Package org.apache.hadoop.crypto.key

Class CachingKeyProvider

java.lang.Object

org.apache.hadoop.crypto.key.KeyProvider

org.apache.hadoop.crypto.key.KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

org.apache.hadoop.crypto.key.CachingKeyProvider

All Implemented Interfaces:

java.io.Closeable, java.lang.AutoCloseable

public class CachingKeyProvider
extends KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

A KeyProviderExtension implementation providing a short lived cache for KeyVersions and Metadatato avoid burst of requests to hit the underlying KeyProvider.

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.hadoop.crypto.key.KeyProviderExtension

KeyProviderExtension.Extension

Nested classes/interfaces inherited from class org.apache.hadoop.crypto.key.KeyProvider

KeyProvider.KeyVersion, KeyProvider.Metadata, KeyProvider.Options

Field Summary

Fields inherited from class org.apache.hadoop.crypto.key.KeyProvider

DEFAULT_BITLENGTH, DEFAULT_BITLENGTH_NAME, DEFAULT_CIPHER, DEFAULT_CIPHER_NAME, JCEKS_KEY_SERIAL_FILTER, JCEKS_KEY_SERIALFILTER_DEFAULT

Constructor Summary

Constructors

Constructor	Description
CachingKeyProvider(KeyProvider keyProvider, long keyTimeoutMillis, long currKeyTimeoutMillis)

Method Summary

Modifier and Type	Method	Description
void	deleteKey(java.lang.String name)	Delete the given key.
KeyProvider.KeyVersion	getCurrentKey(java.lang.String name)	Get the current version of the key, which should be used for encrypting new data.
KeyProvider.KeyVersion	getKeyVersion(java.lang.String versionName)	Get the key material for a specific version of the key.
KeyProvider.Metadata	getMetadata(java.lang.String name)	Get metadata about the key.
void	invalidateCache(java.lang.String name)	Can be used by implementing classes to invalidate the caches.
KeyProvider.KeyVersion	rollNewVersion(java.lang.String name)	Roll a new version of the given key generating the material for it.
KeyProvider.KeyVersion	rollNewVersion(java.lang.String name, byte[] material)	Roll a new version of the given key.

Methods inherited from class org.apache.hadoop.crypto.key.KeyProviderExtension

createKey, createKey, flush, getExtension, getKeyProvider, getKeys, getKeysMetadata, getKeyVersions, isTransient, toString

Methods inherited from class org.apache.hadoop.crypto.key.KeyProvider

buildVersionName, close, findProvider, generateKey, getBaseName, getConf, needsPassword, noPasswordError, noPasswordWarning, options

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

CachingKeyProvider

public CachingKeyProvider(KeyProvider keyProvider,
                          long keyTimeoutMillis,
                          long currKeyTimeoutMillis)

Method Detail

getCurrentKey

public KeyProvider.KeyVersion getCurrentKey(java.lang.String name)
                                     throws java.io.IOException

Description copied from class: KeyProvider

Get the current version of the key, which should be used for encrypting new data.

Overrides:

getCurrentKey in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the base name of the key

Returns:

the version name of the current version of the key or null if the key version doesn't exist

Throws:

java.io.IOException - raised on errors performing I/O.

getKeyVersion

public KeyProvider.KeyVersion getKeyVersion(java.lang.String versionName)
                                     throws java.io.IOException

Description copied from class: KeyProvider

Get the key material for a specific version of the key. This method is used when decrypting data.

Overrides:

getKeyVersion in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

versionName - the name of a specific version of the key

Returns:

the key material

Throws:

java.io.IOException - raised on errors performing I/O.

deleteKey

public void deleteKey(java.lang.String name)
               throws java.io.IOException

Description copied from class: KeyProvider

Delete the given key.

Overrides:

deleteKey in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the name of the key to delete

Throws:

java.io.IOException - raised on errors performing I/O.

rollNewVersion

public KeyProvider.KeyVersion rollNewVersion(java.lang.String name,
                                             byte[] material)
                                      throws java.io.IOException

Description copied from class: KeyProvider

Roll a new version of the given key.

Overrides:

rollNewVersion in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the basename of the key

material - the new key material

Returns:

the name of the new version of the key

Throws:

java.io.IOException - raised on errors performing I/O.

rollNewVersion

public KeyProvider.KeyVersion rollNewVersion(java.lang.String name)
                                      throws java.security.NoSuchAlgorithmException,
                                             java.io.IOException

Description copied from class: KeyProvider

Roll a new version of the given key generating the material for it.

This implementation generates the key material and calls the KeyProvider.rollNewVersion(String, byte[]) method.

Overrides:

rollNewVersion in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the basename of the key

Returns:

the name of the new version of the key

Throws:

java.security.NoSuchAlgorithmException - This exception is thrown when a particular cryptographic algorithm is requested but is not available in the environment.

java.io.IOException - raised on errors performing I/O.

invalidateCache

public void invalidateCache(java.lang.String name)
                     throws java.io.IOException

Description copied from class: KeyProvider

Can be used by implementing classes to invalidate the caches. This could be used after rollNewVersion to provide a strong guarantee to return the new version of the given key.

Overrides:

invalidateCache in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the basename of the key

Throws:

java.io.IOException - raised on errors performing I/O.

getMetadata

public KeyProvider.Metadata getMetadata(java.lang.String name)
                                 throws java.io.IOException

Description copied from class: KeyProvider

Get metadata about the key.

Overrides:

getMetadata in class KeyProviderExtension<org.apache.hadoop.crypto.key.CachingKeyProvider.CacheExtension>

Parameters:

name - the basename of the key

Returns:

the key's metadata or null if the key doesn't exist

Throws:

java.io.IOException - raised on errors performing I/O.