Add disable_group_name_selectors option to Windows workload attestor

[jananiarunachalam]

Pull Request check list

• Commit conforms to CONTRIBUTING.md?
• Proper tests/regressions included?
• Documentation updated?

Affected functionality
Windows workload attestor group SID resolution.

Description of change
Adds a disable_group_name_selectors boolean configuration option (default: false) to the Windows workload attestor. When enabled, the attestor skips resolving group SIDs to human-readable names via LookupAccountSid, avoiding timeouts for workloads whose principals belong to many groups (~88ms per group, 44+ seconds for 500+ groups). Group SID selectors (group_sid) are always collected regardless of this setting, only group_name selectors are skipped.

Also adds debug-level timing instrumentation to the group name lookup path so operators can observe lookup latency without enabling the flag.

Which issue this PR fixes
fixes #6902

[amartinezfayo]

Thank you @jananiarunachalam for this contribution!

[amartinezfayo]

I wonder if it would help to surface in the Notes section that enabling this flag will cause existing workload registration entries using group_name selectors to stop matching, so operators know to audit those entries (or switch them to group_sid selectors) before flipping it on. As a smaller wording detail, I think that LookupAccount is not strictly a Domain Controller call in every environment (local SAM, AD DS, or other providers can answer); something like "potentially expensive account name resolution (e.g. against a Domain Controller)" might be more accurate.

[amartinezfayo]

A couple of small things on this Debug log. I don't think we have any other elapsed_ms keys already logged. I think telemetry.ElapsedTime and the duration_ms field are the closest that we have, and maybe we could use one of those?
In terms of the wording, maybe "Group account name lookups completed" might feel more familiar.

It could also be worth considering whether this is redundant with the host-level metric from telemetry_workload.StartAttestorCall, which already captures the full per-attestor Attest time and is dominated by this loop for the Windows attestor.

[jananiarunachalam]

Addressed all comments.

This debug log specifically isolates the group name resolution portion with a count, which is still useful for diagnosing whether the lookups are the bottleneck.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a configuration option to disable group name selector resolution in the Windows workload attestor to avoid potentially expensive SID-to-name lookups.

Changes:

• Introduces disable_group_name_selectors configuration flag and plumbs it through attestation.
• Skips LookupAccount for group SIDs when the flag is enabled, still producing group_sid selectors.
• Updates docs and adds a test case covering the disabled behavior and expected log message.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/agent/plugin/workloadattestor/windows/windows_windows.go	Adds config flag, conditionally skips group name lookups, logs when enabled
pkg/agent/plugin/workloadattestor/windows/windows_windows_test.go	Adds test case for selectors/logs when group name selectors are disabled
doc/plugin_agent_workloadattestor_windows.md	Documents the new configuration flag and operational impact

Comments suppressed due to low confidence (1)

pkg/agent/plugin/workloadattestor/windows/windows_windows.go:1

• start := time.Now() is executed even when disableGroupNames is true, but the timing is only used when group name lookups are enabled. Move the start initialization inside the if !disableGroupNames path (e.g., set it before running lookups / before the loop only when enabled) to avoid unnecessary work and keep the intent clearer.

//go:build windows