Bring in safe mode support (#8478)

This PR refactors object layer handling such
that upon failure in sub-system initialization
server reaches a stage of safe-mode operation
wherein only certain API operations are enabled
and available.

This allows for fixing many scenarios such as

 - incorrect configuration in vault, etcd,
   notification targets
 - missing files, incomplete config migrations
   unable to read encrypted content etc
 - any other issues related to notification,
   policies, lifecycle etc

cmd/config/config.go

@@ -386,11 +386,6 @@ func (c Config) SetKVS(s string, defaultKVS map[string]KVS) error {
 		return Error(fmt.Sprintf("invalid number of arguments %s", s))
 	}
 
-	if subSystemValue[0] == CredentialsSubSys {
-		return Error(fmt.Sprintf("changing '%s' sub-system values is not allowed, use ENVs instead",
-			subSystemValue[0]))
-	}
-
 	if !SubSystems.Contains(subSystemValue[0]) {
 		return Error(fmt.Sprintf("unknown sub-system %s", s))
 	}

cmd/config/etcd/etcd.go

@@ -31,7 +31,7 @@ import (
 
 const (
 	// Default values used while communicating with etcd.
-	defaultDialTimeout   = 30 * time.Second
+	defaultDialTimeout   = 5 * time.Second
 	defaultDialKeepAlive = 30 * time.Second
 )
 
@@ -112,7 +112,7 @@ func LookupConfig(kv config.KVS, rootCAs *x509.CertPool) (Config, error) {
 		return cfg, config.Error("'endpoints' key cannot be empty if you wish to enable etcd")
 	}
 
-	if len(endpoints) == 0 {
+	if len(endpoints) == 0 && !stateBool {
 		return cfg, nil
 	}