kmsv2

Documentation

Overview

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope provider

Index

• Constants
• func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, ...) value.Transformer
• func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)
• type ErrCodeKeyID
  • func ValidateKeyID(keyID string) (ErrCodeKeyID, error)
• type KeyIDGetterFunc
• type ProbeHealthzCheckFunc

Constants

const (
	// KMSAPIVersion is the version of the KMS API.
	KMSAPIVersion = "v2alpha1"

	// KeyIDMaxSize is the maximum size of the keyID.
	KeyIDMaxSize = 1 * 1024 // 1 kB

)

Functions

func NewEnvelopeTransformer

func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, keyIDGetter KeyIDGetterFunc, probeHealthzCheck ProbeHealthzCheckFunc, baseTransformerFunc func(cipher.Block) value.Transformer) value.Transformer

NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to the data items they encrypt.

func NewGRPCService

func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)

NewGRPCService returns an envelope.Service which use gRPC to communicate the remote KMS provider.

Types

type ErrCodeKeyID

type ErrCodeKeyID string

func ValidateKeyID

func ValidateKeyID(keyID string) (ErrCodeKeyID, error)

ValidateKeyID tests the following: 1. The keyID is not empty. 2. The size of keyID is less than 1 kB.

type KeyIDGetterFunc

type KeyIDGetterFunc func(context.Context) (keyID string, err error)

type ProbeHealthzCheckFunc

type ProbeHealthzCheckFunc func(context.Context) (err error)