kmip Vault

A Zilla runtime kmip vault that wraps and unwraps symmetric encryption keys against a KMIP-compliant key management server — Fortanix DSM, Thales CipherTrust, Entrust KeyControl, IBM Security Guardium Key Lifecycle Manager, and others — over the OASIS Key Management Interoperability Protocol's TTLV-over-TLS transport. No vendor-specific client library is required, and raw key material never leaves the KMIP server: only wrap/unwrap requests cross the wire.

Available in Zilla Plus

This is typically combined with a model's encryption option, referencing one or more keys by name to wrap and unwrap the data encryption keys used for field-level or full-payload Kafka message encryption.

server:
  type: kmip
  options:
    endpoint: https://kmip.example.com:5696
    keys:
      orders-key: <kmip-key-id>

Configuration (* required)

options

object

The kmip specific options.

options.endpoint*

string

The KMIP server's TTLV-over-TLS endpoint, as a https://host:port URL. Port 5696 is the IANA-registered default for KMIP.

options:
  endpoint: https://kmip.example.com:5696

options.tls

object

Client-side TLS material for the connection to the KMIP server, sourced from another named vault in the same namespace rather than configured inline. Most KMIP servers require mutual TLS, so this is typically needed in practice.

options:
  tls:
    vault: my-tls-vault
    keys:
      - kmip-client
    trust:
      - kmip-ca

tls.vault*

string

Name of another vault, declared in the same namespace, that holds the client identity and/or trusted certificate authority material — for example a filesystem vault backed by a PKCS12 keystore.

tls.keys

array of string

Alias(es) of the client identity entries to resolve from the referenced vault, for mutual TLS. When omitted, every key entry the referenced vault holds is resolved.

tls.trust

array of string

Alias(es) of the trusted certificate authority entries to resolve from the referenced vault. When omitted, every trust entry the referenced vault holds is resolved; when the referenced vault has none, the JVM's default trust store is used instead.

options.keys*

array of string, object

KMIP server UniqueIdentifiers for the symmetric key objects to wrap/unwrap against. Accepts either a list of ids or a map of alias name to id, so an alias can be referenced by name wherever an id would otherwise be required. Each configured name (or bare id, when unaliased) is what a model's encryption option references.

options:
  keys:
    orders-key: <kmip-key-id>