Skip to main content

Schema based encryption​

You can now define your encryption requirement directly within your Schemas.

Here is an example using json schema where we specify that we want to encrypt the password and visa fields, with their corresponding keySecretId. We also tag the location field as PII and GDPR.

{
  "$id": "https://example.com/person.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Customer",
  "type": "object",
  "properties": {
    "name": { "type": "string" },
    "username": { "type": "string" },
    "password": { "type": "string", "conduktor.keySecretId": "password-secret"},
    "visa": { "type": "string", "conduktor.keySecretId": "visa-secret" },
    "address": {
      "type": "object",
      "properties": {
        "location": { "type": "string", "conduktor.tags": ["PII", "GDPR"] },
        "town": { "type": "string" },
        "country": { "type": "string" }
      }
    }
  }
}

The encryption configuration now supports defaults to simplify your setups

{
    "defaultKeySecretId": "myDefaultKeySecret",
    "defaultAlgorithm": {
      "type": "TINK/AES128_EAX",
      "kms": "IN_MEMORY"
    },
    "tags": [ "PII", "ENCRYPTION", "GDPR" ]
}

KMS now use cloud managed identities by default​

To prevent setting up manual connectivity, KMS are now using cloud managed identity by default

Cache KMS Time to Live​

You can now cache the KMS keys for a certain amount of time. This is useful to reduce the number of calls to your KMS.

keyTtlMs: The key's time to live in milliseconds. Default is 1 hour, disable the cache by setting it to 0

Override Header Injections​

Header config can now be further enforced with overrides, the plugin now supports overrideIfExists with default set to false. When set to true, the plugin will override the header if it already exists in the request. This can be useful for if a required piece of metadata is missing in the header, you can add something automatically whilst ignoring the ones that have set the value.

SSL Principal Extraction​

The SSL principal extraction is now configurable with GATEWAY_SSL_PRINCIPAL_MAPPING_RULES it will follow the same rules as Kafka.

General Fixes 🔨​

  • Quieter responses to Prometheus by not publishing HTTP quantiles in the response
  • Topic configuration is now returned in all Gateway modes
  • Additional tools have been added to the base image to help with setup and debug: lsof, iotop, htop, iftop