refactor: route admin kms manager through app context (#3781)

rustfs/src/admin/handlers/kms_dynamic.rs

@@ -17,7 +17,9 @@
 use super::super::{read_admin_config, save_admin_config};
 use crate::admin::auth::validate_admin_request;
 use crate::admin::router::{AdminOperation, Operation, S3Router};
-use crate::app::context::{resolve_kms_runtime_service_manager, resolve_object_store_handle};
+use crate::app::context::{
+    resolve_kms_runtime_service_manager, resolve_object_store_handle, resolve_or_init_kms_runtime_service_manager,
+};
 use crate::auth::{check_key_valid, get_session_token};
 use crate::server::{ADMIN_PREFIX, RemoteAddr};
 use hyper::{Method, StatusCode};
@@ -46,7 +48,7 @@ fn kms_service_manager_from_context() -> std::sync::Arc<rustfs_kms::KmsServiceMa
             result = "service_manager_fallback_initialized",
             "admin kms dynamic state"
         );
-        rustfs_kms::init_global_kms_service_manager()
+        resolve_or_init_kms_runtime_service_manager()
     })
 }
 

rustfs/src/admin/handlers/kms_keys.rs

@@ -16,14 +16,14 @@
 
 use crate::admin::auth::validate_admin_request;
 use crate::admin::router::{AdminOperation, Operation, S3Router};
-use crate::app::context::resolve_kms_runtime_service_manager;
+use crate::app::context::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
 use crate::auth::{check_key_valid, get_session_token};
 use crate::server::{ADMIN_PREFIX, RemoteAddr};
 use base64::Engine;
 use hyper::{HeaderMap, Method, StatusCode};
 use matchit::Params;
 use rustfs_config::MAX_ADMIN_REQUEST_BODY_SIZE;
-use rustfs_kms::{KmsError, init_global_kms_service_manager, types::*};
+use rustfs_kms::{KmsError, types::*};
 use rustfs_policy::policy::action::{Action, KmsAction};
 use s3s::header::CONTENT_TYPE;
 use s3s::{Body, S3Request, S3Response, S3Result, s3_error};
@@ -121,7 +121,7 @@ fn kms_service_manager_from_context() -> Option<std::sync::Arc<rustfs_kms::KmsSe
 }
 
 async fn kms_encryption_service_from_context() -> Option<std::sync::Arc<rustfs_kms::ObjectEncryptionService>> {
-    let manager = kms_service_manager_from_context().unwrap_or_else(init_global_kms_service_manager);
+    let manager = resolve_or_init_kms_runtime_service_manager();
     manager.get_encryption_service().await
 }
 

rustfs/src/admin/handlers/kms_management.rs

@@ -17,12 +17,12 @@
 use super::kms_keys::{CreateKeyHandler, DescribeKeyHandler, GenerateDataKeyHandler, ListKeysHandler};
 use crate::admin::auth::validate_admin_request;
 use crate::admin::router::{AdminOperation, Operation, S3Router};
-use crate::app::context::resolve_kms_runtime_service_manager;
+use crate::app::context::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
 use crate::auth::{check_key_valid, get_session_token};
 use crate::server::{ADMIN_PREFIX, RemoteAddr};
 use hyper::{HeaderMap, Method, StatusCode};
 use matchit::Params;
-use rustfs_kms::{KmsBackend, init_global_kms_service_manager};
+use rustfs_kms::KmsBackend;
 use rustfs_policy::policy::action::{Action, KmsAction};
 use s3s::header::CONTENT_TYPE;
 use s3s::{Body, S3Request, S3Response, S3Result, s3_error};
@@ -39,7 +39,7 @@ fn kms_service_manager_from_context() -> std::sync::Arc<rustfs_kms::KmsServiceMa
         Some(manager) => manager,
         None => {
             warn!("KMS service manager not initialized, initializing now as fallback");
-            init_global_kms_service_manager()
+            resolve_or_init_kms_runtime_service_manager()
         }
     }
 }

rustfs/src/app/context.rs

@@ -37,7 +37,7 @@ use crate::config::RustFSBufferConfig;
 use rustfs_config::server_config::Config;
 use rustfs_credentials::Credentials;
 use rustfs_iam::{store::object::ObjectStore, sys::IamSys};
-use rustfs_kms::KmsServiceManager;
+use rustfs_kms::{KmsServiceManager, init_global_kms_service_manager};
 use rustfs_lock::LockClient;
 use rustfs_tls_runtime::{GlobalPublishedOutboundTlsState, TlsGeneration};
 use std::{future::Future, sync::Arc, time::SystemTime};
@@ -48,6 +48,11 @@ pub fn resolve_kms_runtime_service_manager() -> Option<Arc<KmsServiceManager>> {
     resolve_kms_runtime_service_manager_with(get_global_app_context(), || default_kms_runtime_interface().service_manager())
 }
 
+/// Resolve or initialize the KMS runtime service manager using AppContext-first precedence.
+pub fn resolve_or_init_kms_runtime_service_manager() -> Arc<KmsServiceManager> {
+    resolve_or_init_kms_runtime_service_manager_with(get_global_app_context(), init_global_kms_service_manager)
+}
+
 /// Resolve outbound TLS generation using AppContext-first precedence.
 pub fn resolve_outbound_tls_generation() -> TlsGeneration {
     resolve_outbound_tls_generation_with(get_global_app_context(), || default_outbound_tls_runtime_interface().generation())
@@ -188,6 +193,15 @@ fn resolve_kms_runtime_service_manager_with(
         .or_else(fallback)
 }
 
+fn resolve_or_init_kms_runtime_service_manager_with(
+    context: Option<Arc<AppContext>>,
+    fallback: impl FnOnce() -> Arc<KmsServiceManager>,
+) -> Arc<KmsServiceManager> {
+    context
+        .and_then(|context| context.kms_runtime().service_manager())
+        .unwrap_or_else(fallback)
+}
+
 fn resolve_outbound_tls_generation_with(
     context: Option<Arc<AppContext>>,
     fallback: impl FnOnce() -> TlsGeneration,
@@ -753,6 +767,10 @@ mod tests {
                 .expect("context KMS runtime"),
             &context_kms
         ));
+        assert!(Arc::ptr_eq(
+            &resolve_or_init_kms_runtime_service_manager_with(Some(context.clone()), || fallback_kms.clone()),
+            &context_kms
+        ));
         assert_eq!(
             resolve_outbound_tls_generation_with(Some(context.clone()), || TlsGeneration(99)),
             context_outbound_tls_state.generation
@@ -838,6 +856,10 @@ mod tests {
             &resolve_kms_runtime_service_manager_with(None, || Some(fallback_kms.clone())).expect("fallback KMS runtime"),
             &fallback_kms
         ));
+        assert!(Arc::ptr_eq(
+            &resolve_or_init_kms_runtime_service_manager_with(None, || fallback_kms.clone()),
+            &fallback_kms
+        ));
         assert_eq!(resolve_outbound_tls_generation_with(None, || TlsGeneration(99)), TlsGeneration(99));
         assert!(!resolve_iam_ready_with(None, || false));
         assert!(resolve_iam_handle_with(None, || None).is_none());