feat(kas): configure KAS URI selection for rewrap by c-r33d · Pull Request #4048 · opentdf/platform

c-r33d · 2026-09-15T00:39:47Z

Stacked on #3951.

Add services.kas.preview.kas_uri_from_kao (default false). The platform key indexer uses the configured registration unless enabled with a nonempty KAO URI. Changing the flag requires restarting KAS.

Update start-additional-kas, examples, docs, and tests for the preview setting.

Validation: focused race tests, SDK README tests, and changed-code lint passed. Full checks encounter existing lint issues and Keycloak fixture failures.

coderabbitai · 2026-09-15T00:39:53Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c20f76f2-a0c2-44c3-aefe-ef4d9188613f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-15T00:46:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	242.569132ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	127.223579ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	415.420129ms
Throughput	240.72 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.634243248s
Average Latency	425.512355ms
Throughput	117.28 requests/second

github-actions · 2026-09-15T00:55:38Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-15T17:49:56Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	259.856929ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.173586ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	445.018914ms
Throughput	224.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.55961161s
Average Latency	444.765885ms
Throughput	112.21 requests/second

github-actions · 2026-09-15T17:59:07Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-16T11:47:21Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.521107ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.376952ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	404.874596ms
Throughput	246.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.180973964s
Average Latency	391.03735ms
Throughput	127.61 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-16T11:49:08Z

X-Test Failure Report

govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-3
govulncheck-failure-4
govulncheck-failure-5
govulncheck-failure-1
opentdf~~platform~~W9MC1X.dockerbuild
govulncheck-failure-8

github-actions · 2026-09-16T11:52:27Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.320938ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.510979ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.713327ms
Throughput	282.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.877859617s
Average Latency	328.064589ms
Throughput	152.08 requests/second

github-actions · 2026-09-16T12:04:26Z

Add a round-trip test for KAO-based key lookup using a dedicated KM3 with `kas_uri_from_kao` enabled. Run it with `force-platform-supports: kas_uri_from_kao`. Stacked on #604. Uses the action input from opentdf/platform#4057 and covers platform stack opentdf/platform#3951 → opentdf/platform#4048 → opentdf/platform#4053 → opentdf/platform#4056. Validation: unit, fixture, workflow, lint, and type checks passed. Live round-trip not yet run.  ## Summary by CodeRabbit - **New Features** - Added support for a dedicated third key management service in multi-KAS testing. - Extended audit log collection to include the third service. - Added validation for retrieving registered keys and handling missing key identifiers. - **Bug Fixes** - Improved KAO-enabled key management test execution based on detected platform support. - Enhanced verification of alternate key registrations, decryption, and rewrap audit events.  --------- Signed-off-by: Chris Reed <creed@virtru.com>

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T11:24:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	253.102964ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.433351ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	421.541866ms
Throughput	237.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.15442163s
Average Latency	460.738252ms
Throughput	108.33 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T11:28:39Z

X-Test Failure Report

govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-1
opentdf~~platform~~QO4P47.dockerbuild
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-2
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-main
govulncheck-failure-4

github-actions · 2026-09-21T11:32:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	262.301311ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	140.362233ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	444.760287ms
Throughput	224.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.829248566s
Average Latency	497.382138ms
Throughput	100.34 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T11:33:25Z

X-Test Failure Report

govulncheck-failure-4
govulncheck-failure-0
govulncheck-failure-5
opentdf~~platform~~U5I6KJ.dockerbuild
govulncheck-failure-3
server-logs-js@main-v0.9.0
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-1

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T11:36:21Z

X-Test Failure Report

govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-4
govulncheck-failure-5
govulncheck-failure-8
opentdf~~platform~~KTE9RF.dockerbuild
govulncheck-failure-3
govulncheck-failure-2

github-actions · 2026-09-21T11:37:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.564511ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	140.341368ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	447.176705ms
Throughput	223.63 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.121645199s
Average Latency	420.499287ms
Throughput	118.70 requests/second

github-actions · 2026-09-21T11:39:28Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.441739ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	59.452959ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	232.464712ms
Throughput	430.17 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.676833232s
Average Latency	246.244632ms
Throughput	202.62 requests/second

github-actions · 2026-09-21T11:51:55Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T12:20:06Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.973266ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.715685ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	349.13573ms
Throughput	286.42 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	33.382119089s
Average Latency	333.223734ms
Throughput	149.78 requests/second

github-actions · 2026-09-21T12:30:41Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T12:48:13Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.166755ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.561107ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	332.912302ms
Throughput	300.38 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.656263272s
Average Latency	365.888743ms
Throughput	136.40 requests/second

github-actions · 2026-09-21T12:51:08Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/ocrypto
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-09-21T12:58:15Z

c-r33d requested review from a team as code owners September 15, 2026 00:39

github-actions Bot added comp:kas Key Access Server docs Documentation size/s labels Sep 15, 2026

feat(kas): Read kas url from kao based on configuration

61a0674

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d force-pushed the kas-uri-config branch from 91f57d9 to 61a0674 Compare September 15, 2026 17:42

This was referenced Sep 15, 2026

feat(platform): expose preview KAS URI selection for rewrap opentdf/charts#208

Open

fix(kas)!: add KAS context to key lookup logs and audit identifiers #4053

Open

fix(kas): default KAO URI lookup to false

7876648

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d added this pull request to stack #4055 September 16, 2026 11:41

refactor(kas): simplify KAO URI configuration

aa09f7d

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d mentioned this pull request Sep 16, 2026

fix(kas): scope key material cache identity by registry #4056

Open

3 tasks

This was referenced Sep 16, 2026

feat(ci): expose KAO URI selection for additional KAS #4057

Merged

feat(xtest): add independent platform feature overrides opentdf/tests#603

Closed

feat(xtest): cover KAO URI lookup with isolated KM3 opentdf/tests#605

Merged

fix(kas): move KAO URI selection under preview

b9efff8

Signed-off-by: Chris Reed <creed@virtru.com>

refactor(kas): select KAO URI in platform key indexer

6d036ce

Signed-off-by: Chris Reed <creed@virtru.com>

docs(kas): keep KAO URI configuration in table only

a9cb5af

Signed-off-by: Chris Reed <creed@virtru.com>

refactor(kas): remove KAO URI config key constant

a046231

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer_test.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer_test.go

test(kas): address key indexer review feedback

a4ad705

Signed-off-by: Chris Reed <creed@virtru.com>

docs(kas): mark KAO URI selection experimental

87a5e75

Signed-off-by: Chris Reed <creed@virtru.com>

dmihalcik-virtru approved these changes Sep 21, 2026

View reviewed changes

Conversation

c-r33d commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 15, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 15, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Failure Report

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

Uh oh!

c-r33d commented Sep 15, 2026 •

edited

Loading

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading