feat(core): Actually use KeyManager ProviderConfig #2837

dmihalcik-virtru · 2025-10-28T01:10:07Z

Proposed Changes

Looking up a key now loads the manager field in the key provider
This is required, as the manager should be the factory key, not the name
This allows us to load the same manager multiple times with different configs.

HOWEVER the config is only looked at on the first load; we should update this so it evicts and reloads the provider if the config changes. This hopefully will come in a follow-up.

Similarly, we don't have much in the way of integration tests for these, since we don't include a key manager that takes a config. I'll look into starting the Vault sample plugin back up and running.

While I'm here, since our downstream deps no longer create them, I've removed support for the KeyManagerFactory that does not take a context object.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

github-actions · 2025-10-28T01:15:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	176.257239ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.910421ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	365.17113ms
Throughput	273.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.02711364s
Average Latency	398.277495ms
Throughput	124.92 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.057643001s
Average Latency	279.537497ms
Throughput	178.20 requests/second

github-actions · 2025-10-28T01:25:15Z

X-Test Results

opentdf~~platform~~FTOE32.dockerbuild
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2837
✅ java-pull-2837
cukes-report
✅ go-pull-2837

github-actions · 2025-10-28T01:36:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.298752ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.228438ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	358.306732ms
Throughput	279.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.954792686s
Average Latency	388.094958ms
Throughput	128.35 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.307295802s
Average Latency	272.141622ms
Throughput	183.10 requests/second

github-actions · 2025-10-28T01:47:59Z

X-Test Results

opentdf~~platform~~VSKY3J.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
bats-test-results
cukes-report
test-cases-mapping-report
✅ go-v0.4.34
✅ js-pull-2837
✅ java-pull-2837
✅ go-pull-2837

github-actions · 2025-10-28T02:30:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.141572ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.93831ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	350.338843ms
Throughput	285.44 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.76923911s
Average Latency	386.218126ms
Throughput	128.97 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.949404263s
Average Latency	268.18243ms
Throughput	185.53 requests/second

github-actions · 2025-10-28T02:41:27Z

X-Test Results

opentdf~~platform~~4B4B18.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2837
cukes-report
✅ java-pull-2837
✅ go-pull-2837

github-actions · 2025-10-28T03:22:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	164.057467ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.648221ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	363.207306ms
Throughput	275.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.545131442s
Average Latency	384.189ms
Throughput	129.72 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.329956246s
Average Latency	272.395285ms
Throughput	182.95 requests/second

github-actions · 2025-10-28T03:31:00Z

X-Test Results

opentdf~~platform~~QJYRIJ.dockerbuild
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2837
✅ java-pull-2837
cukes-report
✅ go-pull-2837

- Looking up a key now loads the `manager` field in the key provider - This is required, as the manager should be the factory key, not the name - This allows us to load the same manager multiple times with different configs. HOWEVER the config is only looked at on the first load; we should update this so it evicts and reloads the provider if the config changes. This will come in a follow-up.

github-actions · 2025-10-28T16:44:29Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.310962ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.248642ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.463455ms
Throughput	267.76 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.471342341s
Average Latency	402.909064ms
Throughput	123.54 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.347130536s
Average Latency	282.382921ms
Throughput	176.38 requests/second

github-actions · 2025-10-28T16:55:19Z

X-Test Results

opentdf~~platform~~O54HJA.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2837
✅ java-pull-2837
✅ go-pull-2837

github-actions · 2025-10-28T17:08:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.842782ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	105.262978ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	365.228438ms
Throughput	273.80 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.138413215s
Average Latency	377.994127ms
Throughput	131.10 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.248109356s
Average Latency	271.614645ms
Throughput	183.50 requests/second

github-actions · 2025-10-28T17:21:43Z

X-Test Results

opentdf~~platform~~HDEXTE.dockerbuild
cukes-report
✅ js-v0.4.34
✅ go-v0.4.34
✅ java-v0.4.34
bats-test-results
✅ js-pull-2837
✅ java-pull-2837
✅ go-pull-2837

strantalis · 2025-10-28T18:08:10Z

/gemini review

gemini-code-assist

Code Review

This pull request effectively refactors the key manager loading mechanism to use ProviderConfig, allowing for more flexible configurations. The changes are well-contained, and the removal of the legacy KeyManagerFactory without context is a good cleanup. The updates to use KeyManagerCtxFactories across the services are consistent. My review includes a couple of suggestions to improve error message clarity for better debuggability.

service/trust/delegating_key_service.go

github-actions · 2025-10-28T19:54:44Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.748857ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.965618ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	359.449165ms
Throughput	278.20 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.700367592s
Average Latency	385.243823ms
Throughput	129.20 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.437199122s
Average Latency	273.179549ms
Throughput	182.23 requests/second

github-actions · 2025-10-28T20:05:39Z

X-Test Results

opentdf~~platform~~E4KYE2.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2837
✅ java-pull-2837
✅ go-pull-2837

strantalis · 2025-10-29T15:21:24Z

/backport

### Proposed Changes - Looking up a key now loads the `manager` field in the key provider - This is required, as the manager should be the factory key, not the name - This allows us to load the same manager multiple times with different configs. HOWEVER the config is only looked at on the first load; we should update this so it evicts and reloads the provider if the config changes. This hopefully will come in a follow-up. Similarly, we don't have much in the way of integration tests for these, since we don't include a key manager that takes a config. I'll look into starting the Vault sample plugin back up and running. While I'm here, since our downstream deps no longer create them, I've removed support for the `KeyManagerFactory` that does *not* take a context object. ### Checklist - [x] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions (cherry picked from commit 65ba2e0)

opentdf-automation · 2025-10-29T15:21:39Z

Successfully created backport PR for release/service/v0.11:

feat(core): Actually use KeyManager ProviderConfig [backport to release/service/v0.11] #2842

### Proposed Changes - Looking up a key now loads the `manager` field in the key provider - This is required, as the manager should be the factory key, not the name - This allows us to load the same manager multiple times with different configs. HOWEVER the config is only looked at on the first load; we should update this so it evicts and reloads the provider if the config changes. This hopefully will come in a follow-up. Similarly, we don't have much in the way of integration tests for these, since we don't include a key manager that takes a config. I'll look into starting the Vault sample plugin back up and running. While I'm here, since our downstream deps no longer create them, I've removed support for the `KeyManagerFactory` that does *not* take a context object. ### Checklist - [x] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions (cherry picked from commit 65ba2e0)

…se/service/v0.11] (#2842) # Description Backport of #2837 to `release/service/v0.11`. Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

github-actions bot added comp:db DB component comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) comp:kas Key Access Server size/m labels Oct 28, 2025

dmihalcik-virtru added 4 commits October 28, 2025 12:38

Update kas.go

a09402b

Update kas.go

779fe9e

fix unit test

02094df

dmihalcik-virtru force-pushed the DSPX-1841-pc-manager branch from f000ac8 to 02094df Compare October 28, 2025 16:39

dmihalcik-virtru marked this pull request as ready for review October 28, 2025 16:53

dmihalcik-virtru requested review from a team as code owners October 28, 2025 16:53

allow defaults to have config

aff8941

gemini-code-assist bot reviewed Oct 28, 2025

View reviewed changes

service/trust/delegating_key_service.go Show resolved Hide resolved

service/trust/delegating_key_service.go Outdated Show resolved Hide resolved

strantalis reviewed Oct 28, 2025

View reviewed changes

service/trust/delegating_key_service.go Show resolved Hide resolved

reviewer suggested fixes

c927788

dmihalcik-virtru requested a review from strantalis October 28, 2025 19:50

cshamrick approved these changes Oct 29, 2025

View reviewed changes

dmihalcik-virtru enabled auto-merge October 29, 2025 13:04

strantalis approved these changes Oct 29, 2025

View reviewed changes

dmihalcik-virtru added this pull request to the merge queue Oct 29, 2025

Merged via the queue into main with commit 65ba2e0 Oct 29, 2025
38 checks passed

dmihalcik-virtru deleted the DSPX-1841-pc-manager branch October 29, 2025 14:33

opentdf-automation bot mentioned this pull request Oct 29, 2025

chore(main): release service 0.12.0 #2841

Open

strantalis added the backport release/service/v0.11 label Oct 29, 2025

opentdf-automation bot mentioned this pull request Oct 29, 2025

feat(core): Actually use KeyManager ProviderConfig [backport to release/service/v0.11] #2842

Merged

feat(core): Actually use KeyManager ProviderConfig #2837

feat(core): Actually use KeyManager ProviderConfig #2837

Uh oh!

Conversation

dmihalcik-virtru commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

github-actions bot commented Oct 28, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 28, 2025

X-Test Results

Uh oh!

strantalis commented Oct 28, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

dmihalcik-virtru commented Oct 28, 2025 •

edited

Loading