Grace period fix - #11
Open
saranggalada wants to merge 1 commit into
Open
Conversation
This was referenced Aug 16, 2026
saranggalada
marked this pull request as ready for review
August 16, 2026 13:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Azure private-key fetch now appends
all=trueto the KMS/keyURL so a service caches every non-expired key, not just the latest.Why
When keys rotate weekly as per the Refresh Keys workflow, there will be a key mismatch window which may last up to the duration of the CCR services' private-key cache interval (i.e. 3h). To prevent this, a grace period is introduced with a time period as set in the Key Rotation Policy, which allows all services to continue using the previous key during the rotation window while also transitioning to the newly rotated key. This ensures that a service launched during the grace period can fetch and cache both the previous and new private keys, allowing it to decrypt traffic encrypted with either key.
Change
CreateHttpRequest(TEE and non-TEE) appends?all=trueor&all=truetoPRIMARY_COORDINATOR_PRIVATE_KEY_ENDPOINT. Parsing, per-key unwrap via/unwrapKey, and cache insert were already multi-key-capable.No change to AWS/GCP fetchers.
Behavior
all/ nokid: latest key only (unchanged).all=true(nokid,fmt=tink): all keys withnow < creationTime + rotation_interval_seconds(currently 31 days).kid: that key only (unchanged).isExpired/expiryTimeMs) are skipped.Compatibility
In order for this to work, the Azure KMS repo must implement the equivalent fix to include the updated API call to return all valid private keys. (See PR #68)
Note: Only the DEPA Private Inferencing Key Management Service (KMS) versions>=1.1.0 contain the required fix for the grace period.