Class: Karafka::Pro::Encryption::Ciphers::Base

Inherits:
Object
  • Object
show all
Defined in:
lib/karafka/pro/encryption/ciphers/base.rb

Overview

Base for the cipher implementations, providing shared access to the configured RSA key material with per-version private key resolution

Direct Known Subclasses

Direct, Envelope

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Base

Note:

Each cipher instance holds its own tiny cache of parsed pem objects. With two cipher implementations composed by Karafka::Pro::Encryption::Cipher this means the material is parsed at most twice per version, which we accept over introducing a shared keyring concept

Note:

The caches are populated via #warmup during the single-threaded setup phase, so under normal operations runtime access is read-only. Should a key version appear only at runtime, the lazy population is idempotent and benign under MRI (worst case the same pem is parsed twice)

Initializes the cipher with an empty private keys cache



54
55
56
 
# File 'lib/karafka/pro/encryption/ciphers/base.rb', line 54

def initialize
  @private_pems = {}
end

Instance Method Details

#warmup(encryption_config) ⇒ Object

Eagerly parses the given encryption config key material into the instance caches

Parameters:

  • encryption_config (Karafka::Core::Configurable::Node) —

    encryption config node. During setup it is the same node the lazy readers resolve at runtime, passed explicitly so this method does not silently couple to the global state



63
64
65
66
67
68
69
 
# File 'lib/karafka/pro/encryption/ciphers/base.rb', line 63

def warmup(encryption_config)
  @public_pem ||= OpenSSL::PKey::RSA.new(encryption_config.public_key)

  encryption_config.private_keys.each do |version, key|
    @private_pems[version] ||= OpenSSL::PKey::RSA.new(key)
  end
end