nevzheng opened a new issue, #12488:
URL: https://github.com/apache/gravitino/issues/12488
### Describe the subtask
`KmsReference` should identify a key by configured provider name and `keyId`
only. Server config should use provider-named instances, each declaring its
API. The unreleased Developer API from #12132 and #12133 can change.
Today `KmsReference` is `{api, source, keyId}`
([#12132](https://github.com/apache/gravitino/pull/12132)) and config is
`gravitino.kms.sources` / `gravitino.kms.source.<name>.api`
([#12133](https://github.com/apache/gravitino/pull/12133)). That puts the
protocol (`api`) and an extra `source` name on the public key identity.
@roryqi asked on
[datastrato/gravitino-enterprise#913](https://github.com/datastrato/gravitino-enterprise/pull/913)
(Linear comment df4b4d02) to change upstream `KmsReference` instead of adding
`KmsProviderKey`. @lasdf1234 asked on
[datastrato/gravitino-enterprise#1096](https://github.com/datastrato/gravitino-enterprise/pull/1096)
for `provider` rather than `source`, and to omit `api` from the key identity.
**Desired outcome**
Server config becomes provider-named, each instance declaring its API:
```
gravitino.kms.providers=aws-prod,aws-dr,azure-eu
gravitino.kms.provider.aws-prod.api=aws-kms
gravitino.kms.provider.aws-dr.api=aws-kms
gravitino.kms.provider.azure-eu.api=azure-key-vault
```
- Same list-plus-prefix pattern as `gravitino.auxService.names`. Legal Java
Properties / `gravitino.conf`.
- Provider names: `[A-Za-z0-9][A-Za-z0-9_-]*` (no `.`).
- Many named instances may share one API (two AWS + one Azure).
Public key identity `KmsReference` becomes `{provider, keyId}` only. No
`api()` / `source()`. JSON DTO: `{"provider":"aws-prod","keyId":"..."}`.
`api` stays a lowercase kebab-case protocol id (`KmsApiIdentifiers`) on
config and `KmsClientFactory.api()` only.
`KmsReference` does not look up API. `KmsClientRegistry` (owned by
`GravitinoEnv`) is a startup hashmap `provider → {api, client}`. Front door:
```java
KmsClientRegistry registry = GravitinoEnv.getInstance().kmsClientRegistry();
KmsReference ref = new KmsReference("aws-prod", "alias/Customer-Key");
KmsClient client = registry.getClient(ref); // hashmap by provider
Optional<KmsKeyProperties> props = client.getKeyProperties(ref);
```
**Scope and boundaries**
In scope: Apache public API and in-repo compile follow-through
(`KmsReference`, DTO, factory, `FakeKmsClient`, `KmsConfig`,
`KmsClientRegistry`, tests).
Out of scope for this issue: enterprise stack, design-pack adapter prose,
demo conf, and `gravitino-server-config.md` (follow-up).
This issue does not close #12131.
Related to: #12131, #12132, #12133.
### Parent issue
https://github.com/apache/gravitino/issues/12131
Nevin
Sent from my 🤖 (Cursor)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
