feat(ci): configure additional KAS key cache expiration

[c-r33d]

Proposed Changes

Allow callers of test/start-additional-kas to configure private-key caching per KAS through key-cache-expiration. For example, 5m enables a five-minute cache and 0 disables it. An omitted or empty input preserves the inherited configuration. Only the generated additional-KAS configuration changes.

This supports the same-KID registry cache test in opentdf/tests#606. That PR now pins this action revision and uses the input instead of editing the shared platform configuration.

Checklist

• I have added or updated unit tests (action-only change; verified generated configuration directly)
• I have added or updated integration tests (feat(xtest): cover disabled KAO lookup and registry cache isolation tests#606)
• Input behavior is documented in the action description

Testing Instructions

Executed the action's actual configuration-generation script with a stubbed server launcher for five cases: omitted setting, inherited setting, explicit override, cache disabled with 0, and a compound duration. Verified generated values, preserved key-management/root-key configuration, and an unchanged source configuration in every case. Shell syntax, YAML parsing, actionlint, and whitespace validation passed.

Live cross-SDK validation is running through opentdf/tests#606 with this action revision pinned and key-cache-expiration: 5m on KM3.

Summary by CodeRabbit

• New Features
  • Added an optional setting when starting an additional KAS to configure private-key cache expiration using Go duration values, such as 5m.
  • Leaving the setting empty inherits the platform configuration; 0 disables caching.
  • Invalid duration values are rejected when the additional KAS starts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 49be2a9c-f551-436f-9bcd-d155fd07785d

📥 Commits

Reviewing files that changed from the base of the PR and between bfa01ae and d68e587.

📒 Files selected for processing (2)

• test/start-additional-kas/README.md
• test/start-additional-kas/action.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The additional KAS action now accepts an optional Go duration for private-key caching. It forwards non-empty values to the generated KAS configuration and documents inheritance, disabling, validation, and configuration scope.

Changes

Additional KAS cache configuration

Layer / File(s)	Summary
Cache input and configuration generation test/start-additional-kas/action.yaml, test/start-additional-kas/README.md	The action accepts key-cache-expiration, passes it as KEY_CACHE_EXPIRATION, and writes services.kas.key_cache_expiration only when the value is non-empty. The README documents the supported behavior and examples.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Feature

Suggested reviewers: dmihalcik-virtru

Merge Risk: ⚪ Minimal · up to 9181d

The optional cache setting is documented and scoped to the generated additional KAS configuration; no merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring private-key cache expiration for additional KAS instances.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/additional-kas-key-cache

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the cache at dawn
A tiny duration hops along
Empty means inherit the trail
Bad times make startup fail
The extra KAS now follows the plan}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

X-Test Failure Report

govulncheck-failure-8
opentdfplatformKU3CDH.dockerbuild
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	257.171996ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	146.548132ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	417.56088ms
Throughput	239.49 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.847349065s
Average Latency	597.280205ms
Throughput	83.55 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	264.642875ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	139.355399ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.734377ms
Throughput	233.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.348406379s
Average Latency	592.049242ms
Throughput	84.25 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-4064
✅ go@pull-4064-pull-4064
cukes-report
✅ go@main-main
govulncheck-failure-8
✅ java@main-pull-4064
✅ go@main-v0.9.0
✅ go@pull-4064-main
opentdfplatform1JRV84.dockerbuild
✅ java@main-v0.9.0
govulncheck-failure-3
✅ go@pull-4064-v0.9.0
bats-test-results
✅ js@main-main
✅ js@main-v0.9.0
govulncheck-failure-1
✅ java@main-main
✅ js@main-pull-4064