From 9f1d87db315a1a5d9fd0c6800b41e91a6f0f6eaa Mon Sep 17 00:00:00 2001 From: Shelley Shen Date: Fri, 21 Aug 2026 09:54:17 -0700 Subject: [PATCH 1/2] feat(api-keys): register event-ledger in the service id map Policy evaluation resolves the audience service id from the request namespace. Without an entry, evaluation returns 400 before the API key is read, which callers surface as 401, so no API key works against event-ledger. Register event-ledger alongside nvcf and nvct, and assert the mapping in ConfigTest. Signed-off-by: Shelley Shen --- .../api-keys/src/main/resources/application-ncp.yaml | 1 + .../api-keys/src/main/resources/application.yaml | 1 + .../java/com/nvidia/apikeys/config/ConfigTest.java | 10 ++++++++++ 3 files changed, 12 insertions(+) diff --git a/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml b/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml index ade8d2bea..532118d4b 100644 --- a/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml +++ b/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml @@ -39,5 +39,6 @@ apikeys: service-id-map: nvcf: ${NVCF_SERVICE_ID:nvidia-cloud-functions-ncp-service-id-aketm} nvct: ${NVCT_SERVICE_ID:nvidia-cloud-tasks-ncp-service-id-nvcttasks} + event-ledger: ${EVENT_LEDGER_SERVICE_ID:nvidia-cloud-events-ncp-service-id-ckozoh6f} key-prefix: nvapi-nvcf-stg- keep-after-expired-duration: P2D diff --git a/src/control-plane-services/api-keys/src/main/resources/application.yaml b/src/control-plane-services/api-keys/src/main/resources/application.yaml index e678cb6d9..dc47123bb 100644 --- a/src/control-plane-services/api-keys/src/main/resources/application.yaml +++ b/src/control-plane-services/api-keys/src/main/resources/application.yaml @@ -175,6 +175,7 @@ apikeys: service-id-map: nvcf: nvidia-cloud-functions-ncp-service-id-aketm nvct: nvidia-cloud-tasks-ncp-service-id-nvcttasks + event-ledger: nvidia-cloud-events-ncp-service-id-ckozoh6f key-prefix: nvcfapi- data-domain-key: ${kv.data-domain-key.value} keep-after-expired-duration: P2D diff --git a/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java b/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java index 493f83fd3..61a78f3ae 100644 --- a/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java +++ b/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java @@ -58,6 +58,16 @@ void vaultPropertiesShouldBeSet() { assertThat(environment.getProperty("kv.private-key-jwks.keys")).isNotEmpty(); } + @Test + void serviceIdMapShouldContainRegisteredServices() { + assertThat(environment.getProperty("apikeys.service-id-map.nvcf")) + .isEqualTo("nvidia-cloud-functions-ncp-service-id-aketm"); + assertThat(environment.getProperty("apikeys.service-id-map.nvct")) + .isEqualTo("nvidia-cloud-tasks-ncp-service-id-nvcttasks"); + assertThat(environment.getProperty("apikeys.service-id-map.event-ledger")) + .isEqualTo("nvidia-cloud-events-ncp-service-id-ckozoh6f"); + } + @Test void shouldBeAbleToEncryptAndDecrypt() { String encryptedText = jwtService.encryptWithKeyId("92f5fb39-0b6b-4472-9b88-0575870294c0", From 90cbeca7255de2ee4a984433818eebb5d14d70e7 Mon Sep 17 00:00:00 2001 From: Shelley Shen Date: Mon, 24 Aug 2026 10:10:42 -0700 Subject: [PATCH 2/2] fix(api-keys): rename event-ledger service id for clarity nvidia-cloud-events-ncp-service-id-ckozoh6f reads as if it belongs to a generic events product rather than event-ledger specifically. Rename it to nvidia-event-ledger-ncp-service-id-ckozoh6f. Update both the service id map registered in this PR and the registration record written by 07_setup_api-keys.sh so the two stay in agreement; api-keys matches a policy's audience against the registered serviceId, so the two must carry the same value. Signed-off-by: Shelley Shen --- migrations/openbao/migrations/07_setup_api-keys.sh | 2 +- .../api-keys/src/main/resources/application-ncp.yaml | 2 +- .../api-keys/src/main/resources/application.yaml | 2 +- .../src/test/java/com/nvidia/apikeys/config/ConfigTest.java | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/migrations/openbao/migrations/07_setup_api-keys.sh b/migrations/openbao/migrations/07_setup_api-keys.sh index 52baa33c9..7dbf9954b 100644 --- a/migrations/openbao/migrations/07_setup_api-keys.sh +++ b/migrations/openbao/migrations/07_setup_api-keys.sh @@ -35,7 +35,7 @@ SERVICE_ACCOUNT_NAME="api-keys-api" # and the NVCT_SERVICE_ID env var consumed by NAK and NVCT. NVCT_SERVICE_ID="nvidia-cloud-tasks-ncp-service-id-nvcttasks" -EVENT_LEDGER_SERVICE_ID="nvidia-cloud-events-ncp-service-id-ckozoh6f" +EVENT_LEDGER_SERVICE_ID="nvidia-event-ledger-ncp-service-id-ckozoh6f" #------------------------------------------- # Set defaults for secret paths and policies diff --git a/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml b/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml index 532118d4b..f87dbc5c4 100644 --- a/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml +++ b/src/control-plane-services/api-keys/src/main/resources/application-ncp.yaml @@ -39,6 +39,6 @@ apikeys: service-id-map: nvcf: ${NVCF_SERVICE_ID:nvidia-cloud-functions-ncp-service-id-aketm} nvct: ${NVCT_SERVICE_ID:nvidia-cloud-tasks-ncp-service-id-nvcttasks} - event-ledger: ${EVENT_LEDGER_SERVICE_ID:nvidia-cloud-events-ncp-service-id-ckozoh6f} + event-ledger: ${EVENT_LEDGER_SERVICE_ID:nvidia-event-ledger-ncp-service-id-ckozoh6f} key-prefix: nvapi-nvcf-stg- keep-after-expired-duration: P2D diff --git a/src/control-plane-services/api-keys/src/main/resources/application.yaml b/src/control-plane-services/api-keys/src/main/resources/application.yaml index dc47123bb..8063d2f8c 100644 --- a/src/control-plane-services/api-keys/src/main/resources/application.yaml +++ b/src/control-plane-services/api-keys/src/main/resources/application.yaml @@ -175,7 +175,7 @@ apikeys: service-id-map: nvcf: nvidia-cloud-functions-ncp-service-id-aketm nvct: nvidia-cloud-tasks-ncp-service-id-nvcttasks - event-ledger: nvidia-cloud-events-ncp-service-id-ckozoh6f + event-ledger: nvidia-event-ledger-ncp-service-id-ckozoh6f key-prefix: nvcfapi- data-domain-key: ${kv.data-domain-key.value} keep-after-expired-duration: P2D diff --git a/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java b/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java index 61a78f3ae..c69ac56c9 100644 --- a/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java +++ b/src/control-plane-services/api-keys/src/test/java/com/nvidia/apikeys/config/ConfigTest.java @@ -65,7 +65,7 @@ void serviceIdMapShouldContainRegisteredServices() { assertThat(environment.getProperty("apikeys.service-id-map.nvct")) .isEqualTo("nvidia-cloud-tasks-ncp-service-id-nvcttasks"); assertThat(environment.getProperty("apikeys.service-id-map.event-ledger")) - .isEqualTo("nvidia-cloud-events-ncp-service-id-ckozoh6f"); + .isEqualTo("nvidia-event-ledger-ncp-service-id-ckozoh6f"); } @Test