grpc-java icon indicating copy to clipboard operation
grpc-java copied to clipboard

api: Add byte[] methods for Trust/KeyManager Channel Credentials API

Open josalmi opened this issue 1 year ago • 4 comments

The TlsChannelCredentials.Builder reads all keyManager and trustManager overloaded input params to byte[] already. Add an option to pass byte[] directly.

Might make sense to do similar changes to: TlsServerCredentials.

josalmi avatar Aug 23 '24 07:08 josalmi

How are you getting your certs/keys such that they are byte[]?

ejona86 avatar Aug 23 '24 17:08 ejona86

As a Base64 encoded Environment Variables running in a container based setup: Base64.getDecoder().decode(envVar). I can of course wrap the byte[] in a new ByteArrayInputStream() with practically no overhead since it's a one time thing.

josalmi avatar Aug 23 '24 18:08 josalmi

Storing secrets in env vars is not something to encourage, but I do see how that's the path of least resistance and may not be a problem in some environments. Converting to InputStream is easy, except you have to catch the impossible IOException. Adding the byte[] methods are easy, but I'd feel better if we had a stronger or more frequent use case.

ejona86 avatar Aug 23 '24 20:08 ejona86