Module: Karafka::Pro::Encryption

Defined in:
lib/karafka/pro/encryption.rb,
lib/karafka/pro/encryption/cipher.rb,
lib/karafka/pro/encryption/errors.rb,
lib/karafka/pro/encryption/ciphers/base.rb,
lib/karafka/pro/encryption/setup/config.rb,
lib/karafka/pro/encryption/ciphers/direct.rb,
lib/karafka/pro/encryption/messages/parser.rb,
lib/karafka/pro/encryption/ciphers/envelope.rb,
lib/karafka/pro/encryption/contracts/config.rb,
lib/karafka/pro/encryption/messages/middleware.rb

Overview

Out of the box encryption engine for both Karafka and WaterDrop It uses asymmetric encryption via RSA. We use asymmetric so we can have producers that won't have ability (when private key not added) to decrypt messages.

Defined Under Namespace

Modules: Ciphers, Contracts, Errors, Messages, Setup Classes: Cipher

Class Method Summary collapse

Class Method Details

.post_fork(_config, _pre_fork_producer) ⇒ Object

This feature does not need any changes post-fork

Parameters:

  • _config (Karafka::Core::Configurable::Node)
  • _pre_fork_producer (WaterDrop::Producer) 


82
83
84
 
# File 'lib/karafka/pro/encryption.rb', line 82

def post_fork(_config, _pre_fork_producer)
  true
end

.post_setup(config) ⇒ Object

Parameters:

  • config (Karafka::Core::Configurable::Node) —

    root node config



55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/karafka/pro/encryption.rb', line 55

def post_setup(config)
  Encryption::Contracts::Config.new.validate!(
    config.to_h,
    scope: %w[config]
  )

  # Don't inject extra components if encryption is not active
  return unless config.encryption.active

  # This parser is encryption aware
  config.internal.messages.parser = Messages::Parser.new

  # Encryption for WaterDrop
  config.producer.middleware.append(Messages::Middleware.new)

  # Warm the cipher internals (sub-ciphers, parsed key material) in this
  # single-threaded phase so runtime encryption and decryption across worker threads
  # only read already-built state. Custom ciphers can opt in by exposing
  # #warmup(config)
  cipher = config.encryption.cipher
  cipher.warmup(config) if cipher.respond_to?(:warmup)
end

.pre_setup(config) ⇒ Object

Sets up additional config scope, validations and other things

Parameters:

  • config (Karafka::Core::Configurable::Node) —

    root node config



41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'lib/karafka/pro/encryption.rb', line 41

def pre_setup(config)
  # Expand the config with this feature specific stuff
  config.instance_eval do
    setting(:encryption, default: Setup::Config.config)
  end

  # Registered as a config-phase constraint (verified centrally during setup together
  # with all other environment requirements) instead of being checked ad hoc here
  Karafka::Constraints.register(:pro_encryption_envelope_openssl, phase: :config) do |cfg|
    verify_envelope_requirements!(cfg)
  end
end