:

Constant Field Values

KMS_KEY_CACHE_LOW_WATERMARK_DEFAULT

public static final float KMS_KEY_CACHE_LOW_WATERMARK_DEFAULT

See Also:

Constant Field Values

KMS_KEY_CACHE_EXPIRY_MS

public static final String KMS_KEY_CACHE_EXPIRY_MS

See Also:

Constant Field Values

KMS_KEY_CACHE_EXPIRY_DEFAULT

public static final int KMS_KEY_CACHE_EXPIRY_DEFAULT

See Also:

Constant Field Values

KMS_KEY_CACHE_NUM_REFILL_THREADS

public static final String KMS_KEY_CACHE_NUM_REFILL_THREADS

See Also:

Constant Field Values

KMS_KEY_CACHE_NUM_REFILL_THREADS_DEFAULT

public static final int KMS_KEY_CACHE_NUM_REFILL_THREADS_DEFAULT

See Also:

Constant Field Values

Constructor Detail

EagerKeyGeneratorKeyProviderCryptoExtension

public EagerKeyGeneratorKeyProviderCryptoExtension(org.apache.hadoop.conf.Configuration conf,
                                                   org.apache.hadoop.crypto.key.KeyProviderCryptoExtension keyProviderCryptoExtension)

This class is a proxy for a KeyProviderCryptoExtension that decorates the underlying CryptoExtension with one that eagerly caches pre-generated Encrypted Keys using a ValueQueue

Parameters:

conf - Configuration object to load parameters from

keyProviderCryptoExtension - KeyProviderCryptoExtension to delegate calls to.

Method Detail

rollNewVersion

public org.apache.hadoop.crypto.key.KeyProvider.KeyVersion rollNewVersion(String name)
                                                                   throws NoSuchAlgorithmException,
                                                                          IOException

Roll a new version of the given key generating the material for it.

Due to the caching on the ValueQueue, even after a rollNewVersion call, KeyProviderCryptoExtension.generateEncryptedKey(String) may still return an old key - even when we drain the queue here, the async thread may later fill in old keys. This is acceptable since old version keys are still able to decrypt, and client shall make no assumptions that it will get a new versioned key after rollNewVersion.

Overrides:

rollNewVersion in class org.apache.hadoop.crypto.key.KeyProviderExtension<org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.CryptoExtension>

Throws:

NoSuchAlgorithmException

IOException

rollNewVersion

public org.apache.hadoop.crypto.key.KeyProvider.KeyVersion rollNewVersion(String name,
                                                                          byte[] material)
                                                                   throws IOException

Overrides:

rollNewVersion in class org.apache.hadoop.crypto.key.KeyProviderExtension<org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.CryptoExtension>

Throws:

IOException

invalidateCache

public void invalidateCache(String name)
                     throws IOException

Overrides:

invalidateCache in class org.apache.hadoop.crypto.key.KeyProviderExtension<org.apache.hadoop.crypto.key.KeyProviderCryptoExtension.CryptoExtension>

Throws:

IOException