Class PemFileKeyProvider

java.lang.Object
org.apache.pulsar.client.api.v5.auth.PemFileKeyProvider
All Implemented Interfaces:
CryptoKeyProvider, PrivateKeyProvider, PublicKeyProvider
public final class PemFileKeyProvider extends Object implements CryptoKeyProvider
Batteries-included key provider that loads PEM-encoded keys from local files.

The same instance can serve as both PublicKeyProvider and PrivateKeyProvider — register public keys for the producer side and private keys for the consumer side. In typical setups each side instantiates its own provider, configured only with the keys it actually needs.

For more complex sources (KMS, Vault, ...) implement PublicKeyProvider or PrivateKeyProvider directly. 

var keys = PemFileKeyProvider.builder()
        .publicKey("orders-v1", Path.of("/etc/keys/orders-pub.pem"))
        .privateKey("orders-v1", Path.of("/etc/keys/orders-priv.pem"))
        .build();

client.newProducer(Schema.string())
      .topic("orders")
      .encryptionPolicy(ProducerEncryptionPolicy.builder()
              .publicKeyProvider(keys)
              .keyName("orders-v1")
              .build())
      .create();

  • Method Details

    • getPublicKey

      public CompletableFuture<EncryptionKey> getPublicKey(String keyName)
      Description copied from interface: PublicKeyProvider
      Look up the public key with the given name.
      Specified by:
      getPublicKey in interface PublicKeyProvider
      Parameters:
      keyName - the key identifier as configured on the producer
      Returns:
      a future completing with the public key, or completing exceptionally if the key cannot be found or loaded

    • getPrivateKey

      public CompletableFuture<EncryptionKey> getPrivateKey(String keyName, Map<String,String> metadata)
      Description copied from interface: PrivateKeyProvider
      Look up the private key for the given name.

      metadata carries any hints the producer attached when the message was encrypted — typically a key version or rotation marker. Implementations that don't rotate keys can ignore it.

      Specified by:
      getPrivateKey in interface PrivateKeyProvider
      Parameters:
      keyName - the key identifier the producer used to encrypt
      metadata - producer-supplied hints about the key (never null; empty when the producer didn't attach any)
      Returns:
      a future completing with the private key, or completing exceptionally if the key cannot be found or loaded

    • builder

      public static PemFileKeyProvider.Builder builder()
      Returns:
      a new builder for constructing a PemFileKeyProvider