keys

Creates, updates, deletes, gets or lists a keys resource.

Overview

Name	keys
Type	Resource
Id	confluent.encryption_keys.keys

Fields

The following fields are returned by SELECT queries:

get_byok_v1_key

Key.

Name	Datatype	Description
id	string	ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object kinds or objects of the same kind within a different scope/namespace ("space"). (example: dlz-f3a90de)
display_name	string	The human-readable name of the key object. (example: Key for billing cluster)
api_version	string	APIVersion defines the schema version of this representation of a resource. (byok/v1)
key	object	The cloud-specific key details. For AWS, provide the corresponding key_arn. For Azure, provide the corresponding key_id. For GCP, provide the corresponding key_id.
kind	string	Kind defines the object this REST resource represents. (Key)
metadata	object	ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
provider	string	The cloud provider of the Key. (example: AWS)
state	string	The state of the key: AVAILABLE: key can be used for a Kafka cluster provisioning. IN_USE: key is already in use by a Kafka cluster provisioning. (example: IN_USE)
validation	object	The validation details of the key.

list_byok_v1_keys

Key.

Name	Datatype	Description
id	string	ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object kinds or objects of the same kind within a different scope/namespace ("space"). (example: dlz-f3a90de)
display_name	string	The human-readable name of the key object. (example: Key for billing cluster)
api_version	string	APIVersion defines the schema version of this representation of a resource. (byok/v1)
key	object	The cloud-specific key details. For AWS, provide the corresponding key_arn. For Azure, provide the corresponding key_id. For GCP, provide the corresponding key_id.
kind	string	Kind defines the object this REST resource represents. (Key)
metadata	object	ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
provider	string	The cloud provider of the Key. (example: AWS)
state	string	The state of the key: AVAILABLE: key can be used for a Kafka cluster provisioning. IN_USE: key is already in use by a Kafka cluster provisioning. (example: IN_USE)
validation	object	The validation details of the key.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_byok_v1_key	select	id		Make a request to read a key.
list_byok_v1_keys	select		display_name, provider, state, validation_phase, validation_region, key, page_size, page_token	Retrieve a sorted, filtered, paginated list of all keys.
create_byok_v1_key	insert	key		Make a request to create a key.
update_byok_v1_key	update	id		Make a request to update a key.
delete_byok_v1_key	delete	id		Make a request to delete a key.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
id	string	The unique identifier for the key.
display_name	string	Filter the results by a partial search of display_name. (example: Key for billing cluster)
key	string	Filters results by a partial match on the key identifier: key_arn for AWS, key_id for Azure and GCP. (example: vault-name)
page_size	integer	A pagination size for collection requests.
page_token	string	An opaque pagination token for collection requests.
provider	string	Filter the results by exact match for provider. (example: AWS)
state	string	Filter the results by exact match for state. (example: IN_USE)
validation_phase	string	Filter the results by exact match for validation_phase.
validation_region	string	Filter keys by the cloud region where they are deployed. (example: us-west-2)

SELECT examples

get_byok_v1_key

Make a request to read a key.

SELECT
id,
display_name,
api_version,
key,
kind,
metadata,
provider,
state,
validation
FROM confluent.encryption_keys.keys
WHERE id = '{{ id }}' -- required
;

list_byok_v1_keys

Retrieve a sorted, filtered, paginated list of all keys.

SELECT
id,
display_name,
api_version,
key,
kind,
metadata,
provider,
state,
validation
FROM confluent.encryption_keys.keys
WHERE display_name = '{{ display_name }}'
AND provider = '{{ provider }}'
AND state = '{{ state }}'
AND validation_phase = '{{ validation_phase }}'
AND validation_region = '{{ validation_region }}'
AND key = '{{ key }}'
AND page_size = '{{ page_size }}'
AND page_token = '{{ page_token }}'
;

INSERT examples

create_byok_v1_key

Make a request to create a key.

INSERT INTO confluent.encryption_keys.keys (
key,
display_name
)
SELECT 
'{{ key }}' /* required */,
'{{ display_name }}'
RETURNING
id,
display_name,
api_version,
key,
kind,
metadata,
provider,
state,
validation
;

Manifest

# Description fields are for documentation purposes
- name: keys
props:
  - name: key
    description: |
      The cloud-specific key details.
      For AWS, provide the corresponding `key_arn`.
      For Azure, provide the corresponding `key_id`.
      For GCP, provide the corresponding `key_id`.
    value:
      key_arn: "{{ key_arn }}"
      roles:
        - "{{ roles }}"
      kind: "{{ kind }}"
      application_id: "{{ application_id }}"
      key_id: "{{ key_id }}"
      key_vault_id: "{{ key_vault_id }}"
      tenant_id: "{{ tenant_id }}"
      security_group: "{{ security_group }}"
  - name: display_name
    value: "{{ display_name }}"
    description: |
      The human-readable name of the key object.

UPDATE examples

update_byok_v1_key

Make a request to update a key.

UPDATE confluent.encryption_keys.keys
SET 
key = '{{ key }}',
display_name = '{{ display_name }}'
WHERE 
id = '{{ id }}' --required
RETURNING
id,
display_name,
api_version,
key,
kind,
metadata,
provider,
state,
validation;

DELETE examples

delete_byok_v1_key

Make a request to delete a key.

DELETE FROM confluent.encryption_keys.keys
WHERE id = '{{ id }}' --required
;