nevzheng opened a new pull request, #12489:
URL: https://github.com/apache/gravitino/pull/12489
### What changes were proposed in this pull request?
`KmsReference` now identifies a key by configured provider name and `keyId`
only. The KMS protocol (`api`) stays in server config, and the previous
`source` name is replaced by `provider`.
Callers resolve a client from `KmsClientRegistry` by provider. The registry
binds each named provider to its API at startup from
`gravitino.kms.provider.<name>.api`. The public reference no longer carries
`api()` or `source()`.
Server config becomes provider-named:
```
gravitino.kms.providers=aws-prod,aws-dr,azure-eu
gravitino.kms.provider.aws-prod.api=aws-kms
gravitino.kms.provider.aws-dr.api=aws-kms
gravitino.kms.provider.azure-eu.api=azure-key-vault
```
JSON DTO: `{"provider":"aws-prod","keyId":"..."}`.
This implements #12488 on the unreleased Developer API from #12132 and
#12133. Enterprise stack, design-pack adapter prose, demo conf, and
`gravitino-server-config.md` remain follow-up.
### Why are the changes needed?
Putting `api` and `source` on the public key identity forced callers to know
the protocol and invented a second name for a configured instance. Reviewers
asked to change upstream `KmsReference` instead of adding a parallel identity
type, and to use `provider` rather than `source`.
Keeping the protocol in server config lets many named providers share one
API without leaking that binding onto stored or exchanged key identity.
Fix: #12488
### Does this PR introduce _any_ user-facing change?
Yes, for the unreleased `@DeveloperApi` KMS contracts:
- `KmsReference` is `{provider, keyId}` instead of `{api, source, keyId}`
- DTO JSON uses `provider` instead of `api` and `source`
- Server config keys are `gravitino.kms.providers` and
`gravitino.kms.provider.<name>.*` instead of `sources` / `source.<name>.*`
- `KmsClientFactory.create` and registry lookup take a provider name;
registry lookup no longer checks `reference.api()`
There are no REST API changes. Docs for `gravitino-server-config.md` are out
of scope here.
### How was this patch tested?
- `./gradlew :api:test :common:test :core:test` for KMS tests passed
### Related work
Closes: #12488
Related to: #12131, #12132, #12133
Nevin
Sent from my 🤖 (Cursor)
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
