Documentation
¶
Overview ¶
Package kms wires the proxy's encryption configuration into a running crypto.Vault.
It reads config.Encryption, opens the configured KMS keys as KEKs (via gocloud.dev/secrets, so any of awskms, azurekeyvault, gcpkms, or a local testing key is supported), assembles a crypto.KEKRegistry, and constructs the crypto.Vault that the rest of the proxy uses to seal and open payloads.
The package exposes a single Module for Uber fx. When encryption is disabled the module provides a nil *crypto.Vault and starts no background work; when enabled it also runs a goroutine that periodically refreshes the vault so DEKs rotate ahead of expiry.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Module = fx.Options( fx.Provide( func(p KMSParams) (*crypto.Vault, error) { if p.Config.Encryption.Default == nil { return nil, nil } reporter := NewReporter(p.Factory.ForSubsystem("encryption")) r, err := createKEKRegistry( p.Context, p.Lifecycle, p.Config, p.Logger, reporter, ) if err != nil { return nil, err } v, err := createVault(p.Config, r, reporter) if err != nil { _ = r.Close() return nil, err } return v, nil }, ), fx.Invoke(func(p KMSParams, v *crypto.Vault) { if !p.Config.Encryption.Enabled { return } ctx, cancel := context.WithCancel(p.Context) p.Lifecycle.Append(fx.Hook{ OnStart: func(context.Context) error { go runRotation(ctx, v, rotationInterval, p.Logger) return nil }, OnStop: func(context.Context) error { cancel() return nil }, }) }), )
Module provides a *crypto.Vault whenever encryption keys are configured (a Default key policy is present) and, only while encryption is Enabled, runs background key rotation for the lifetime of the fx application. Building the vault from key presence rather than the Enabled flag lets encryption be turned off for new traffic while the vault stays available to open payloads sealed earlier: the proxy interceptor gates sealing on Enabled but always decrypts. With no key policy the vault is nil and no rotation runs.
Functions ¶
This section is empty.
Types ¶
type KMSParams ¶
type KMSParams struct {
fx.In
Context context.Context
Config *config.Config
Lifecycle fx.Lifecycle
Logger logger.Logger
Factory *metrics.Factory
}
KMSParams are the fx dependencies used to construct and run the vault.
type Reporter ¶
type Reporter struct {
// contains filtered or unexported fields
}
Reporter records encryption telemetry to Prometheus: KEK wrap/unwrap calls and DEK cache behavior. It implements crypto.Observer so a Vault can notify it of cache events, and exposes KEKOp for the KEK decorator. Handles for the low-cardinality KEK label combinations are pre-resolved so the emit path is a lock-free map read; an unexpected combination falls back to WithLabelValues. A Reporter is safe for concurrent use.
func NewReporter ¶
NewReporter builds the Prometheus-backed encryption Reporter, pre-resolving the meaningful KEK label combinations so every series starts at zero. f must already be scoped to the "encryption" subsystem by the caller.
func (*Reporter) CacheHit ¶
func (r *Reporter) CacheHit(e crypto.CacheEvent)
CacheHit records a DEK cache hit and updates the cache-size gauge.
func (*Reporter) CacheMiss ¶
func (r *Reporter) CacheMiss(e crypto.CacheEvent)
CacheMiss records a DEK cache miss and updates the cache-size gauge.
Source Files