feat(policy): namespace root certificates #2771

pflynn-virtru · 2025-09-30T17:55:58Z

This pull request introduces new support for namespace root certificates within the policy service, updates the API to expose these certificates, and makes related improvements to authentication and routing. The most significant changes include extending the Namespace object to include root certificates, updating the API and HTTP routing to allow public access to namespace information, and adding a proof-of-concept implementation for injecting a root CA certificate.

http://localhost:8080/policy.namespaces.NamespaceService/GetNamespace

{
    "namespace": {
        "id": "8f1d8839-2851-4bf4-8bf4-5243dbfe517d",
        "name": "example.com",
        "fqn": "https://example.com",
        "active": true,
        "metadata": {
            "createdAt": "2025-10-10T17:01:12.477117Z",
            "updatedAt": "2025-10-10T17:01:12.477117Z"
        },
        "rootCerts": [
            {
                "id": "46f1aa69-a458-45fa-9ff3-bc6e2f349773",
                "pem": "-----BEGIN CERTIFICATE-----\nMIIC/TCCAeWgAwIBAgIUSMNrGBq+5ax1wDaMSX8Nnl1m/REwDQYJKoZIhvcNAQEL\nBQAwDjEMMAoGA1UEAwwDa2FzMB4XDTI0MDUyOTE4MzcxOFoXDTI1MDUyOTE4Mzcx\nOFowDjEMMAoGA1UEAwwDa2FzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAzbLGCYovxrCy6DccFAdj1DjnDKwmTqjYQoHfOKXbYOF1Yf5mvAyFO9MhtLet\nPRhmCd7mJA3M8Sy4/kqqAZprYHmvagAIwD0zQyQ+DcogrzmirQ8cUYIDkGre1exc\niVKsNYSlM/NcjNO5AqOaw7gQvmUkp2YciSMa7mixPsl3OTArtOtEGMn34RK1NGC+\n+MdUH6TOF2VmhqJ6+F8iSF154ldRoiR01LIzIxvqpHr0RYhU93BrMDcb4Yx92j2M\nlCpwJ8hVf2RPIqhjsnivzXu+BBQh7zynB3H6LnZUGlyWEHgEfM9yhTFWNeKDClKC\nFE2s1DD8ksvMa8ayndIy0+cNXQIDAQABo1MwUTAdBgNVHQ4EFgQUrrmJ35Nvvkpp\nGnQi686Y/DKmsv0wHwYDVR0jBBgwFoAUrrmJ35NvvkppGnQi686Y/DKmsv0wDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAXfFJqJYVD+7GqZAWg3v\nw1Sr9jKvwMTtcAhmEJ8KKu9u4C/eGz+P4vU+KwismRfFwQaZVr0AuxRhCtCt3dqh\nKPHZ6sVUw8NG/Fg8v7cQmSpNEuy31vxTMrAWE0/zgScZmIQgS5TnqavsEaxiQGU1\nKTEGOuYQRQZ44KBQJJwUHpwb6znHOwVTKex4OsenkxMLOgsPYa3Qf53kHdZIq8x6\nkxm+METK7jT7RMDNqFWPo4R7XfpvCBR/HS3xjmXe0VVonSc2I4QKdrFPpmx2oOsS\n8Mr8dklyCivjNJ4dM1oKU/YK0hm0bF4OuhoROKpDDBDimDPnFFh/tphl1rzAuuxM\n/A==\n-----END CERTIFICATE-----\n"
            }
        ]
    }
}

Namespace Root Certificate Support:

Added a root_certs repeated field of type Certificate to the Namespace message in policy/objects.proto, and defined a new Certificate message to hold certificate data in PEM format.

…ons.

github-actions · 2025-10-02T16:47:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.886396ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.521893ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.943783ms
Throughput	280.94 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.537871937s
Average Latency	373.798287ms
Throughput	133.20 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.788514431s
Average Latency	256.983679ms
Throughput	193.88 requests/second

…ent.

github-actions · 2025-10-02T17:04:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.372936ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.478311ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.260561ms
Throughput	274.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.432964175s
Average Latency	392.155218ms
Throughput	126.80 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.422897667s
Average Latency	272.611464ms
Throughput	182.33 requests/second

github-actions · 2025-10-02T17:05:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.628447ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.737715ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.727788ms
Throughput	281.11 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.955485373s
Average Latency	386.922569ms
Throughput	128.35 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.012714986s
Average Latency	268.756871ms
Throughput	185.10 requests/second

…or certificate management. Add associated tests.

github-actions · 2025-10-02T17:19:15Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.484578ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.999687ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	342.051044ms
Throughput	292.35 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.45971998s
Average Latency	382.525569ms
Throughput	130.01 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.076982976s
Average Latency	259.571739ms
Throughput	191.74 requests/second

github-actions · 2025-10-02T17:30:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.261382ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.6032ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	351.284832ms
Throughput	284.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.804643997s
Average Latency	376.588363ms
Throughput	132.26 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.089247832s
Average Latency	259.643523ms
Throughput	191.65 requests/second

github-actions · 2025-10-02T17:43:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	168.032423ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.068562ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	350.923725ms
Throughput	284.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.261525961s
Average Latency	371.158829ms
Throughput	134.19 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.007383525s
Average Latency	258.89895ms
Throughput	192.25 requests/second

service/policy/namespaces/namespaces.proto

service/policy/namespaces/namespaces.go

service/policy/db/migrations/20251002000000_add_namespace_certificates.sql

c-r33d

Looks good, just a couple small comments.

Are you wanting to be able to retrieve your created certs? In addition, you will probably want an easy command to list your namespace <-> cert pairs. Key management uses a function called ListKeyMappings, which will return all mappings for namespace/definition/value <-> kas asymmetric keys.

…distinction, enhance namespace-certificate management with ID/FQN support. Update related migrations, RPCs, and documentation.

github-actions · 2025-10-07T19:36:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.816742ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.935635ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.950733ms
Throughput	276.28 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.65110799s
Average Latency	414.342461ms
Throughput	120.04 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.306901147s
Average Latency	272.09727ms
Throughput	183.10 requests/second

github-actions · 2025-10-07T20:24:27Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.83363ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.219444ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.999374ms
Throughput	273.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.346098183s
Average Latency	382.083834ms
Throughput	130.39 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.882956415s
Average Latency	267.736099ms
Throughput	185.99 requests/second

c-r33d · 2025-10-08T13:35:57Z

Looks good. Gonna have @jakedoublev review it as well, just to make sure his concerns are met also.

service/policy/objects.proto

service/policy/db/namespaces.go

service/internal/auth/casbin_policy.csv

jakedoublev · 2025-10-08T15:11:54Z

service/policy/db/queries/namespaces.sql

+
+-- name: createCertificate :one
+INSERT INTO certificates (x5c, is_root, metadata)
+VALUES (sqlc.arg('x5c'), COALESCE(sqlc.narg('is_root')::BOOLEAN, TRUE), sqlc.arg('metadata'))


Are we taking in is_root from the protos at all? Or is every cert creation/assignment a root at this time? I didn't see it in the protos. 🤔

service/policy/db/migrations/20251002000000_add_namespace_certificates.sql

service/policy/namespaces/namespaces.go

strantalis · 2025-10-08T19:50:04Z

/gemini review

gemini-code-assist

Code Review

This is a great feature addition, enabling namespace-scoped root certificates. The implementation is well-structured, with good use of database transactions, clear separation of concerns, and appropriate validation. The addition of database migrations, documentation, and tests is also excellent.

I've identified a couple of areas for improvement related to database query efficiency and maintainability. My comments are detailed below.

service/policy/db/namespaces.go

service/policy/db/queries/namespaces.sql

strantalis

After reviewing this pr something we should think about is tracking key fingerprints so we don't end up with duplicate keys in our system as well.

service/policy/objects.proto

service/policy/namespaces/namespaces.go

…Cs, migrations, documentation, and tests for consistency with PEM standards.

github-actions · 2025-10-09T17:44:06Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	171.01686ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.450668ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	357.399928ms
Throughput	279.80 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.446420937s
Average Latency	382.659234ms
Throughput	130.05 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.410685224s
Average Latency	263.304768ms
Throughput	189.32 requests/second

…space # Conflicts: # docs/openapi/policy/attributes/attributes.openapi.yaml # protocol/go/policy/namespaces/namespaces.pb.go

…e certificate RPCs for enhanced certificate management.

github-actions · 2025-10-09T19:38:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.81513ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.097697ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.827169ms
Throughput	271.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.125029851s
Average Latency	399.674042ms
Throughput	124.61 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.941216256s
Average Latency	268.636087ms
Throughput	185.59 requests/second

…n namespace key and certificate assignments

…in migration rollback

github-actions · 2025-10-09T20:23:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.471961ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.57047ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.994505ms
Throughput	268.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.105535818s
Average Latency	399.211596ms
Throughput	124.67 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.626333432s
Average Latency	265.133928ms
Throughput	187.78 requests/second

…pecs, and database mappings; update related documentation and RPCs.

Co-authored-by: Jake Van Vorhis <83739412+jakedoublev@users.noreply.github.com>

…d error context serialization

github-actions · 2025-10-10T15:03:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.140676ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.328138ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	354.635773ms
Throughput	281.98 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.55479066s
Average Latency	393.107798ms
Throughput	126.41 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.664672348s
Average Latency	265.853151ms
Throughput	187.51 requests/second

github-actions · 2025-10-10T15:06:02Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.643523ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.990602ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	366.183984ms
Throughput	273.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.959081731s
Average Latency	387.81751ms
Throughput	128.34 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.664819945s
Average Latency	265.935737ms
Throughput	187.51 requests/second

github-actions · 2025-10-10T15:08:12Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.766212ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.039532ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	356.651311ms
Throughput	280.39 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.305887538s
Average Latency	381.21013ms
Throughput	130.53 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.169175472s
Average Latency	260.949489ms
Throughput	191.06 requests/second

…nhanced context in unknown identifier cases

github-actions · 2025-10-10T15:37:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	176.999961ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.888637ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	363.309301ms
Throughput	275.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.656004037s
Average Latency	383.283418ms
Throughput	129.35 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.180106071s
Average Latency	260.934596ms
Throughput	190.98 requests/second

…ries, methods, and documentation for simplified root-only certificate management.

pflynn-virtru · 2025-10-10T16:22:40Z

After reviewing this pr something we should think about is tracking key fingerprints so we don't end up with duplicate keys in our system as well.

I added a check to see if the PEM is already added to the certificate table. so no duplicate PEM

github-actions · 2025-10-10T16:26:46Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.78622ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	118.833666ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	371.653128ms
Throughput	269.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.601551102s
Average Latency	404.781091ms
Throughput	123.15 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.142285604s
Average Latency	270.468227ms
Throughput	184.21 requests/second

…, and ensure proper certificate cleanup on namespace removal

github-actions · 2025-10-10T19:03:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.774319ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.005329ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.079079ms
Throughput	268.76 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.222572943s
Average Latency	400.283771ms
Throughput	124.31 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.716914135s
Average Latency	266.349303ms
Throughput	187.15 requests/second

Extend authentication exclusions and update namespace policy definiti…

926f5ab

…ons.

github-actions bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) comp:middleware:auth size/m labels Sep 30, 2025

Add X.509 certificate management to namespace policy definitions.

48c4e62

pflynn-virtru changed the title ~~feat(service): namespace root certificates~~ feat(policy): namespace root certificates Oct 2, 2025

pflynn-virtru added 2 commits October 2, 2025 12:59

Introduce namespace-to-certificate RPCs for X.509 certificate managem…

f61ecc0

…ent.

Remove namespace policy routes from public access and associated tests.

0187c8d

Introduce X.509 certificate validation and enhance namespace policy f…

a57e637

…or certificate management. Add associated tests.

pflynn-virtru marked this pull request as ready for review October 2, 2025 17:14

pflynn-virtru requested review from a team as code owners October 2, 2025 17:14

pflynn-virtru mentioned this pull request Oct 2, 2025

feat(core): Assign certificate to namespace opentdf/otdfctl#661

Draft

Remove unused error messages in namespace certificate assignment test.

f0624f9

Add schema and migration for namespace certificate management

9669a30

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.proto Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.proto Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.go Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/db/migrations/20251002000000_add_namespace_certificates.sql Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

Introduce is_root flag to certificate schema for root/intermediate …

7b6f379

…distinction, enhance namespace-certificate management with ID/FQN support. Update related migrations, RPCs, and documentation.

jakedoublev reviewed Oct 8, 2025

View reviewed changes

gemini-code-assist bot reviewed Oct 8, 2025

View reviewed changes

service/policy/db/namespaces.go Show resolved Hide resolved

service/policy/db/queries/namespaces.sql Outdated Show resolved Hide resolved

strantalis reviewed Oct 8, 2025

View reviewed changes

service/policy/objects.proto Outdated Show resolved Hide resolved

service/policy/objects.proto Outdated Show resolved Hide resolved

service/policy/namespaces/namespaces.go Outdated Show resolved Hide resolved

Change certificate field format from x5c to pem across schema, RP…

d1dca55

…Cs, migrations, documentation, and tests for consistency with PEM standards.

pflynn-virtru added 2 commits October 9, 2025 15:31

Merge remote-tracking branch 'origin/main' into feature/trust-by-name…

c5b2680

…space # Conflicts: # docs/openapi/policy/attributes/attributes.openapi.yaml # protocol/go/policy/namespaces/namespaces.pb.go

Remove deprecated AttributeValueSelector schema and update namespac…

f7ed290

…e certificate RPCs for enhanced certificate management.

pflynn-virtru added 2 commits October 9, 2025 15:53

Update SQL queries to return specific fields instead of all columns i…

8311e79

…n namespace key and certificate assignments

Add trigger for certificates.updated_at and handle trigger removal …

b2f88fa

…in migration rollback

pflynn-virtru and others added 3 commits October 10, 2025 10:57

Add metadata field to certificate schema across protobuf, OpenAPI s…

b4868b7

…pecs, and database mappings; update related documentation and RPCs.

Apply suggestion from Jake

f5d8101

Co-authored-by: Jake Van Vorhis <83739412+jakedoublev@users.noreply.github.com>

Update error logging in namespaces.go to use slog.Any for improve…

6454b1b

…d error context serialization

Refactor error handling in namespaces.go to use errors.Join for e…

c9fdcea

…nhanced context in unknown identifier cases

Remove is_root flag from certificate schema, update related SQL que…

2695891

…ries, methods, and documentation for simplified root-only certificate management.

Add validation for root certificates, improve namespace ID resolution…

80e7d39

…, and ensure proper certificate cleanup on namespace removal

pflynn-virtru requested review from c-r33d, jakedoublev and strantalis October 10, 2025 18:59

feat(policy): namespace root certificates #2771

Are you sure you want to change the base?

feat(policy): namespace root certificates #2771

Uh oh!

Conversation

pflynn-virtru commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

c-r33d left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 7, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 7, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

c-r33d commented Oct 8, 2025

pflynn-virtru commented Sep 30, 2025 •

edited

Loading