feat(policy): namespace root certificates #2771

pflynn-virtru · 2025-09-30T17:55:58Z

This pull request introduces new support for namespace root certificates within the policy service, updates the API to expose these certificates, and makes related improvements to authentication and routing. The most significant changes include extending the Namespace object to include root certificates, updating the API and HTTP routing to allow public access to namespace information, and adding a proof-of-concept implementation for injecting a root CA certificate.

http://localhost:8080/policy.namespaces.NamespaceService/GetNamespace

{
    "namespace": {
        "id": "8f1d8839-2851-4bf4-8bf4-5243dbfe517d",
        "name": "example.com",
        "fqn": "https://example.com",
        "active": true,
        "metadata": {
            "createdAt": "2025-10-10T17:01:12.477117Z",
            "updatedAt": "2025-10-10T17:01:12.477117Z"
        },
        "rootCerts": [
            {
                "id": "46f1aa69-a458-45fa-9ff3-bc6e2f349773",
                "pem": "-----BEGIN CERTIFICATE-----\nMIIC/TCCAeWgAwIBAgIUSMNrGBq+5ax1wDaMSX8Nnl1m/REwDQYJKoZIhvcNAQEL\nBQAwDjEMMAoGA1UEAwwDa2FzMB4XDTI0MDUyOTE4MzcxOFoXDTI1MDUyOTE4Mzcx\nOFowDjEMMAoGA1UEAwwDa2FzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAzbLGCYovxrCy6DccFAdj1DjnDKwmTqjYQoHfOKXbYOF1Yf5mvAyFO9MhtLet\nPRhmCd7mJA3M8Sy4/kqqAZprYHmvagAIwD0zQyQ+DcogrzmirQ8cUYIDkGre1exc\niVKsNYSlM/NcjNO5AqOaw7gQvmUkp2YciSMa7mixPsl3OTArtOtEGMn34RK1NGC+\n+MdUH6TOF2VmhqJ6+F8iSF154ldRoiR01LIzIxvqpHr0RYhU93BrMDcb4Yx92j2M\nlCpwJ8hVf2RPIqhjsnivzXu+BBQh7zynB3H6LnZUGlyWEHgEfM9yhTFWNeKDClKC\nFE2s1DD8ksvMa8ayndIy0+cNXQIDAQABo1MwUTAdBgNVHQ4EFgQUrrmJ35Nvvkpp\nGnQi686Y/DKmsv0wHwYDVR0jBBgwFoAUrrmJ35NvvkppGnQi686Y/DKmsv0wDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAXfFJqJYVD+7GqZAWg3v\nw1Sr9jKvwMTtcAhmEJ8KKu9u4C/eGz+P4vU+KwismRfFwQaZVr0AuxRhCtCt3dqh\nKPHZ6sVUw8NG/Fg8v7cQmSpNEuy31vxTMrAWE0/zgScZmIQgS5TnqavsEaxiQGU1\nKTEGOuYQRQZ44KBQJJwUHpwb6znHOwVTKex4OsenkxMLOgsPYa3Qf53kHdZIq8x6\nkxm+METK7jT7RMDNqFWPo4R7XfpvCBR/HS3xjmXe0VVonSc2I4QKdrFPpmx2oOsS\n8Mr8dklyCivjNJ4dM1oKU/YK0hm0bF4OuhoROKpDDBDimDPnFFh/tphl1rzAuuxM\n/A==\n-----END CERTIFICATE-----\n"
            }
        ]
    }
}

Namespace Root Certificate Support:

Added a root_certs repeated field of type Certificate to the Namespace message in policy/objects.proto, and defined a new Certificate message to hold certificate data in PEM format.

…ons.

github-actions · 2025-10-02T16:47:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.886396ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.521893ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.943783ms
Throughput	280.94 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.537871937s
Average Latency	373.798287ms
Throughput	133.20 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.788514431s
Average Latency	256.983679ms
Throughput	193.88 requests/second

…ent.

github-actions · 2025-10-02T17:04:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.372936ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.478311ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.260561ms
Throughput	274.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.432964175s
Average Latency	392.155218ms
Throughput	126.80 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.422897667s
Average Latency	272.611464ms
Throughput	182.33 requests/second

github-actions · 2025-10-02T17:05:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.628447ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.737715ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.727788ms
Throughput	281.11 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.955485373s
Average Latency	386.922569ms
Throughput	128.35 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.012714986s
Average Latency	268.756871ms
Throughput	185.10 requests/second

…or certificate management. Add associated tests.

github-actions · 2025-10-02T17:19:15Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.484578ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.999687ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	342.051044ms
Throughput	292.35 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.45971998s
Average Latency	382.525569ms
Throughput	130.01 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.076982976s
Average Latency	259.571739ms
Throughput	191.74 requests/second

github-actions · 2025-10-02T17:30:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.261382ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.6032ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	351.284832ms
Throughput	284.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.804643997s
Average Latency	376.588363ms
Throughput	132.26 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.089247832s
Average Latency	259.643523ms
Throughput	191.65 requests/second

github-actions · 2025-10-02T17:43:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	168.032423ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.068562ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	350.923725ms
Throughput	284.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.261525961s
Average Latency	371.158829ms
Throughput	134.19 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.007383525s
Average Latency	258.89895ms
Throughput	192.25 requests/second

service/policy/namespaces/namespaces.proto

service/policy/namespaces/namespaces.go

service/policy/db/migrations/20251002000000_add_namespace_certificates.sql

c-r33d

Looks good, just a couple small comments.

Are you wanting to be able to retrieve your created certs? In addition, you will probably want an easy command to list your namespace <-> cert pairs. Key management uses a function called ListKeyMappings, which will return all mappings for namespace/definition/value <-> kas asymmetric keys.

…distinction, enhance namespace-certificate management with ID/FQN support. Update related migrations, RPCs, and documentation.

github-actions · 2025-10-07T19:36:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.816742ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.935635ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.950733ms
Throughput	276.28 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.65110799s
Average Latency	414.342461ms
Throughput	120.04 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.306901147s
Average Latency	272.09727ms
Throughput	183.10 requests/second

…e related methods to improve root certificate management, error handling, and assignment logic.

github-actions · 2025-10-14T16:21:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.979067ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.682777ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.763495ms
Throughput	282.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.847179637s
Average Latency	386.533067ms
Throughput	128.71 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.693486876s
Average Latency	266.23524ms
Throughput	187.31 requests/second

service/policy/db/namespaces.go

…space # Conflicts: # docs/grpc/index.html # docs/openapi/policy/actions/actions.openapi.yaml # docs/openapi/policy/attributes/attributes.openapi.yaml # docs/openapi/policy/namespaces/namespaces.openapi.yaml # docs/openapi/policy/objects.openapi.yaml # docs/openapi/policy/obligations/obligations.openapi.yaml # docs/openapi/policy/registeredresources/registered_resources.openapi.yaml # docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml # docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml # docs/openapi/policy/unsafe/unsafe.openapi.yaml # protocol/go/policy/namespaces/namespaces.pb.go # protocol/go/policy/namespaces/namespaces_grpc.pb.go # protocol/go/policy/namespaces/namespacesconnect/namespaces.connect.go # protocol/go/policy/objects.pb.go # service/policy/namespaces/namespaces.go # service/policy/namespaces/namespaces.proto # service/policy/objects.proto

github-actions · 2025-10-15T13:52:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	169.4005ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.975546ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	359.086853ms
Throughput	278.48 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.733354077s
Average Latency	386.002133ms
Throughput	129.09 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.168103639s
Average Latency	270.974528ms
Throughput	184.04 requests/second

…rFqnMismatch` and `ErrInvalidCertificate` for improved specificity; replace generic error messages with structured errors using `errors.Join`.

github-actions · 2025-10-15T14:10:29Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	173.394142ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.954092ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.337286ms
Throughput	274.47 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.136781309s
Average Latency	379.671655ms
Throughput	131.11 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.998925833s
Average Latency	269.17485ms
Throughput	185.19 requests/second

…nvalid FQN

github-actions · 2025-10-15T14:22:42Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.622289ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.648924ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	368.571641ms
Throughput	271.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.855972706s
Average Latency	406.018975ms
Throughput	122.38 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.24045197s
Average Latency	281.440214ms
Throughput	177.05 requests/second

…tured `fmt.Errorf` and adjust test expectations accordingly.

github-actions · 2025-10-15T14:36:18Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.013346ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.962427ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.936882ms
Throughput	271.79 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.503889459s
Average Latency	413.462143ms
Throughput	120.47 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.740281094s
Average Latency	286.478005ms
Throughput	173.97 requests/second

jentfoo

I really like the idea of a namespace cert, and don't see any significant issues to this design. Marking as requires changes because of a couple small bugs noticed.

service/policy/db/namespaces.go

jrschumacher

After consultation we've decided to move forward and figure out any additional enhancements in the future.

…cate validations with tests

github-actions · 2025-10-17T16:11:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.283847ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.466562ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	368.331268ms
Throughput	271.49 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.143661979s
Average Latency	390.204987ms
Throughput	127.73 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.415870925s
Average Latency	273.291352ms
Throughput	182.38 requests/second

jentfoo

Changes look good to me. Technically the transaction behavior will depend on the databases configured transaction isolation defaults, but I suspect this is not a huge concern.

🤖 I have created a release *beep* *boop* --- ## [0.11.0](service/v0.10.0...service/v0.11.0) (2025-10-22) ### Features * **authz:** add obligation fulfillment logic to obligation PDP ([#2740](#2740)) ([2f8d30d](2f8d30d)) * **authz:** audit logs should properly handle obligations ([#2824](#2824)) ([874ec7b](874ec7b)) * **authz:** defer to request auth as decision/entitlements entity ([#2789](#2789)) ([feb34d8](feb34d8)) * **authz:** obligations protos within auth service ([#2745](#2745)) ([41ee5a8](41ee5a8)) * **authz:** protovalidate tests for new authz obligations fields ([#2747](#2747)) ([73e6319](73e6319)) * **authz:** service logic to use request auth as entity identifier in PDP decisions/entitlements ([#2790](#2790)) ([6784e88](6784e88)) * **authz:** wire up obligations enforcement in auth service ([#2756](#2756)) ([11b3ea9](11b3ea9)) * **core:** propagate token clientID on configured claim via interceptor into shared context metadata ([#2760](#2760)) ([0f77246](0f77246)) * **kas:** Add required obligations to kao metadata.: ([#2806](#2806)) ([16fb26c](16fb26c)) * **policy:** add FQNs to obligation defs + vals ([#2749](#2749)) ([fa2585c](fa2585c)) * **policy:** Add obligation support to KAS ([#2786](#2786)) ([bb1bca0](bb1bca0)) * **policy:** List obligation triggers rpc ([#2823](#2823)) ([206abe3](206abe3)) * **policy:** namespace root certificates ([#2771](#2771)) ([beaff21](beaff21)) * **policy:** Proto - root certificates by namespace ([#2800](#2800)) ([0edb359](0edb359)) * **policy:** Protos List obligation triggers ([#2803](#2803)) ([b32df81](b32df81)) * **policy:** Return built obligations fqns with triggers. ([#2830](#2830)) ([e843018](e843018)) * **policy:** Return obligations from GetAttributeValue calls ([#2742](#2742)) ([aa9b393](aa9b393)) ### Bug Fixes * **core:** CORS ([#2787](#2787)) ([a030ac6](a030ac6)) * **core:** deprecate policy WithValue selector not utilized by RPC ([#2794](#2794)) ([c573595](c573595)) * **core:** deprecated stale protos and add better upgrade comments ([#2793](#2793)) ([f2678cc](f2678cc)) * **core:** Don't require known manager names ([#2792](#2792)) ([8a56a96](8a56a96)) * **core:** Fix mode negation and core mode ([#2779](#2779)) ([de9807d](de9807d)) * **core:** resolve environment loading issues ([#2827](#2827)) ([9af3184](9af3184)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.6.0 to 0.7.0 in /service ([#2812](#2812)) ([a6d180d](a6d180d)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.12.0 to 0.13.0 in /service ([#2814](#2814)) ([5e9c695](5e9c695)) * **deps:** bump github.com/opentdf/platform/sdk from 0.7.0 to 0.9.0 in /service ([#2798](#2798)) ([d6bc9a8](d6bc9a8)) * **deps:** bump github.com/opentdf/platform/sdk from 0.9.0 to 0.10.0 in /service ([#2831](#2831)) ([412dfd1](412dfd1)) * ECC key loading (deprecated) ([#2757](#2757)) ([49990eb](49990eb)) * **policy:** Change to nil ([#2746](#2746)) ([a449434](a449434)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

Extend authentication exclusions and update namespace policy definiti…

926f5ab

…ons.

github-actions bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) comp:middleware:auth size/m labels Sep 30, 2025

Add X.509 certificate management to namespace policy definitions.

48c4e62

pflynn-virtru changed the title ~~feat(service): namespace root certificates~~ feat(policy): namespace root certificates Oct 2, 2025

pflynn-virtru added 2 commits October 2, 2025 12:59

Introduce namespace-to-certificate RPCs for X.509 certificate managem…

f61ecc0

…ent.

Remove namespace policy routes from public access and associated tests.

0187c8d

Introduce X.509 certificate validation and enhance namespace policy f…

a57e637

…or certificate management. Add associated tests.

pflynn-virtru marked this pull request as ready for review October 2, 2025 17:14

pflynn-virtru requested review from a team as code owners October 2, 2025 17:14

pflynn-virtru mentioned this pull request Oct 2, 2025

feat(core): Assign certificate to namespace opentdf/otdfctl#661

Closed

Remove unused error messages in namespace certificate assignment test.

f0624f9

Add schema and migration for namespace certificate management

9669a30

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.proto Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.proto Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/namespaces/namespaces.go Outdated Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

service/policy/db/migrations/20251002000000_add_namespace_certificates.sql Show resolved Hide resolved

c-r33d reviewed Oct 7, 2025

View reviewed changes

Introduce is_root flag to certificate schema for root/intermediate …

7b6f379

…distinction, enhance namespace-certificate management with ID/FQN support. Update related migrations, RPCs, and documentation.

Refactor CreateCertificate to return full certificate object, updat…

82ba7b1

…e related methods to improve root certificate management, error handling, and assignment logic.

jakedoublev reviewed Oct 14, 2025

View reviewed changes

service/policy/db/namespaces.go Outdated Show resolved Hide resolved

Refactor error handling in namespaces.go and errors.go to add `Er…

b3e7bc3

…rFqnMismatch` and `ErrInvalidCertificate` for improved specificity; replace generic error messages with structured errors using `errors.Join`.

Update test to expect ErrFqnMismatch instead of ErrNotFound for i…

a3a1b5a

…nvalid FQN

Refactor UnsafeDeleteNamespace to replace generic errors with struc…

5fad1f5

…tured `fmt.Errorf` and adjust test expectations accordingly.

pflynn-virtru requested review from dmihalcik-virtru and jakedoublev October 15, 2025 20:10

pflynn-virtru enabled auto-merge October 16, 2025 14:49

dmihalcik-virtru previously approved these changes Oct 16, 2025

View reviewed changes

jentfoo requested changes Oct 16, 2025

View reviewed changes

service/policy/db/namespaces.go Show resolved Hide resolved

service/policy/db/namespaces.go Outdated Show resolved Hide resolved

service/policy/db/namespaces.go Show resolved Hide resolved

jrschumacher previously approved these changes Oct 16, 2025

View reviewed changes

Add certificate validation and signature checks; enhance root certifi…

3f0b299

…cate validations with tests

pflynn-virtru dismissed stale reviews from jrschumacher and dmihalcik-virtru via 3f0b299 October 17, 2025 16:06

pflynn-virtru requested a review from jentfoo October 17, 2025 17:51

jentfoo approved these changes Oct 17, 2025

View reviewed changes

jrschumacher approved these changes Oct 17, 2025

View reviewed changes

pflynn-virtru added this pull request to the merge queue Oct 17, 2025

Merged via the queue into main with commit beaff21 Oct 17, 2025
32 checks passed

pflynn-virtru deleted the feature/trust-by-namespace branch October 17, 2025 19:04

opentdf-automation bot mentioned this pull request Oct 17, 2025

chore(main): release service 0.11.0 #2744

Merged

Uh oh!

feat(policy): namespace root certificates #2771

feat(policy): namespace root certificates #2771

Uh oh!

Conversation

pflynn-virtru commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 2, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

c-r33d left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 7, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 14, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

Uh oh!

pflynn-virtru commented Sep 30, 2025 •

edited

Loading

jentfoo left a comment •

edited

Loading