feat(kms-provider): measure the Vault Transit DEK operations#3536
Open
chet wants to merge 1 commit into
Open
Conversation
The KMS provider's three outbound Vault Transit calls -- encrypt, decrypt, and generate-data-key for DEK wrap/unwrap -- were invisible: a remote Transit failure surfaced in no metric. Each now runs through the framework's RED helper.
- `encrypt_dek`, `decrypt_dek`, and `generate_and_wrap_dek` wrap their Transit call in `red::instrumented("vault_transit", op, ...)`, recording `carbide_external_call_duration_milliseconds{backend = "vault_transit", operation, outcome}` -- the duration, the request and error rate (the `_count` split by outcome), and a WARN on failure.
- It reuses the existing outbound-RED family, so there are no new catalogue rows, and DEK plaintext and `kek_id` stay out of every label and log line, as before.
This supports NVIDIA#3173
Signed-off-by: Chet Nichols III <chetn@nvidia.com>
Contributor
Author
|
@coderabbitai full_review, thanks! |
Contributor
|
🐰✨ ✅ Action performedFull review finished. |
Contributor
Summary by CodeRabbit
WalkthroughThe KMS provider adds a local ChangesVault Transit instrumentation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
crates/kms-provider/src/providers/transit.rs (1)
140-149: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd call-site regression coverage for all three operations.
The existing RED helper tests do not prove that the KMS provider emits the exact
vault_transit/operation labels for encrypt, decrypt, and data-key generation. Add table-driven tests covering success, failure metrics, WARN behavior, and unchanged error propagation.Also applies to: 171-180, 212-221
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/kms-provider/src/providers/transit.rs` around lines 140 - 149, Add table-driven call-site regression tests for the provider’s encrypt, decrypt, and data-key generation methods, covering successful and failed RED calls, WARN behavior, and unchanged error propagation. Assert each operation emits the exact vault_transit service label and corresponding encrypt_dek, decrypt_dek, or generate_data_key operation label, while preserving existing helper tests and provider behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@crates/kms-provider/src/providers/transit.rs`:
- Around line 140-149: Add table-driven call-site regression tests for the
provider’s encrypt, decrypt, and data-key generation methods, covering
successful and failed RED calls, WARN behavior, and unchanged error propagation.
Assert each operation emits the exact vault_transit service label and
corresponding encrypt_dek, decrypt_dek, or generate_data_key operation label,
while preserving existing helper tests and provider behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bb02d54f-24c9-467a-8b37-3a7ba6baf732
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
crates/kms-provider/Cargo.tomlcrates/kms-provider/src/providers/transit.rs
🔍 Container Scan Summary
Per-CVE detail lives in the per-service |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The KMS provider's three outbound Vault Transit calls -- encrypt, decrypt, and generate-data-key for DEK wrap/unwrap -- were invisible: a remote Transit failure surfaced in no metric. Each now runs through the framework's RED helper.
encrypt_dek,decrypt_dek, andgenerate_and_wrap_dekwrap their Transit call inred::instrumented("vault_transit", op, ...), recordingcarbide_external_call_duration_milliseconds{backend = "vault_transit", operation, outcome}-- the duration, the request and error rate (the_countsplit by outcome), and a WARN on failure.kek_idstay out of every label and log line, as before.This supports #3173