func init() { … } const KMSAPIVersionv2 … const KMSAPIVersionv2beta1 … const annotationsMaxSize … const KeyIDMaxSize … const encryptedDEKSourceMaxSize … const cacheTTL … const errKeyIDOKCode … const errKeyIDEmptyCode … const errKeyIDTooLongCode … var NowFunc … type StateFunc … type ErrCodeKeyID … type State … func (s *State) ValidateEncryptCapability() error { … } type envelopeTransformer … // NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. // It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to // the data items they encrypt. func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc, apiServerID string) value.Transformer { … } func newEnvelopeTransformerWithClock(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc, apiServerID string, cacheTTL time.Duration, clock clock.Clock) value.Transformer { … } // TransformFromStorage decrypts data encrypted by this transformer using envelope encryption. func (t *envelopeTransformer) TransformFromStorage(ctx context.Context, data []byte, dataCtx value.Context) ([]byte, bool, error) { … } // TransformToStorage encrypts data to be written to disk using envelope encryption. func (t *envelopeTransformer) TransformToStorage(ctx context.Context, data []byte, dataCtx value.Context) ([]byte, error) { … } // addTransformerForDecryption inserts a new transformer to the Envelope cache of DEKs for future reads. func (t *envelopeTransformer) addTransformerForDecryption(cacheKey []byte, key []byte, useSeed bool) (value.Read, error) { … } // doEncode encodes the EncryptedObject to a byte array. func (t *envelopeTransformer) doEncode(request *kmstypes.EncryptedObject) ([]byte, error) { … } // doDecode decodes the byte array to an EncryptedObject. func (t *envelopeTransformer) doDecode(originalData []byte) (*kmstypes.EncryptedObject, error) { … } // GenerateTransformer generates a new transformer and encrypts the DEK/seed using the envelope service. // It returns the transformer, the encrypted DEK/seed, cache key and error. func GenerateTransformer(ctx context.Context, uid string, envelopeService kmsservice.Service, useSeed bool) (value.Transformer, *kmstypes.EncryptedObject, []byte, error) { … } func ValidateEncryptedObject(o *kmstypes.EncryptedObject) error { … } // validateEncryptedDEKSource tests the following: // 1. The encrypted DEK source is not empty. // 2. The size of encrypted DEK source is less than 1 kB. func validateEncryptedDEKSource(encryptedDEKSource []byte) error { … } // validateAnnotations tests the following: // 1. checks if the annotation key is fully qualified // 2. The size of annotations keys + values is less than 32 kB. func validateAnnotations(annotations map[string][]byte) error { … } // ValidateKeyID tests the following: // 1. The keyID is not empty. // 2. The size of keyID is less than 1 kB. func ValidateKeyID(keyID string) (ErrCodeKeyID, error) { … } func getRequestInfoFromContext(ctx context.Context) *genericapirequest.RequestInfo { … } // generateCacheKey returns a key for the cache. // The key is a concatenation of: // 0. encryptedDEKSourceType // 1. encryptedDEKSource // 2. keyID // 3. length of annotations // 4. annotations (sorted by key) - each annotation is a concatenation of: // a. annotation key // b. annotation value func generateCacheKey(encryptedDEKSourceType kmstypes.EncryptedDEKSourceType, encryptedDEKSource []byte, keyID string, annotations map[string][]byte) ([]byte, error) { … } // toBytes performs unholy acts to avoid allocations func toBytes(s string) []byte { … } // GetHashIfNotEmpty returns the sha256 hash of the data if it is not empty. func GetHashIfNotEmpty(data string) string { … }
Codebase Browser
kubernetes