CLDSRV-1057: move the D1 epic to Arsenal 8.7.0

.github/workflows/tests.yaml

@@ -912,7 +912,7 @@ jobs:
         if: always()
 
   kmip-cluster-ft-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build
     env:
       S3BACKEND: file
@@ -1007,7 +1007,7 @@ jobs:
       }}${{
         matrix.opts.globalEncryptionEnabled && '-global' || ''
       }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build
     env:
       S3BACKEND: file

lib/kms/wrapper.js

@@ -123,7 +123,7 @@ function getClientForKey(key, log) {
         // if type was extracted, it is a scality arnPrefix, it needs validation
         // might throw if arn malformed or backend not available
         // for any request (PUT or GET)
-        const error = validateKeyDetail(detail, availableBackends);
+        const error = validateKeyDetail(detail, availableBackends, key);
         if (error) {
             log.error('KMS key arn is invalid', { key, detail, availableBackends });
             return { error };
@@ -253,7 +253,7 @@ class KMS {
                 // otherwise prepend the current KMS client arnPrefix
                 if (isScalityKmsArn(configuredMasterKeyId)) {
                     const detail = extractDetailFromArn(configuredMasterKeyId);
-                    const error = validateKeyDetail(detail, availableBackends);
+                    const error = validateKeyDetail(detail, availableBackends, configuredMasterKeyId);
                     if (error) {
                         return cb(error);
                     }

package.json

@@ -33,7 +33,7 @@
         "@opentelemetry/instrumentation-http": "~0.222.0",
         "@opentelemetry/instrumentation-ioredis": "~0.70.0",
         "@opentelemetry/instrumentation-mongodb": "~0.75.0",
-        "@scality/arsenal": "8.6.0-preview.5",
+        "@scality/arsenal": "8.7.0",
         "@scality/bucketclient": "scality/bucketclient#8.3.0",
         "@scality/cloudserverclient": "1.0.13",
         "@scality/scubaclient": "1.2.1",

tests/unit/encryption/kms.js

@@ -48,6 +48,37 @@ describe('KMS unit tests', () => {
         });
     });
 
+    describe('with a key of a KMS that is not configured', () => {
+        const keyArn = 'arn:scality:kms:external:kmip:unconfigured:key/1';
+
+        function assertRefusedNamingOnlyTheKey(err) {
+            assert.strictEqual(err.is.InvalidArgument, true);
+            assert.strictEqual(
+                err.description,
+                `KMS Scality KeyArn "${keyArn}" doesn't match any configured providers`,
+            );
+        }
+
+        it('should refuse it on bucket encryption', done => {
+            const sseConfig = parseBucketEncryptionHeaders({
+                'x-amz-scal-server-side-encryption': 'aws:kms',
+                'x-amz-scal-server-side-encryption-aws-kms-key-id': keyArn,
+            });
+            KMS.bucketLevelEncryption(dummyBucket, sseConfig, log, err => {
+                assertRefusedNamingOnlyTheKey(err);
+                done();
+            });
+        });
+
+        it('should refuse it on object encryption', done => {
+            const sseInfo = { algorithm: 'aws:kms', cryptoScheme: 1, mandatory: true, masterKeyId: keyArn };
+            KMS.createCipherBundle(sseInfo, log, err => {
+                assertRefusedNamingOnlyTheKey(err);
+                done();
+            });
+        });
+    });
+
     it(
         'should not construct a sse info object if ' +
             'x-amz-scal-server-side-encryption header contains invalid algorithm option',