class DriverKms extends Kms with CloseableAtomicHealthComponent with HasCloseContext with NamedLogging
An internal KMS implementation based on an external KMS driver
- Alphabetic
- By Inheritance
- DriverKms
- NamedLogging
- HasCloseContext
- PromiseUnlessShutdownFactory
- CloseableAtomicHealthComponent
- AtomicHealthComponent
- AtomicHealthElement
- CloseableHealthComponent
- HealthComponent
- CloseableHealthQuasiComponent
- HealthQuasiComponent
- CloseableHealthElement
- HealthElement
- Kms
- FlagCloseable
- PerformUnlessClosing
- OnShutdownRunner
- AutoCloseable
- AnyRef
- Any
- Hide All
- Show All
- Public
- Protected
Instance Constructors
- new DriverKms(config: Driver, driver: KmsDriver, futureSupervisor: FutureSupervisor, driverExecutionContext: ExecutorService, checkPeriod: PositiveFiniteDuration, clock: Clock, timeouts: ProcessingTimeout, loggerFactory: NamedLoggerFactory, executionContext: ExecutionContext)
Type Members
- type Config = Driver
- type State = ComponentHealthState
The type of health states exposed by this component
The type of health states exposed by this component
- Definition Classes
- HealthComponent → HealthQuasiComponent → HealthElement
Value Members
- final def !=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def ##: Int
- Definition Classes
- AnyRef → Any
- final def ==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def asInstanceOf[T0]: T0
- Definition Classes
- Any
- final def associatedOnShutdownRunner: FlagCloseable
The com.digitalasset.canton.lifecycle.OnShutdownRunner associated with this object.
The com.digitalasset.canton.lifecycle.OnShutdownRunner associated with this object.
When this com.digitalasset.canton.lifecycle.OnShutdownRunner closes, the health state permanently becomes closingState and all listeners are notified about this.
- Attributes
- protected
- Definition Classes
- CloseableHealthElement → HealthElement
- def cancelShutdownTask(token: Long): Unit
Removes a shutdown task from the list using a token returned by runOnShutdown
Removes a shutdown task from the list using a token returned by runOnShutdown
- Definition Classes
- OnShutdownRunner
- def clone(): AnyRef
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.CloneNotSupportedException]) @native() @IntrinsicCandidate()
- final def close(): Unit
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
- Definition Classes
- FlagCloseable → OnShutdownRunner → AutoCloseable
- implicit val closeContext: CloseContext
- Definition Classes
- HasCloseContext
- def closingState: ComponentHealthState
The state set when the associatedOnShutdownRunner closes
The state set when the associatedOnShutdownRunner closes
- Definition Classes
- HealthComponent → HealthQuasiComponent → HealthElement
- def closingTimeout: FiniteDuration
- Attributes
- protected
- Definition Classes
- FlagCloseable → PerformUnlessClosing
- val config: Driver
- def containsShutdownTask(token: Long): Boolean
- Definition Classes
- OnShutdownRunner
- def decryptAsymmetric(keyId: KmsKeyId, data: ByteString256, encryptionKeyScheme: EncryptionKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString190]
Asymmetrically decrypt the data passed as a byte array using a KMS private key.
Asymmetrically decrypt the data passed as a byte array using a KMS private key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to decrypt. The higher bound on the data size we can decrypt is 256bytes (i.e. the ciphertext length for RSA2048-OAEP-SHA256 encryption; when using RSAES-OAEP the ciphertext size is always equal to the size of the Modulus).
- encryptionKeyScheme
the encryption algorithm that was used to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.
- returns
a decrypted byte string or an error if it fails to decrypt
- Definition Classes
- Kms
- def decryptAsymmetricInternal(keyId: KmsKeyId, data: ByteString256, encryptionKeyScheme: EncryptionKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString190]
- def decryptSymmetric(keyId: KmsKeyId, data: ByteString6144)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString4096]
Symmetrically decrypt the data passed as a byte array using a KMS symmetric key.
Symmetrically decrypt the data passed as a byte array using a KMS symmetric key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to decrypt. The higher bound on the data size we can decrypt is 6144 bytes (i.e. maximum accepted input size for the external KMSs that we support).
- returns
a decrypted byte string or an error if it fails to decrypt
- Definition Classes
- Kms
- def decryptSymmetricInternal(keyId: KmsKeyId, data: ByteString6144)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString4096]
- def degradationOccurred(error: String)(implicit tc: TraceContext): Unit
Report that the component is now degraded.
Report that the component is now degraded. Note that this will override the component state, even if it is currently failed!
- Definition Classes
- AtomicHealthComponent
- def degradationOccurred(error: BaseError)(implicit tc: TraceContext): Unit
Report that the component is now degraded.
Report that the component is now degraded. Note that this will override the component state, even if it is currently failed!
- Definition Classes
- AtomicHealthComponent
- def deleteKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
Schedule a deletion of a KMS key (takes between 7-30 days)
Schedule a deletion of a KMS key (takes between 7-30 days)
- keyId
key identifier (e.g. AWS key ARN)
- returns
an error if it fails to schedule a deletion of a key
- Definition Classes
- Kms
- def deleteKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
- def encryptSymmetric(keyId: KmsKeyId, data: ByteString4096)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString6144]
Symmetrically encrypt the data passed as a byte string using a KMS symmetric key.
Symmetrically encrypt the data passed as a byte string using a KMS symmetric key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to encrypt. The higher bound on the data size we can encrypt is 4kb (i.e. maximum accepted input size for the external KMSs that we support).
- returns
an encrypted byte string or an error if it fails to encrypt
- Definition Classes
- Kms
- def encryptSymmetricInternal(keyId: KmsKeyId, data: ByteString4096)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString6144]
- final def eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def equals(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef → Any
- implicit def errorLoggingContext(implicit traceContext: TraceContext): ErrorLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- def failureOccurred(error: String)(implicit tc: TraceContext): Unit
Report that the component is now failed
Report that the component is now failed
- Definition Classes
- AtomicHealthComponent
- def failureOccurred(error: BaseError)(implicit tc: TraceContext): Unit
Report that the component is now failed
Report that the component is now failed
- Definition Classes
- AtomicHealthComponent
- def fatalOccurred(error: String)(implicit tc: TraceContext): Unit
Report that the component is now fatally failed and the system should be restarted.
Report that the component is now fatally failed and the system should be restarted.
- Definition Classes
- AtomicHealthComponent
- def generateAsymmetricEncryptionKeyPair(encryptionKeyScheme: EncryptionKeyScheme, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new (asymmetric) encryption key pair in the KMS and returns a key identifier.
Creates a new (asymmetric) encryption key pair in the KMS and returns a key identifier.
- encryptionKeyScheme
defines the encryption key scheme to which the key is going to be used for.
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- Definition Classes
- Kms
- def generateAsymmetricEncryptionKeyPairInternal(encryptionKeyScheme: EncryptionKeyScheme, name: Option[KeyName])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- def generateSigningKeyPair(signingKeyScheme: SigningKeyScheme, name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new signing key pair in the KMS and returns its key identifier.
Creates a new signing key pair in the KMS and returns its key identifier.
- signingKeyScheme
defines the signing key scheme to which the key is going to be used for.
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- Definition Classes
- Kms
- def generateSigningKeyPairInternal(signingKeyScheme: SigningKeyScheme, name: Option[KeyName])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- def generateSymmetricEncryptionKey(name: Option[KeyName] = None)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
Creates a new symmetric encryption key in the KMS and returns its key identifier.
Creates a new symmetric encryption key in the KMS and returns its key identifier. The specific encryption scheme is not necessary (default is taken) because this is intended to be used to generate a KMS wrapper key.
- name
an optional name to identify the key.
- returns
a key id or an error if it fails to create a key
- Definition Classes
- Kms
- def generateSymmetricEncryptionKeyInternal(name: Option[KeyName])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, KmsKeyId]
- final def getClass(): Class[_ <: AnyRef]
- Definition Classes
- AnyRef → Any
- Annotations
- @native() @IntrinsicCandidate()
- def getPublicEncryptionKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, EncryptionPublicKey]
Get public key for encryption from KMS given a KMS key identifier.
Get public key for encryption from KMS given a KMS key identifier.
- keyId
key identifier (e.g. AWS key ARN)
- returns
the public encryption key for that keyId
- Definition Classes
- Kms
- def getPublicEncryptionKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, EncryptionPublicKey]
- def getPublicKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, PublicKey]
Get the public key with the given keyId
Get the public key with the given keyId
- Definition Classes
- Kms
- def getPublicSigningKey(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, SigningPublicKey]
Get public key for signing from KMS given a KMS key identifier.
Get public key for signing from KMS given a KMS key identifier.
- keyId
key identifier (e.g. AWS key ARN)
- returns
the public signing key for that keyId
- Definition Classes
- Kms
- def getPublicSigningKeyInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, SigningPublicKey]
- final def getState: State
Returns the current state
Returns the current state
- Definition Classes
- HealthElement
- def hashCode(): Int
- Definition Classes
- AnyRef → Any
- Annotations
- @native() @IntrinsicCandidate()
- def initialHealthState: ComponentHealthState
The initial state upon creation
The initial state upon creation
- Attributes
- protected
- Definition Classes
- DriverKms → HealthElement
- def internalPerformUnlessClosingF[A](name: String)(f: => Future[A])(implicit ec: ExecutionContext, traceContext: TraceContext): UnlessShutdown[Future[A]]
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- def isClosing: Boolean
Check whether we're closing.
Check whether we're closing. Susceptible to race conditions; unless you're using this as a flag to the retry lib or you really know what you're doing, prefer
performUnlessClosingand friends.- Definition Classes
- OnShutdownRunner
- def isDegrading: Boolean
- Definition Classes
- HealthQuasiComponent
- def isFailed: Boolean
- Definition Classes
- HealthQuasiComponent
- def isFatal: Boolean
- Definition Classes
- HealthQuasiComponent
- final def isInstanceOf[T0]: Boolean
- Definition Classes
- Any
- def isOk: Boolean
- Definition Classes
- HealthQuasiComponent
- def keepTrackOfOpenFutures: Boolean
track running futures on shutdown
track running futures on shutdown
set to true to get detailed information about all futures that did not complete during shutdown. if set to false, we don't do anything.
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- def keyExistsAndIsActive(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
Checks that a key identified by keyId exists in the KMS and is not deleted or disabled, and therefore can be used.
Checks that a key identified by keyId exists in the KMS and is not deleted or disabled, and therefore can be used.
- keyId
key identifier (e.g. AWS key ARN)
- returns
error if it fails to find key
- Definition Classes
- Kms
- def keyExistsAndIsActiveInternal(keyId: KmsKeyId)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, Unit]
- def logger: TracedLogger
- Attributes
- protected
- Definition Classes
- NamedLogging
- val loggerFactory: NamedLoggerFactory
- Attributes
- protected
- Definition Classes
- DriverKms → NamedLogging
- def maxSleepMillis: Long
How often to poll to check that all tasks have completed.
How often to poll to check that all tasks have completed.
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- def mkPromise[A](description: String, futureSupervisor: FutureSupervisor, logAfter: Duration = 10.seconds, logLevel: Level = Level.DEBUG)(implicit elc: ErrorLoggingContext, ec: ExecutionContext): PromiseUnlessShutdown[A]
Use this method to create a PromiseUnlessShutdown that will automatically be cancelled when the close context is closed.
Use this method to create a PromiseUnlessShutdown that will automatically be cancelled when the close context is closed. This allows proper clean up of stray promises when the node is transitioning to a passive state.
Note: you should *not* invoke
successon the returned promise but rather usetrySuccess. The reason is that the call tosuccessmay fail in case of shutdown.- Definition Classes
- PromiseUnlessShutdownFactory
- def name: String
Name of the health element.
Name of the health element. Used for logging.
- Definition Classes
- DriverKms → HealthElement
- implicit def namedLoggingContext(implicit traceContext: TraceContext): NamedLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- final def ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def noTracingLogger: Logger
- Attributes
- protected
- Definition Classes
- NamedLogging
- final def notify(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native() @IntrinsicCandidate()
- final def notifyAll(): Unit
- Definition Classes
- AnyRef
- Annotations
- @native() @IntrinsicCandidate()
- def onCloseFailure(e: Throwable): Unit
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- def onClosed(): Unit
- Definition Classes
- DriverKms → PerformUnlessClosing
- final def onFirstClose(): Unit
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
- Definition Classes
- PerformUnlessClosing → OnShutdownRunner
- Annotations
- @SuppressWarnings()
- def performUnlessClosing[A](name: String)(f: => A)(implicit traceContext: TraceContext): UnlessShutdown[A]
Performs the task given by
funless a shutdown has been initiated.Performs the task given by
funless a shutdown has been initiated. The shutdown will only begin afterfcompletes, but other tasks may execute concurrently withf, if started using this function, or one of the other variants (performUnlessClosingF and performUnlessClosingEitherT). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part off, because it will result in a deadlock.- f
The task to perform
- returns
scala.None$ if a shutdown has been initiated. Otherwise the result of the task.
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingCheckedT[A, N, R](name: String, onClosing: => Checked[A, N, R])(etf: => CheckedT[Future, A, N, R])(implicit ec: ExecutionContext, traceContext: TraceContext): CheckedT[Future, A, N, R]
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingEitherT[E, R](name: String, onClosing: => E)(etf: => EitherT[Future, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[Future, E, R]
Performs the EitherT[Future] given by
etfunless a shutdown has been initiated, in which case the provided error is returned instead.Performs the EitherT[Future] given by
etfunless a shutdown has been initiated, in which case the provided error is returned instead. Bothetfand the error are lazy;etfis only evaluated if there is no shutdown, the error only if we're shutting down. The shutdown will only begin afteretfcompletes, but other tasks may execute concurrently withetf, if started using this function, or one of the other variants (performUnlessClosing and performUnlessClosingF). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part ofetf, because it will result in a deadlock.- etf
The task to perform
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingEitherTF[E, R](name: String, onClosing: => E)(etf: => EitherT[Future, E, Future[R]])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[Future, E, Future[R]]
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingEitherU[E, R](name: String)(etf: => EitherT[Future, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[FutureUnlessShutdown, E, R]
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingEitherUSF[E, R](name: String)(etf: => EitherT[FutureUnlessShutdown, E, R])(implicit ec: ExecutionContext, traceContext: TraceContext): EitherT[FutureUnlessShutdown, E, R]
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingF[A](name: String)(f: => Future[A])(implicit ec: ExecutionContext, traceContext: TraceContext): FutureUnlessShutdown[A]
Performs the Future given by
funless a shutdown has been initiated.Performs the Future given by
funless a shutdown has been initiated. The future is lazy and not evaluated during shutdown. The shutdown will only begin afterfcompletes, but other tasks may execute concurrently withf, if started using this function, or one of the other variants (performUnlessClosing and performUnlessClosingEitherT). The tasks are assumed to take less than closingTimeout to complete.DO NOT CALL
this.closeas part off, because it will result in a deadlock.- f
The task to perform
- returns
The future completes with com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if a shutdown has been initiated. Otherwise the result of the task wrapped in com.digitalasset.canton.lifecycle.UnlessShutdown.Outcome.
- Definition Classes
- PerformUnlessClosing
- def performUnlessClosingUSF[A](name: String)(f: => FutureUnlessShutdown[A])(implicit ec: ExecutionContext, traceContext: TraceContext): FutureUnlessShutdown[A]
- Definition Classes
- PerformUnlessClosing
- def prettyState: Pretty[State]
- Attributes
- protected
- Definition Classes
- HealthQuasiComponent → HealthElement
- def refreshState(newState: Eval[State])(implicit traceContext: TraceContext): Unit
Triggers a refresh of the component's state, using
newStateto determine the new state.Triggers a refresh of the component's state, using
newStateto determine the new state. May return before thenewStatehas been evaluated and the listeners have been poked.Note that listeners need not be poked about every state change; it suffices that they are poked eventually after each state change. So if there are frequent updates to the state, possibly from concurrent calls, then the listeners may never see some intermediate states.
- Attributes
- protected
- Definition Classes
- HealthElement
- def registerOnHealthChange(listener: HealthListener): Boolean
Registers a listener that gets poked upon each change of this element's health state.
Registers a listener that gets poked upon each change of this element's health state.
- returns
Whether the listener was not registered before
- Definition Classes
- HealthElement
- def reportHealthState(state: State)(implicit tc: TraceContext): Unit
Sets the state of this component and notifies its listeners
Sets the state of this component and notifies its listeners
- Definition Classes
- AtomicHealthElement
- def resolveUnhealthy()(implicit traceContext: TraceContext): Unit
Set the health state to Ok and if the previous state was unhealthy, log a message to inform about the resolution of the ongoing issue.
Set the health state to Ok and if the previous state was unhealthy, log a message to inform about the resolution of the ongoing issue.
- Definition Classes
- AtomicHealthComponent
- def runOnShutdown[T](task: RunOnShutdown)(implicit traceContext: TraceContext): Long
Same as runOnShutdown_ but returns a token that allows you to remove the task explicitly from being run using cancelShutdownTask
Same as runOnShutdown_ but returns a token that allows you to remove the task explicitly from being run using cancelShutdownTask
- Definition Classes
- OnShutdownRunner
- def runOnShutdown_[T](task: RunOnShutdown)(implicit traceContext: TraceContext): Unit
Register a task to run when shutdown is initiated.
Register a task to run when shutdown is initiated.
You can use this for example to register tasks that cancel long-running computations, whose termination you can then wait for in "closeAsync".
- Definition Classes
- OnShutdownRunner
- def runStateChanged(waitingState: Boolean = false): Unit
- Attributes
- protected
- Definition Classes
- OnShutdownRunner
- Annotations
- @VisibleForTesting()
- def sign(keyId: KmsKeyId, data: ByteString4096, signingKeyScheme: SigningKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString]
Sign the data passed as a byte string using a KMS key.
Sign the data passed as a byte string using a KMS key.
- keyId
key identifier (e.g. AWS key ARN)
- data
byte string to sign. The higher bound on the data size we can sign is 4kb (i.e. maximum accepted input size for the external KMSs that we support).
- signingKeyScheme
the signing algorithm to use to generate the signature
- returns
a byte string corresponding to the signature of the data
- Definition Classes
- Kms
- def signInternal(keyId: KmsKeyId, data: ByteString4096, signingKeyScheme: SigningKeyScheme)(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, ByteString]
- lazy val supportedEncryptionSchemes: Set[EncryptionKeyScheme]
- lazy val supportedSigningSchemes: Set[SigningKeyScheme]
- final def synchronized[T0](arg0: => T0): T0
- Definition Classes
- AnyRef
- val timeouts: ProcessingTimeout
- Attributes
- protected
- Definition Classes
- DriverKms → FlagCloseable
- def toComponentStatus: ComponentStatus
- Definition Classes
- HealthQuasiComponent
- def toString(): String
- Definition Classes
- AnyRef → Any
- def unregisterOnHealthChange(listener: HealthListener): Boolean
Unregisters a listener.
Unregisters a listener.
- returns
Whether the listener was registered before.
- Definition Classes
- HealthElement
- final def wait(arg0: Long, arg1: Int): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException]) @native()
- final def wait(): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- def withRetries[T](description: String, checkKeyCreation: Boolean = false)(task: => EitherT[Future, KmsError, T])(implicit ec: ExecutionContext, tc: TraceContext): EitherT[Future, KmsError, T]
- Attributes
- protected
- Definition Classes
- Kms