Package io.kroxylicious.proxy.tls

Interface ServerTlsCredentialSupplierFactory<C,I>

Type Parameters:
C - The type of configuration. Use Void if the credential supplier is not configurable.
I - The type of the initialization data passed between factory methods.
public interface ServerTlsCredentialSupplierFactory<C,I>

A pluggable factory for creating ServerTlsCredentialSupplier instances.

ServerTlsCredentialSupplierFactory implementations are:

  • service implementations provided by plugin authors
  • called by the proxy runtime to create credential supplier instances
  • used to configure how the proxy obtains TLS credentials for server-side connections

The proxy runtime guarantees that:

  1. instances will be initialized before any attempt to create credential supplier instances,
  2. instances will eventually be closed if and only if they were successfully initialized,
  3. no attempts to create credential supplier instances will be made once a factory instance is closed,
  4. instances will be initialized and closed on the same thread.

Credential supplier creation can happen on a different thread than initialization or cleanup. It is suggested to pass state using the return value from initialize(ServerTlsCredentialSupplierFactoryContext, Object) rather than relying on synchronization within a factory implementation.

Lifecycle

 1. initialize(ServerTlsCredentialSupplierFactoryContext, Object) - validate config, create shared resources
 2. create(ServerTlsCredentialSupplierFactoryContext, Object) - create a single shared supplier instance
 3. close(Object) - release resources

Usage Example: Simple File-Based Supplier


 @Plugin(configType = FileBasedSupplierConfig.class)
 public class FileBasedSupplierFactory
         implements ServerTlsCredentialSupplierFactory<FileBasedSupplierConfig, FileBasedSupplierConfig> {

     @Override
     public FileBasedSupplierConfig initialize(ServerTlsCredentialSupplierFactoryContext context,
                                               FileBasedSupplierConfig config) {
         // Validate configuration
         FileBasedSupplierConfig validated = Plugins.requireConfig(this, config);

         // Verify files exist
         if (!Files.exists(validated.keyPath())) {
             throw new PluginConfigurationException("Private key file not found: " + validated.keyPath());
         }
         if (!Files.exists(validated.certPath())) {
             throw new PluginConfigurationException("Certificate file not found: " + validated.certPath());
         }

         return validated;
     }

     @Override
     public ServerTlsCredentialSupplier create(ServerTlsCredentialSupplierFactoryContext context,
                                               FileBasedSupplierConfig config) {
         return new FileBasedCredentialSupplier(config.keyPath(), config.certPath());
     }
 }

 public record FileBasedSupplierConfig(
     @JsonProperty(required = true) Path keyPath,
     @JsonProperty(required = true) Path certPath
 ) {}

Usage Example: Supplier with Shared Resources


 @Plugin(configType = KmsSupplierConfig.class)
 public class KmsSupplierFactory
         implements ServerTlsCredentialSupplierFactory<KmsSupplierConfig, KmsSupplierFactory.SharedContext> {

     record SharedContext(KmsSupplierConfig config, KeyManagementService kms) {}

     @Override
     public SharedContext initialize(ServerTlsCredentialSupplierFactoryContext context, KmsSupplierConfig config) {
         KmsSupplierConfig validated = Plugins.requireConfig(this, config);

         // Get KMS plugin instance
         KeyManagementService kms = context.pluginInstance(
             KeyManagementService.class,
             validated.kmsImplementation()
         );

         return new SharedContext(validated, kms);
     }

     @Override
     public ServerTlsCredentialSupplier create(ServerTlsCredentialSupplierFactoryContext context,
                                               SharedContext sharedContext) {
         return new KmsCredentialSupplier(sharedContext.kms(), sharedContext.config());
     }

     @Override
     public void close(SharedContext sharedContext) {
         // Clean up KMS resources if needed
         if (sharedContext.kms() instanceof AutoCloseable closeable) {
             closeable.close();
         }
     }
 }

 public record KmsSupplierConfig(
     @PluginImplName(KeyManagementService.class) String kmsImplementation,
     @PluginImplConfig(implNameProperty = "kmsImplementation") Object kmsConfig,
     @JsonProperty(required = true) String keyId
 ) {}

Configuration Example

Configure a TLS credential supplier in the proxy YAML configuration:

 virtualClusters:
   demo:
     targetCluster:
       bootstrap_servers: kafka.example.com:9093
       tls:
         trust:
           storeFile: /path/to/truststore.p12
           storePassword:
             passwordFile: /path/to/password.txt
         # TLS credential supplier configuration
         credentialSupplier:
           type: FileBasedSupplier  # References @Plugin annotation's name
           config:
             keyPath: /path/to/client-key.pem
             certPath: /path/to/client-cert.pem
See Also: