kms: add support for MinKMS and remove some unused/broken code (#19368)

This commit adds support for MinKMS. Now, there are three KMS implementations in `internal/kms`: Builtin, MinIO KES and MinIO KMS. Adding another KMS integration required some cleanup. In particular: - Various KMS APIs that haven't been and are not used have been removed. A lot of the code was broken anyway. - Metrics are now monitored by the `kms.KMS` itself. For basic metrics this is simpler than collecting metrics for external servers. In particular, each KES server returns its own metrics and no cluster-level view. - The builtin KMS now uses the same en/decryption implemented by MinKMS and KES. It still supports decryption of the previous ciphertext format. It's backwards compatible. - Data encryption keys now include a master key version since MinKMS supports multiple versions (~4 billion in total and 10000 concurrent) per key name. Signed-off-by: Andreas Auernhammer <github@aead.dev>
2025-11-07 12:52:58 -05:00 · 2024-05-08 01:55:37 +02:00
parent 981497799a
commit 8b660e18f2
36 changed files with 1794 additions and 1808 deletions
--- a/internal/kms/config_test.go
+++ b/internal/kms/config_test.go
@@ -0,0 +1,105 @@
+// Copyright (c) 2015-2024 MinIO, Inc.
+//
+// # This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package kms
+
+import (
+	"os"
+	"testing"
+)
+
+func TestIsPresent(t *testing.T) {
+	for i, test := range isPresentTests {
+		os.Clearenv()
+		for k, v := range test.Env {
+			os.Setenv(k, v)
+		}
+
+		ok, err := IsPresent()
+		if err != nil && !test.ShouldFail {
+			t.Fatalf("Test %d: %v", i, err)
+		}
+		if err == nil && test.ShouldFail {
+			t.Fatalf("Test %d: should have failed but succeeded", i)
+		}
+
+		if !test.ShouldFail && ok != test.IsPresent {
+			t.Fatalf("Test %d: reported that KMS present=%v - want present=%v", i, ok, test.IsPresent)
+		}
+	}
+}
+
+var isPresentTests = []struct {
+	Env        map[string]string
+	IsPresent  bool
+	ShouldFail bool
+}{
+	{Env: map[string]string{}}, // 0
+	{ // 1
+		Env: map[string]string{
+			EnvKMSSecretKey: "minioy-default-key:6jEQjjMh8iPq8/gqgb4eMDIZFOtPACIsr9kO+vx8JFs=",
+		},
+		IsPresent: true,
+	},
+	{ // 2
+		Env: map[string]string{
+			EnvKMSEndpoint:   "https://127.0.0.1:7373",
+			EnvKMSDefaultKey: "minio-key",
+			EnvKMSEnclave:    "demo",
+			EnvKMSAPIKey:     "k1:MBDtmC9ZAf3Wi4-oGglgKx_6T1jwJfct1IC15HOxetg",
+		},
+		IsPresent: true,
+	},
+	{ // 3
+		Env: map[string]string{
+			EnvKESEndpoint:   "https://127.0.0.1:7373",
+			EnvKESDefaultKey: "minio-key",
+			EnvKESAPIKey:     "kes:v1:AGtR4PvKXNjz+/MlBX2Djg0qxwS3C4OjoDzsuFSQr82e",
+		},
+		IsPresent: true,
+	},
+	{ // 4
+		Env: map[string]string{
+			EnvKESEndpoint:   "https://127.0.0.1:7373",
+			EnvKESDefaultKey: "minio-key",
+			EnvKESClientKey:  "/tmp/client.key",
+			EnvKESClientCert: "/tmp/client.crt",
+		},
+		IsPresent: true,
+	},
+	{ // 5
+		Env: map[string]string{
+			EnvKMSEndpoint: "https://127.0.0.1:7373",
+			EnvKESEndpoint: "https://127.0.0.1:7373",
+		},
+		ShouldFail: true,
+	},
+	{ // 6
+		Env: map[string]string{
+			EnvKMSEndpoint:  "https://127.0.0.1:7373",
+			EnvKMSSecretKey: "minioy-default-key:6jEQjjMh8iPq8/gqgb4eMDIZFOtPACIsr9kO+vx8JFs=",
+		},
+		ShouldFail: true,
+	},
+	{ // 7
+		Env: map[string]string{
+			EnvKMSEnclave:  "foo",
+			EnvKESServerCA: "/etc/minio/certs",
+		},
+		ShouldFail: true,
+	},
+}