fix(kas): scope key material cache identity by registry by c-r33d · Pull Request #4056 · opentdf/platform

c-r33d · 2026-09-16T11:48:20Z

Proposed Changes

Prevent private-key cache collisions when KAS registrations share a key ID. The optional ScopedKeyIdentifier.ScopedKeyID() includes the KAS URI; the basic manager falls back to ID() for existing implementations. Provider lookups continue using ID().

Stack: #3951 → #4048 → #4053 → #4056.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

Focused race tests and SDK README tests pass. No new lint findings; full local checks encounter existing lint issues and Keycloak fixture failures.

Prior xtest passed all 27 KAO/cache cases without skips, before these review changes.

coderabbitai · 2026-09-16T11:48:27Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 81bda7a4-4423-4766-9987-be06a2c5bcc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-16T11:52:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	141.463832ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	60.130041ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	255.016944ms
Throughput	392.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	30.791423609s
Average Latency	307.389018ms
Throughput	162.38 requests/second

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-16T12:01:44Z

github-actions · 2026-09-16T12:06:38Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.773201ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	130.205189ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	444.367005ms
Throughput	225.04 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.538252383s
Average Latency	424.48892ms
Throughput	117.54 requests/second

github-actions · 2026-09-16T12:16:22Z

Add a round-trip test for KAO-based key lookup using a dedicated KM3 with `kas_uri_from_kao` enabled. Run it with `force-platform-supports: kas_uri_from_kao`. Stacked on #604. Uses the action input from opentdf/platform#4057 and covers platform stack opentdf/platform#3951 → opentdf/platform#4048 → opentdf/platform#4053 → opentdf/platform#4056. Validation: unit, fixture, workflow, lint, and type checks passed. Live round-trip not yet run.  ## Summary by CodeRabbit - **New Features** - Added support for a dedicated third key management service in multi-KAS testing. - Extended audit log collection to include the third service. - Added validation for retrieving registered keys and handling missing key identifiers. - **Bug Fixes** - Improved KAO-enabled key management test execution based on detected platform support. - Enhanced verification of alternate key registrations, decryption, and rewrap audit events.  --------- Signed-off-by: Chris Reed <creed@virtru.com>

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T13:34:20Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	247.804611ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	146.910236ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	442.297452ms
Throughput	226.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.723539845s
Average Latency	456.56783ms
Throughput	109.35 requests/second

github-actions · 2026-09-21T13:43:45Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T16:53:48Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.120632ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.418485ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	294.536156ms
Throughput	339.52 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.756945443s
Average Latency	327.028464ms
Throughput	152.64 requests/second

github-actions · 2026-09-21T17:03:53Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T17:36:40Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	254.234243ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	141.009781ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	439.835932ms
Throughput	227.36 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.729187663s
Average Latency	446.540355ms
Throughput	111.78 requests/second

github-actions · 2026-09-21T17:47:01Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-21T18:01:17Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	249.792786ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	141.860938ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.347611ms
Throughput	236.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.058602148s
Average Latency	439.86793ms
Throughput	113.49 requests/second

github-actions · 2026-09-21T18:10:41Z

The cache isolation test still expects registry IDs in cache-hit logs, so it fails after opentdf/platform#4056 changes cache identity to quoted KAS URI + key ID. Match the complete `cache_key` value so `/kas` cannot also satisfy the shorter URI’s assertion. Validation: Ruff lint/format and Pyright passed; checked matching against both URIs and rejection of wrong IDs, registry IDs, and the old prefix. [Cross-SDK validation](https://github.com/opentdf/tests/actions/runs/35634166716) is running against platform commit `110f84d3263c0479ca598c793074a1543cb9bc20`, with KAO/cache coverage enabled.  ## Summary by CodeRabbit - **Tests** - Updated audit-log validation for cached private keys to verify the complete cache key, including the KAS URI and key ID. - Added coverage to ensure entries from different registries are matched distinctly.  Signed-off-by: Chris Reed <creed@virtru.com>

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-22T16:38:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	131.903913ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	70.260897ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	272.843397ms
Throughput	366.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.621092829s
Average Latency	275.703789ms
Throughput	181.02 requests/second

github-actions · 2026-09-22T16:49:05Z

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-22T18:34:04Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	257.472236ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.689179ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	426.695968ms
Throughput	234.36 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.943823251s
Average Latency	458.599964ms
Throughput	108.83 requests/second

github-actions · 2026-09-22T18:43:01Z

dmihalcik-virtru · 2026-09-22T19:04:55Z

+	// CacheKey returns an opaque, stable identifier that distinguishes this key
+	// from keys at other KAS URIs or providers sharing a cache.
+	// Use ID for key lookups amonst key providers and CacheKey for caching key material.
+	CacheKey() string


maybe?

Suggested change

CacheKey() string

StableKey() string

Also, move this to a separate interface, either its own or an extension

Went ahead and created a ScopedKeyIdentifier that is implemented by the platform key indexer to uniquely identify the key for caching and other logging behavior. The manager's should still use ID() when reaching out to providers.

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-22T20:51:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	251.875508ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.157361ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	453.963545ms
Throughput	220.28 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.517486379s
Average Latency	454.395493ms
Throughput	109.85 requests/second

github-actions · 2026-09-22T20:53:23Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/ocrypto
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-09-22T21:02:05Z

c-r33d requested review from a team as code owners September 16, 2026 11:48

c-r33d force-pushed the codex/kas-key-index-debug branch from 10ac321 to 6712976 Compare September 16, 2026 11:48

c-r33d requested a review from a team as a code owner September 16, 2026 11:48

github-actions Bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) comp:kas Key Access Server size/s labels Sep 16, 2026

fix(kas): scope key material cache identity by registry

1b758b8

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d force-pushed the codex/kas-key-details branch from 052c050 to 1b758b8 Compare September 16, 2026 12:01

c-r33d mentioned this pull request Sep 16, 2026

feat(kas): Read kas registry from kao #3951

Open

c-r33d mentioned this pull request Sep 17, 2026

feat(xtest): cover disabled KAO lookup and registry cache isolation opentdf/tests#606

Merged

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/internal/security/in_process_provider.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/trust/key_index.go Outdated

c-r33d commented Sep 21, 2026

View reviewed changes

Comment thread service/kas/key_indexer.go Outdated

fix(kas): sync cache isolation branch with KAS URI stack

8ad4dd5

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d mentioned this pull request Sep 21, 2026

fix(ci): support preview KAO configuration in additional KAS #4085

Merged

fix(kas): scope cache keys by URI and address review feedback

8dcc6a6

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d changed the title ~~fix(kas): scope key material cache identity by registry~~ fix(kas)!: scope key material cache identity by registry Sep 21, 2026

fix(kas): remove cache key namespace prefix

110f84d

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d mentioned this pull request Sep 21, 2026

fix(xtest): match URI-scoped private key cache hits opentdf/tests#615

Merged

test(kas): verify cache hits isolate shared key IDs

5102dc5

Signed-off-by: Chris Reed <creed@virtru.com>

ci: enable KAO URI coverage in xtest

3873512

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d mentioned this pull request Sep 22, 2026

fix(xtest)!: remove platform feature overrides opentdf/tests#618

Open

ci: remove forced KAO platform support

d93611c

Signed-off-by: Chris Reed <creed@virtru.com>

dmihalcik-virtru reviewed Sep 22, 2026

View reviewed changes

fix(kas): make scoped key identity an optional interface

cca7057

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d changed the title ~~fix(kas)!: scope key material cache identity by registry~~ fix(kas): scope key material cache identity by registry Sep 22, 2026

dmihalcik-virtru mentioned this pull request Sep 23, 2026

build: make fuzz actually fuzz (DSPX-4903) #4096

Open

Conversation

c-r33d commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 21, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 22, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

c-r33d commented Sep 16, 2026 •

edited

Loading

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading