LiJie20190102 opened a new issue, #14397:
URL: https://github.com/apache/gravitino/issues/14397
### Describe the subtask
**Priority:** P0
**Dependencies:** #13755
**Problem:** The existing `KmsClient` (#12252) only inspects key metadata —
it does not
perform cryptographic operations. Envelope encryption needs a
`wrap`/`unwrap` primitive so a
KMS can protect the master key while being contacted once per process start.
**Scope:**
- Add the `SealClient` interface with `wrap(byte[])` / `unwrap(byte[])` per
the design doc
(§5.2); Javadoc must state that implementations never log key material.
- Add a `SealClientRegistry` loading implementations from
`gravitino.seal.providers` and
`gravitino.seal.provider.<name>.className`, following the existing
`gravitino.kms.*` / `gravitino.secret.*` instance style.
- Add the `local` implementation backed by a symmetric key file, for
development and tests
only.
- Unit tests for registry loading/failure paths and a wrap/unwrap round trip
for `local`.
- No behavior change when no seal is configured.
### Parent issue
#14396
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
