kms: add support for MinKMS and remove some unused/broken code (#19368)

This commit adds support for MinKMS. Now, there are three KMS
implementations in `internal/kms`: Builtin, MinIO KES and MinIO KMS.

Adding another KMS integration required some cleanup. In particular:
 - Various KMS APIs that haven't been and are not used have been
   removed. A lot of the code was broken anyway.
 - Metrics are now monitored by the `kms.KMS` itself. For basic
   metrics this is simpler than collecting metrics for external
   servers. In particular, each KES server returns its own metrics
   and no cluster-level view.
 - The builtin KMS now uses the same en/decryption implemented by
   MinKMS and KES. It still supports decryption of the previous
   ciphertext format. It's backwards compatible.
 - Data encryption keys now include a master key version since MinKMS
   supports multiple versions (~4 billion in total and 10000 concurrent)
   per key name.

Signed-off-by: Andreas Auernhammer <github@aead.dev>

internal/kms/errors.go

@@ -17,13 +17,112 @@
 
 package kms
 
-// Error encapsulates S3 API error response fields.
+import (
+	"fmt"
+	"net/http"
+)
+
+var (
+	// ErrPermission is an error returned by the KMS when it has not
+	// enough permissions to perform the operation.
+	ErrPermission = Error{
+		Code:    http.StatusForbidden,
+		APICode: "kms:NotAuthorized",
+		Err:     "insufficient permissions to perform KMS operation",
+	}
+
+	// ErrKeyExists is an error returned by the KMS when trying to
+	// create a key that already exists.
+	ErrKeyExists = Error{
+		Code:    http.StatusConflict,
+		APICode: "kms:KeyAlreadyExists",
+		Err:     "key with given key ID already exits",
+	}
+
+	// ErrKeyNotFound is an error returned by the KMS when trying to
+	// use a key that does not exist.
+	ErrKeyNotFound = Error{
+		Code:    http.StatusNotFound,
+		APICode: "kms:KeyNotFound",
+		Err:     "key with given key ID does not exit",
+	}
+
+	// ErrDecrypt is an error returned by the KMS when the decryption
+	// of a ciphertext failed.
+	ErrDecrypt = Error{
+		Code:    http.StatusBadRequest,
+		APICode: "kms:InvalidCiphertextException",
+		Err:     "failed to decrypt ciphertext",
+	}
+
+	// ErrNotSupported is an error returned by the KMS when the requested
+	// functionality is not supported by the KMS service.
+	ErrNotSupported = Error{
+		Code:    http.StatusNotImplemented,
+		APICode: "kms:NotSupported",
+		Err:     "requested functionality is not supported",
+	}
+)
+
+// Error is a KMS error that can be translated into an S3 API error.
+//
+// It does not implement the standard error Unwrap interface for
+// better error log messages.
 type Error struct {
-	Err            error
-	APICode        string
-	HTTPStatusCode int
+	Code    int    // The HTTP status code returned to the client
+	APICode string // The API error code identifying the error
+	Err     string // The error message returned to the client
+	Cause   error  // Optional, lower level error cause.
 }
 
 func (e Error) Error() string {
-	return e.Err.Error()
+	if e.Cause == nil {
+		return e.Err
+	}
+	return fmt.Sprintf("%s: %v", e.Err, e.Cause)
+}
+
+func errKeyCreationFailed(err error) Error {
+	return Error{
+		Code:    http.StatusInternalServerError,
+		APICode: "kms:KeyCreationFailed",
+		Err:     "failed to create KMS key",
+		Cause:   err,
+	}
+}
+
+func errKeyDeletionFailed(err error) Error {
+	return Error{
+		Code:    http.StatusInternalServerError,
+		APICode: "kms:KeyDeletionFailed",
+		Err:     "failed to delete KMS key",
+		Cause:   err,
+	}
+}
+
+func errListingKeysFailed(err error) Error {
+	return Error{
+		Code:    http.StatusInternalServerError,
+		APICode: "kms:KeyListingFailed",
+		Err:     "failed to list keys at the KMS",
+		Cause:   err,
+	}
+}
+
+func errKeyGenerationFailed(err error) Error {
+	return Error{
+		Code:    http.StatusInternalServerError,
+		APICode: "kms:KeyGenerationFailed",
+		Err:     "failed to generate data key with KMS key",
+		Cause:   err,
+	}
+}
+
+func errDecryptionFailed(err error) Error {
+	return Error{
+		Code:    http.StatusInternalServerError,
+		APICode: "kms:DecryptionFailed",
+		Err:     "failed to decrypt ciphertext with KMS key",
+		Cause:   err,
+	}
 }