Add logging

confluentinc · Dec 7, 2023 · ae313e5 · ae313e5
1 parent 6683bd0
commit ae313e5
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/...n/src/main/java/io/confluent/kafka/schemaregistry/encryption/FieldEncryptionExecutor.java b/...n/src/main/java/io/confluent/kafka/schemaregistry/encryption/FieldEncryptionExecutor.java
@@ -54,6 +54,8 @@
 import java.util.Optional;
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.kafka.common.config.ConfigException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * In envelope encryption, a user generates a data encryption key (DEK) locally, encrypts data with
@@ -64,6 +66,8 @@
  */
 public class FieldEncryptionExecutor extends FieldRuleExecutor {
 
+  private static final Logger log = LoggerFactory.getLogger(FieldEncryptionExecutor.class);
+
   public static final String TYPE = "ENCRYPT";
 
   public static final String ENCRYPT_KEK_NAME = "encrypt.kek.name";
@@ -374,6 +378,10 @@ protected DekInfo getDek(RuleContext ctx, String kekName, KekInfo kek, Integer v
       Aead aead = null;
       DekInfo dek = retrieveDekFromRegistry(dekId);
       boolean isExpired = isExpired(ctx, dek);
+      if (isExpired) {
+        log.info("Dek with ts " + dek.getTimestamp()
+            + " expired after " + dekExpiryDays + " day(s)");
+      }
       if (dek == null || isExpired) {
         if (isRead) {
           throw new RuleException("No dek found for " + kekName + " during consume");