Initiative: Key Health Dashboard

[isanmaz]

Problem Statement

Customers have no visibility into the health of their key hierarchy on a normal day. They cannot see whether their L1 provider is reachable, which services are connected, when keys were last rotated, or whether any key is in a degraded state — until something breaks.

Business Context

Operational visibility is a baseline requirement for any production system managing critical security infrastructure. Security administrators need a single view of their key estate every day — not just during incidents. Without this, OpenKCM is a black box and customers cannot confidently rely on it for production workloads.

Scope

In scope:

• Key hierarchy status per namespace: L1 connection status (reachable / unreachable), L2/L3 state, last rotation time, next rotation time
• Active KMIP connections per service — which services are currently connected and which L3 key they are using
• Alerting for key events: L1 provider unreachable, key approaching cryptoperiod end, rotation failed
• Role-scoped visibility: Key Admin sees all namespaces, Namespace Encryption Admin sees their namespace only

Out of scope:

• Key usage metrics and analytics (future)
• Multi-region aggregated view (separate initiative)

Acceptance Criteria

• Dashboard shows real-time L1 provider connection status (reachable / unreachable / degraded)
• Dashboard shows state of all L2 and L3 keys: active, suspended, approaching expiry
• Dashboard shows which services are connected via KMIP and which L3 key each service is using
• Customer can configure alerts for: L1 unreachable for > N minutes, key within N days of cryptoperiod end, rotation failure
• Dashboard is scoped per role — cross-namespace visibility only for Key Admin

Success Metrics

• Mean time to detect a key connectivity issue reduced to < 5 minutes with alerting configured
• Zero surprise key expirations for customers with alerting enabled