Skip to content

[Client encryption]: Initialize CosmosDataEncryptionKeyProvider without making a backend call #5400

@juraj-blazek

Description

@juraj-blazek

Is your feature request related to a problem? Please describe.
Currently, the CosmosDataEncryptionKeyProvider needs to be initialized by calling InitializeAsync() method, which tries to create the specified container if it does not exist and initializes its reference. It also validates proper partition key setting.
This is a problem for high-scale services when many instances start in parallel, because the request is a metadata request with limited throughput on the account level. Additionally, this makes the startup vulnerable to temporary DB outages.
Services usually provision resources independently ahead of time, with the proper configuration, so this all is not be necessary.

Describe the solution you'd like
The CosmosDataEncryptionKeyProvider ultimately needs a reference to the container to work properly, and the services already have it available during initialization. Add Initialize(Container) overload method as an alternative initialization method that will not make any backend calls.

Describe alternatives you've considered
We considered deferring the initialization of DEK provider to a later stage, but that only mitigates the potential startup failure during DB outage. It still eats from the quota and causes throttling. The workaround would be also not elegant, implementation-wise.

Additional context
We'll prepare proposal for this change as part of the broader optimizations effort.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions