cluster

Documentation

Overview

Package cluster implements a KMS backend for in cluster key management.

The cluster backend holds a master key, and corresponding salt. Data Encryption Keys (DEK) are derived from master key and salt using HKDF.

This backend does not require a storage backend, as keys are derived on demand and not stored anywhere. For that purpose the special NoStoreURI can be used during KMS initialization.

Index

• type KMS
  • func New(key []byte, salt []byte) (*KMS, error)
  • func (c *KMS) Close()
  • func (c *KMS) GetDEK(_ context.Context, dekID string, dekSize int) ([]byte, error)

Types

type KMS

type KMS struct {
	// contains filtered or unexported fields
}

KMS implements the kms.CloudKMS interface for in cluster key management.

func New

func New(key []byte, salt []byte) (*KMS, error)

New creates a new ClusterKMS.

func (*KMS) Close

func (c *KMS) Close()

Close is a no-op for cKMS.

func (*KMS) GetDEK

func (c *KMS) GetDEK(_ context.Context, dekID string, dekSize int) ([]byte, error)

GetDEK derives a key from the KMS masterKey.