Package org.elasticsearch.xpack.esql.datasources

Class DataSourceEncryptedDataHandler

java.lang.Object

org.elasticsearch.xpack.esql.datasources.DataSourceEncryptedDataHandler

All Implemented Interfaces:

EncryptedDataHandler<DataSourceMetadata>

public final class DataSourceEncryptedDataHandler
extends Object
implements EncryptedDataHandler<DataSourceMetadata>

Re-encrypts every stored data-source secret under the active project encryption key on rotation — without it, retiring a key would strand secrets undecryptable. Driven by the rotation coordinator for the DataSourceMetadata custom; contributed via EsqlEncryptedDataHandlerProvider. The payload is an opaque writeGenericValue blob, preserved verbatim — only the wrapping key changes.

Constructor Summary

Constructors

Constructor	Description
DataSourceEncryptedDataHandler()

Method Summary

Modifier and Type	Method	Description
String	customName()
DataSourceMetadata	onDestructiveReset(DataSourceMetadata current)	On destructive reset, wipe only the encrypted credential values while preserving the rest of each data source's configuration (name, type, description, non-secret settings).
DataSourceMetadata	reEncrypt(DataSourceMetadata current, EncryptionService encryptionService, String activeKeyId)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DataSourceEncryptedDataHandler

public DataSourceEncryptedDataHandler()

Method Details

customName

public String customName()

Specified by:

customName in interface EncryptedDataHandler<DataSourceMetadata>

onDestructiveReset

public DataSourceMetadata onDestructiveReset(DataSourceMetadata current)

On destructive reset, wipe only the encrypted credential values while preserving the rest of each data source's configuration (name, type, description, non-secret settings). Users will see null for credentials in the API and need only re-provision those — not recreate the entire data source from scratch.

Specified by:

onDestructiveReset in interface EncryptedDataHandler<DataSourceMetadata>

reEncrypt

public DataSourceMetadata reEncrypt(DataSourceMetadata current,
 EncryptionService encryptionService,
 String activeKeyId)

Specified by:

reEncrypt in interface EncryptedDataHandler<DataSourceMetadata>