Fixed
Pinned fields
Click on the next to a field label to start pinning.
Details
Details
Assignee
Albert Shau
Albert ShauReporter
Albert Shau
Albert ShauTriaged
Yes
Components
Fix versions
Priority
Created March 30, 2023 at 5:51 PM
Updated October 26, 2023 at 10:10 PM
Resolved April 24, 2023 at 4:08 PM
The
SecureStore
interface used by applications has a method to get both the metadata and the secret content in a single call:This mirrors the
SecretManager
interface in securestore-spi, which only has a single method to get both the metadata and content.However, the securekeys API separates out the metadata and content into separate APIs:
In application contexts, the
SecureStore
interface is usually backed byRemoteSecureStore
, which needs to make 2 rest calls in order to return theSecureStoreData
object. If the underlyingSecretManager
implementation needs to fetch both metadata and data in separate calls, then that singleSecureStore.get()
call in the program results 4 external calls (2 REST calls in RemoteSecureStore, each of which require 2 external calls).All our current applications only require the data and don't read the metadata. As such, it would be better to extend the
SecretManager
SPI to have separate methods for getting data and metadata, and to also have separate methods in theSecureStore
API.