wbtiger
/
foundationdb
mirror of https://github.com/apple/foundationdb.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove orphaned REST KMS connector code

This commit is contained in:
Trevor Clinkenbeard 2026-04-28 06:53:57 -07:00
parent 5e779af7f3
commit 1f37a6506c
7 changed files with 0 additions and 313 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
fdbserver/core/ServerKnobs.cpp
View File

@ -1358,41 +1358,10 @@ void ServerKnobs::initialize(Randomize randomize, ClientKnobs* clientKnobs, IsSi
init( ENCRYPTION_LOGGING_INTERVAL, 5.0 );
init( DISABLED_ENCRYPTION_PROBABILITY_SIM, 0.95 );
// KMS connector type
init( KMS_CONNECTOR_TYPE, "RESTKmsConnector" );
// Blob Metadata
init( BLOB_METADATA_CACHE_TTL, isSimulated ? 120 : 24 * 60 * 60 );
if ( randomize && BUGGIFY) { BLOB_METADATA_CACHE_TTL = deterministicRandom()->randomInt(50, 100); }
// HTTP KMS Connector
init( REST_KMS_CONNECTOR_KMS_DISCOVERY_URL_MODE, "file");
init( REST_KMS_CONNECTOR_VALIDATION_TOKEN_MODE, "file");
init( REST_KMS_CONNECTOR_VALIDATION_TOKEN_MAX_SIZE, 1024);
init( REST_KMS_CONNECTOR_VALIDATION_TOKENS_MAX_PAYLOAD_SIZE, 10 * 1024);
init( REST_KMS_CONNECTOR_REFRESH_KMS_URLS, true);
init( REST_KMS_CONNECTOR_REFRESH_KMS_URLS_INTERVAL_SEC, 600);
// Below KMS configurations are responsible for:
// Discovering KMS URLs, fetch encryption keys endpoint and validation token details.
// Configurations are expected to be passed as command-line arguments.
// NOTE: Care must be taken when attempting to update below configurations for a up/running FDB cluster.
init( REST_KMS_CONNECTOR_DISCOVER_KMS_URL_FILE, "");
init( REST_KMS_CONNECTOR_GET_ENCRYPTION_KEYS_ENDPOINT, "");
init( REST_KMS_CONNECTOR_GET_LATEST_ENCRYPTION_KEYS_ENDPOINT, "");
init( REST_KMS_CONNECTOR_GET_BLOB_METADATA_ENDPOINT, "");
// Details to fetch validation token from a localhost file
// acceptable format: "<token_name1>$<absolute_file_path1>,<token_name2>$<absolute_file_path2>,.."
// NOTE: 'token-name" can NOT contain '$' character
init( REST_KMS_CONNECTOR_VALIDATION_TOKEN_DETAILS, "");
init( ENABLE_REST_KMS_COMMUNICATION, false); if( randomize && BUGGIFY ) ENABLE_REST_KMS_COMMUNICATION = true;
init( REST_KMS_CONNECTOR_REMOVE_TRAILING_NEWLINE, false);
init( REST_KMS_CURRENT_BLOB_METADATA_REQUEST_VERSION, 1);
init( REST_KMS_MAX_BLOB_METADATA_REQUEST_VERSION, 1);
init( REST_KMS_CURRENT_CIPHER_REQUEST_VERSION, 1);
init( REST_KMS_MAX_CIPHER_REQUEST_VERSION, 1);
init( REST_SIM_KMS_VAULT_DIR, "");
init( REST_KMS_STABILITY_CHECK_INTERVAL, 5.0);
init( CONSISTENCY_SCAN_ACTIVE_THROTTLE_RATIO, 0.5 ); if( randomize && BUGGIFY ) CONSISTENCY_SCAN_ACTIVE_THROTTLE_RATIO = deterministicRandom()->random01();

24
fdbserver/core/include/fdbserver/core/Knobs.h
View File

@ -1335,33 +1335,9 @@ public:
double ENCRYPTION_LOGGING_INTERVAL;
double DISABLED_ENCRYPTION_PROBABILITY_SIM; // Probability that encryption is forced to be disabled in simulation
// Key Management Service (KMS) Connector
std::string KMS_CONNECTOR_TYPE;
// Blob metadata
int64_t BLOB_METADATA_CACHE_TTL;
// HTTP KMS Connector
std::string REST_KMS_CONNECTOR_KMS_DISCOVERY_URL_MODE;
std::string REST_KMS_CONNECTOR_DISCOVER_KMS_URL_FILE;
std::string REST_KMS_CONNECTOR_VALIDATION_TOKEN_MODE;
std::string REST_KMS_CONNECTOR_VALIDATION_TOKEN_DETAILS;
bool ENABLE_REST_KMS_COMMUNICATION;
bool REST_KMS_CONNECTOR_REMOVE_TRAILING_NEWLINE;
int REST_KMS_CONNECTOR_VALIDATION_TOKEN_MAX_SIZE;
int REST_KMS_CONNECTOR_VALIDATION_TOKENS_MAX_PAYLOAD_SIZE;
bool REST_KMS_CONNECTOR_REFRESH_KMS_URLS;
double REST_KMS_CONNECTOR_REFRESH_KMS_URLS_INTERVAL_SEC;
std::string REST_KMS_CONNECTOR_GET_ENCRYPTION_KEYS_ENDPOINT;
std::string REST_KMS_CONNECTOR_GET_LATEST_ENCRYPTION_KEYS_ENDPOINT;
std::string REST_KMS_CONNECTOR_GET_BLOB_METADATA_ENDPOINT;
int REST_KMS_CURRENT_BLOB_METADATA_REQUEST_VERSION;
int REST_KMS_MAX_BLOB_METADATA_REQUEST_VERSION;
int REST_KMS_CURRENT_CIPHER_REQUEST_VERSION;
int REST_KMS_MAX_CIPHER_REQUEST_VERSION;
std::string REST_SIM_KMS_VAULT_DIR;
double REST_KMS_STABILITY_CHECK_INTERVAL;
double CONSISTENCY_SCAN_ACTIVE_THROTTLE_RATIO;
// Idempotency ids

47
fdbserver/include/fdbserver/KmsConnector.h
View File

@ -1,47 +0,0 @@
/*
* KmsConnector.h
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef KMS_CONNECTOR_H
#define KMS_CONNECTOR_H
#pragma once
#include "fdbserver/KmsConnectorInterface.h"
#include "flow/Arena.h"
#include "flow/EncryptUtils.h"
// FDB encryption needs to interact with external Key Management Services (KMS) solutions to lookup/refresh encryption
// keys. KmsConnector interface is an abstract interface enabling implementing specialized KMS connector
// implementations.
// FDB KMSConnector implementations should inherit from KmsConnector and implement the pure virtual function below.
class KmsConnector : public NonCopyable {
public:
KmsConnector(const std::string& conStr) : connectorStr(conStr) {}
virtual ~KmsConnector() {}
virtual Future<Void> connectorCore(struct KmsConnectorInterface interf) = 0;
std::string getConnectorStr() const { return connectorStr; }
protected:
std::string connectorStr;
};
#endif

33
fdbserver/include/fdbserver/RESTKmsConnector.h
View File

@ -1,33 +0,0 @@
/*
* RESTKmsConnector.actor.h
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef REST_KMS_CONNECTOR_H
#define REST_KMS_CONNECTOR_H
#pragma once
#include "fdbserver/KmsConnector.h"
class RESTKmsConnector : public KmsConnector {
public:
RESTKmsConnector(const std::string& conStr) : KmsConnector(conStr) {}
Future<Void> connectorCore(KmsConnectorInterface interf);
};
#endif

116
fdbserver/include/fdbserver/RESTKmsConnectorUtils.h
View File

@ -1,116 +0,0 @@
/*
* RESTKmsConnectorUtils.h
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FDBSERVER_REST_KMS_CONNECTOR_UTILS_H
#define FDBSERVER_REST_KMS_CONNECTOR_UTILS_H
#pragma once
#include "fdbrpc/HTTP.h"
#include "flow/EncryptUtils.h"
#include "flow/flow.h"
#include <rapidjson/rapidjson.h>
#include <rapidjson/document.h>
#include <rapidjson/stringbuffer.h>
#include <rapidjson/writer.h>
namespace RESTKmsConnectorUtils {
extern const char* BASE_CIPHER_ID_TAG;
extern const char* BASE_CIPHER_TAG;
extern const char* CIPHER_KEY_DETAILS_TAG;
extern const char* ENCRYPT_DOMAIN_ID_TAG;
extern const char* REFRESH_AFTER_SEC;
extern const char* EXPIRE_AFTER_SEC;
extern const char* ERROR_TAG;
extern const char* ERROR_MSG_TAG;
extern const char* ERROR_CODE_TAG;
extern const char* KMS_URLS_TAG;
extern const char* REFRESH_KMS_URLS_TAG;
extern const char* REQUEST_VERSION_TAG;
extern const char* VALIDATION_TOKENS_TAG;
extern const char* VALIDATION_TOKEN_NAME_TAG;
extern const char* VALIDATION_TOKEN_VALUE_TAG;
extern const char* DEBUG_UID_TAG;
extern const char* TOKEN_NAME_FILE_SEP;
extern const char* TOKEN_TUPLE_SEP;
extern const char DISCOVER_URL_FILE_URL_SEP;
extern const char* BLOB_METADATA_DETAILS_TAG;
extern const char* BLOB_METADATA_DOMAIN_ID_TAG;
extern const char* BLOB_METADATA_LOCATIONS_TAG;
extern const char* BLOB_METADATA_LOCATION_ID_TAG;
extern const char* BLOB_METADATA_LOCATION_PATH_TAG;
extern const int INVALID_REQUEST_VERSION;
enum class ValidationTokenSource {
VALIDATION_TOKEN_SOURCE_FILE = 1,
VALIDATION_TOKEN_SOURCE_LAST // Always the last element
};
struct ErrorDetail {
std::string errorCode;
std::string errorMsg;
ErrorDetail() {}
ErrorDetail(const std::string& code, const std::string& msg) : errorCode(code), errorMsg(msg) {}
bool isEqual(const ErrorDetail& toCompare) const {
return errorCode.compare(toCompare.errorCode) == 0 && errorMsg.compare(toCompare.errorMsg) == 0;
}
};
struct ValidationTokenCtx {
std::string name;
std::string value;
ValidationTokenSource source;
Optional<std::string> filePath;
explicit ValidationTokenCtx(const std::string& n, ValidationTokenSource s)
: name(n), value(""), source(s), filePath(Optional<std::string>()), readTS(now()) {}
double getReadTS() const { return readTS; }
private:
double readTS; // Approach assists refreshing token based on time of creation
};
using ValidationTokenMap = std::unordered_map<std::string, ValidationTokenCtx>;
HTTP::Headers getHTTPHeaders();
void addVersionToDoc(rapidjson::Document& doc, const int requestVersion);
void addLatestDomainDetailsToDoc(rapidjson::Document& doc,
const char* rootTagName,
const char* idTagName,
const EncryptCipherDomainIdVec& domainIds);
void addBaseCipherIdDomIdToDoc(rapidjson::Document& doc,
rapidjson::Value& keyIdDetails,
const EncryptCipherBaseKeyId baseCipherId,
const Optional<EncryptCipherDomainId> domainId);
void addValidationTokensSectionToJsonDoc(rapidjson::Document& doc, const ValidationTokenMap& tokenMap);
void addRefreshKmsUrlsSectionToJsonDoc(rapidjson::Document& doc, const bool refreshKmsUrls);
void addDebugUidSectionToJsonDoc(rapidjson::Document& doc, Optional<UID> dbgId);
Optional<ErrorDetail> getError(const rapidjson::Document& doc);
} // namespace RESTKmsConnectorUtils
#endif

41
fdbserver/include/fdbserver/RESTSimKmsVault.h
View File

@ -1,41 +0,0 @@
/*
* RESTSimKmsVault.h
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2026 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FDBSERVER_REST_SIM_KMS_VAULT_H
#define FDBSERVER_REST_SIM_KMS_VAULT_H
#pragma once
#include "fdbrpc/HTTP.h"
#include "fdbrpc/simulator.h"
const std::string REST_SIM_KMS_VAULT_GET_ENCRYPTION_KEYS_BY_KEY_IDS_RESOURCE = "/get-encryption-keys-by-key-ids";
const std::string REST_SIM_KMS_VAULT_GET_ENCRYPTION_KEYS_BY_DOMAIN_IDS_RESOURCE = "/get-encryption-keys-by-domain-ids";
const std::string REST_SIM_KMS_VAULT_GET_BLOB_METADATA_RESOURCE = "/get-blob-metadata";
struct RESTSimKmsVaultRequestHandler : HTTP::IRequestHandler, ReferenceCounted<RESTSimKmsVaultRequestHandler> {
Future<Void> handleRequest(Reference<HTTP::IncomingRequest> req,
Reference<HTTP::OutgoingResponse> response) override;
Reference<HTTP::IRequestHandler> clone() override { return makeReference<RESTSimKmsVaultRequestHandler>(); }
void addref() override { ReferenceCounted<RESTSimKmsVaultRequestHandler>::addref(); }
void delref() override { ReferenceCounted<RESTSimKmsVaultRequestHandler>::delref(); }
};
#endif

21
tests/fast/RESTUnit.toml
View File

@ -1,6 +1,3 @@
[[knobs]]
rest_kms_connector_remove_trailing_newline = true
[[test]]
testTitle = 'RESTUtilsTest'
startDelay = 0
@ -9,21 +6,3 @@ useDB = false
[[test.workload]]
testName = 'UnitTests'
testsMatching = '/RESTUtils'
[[test]]
testTitle = 'RESTSimKmsVaultTest'
startDelay = 0
useDB = false
[[test.workload]]
testName = 'UnitTests'
testsMatching = '/restSimKmsVault/'
[[test]]
testTitle = 'RESTKmsConnectorTest'
useDB = false
startDelay = 0
[[test.workload]]
testName = 'UnitTests'
testsMatching = '/KmsConnector/'