Package io.kroxylicious.proxy.tls

Interface ServerTlsCredentialSupplier

public interface ServerTlsCredentialSupplier

Supplies TLS credentials for proxy-to-server (upstream) TLS connections.

Instances of this interface are created by ServerTlsCredentialSupplierFactory and are responsible for providing TLS credentials (private keys and certificate chains) that the proxy uses when connecting to the target Kafka cluster.

The supplier supports asynchronous credential retrieval, allowing implementations to load credentials from remote sources, perform cryptographic operations, or interact with external services without blocking the proxy runtime.

Thread Safety

Implementations must be thread-safe as the tlsCredentials(ServerTlsCredentialSupplierContext) method may be called concurrently from multiple threads.

Non-Blocking Requirement

Implementations must not block the calling thread or perform heavy I/O operations synchronously. Long-running work such as network calls, file I/O, or key generation should be performed asynchronously, returning a CompletionStage that completes when the work is done.

Error Handling

If credential retrieval fails, implementations should return a CompletionStage that completes exceptionally. The runtime will handle the exception appropriately, typically by rejecting the connection attempt.

Usage Example: File-Based Credential Loading


 public class FileBasedCredentialSupplier implements ServerTlsCredentialSupplier {
     private final PrivateKey key;
     private final X509Certificate[] chain;

     public FileBasedCredentialSupplier(PrivateKey key, X509Certificate[] chain) {
         this.key = key;
         this.chain = chain;
     }

     @Override
     public CompletionStage<TlsCredentials> tlsCredentials(ServerTlsCredentialSupplierContext context) {
         // Plugin has already parsed the key and certificate chain (from PEM, PKCS12, etc.)
         // Use context factory method to create validated TlsCredentials
         TlsCredentials creds = context.tlsCredentials(key, chain);
         return CompletableFuture.completedFuture(creds);
     }
 }

Usage Example: Client-Specific Credentials


 public class ClientSpecificSupplier implements ServerTlsCredentialSupplier {
     private final Map<String, PrivateKey> clientKeys;
     private final Map<String, X509Certificate[]> clientChains;
     private final PrivateKey defaultKey;
     private final X509Certificate[] defaultChain;

     public ClientSpecificSupplier(Map<String, PrivateKey> clientKeys,
                                   Map<String, X509Certificate[]> clientChains,
                                   PrivateKey defaultKey,
                                   X509Certificate[] defaultChain) {
         this.clientKeys = clientKeys;
         this.clientChains = clientChains;
         this.defaultKey = defaultKey;
         this.defaultChain = defaultChain;
     }

     @Override
     public CompletionStage<TlsCredentials> tlsCredentials(ServerTlsCredentialSupplierContext context) {
         Optional<ClientTlsContext> clientContext = context.clientTlsContext();

         if (clientContext.isPresent() && clientContext.get().clientCertificate().isPresent()) {
             String clientId = clientContext.get().clientCertificate().get()
                 .getSubjectX500Principal().getName();

             PrivateKey key = clientKeys.get(clientId);
             X509Certificate[] chain = clientChains.get(clientId);

             if (key != null && chain != null) {
                 TlsCredentials creds = context.tlsCredentials(key, chain);
                 return CompletableFuture.completedFuture(creds);
             }
         }

         // Fall back to shared default credentials
         TlsCredentials creds = context.tlsCredentials(defaultKey, defaultChain);
         return CompletableFuture.completedFuture(creds);
     }
 }
See Also:

  • Method Details

    • tlsCredentials

      CompletionStage<TlsCredentials> tlsCredentials(ServerTlsCredentialSupplierContext context)

      Asynchronously retrieves TLS credentials for the proxy to use when connecting to the target Kafka cluster.

      This method may be called multiple times and should return credentials appropriate for the current request context. Implementations may cache credentials, retrieve them from external sources, or generate them on-demand.

      Parameters:
      context - The runtime context for this credential request
      Returns:
      A CompletionStage that completes with the TLS credentials