nevzheng opened a new issue, #12131: URL: https://github.com/apache/gravitino/issues/12131
### Describe the proposal Add a server-private, provider-neutral KMS API that allows Gravitino to validate a key reference against a configured KMS source. The proposal includes: - typed key references containing the KMS API, configured source, and provider-native key ID; - normalized key properties for existence, enabled state, and supported operations; - named KMS source configuration, discovery, routing, and lifecycle management; - adapters for OpenBao Transit, HashiCorp Vault Transit, AWS KMS, Google Cloud KMS, and Azure Key Vault; - distinct configuration, authentication, availability, and key-validation errors; and - unit, contract, Docker, and opt-in cloud integration tests. KMS credentials and key material remain server-private. The initial API inspects key properties so applications can validate keys; it does not perform encryption, decryption, key creation, or rotation. The first application is governed Iceberg table encryption, but the KMS API is not coupled to that use case. Design: [Provider-Neutral KMS API](https://github.com/nevzheng/gravitino/blob/codex/kms-api/design-docs/kms-api.md) Requested reviewers: @roryqi and @asdf1234. ### Task list The PR links will be added here as the stack is submitted. - [ ] Define the provider-neutral KMS API and key-reference model - [ ] Add named-source configuration, routing, and lifecycle management - [ ] Add OpenBao and Vault Transit providers - [ ] Add the AWS KMS provider - [ ] Add the Google Cloud KMS provider - [ ] Add the Azure Key Vault provider - [ ] Add OpenBao and Vault Transit integration coverage - [ ] Add AWS KMS integration coverage - [ ] Add Google Cloud KMS integration coverage - [ ] Add Azure Key Vault integration coverage - [ ] Document the API, provider contracts, security boundaries, and testing - [ ] Wire and verify provider discovery in the packaged Gravitino server -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
