feat(cli): deprecate KAS URL path flag by elizabethhealy · Pull Request #4201 · opentdf/platform

elizabethhealy · 2026-10-08T18:50:16Z

Summary

deprecate --kas-url-path while preserving its current default and behavior
direct users toward platform KAS grants and well-known base-key discovery
document and test the deprecation metadata

Testing

cd otdfctl && go test ./... -race
changed-code lint: 0 issues

coderabbitai · 2026-10-08T18:50:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 12fb131a-0581-42cf-99a9-64d70f9c9928

📥 Commits

Reviewing files that changed from the base of the PR and between 76d2cb8 and c25debd.

📒 Files selected for processing (3)

otdfctl/cmd/tdf/encrypt.go
otdfctl/cmd/tdf/encrypt_test.go
otdfctl/docs/man/encrypt/_index.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The encrypt command retains the kas-url-path flag and marks it deprecated, with a notice directing users to platform KAS grants and well-known base-key discovery. A test checks the flag’s default and deprecation notice. The manual page now documents the deprecation.

Changes

Encrypt KAS URL path deprecation

Layer / File(s)	Summary
Deprecate the KAS URL path flag `otdfctl/cmd/tdf/encrypt.go`, `otdfctl/cmd/tdf/encrypt_test.go`, `otdfctl/docs/man/encrypt/_index.md`	The flag remains registered with its `/kas` default and gains a deprecation notice. Initialization panics if registering the deprecation fails. The test checks the flag, default, and notice; the manual page documents the deprecation.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: alkalescent

Merge Risk: ⚪ Minimal · up to c25de

The flag remains functional during deprecation. The supplied context does not establish a concrete failure that should block merging.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: deprecation of the `kas-url-path` CLI flag.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit reads the flag’s new note
And finds the old path in its coat
“Use grants,” it says, “and base keys bright”
Then hops through fields of code tonight
The manual joins the trail just right}

_{Comment @coderabbitai help to get the list of available commands.}

Signed-off-by: Elizabeth Healy <ehealy@virtru.com>

github-actions · 2026-10-08T18:55:50Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	431.803399ms
Throughput	231.59 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.419502594s
Average Latency	473.073268ms
Throughput	105.44 requests/second

github-actions · 2026-10-08T18:57:43Z

X-Test Failure Report

bats-test-results
govulncheck-failure-7
opentdf~~platform~~KWQISG.dockerbuild
server-logs-go@pull-4201-v0.9.0
govulncheck-failure-2
govulncheck-failure-0
❌ go@pull-4201-v0.9.0

github-actions · 2026-10-08T19:01:10Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.951784ms
Throughput	235.88 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.610222539s
Average Latency	485.02717ms
Throughput	102.86 requests/second

github-actions · 2026-10-08T19:11:47Z

X-Test Results

✅ go@main-pull-4201
✅ go@pull-4201-pull-4201
✅ go@main-main
cukes-report
✅ go@pull-4201-v0.9.0
✅ java@main-v0.9.0
govulncheck-failure-7
✅ java@main-main
opentdf~~platform~~YPB32B.dockerbuild
✅ go@pull-4201-main
govulncheck-failure-2
bats-test-results
govulncheck-failure-0
✅ js@main-main
✅ java@main-pull-4201
✅ go@main-v0.9.0
✅ js@main-pull-4201
✅ js@main-v0.9.0

github-actions · 2026-10-08T19:20:46Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	343.050657ms
Throughput	291.50 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	34.615492534s
Average Latency	345.257314ms
Throughput	144.44 requests/second

github-actions · 2026-10-08T19:24:12Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-10-08T19:29:58Z

X-Test Results

✅ go@main-pull-4201
opentdf~~platform~~5GH12E.dockerbuild
✅ js@main-main
govulncheck-failure-0
✅ java@main-main
govulncheck-failure-7
✅ js@main-v0.9.0
✅ go@pull-4201-pull-4201
✅ go@main-main
✅ go@pull-4201-v0.9.0
✅ js@main-pull-4201
✅ java@main-pull-4201
✅ go@pull-4201-main
✅ go@main-v0.9.0
govulncheck-failure-2
✅ java@main-v0.9.0
bats-test-results
cukes-report

c-r33d

Just to make sure i understand, this previously set the path of the url so:

path="/kas/1", host="https://example.com".
KAS URL->"https://example.com/kas/1|

Or would it set the entire host?

elizabethhealy · 2026-10-08T21:30:52Z

Just to make sure i understand, this previously set the path of the url so:

path="/kas/1", host="https://example.com". KAS URL->"https://example.com/kas/1|

Or would it set the entire host?

@c-r33d ya it would get concatenated with the host so otdfctl encrypt --host https;//example.com --kas-url-path "/my-special-kas" would use the kas at https://example.com/my-special-kas , but we should be using the kas-registry instead

if this is useful for testing, we could eventually remove it from the docs and keep it hidden as a dev only command

elizabethhealy requested a review from a team as a code owner October 8, 2026 18:50

github-actions Bot added the size/s label Oct 8, 2026

chore(otdfctl): deprecate KAS URL path flag

c25debd

Signed-off-by: Elizabeth Healy <ehealy@virtru.com>

elizabethhealy force-pushed the chore/dspx-4803-remove-kas-url-path branch from 76d2cb8 to c25debd Compare October 8, 2026 18:56

elizabethhealy changed the title ~~chore(otdfctl): remove KAS URL path flag~~ chore(otdfctl): deprecate KAS URL path flag Oct 8, 2026

elizabethhealy closed this Oct 8, 2026

elizabethhealy deleted the chore/dspx-4803-remove-kas-url-path branch October 8, 2026 19:05

elizabethhealy restored the chore/dspx-4803-remove-kas-url-path branch October 8, 2026 19:10

elizabethhealy reopened this Oct 8, 2026

github-actions Bot added size/xs and removed size/s labels Oct 8, 2026

elizabethhealy changed the title ~~chore(otdfctl): deprecate KAS URL path flag~~ feat(cli): deprecate KAS URL path flag Oct 8, 2026

c-r33d reviewed Oct 8, 2026

View reviewed changes

c-r33d approved these changes Oct 8, 2026

View reviewed changes

elizabethhealy added this pull request to the merge queue Oct 9, 2026

Merged via the queue into main with commit af6b1f8 Oct 9, 2026
91 of 97 checks passed

elizabethhealy deleted the chore/dspx-4803-remove-kas-url-path branch October 9, 2026 15:57

opentdf-automation Bot mentioned this pull request Oct 9, 2026

chore(main): release otdfctl 0.39.0 #4101

Open

Conversation

elizabethhealy commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

coderabbitai Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Oct 8, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 8, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 8, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 8, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 8, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 8, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Oct 8, 2026

X-Test Results

Uh oh!

c-r33d left a comment

Choose a reason for hiding this comment

Uh oh!

elizabethhealy commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

elizabethhealy commented Oct 8, 2026 •

edited

Loading

coderabbitai Bot commented Oct 8, 2026 •

edited

Loading

elizabethhealy commented Oct 8, 2026 •

edited

Loading