fix(kas)!: add KAS context to key lookup logs and audit identifiers by c-r33d · Pull Request #4053 · opentdf/platform

c-r33d · 2026-09-15T19:35:25Z

Adds KAS URI context to key lookup and listing debug logs. The indexer logs the registration selected by services.kas.preview.kas_uri_from_kao.

Breaking change: Successful GetKey audit events use <kas_url>:<kid> for object.id instead of KID alone. Audit consumers must update matching and parsing accordingly.

Validation: Focused race tests, SDK README tests, and PR-specific lint passed. Full checks encounter existing lint issues and Keycloak fixture failures.

Stacked on #4048.

coderabbitai · 2026-09-15T19:35:32Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 91fcd161-5541-4f59-b19d-2291e6aebfbd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-15T19:41:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.470433ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.336362ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	414.723431ms
Throughput	241.12 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.944161841s
Average Latency	428.570652ms
Throughput	116.43 requests/second

github-actions · 2026-09-15T19:51:31Z

Invalidated by push of a6e6d97

github-actions · 2026-09-15T20:14:29Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	254.641923ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	132.713319ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.238631ms
Throughput	236.27 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.354910448s
Average Latency	432.753326ms
Throughput	115.33 requests/second

github-actions · 2026-09-15T20:24:01Z

github-actions · 2026-09-16T11:41:41Z

X-Test Failure Report

github-actions · 2026-09-16T11:47:34Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	254.922709ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.859875ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	448.293658ms
Throughput	223.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.100341998s
Average Latency	430.202799ms
Throughput	116.01 requests/second

github-actions · 2026-09-16T11:47:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	249.19882ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	126.665258ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	414.368943ms
Throughput	241.33 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.985949691s
Average Latency	429.225505ms
Throughput	116.32 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-16T11:49:08Z

X-Test Failure Report

cukes-report
govulncheck-failure-8
govulncheck-failure-4
govulncheck-failure-3
govulncheck-failure-2
opentdf~~platform~~TXHJ7R.dockerbuild
govulncheck-failure-5
govulncheck-failure-1
govulncheck-failure-0

github-actions · 2026-09-16T11:53:13Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	236.617699ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	124.568685ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	445.99344ms
Throughput	224.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.624361639s
Average Latency	425.539846ms
Throughput	117.30 requests/second

github-actions · 2026-09-16T11:53:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	246.176014ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.906166ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	431.814752ms
Throughput	231.58 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.443256604s
Average Latency	443.614361ms
Throughput	112.50 requests/second

github-actions · 2026-09-16T12:04:48Z

Add a round-trip test for KAO-based key lookup using a dedicated KM3 with `kas_uri_from_kao` enabled. Run it with `force-platform-supports: kas_uri_from_kao`. Stacked on #604. Uses the action input from opentdf/platform#4057 and covers platform stack opentdf/platform#3951 → opentdf/platform#4048 → opentdf/platform#4053 → opentdf/platform#4056. Validation: unit, fixture, workflow, lint, and type checks passed. Live round-trip not yet run.  ## Summary by CodeRabbit - **New Features** - Added support for a dedicated third key management service in multi-KAS testing. - Extended audit log collection to include the third service. - Added validation for retrieving registered keys and handling missing key identifiers. - **Bug Fixes** - Improved KAO-enabled key management test execution based on detected platform support. - Enhanced verification of alternate key registrations, decryption, and rewrap audit events.  --------- Signed-off-by: Chris Reed <creed@virtru.com>

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-17T20:00:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	265.762738ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	143.449437ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.025176ms
Throughput	236.95 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.560040883s
Average Latency	444.812265ms
Throughput	112.21 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-17T20:08:48Z

X-Test Failure Report

✅ js@main-pull-4053
✅ java@main-pull-4053
cukes-report
✅ java@main-v0.9.0
✅ go@main-v0.9.0
✅ go@pull-4053-v0.9.0
✅ java@main-main
opentdf~~platform~~7CLAF7.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-5
✅ js@main-main
govulncheck-failure-4
govulncheck-failure-1
govulncheck-failure-0

github-actions · 2026-09-17T20:12:00Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	242.330696ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	132.680657ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	441.95245ms
Throughput	226.27 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.505862612s
Average Latency	444.166537ms
Throughput	112.34 requests/second

BREAKING CHANGE: GetKey audit object.id changes from the KID alone to <kid>:<kas_registry_id>. Audit consumers matching or parsing this value must update their handling. Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-17T20:18:18Z

X-Test Failure Report

govulncheck-failure-1
opentdf~~platform~~5CWYGB.dockerbuild
✅ java@main-v0.9.0
govulncheck-failure-2
govulncheck-failure-8
govulncheck-failure-4
govulncheck-failure-3
✅ js@main-v0.9.0
govulncheck-failure-0
govulncheck-failure-5

github-actions · 2026-09-17T20:22:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	235.627123ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.058447ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	454.511817ms
Throughput	220.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.752150524s
Average Latency	426.548724ms
Throughput	116.95 requests/second

github-actions · 2026-09-17T20:35:16Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T12:58:16Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.834642ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.041155ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.500086ms
Throughput	244.80 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.905658095s
Average Latency	428.233179ms
Throughput	116.53 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T13:00:51Z

X-Test Failure Report

opentdf~~platform~~OVCFZY.dockerbuild
govulncheck-failure-3
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-4
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-5

github-actions · 2026-09-21T13:04:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	238.166167ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	124.294288ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	447.463262ms
Throughput	223.48 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.665411827s
Average Latency	415.722772ms
Throughput	120.00 requests/second

github-actions · 2026-09-21T13:07:25Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/ocrypto
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-09-21T13:20:28Z

c-r33d requested review from a team as code owners September 15, 2026 19:35

github-actions Bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) comp:kas Key Access Server size/s labels Sep 15, 2026

jakedoublev previously approved these changes Sep 15, 2026

View reviewed changes

c-r33d added this pull request to stack #4055 September 16, 2026 11:41

c-r33d force-pushed the codex/kas-key-index-debug branch from a6e6d97 to 10ac321 Compare September 16, 2026 11:41

c-r33d added 2 commits September 16, 2026 06:48

fix(kas): log KAS URIs during key lookup

0fe2844

Signed-off-by: Chris Reed <creed@virtru.com>

fix(kas): clarify rewrap URI logging and indexer context

6712976

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d mentioned this pull request Sep 16, 2026

fix(kas): scope key material cache identity by registry #4056

Open

3 tasks

c-r33d force-pushed the codex/kas-key-index-debug branch from 10ac321 to 6712976 Compare September 16, 2026 11:48

fix(policy): identify KAS key audit events by database ID

26ea536

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d changed the title ~~fix(kas): log KAS URIs during key lookup~~ fix(kas): add KAS URI context to key lookup logs and audits Sep 17, 2026

test(policy): remove KAS key audit snapshot test

ba5af18

Signed-off-by: Chris Reed <creed@virtru.com>

fix(policy)!: scope key audit identifiers to KAS registrations

5f8147b

BREAKING CHANGE: GetKey audit object.id changes from the KID alone to <kid>:<kas_registry_id>. Audit consumers matching or parsing this value must update their handling. Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d changed the title ~~fix(kas): add KAS URI context to key lookup logs and audits~~ fix(kas)!: add KAS context to key lookup logs and audit identifiers Sep 17, 2026

fix(kas): sync key index debug logs with preview URI selection

54ad4ee

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/access/rewrap.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer_test.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/policy/kasregistry/key_access_server_registry.go Outdated

fix(kas): address logging and audit review feedback

e966078

Signed-off-by: Chris Reed <creed@virtru.com>

dmihalcik-virtru approved these changes Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer.go

Conversation

c-r33d commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 15, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 15, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 17, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 17, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

c-r33d commented Sep 15, 2026 •

edited

Loading

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading