rbd: add aws-sts-metdata encryption type

With Amazon STS and kubernetes cluster is configured with
OIDC identity provider, credentials to access Amazon KMS
can be fetched using oidc-token(serviceaccount token).
Each tenant/namespace needs to create a secret with aws region,
role and CMK ARN.
Ceph-CSI will assume the given role with oidc token and access
aws KMS, with given CMK to encrypt/decrypt DEK which will stored
in the image metdata.

Refer: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html
Resolves: #2879

Signed-off-by: Rakshith R <rar@redhat.com>

vendor/github.com/aws/smithy-go/encoding/httpbinding/encode.go

@@ -0,0 +1,116 @@
+package httpbinding
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+const (
+	contentLengthHeader = "Content-Length"
+	floatNaN            = "NaN"
+	floatInfinity       = "Infinity"
+	floatNegInfinity    = "-Infinity"
+)
+
+// An Encoder provides encoding of REST URI path, query, and header components
+// of an HTTP request. Can also encode a stream as the payload.
+//
+// Does not support SetFields.
+type Encoder struct {
+	path, rawPath, pathBuffer []byte
+
+	query  url.Values
+	header http.Header
+}
+
+// NewEncoder creates a new encoder from the passed in request. All query and
+// header values will be added on top of the request's existing values. Overwriting
+// duplicate values.
+func NewEncoder(path, query string, headers http.Header) (*Encoder, error) {
+	parseQuery, err := url.ParseQuery(query)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse query string: %w", err)
+	}
+
+	e := &Encoder{
+		path:    []byte(path),
+		rawPath: []byte(path),
+		query:   parseQuery,
+		header:  headers.Clone(),
+	}
+
+	return e, nil
+}
+
+// Encode returns a REST protocol encoder for encoding HTTP bindings.
+//
+// Due net/http requiring `Content-Length` to be specified on the http.Request#ContentLength directly. Encode
+// will look for whether the header is present, and if so will remove it and set the respective value on http.Request.
+//
+// Returns any error occurring during encoding.
+func (e *Encoder) Encode(req *http.Request) (*http.Request, error) {
+	req.URL.Path, req.URL.RawPath = string(e.path), string(e.rawPath)
+	req.URL.RawQuery = e.query.Encode()
+
+	// net/http ignores Content-Length header and requires it to be set on http.Request
+	if v := e.header.Get(contentLengthHeader); len(v) > 0 {
+		iv, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			return nil, err
+		}
+		req.ContentLength = iv
+		e.header.Del(contentLengthHeader)
+	}
+
+	req.Header = e.header
+
+	return req, nil
+}
+
+// AddHeader returns a HeaderValue for appending to the given header name
+func (e *Encoder) AddHeader(key string) HeaderValue {
+	return newHeaderValue(e.header, key, true)
+}
+
+// SetHeader returns a HeaderValue for setting the given header name
+func (e *Encoder) SetHeader(key string) HeaderValue {
+	return newHeaderValue(e.header, key, false)
+}
+
+// Headers returns a Header used for encoding headers with the given prefix
+func (e *Encoder) Headers(prefix string) Headers {
+	return Headers{
+		header: e.header,
+		prefix: strings.TrimSpace(prefix),
+	}
+}
+
+// HasHeader returns if a header with the key specified exists with one or
+// more value.
+func (e Encoder) HasHeader(key string) bool {
+	return len(e.header[key]) != 0
+}
+
+// SetURI returns a URIValue used for setting the given path key
+func (e *Encoder) SetURI(key string) URIValue {
+	return newURIValue(&e.path, &e.rawPath, &e.pathBuffer, key)
+}
+
+// SetQuery returns a QueryValue used for setting the given query key
+func (e *Encoder) SetQuery(key string) QueryValue {
+	return NewQueryValue(e.query, key, false)
+}
+
+// AddQuery returns a QueryValue used for appending the given query key
+func (e *Encoder) AddQuery(key string) QueryValue {
+	return NewQueryValue(e.query, key, true)
+}
+
+// HasQuery returns if a query with the key specified exists with one or
+// more values.
+func (e *Encoder) HasQuery(key string) bool {
+	return len(e.query.Get(key)) != 0
+}

vendor/github.com/aws/smithy-go/encoding/httpbinding/header.go

@@ -0,0 +1,122 @@
+package httpbinding
+
+import (
+	"encoding/base64"
+	"math"
+	"math/big"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// Headers is used to encode header keys using a provided prefix
+type Headers struct {
+	header http.Header
+	prefix string
+}
+
+// AddHeader returns a HeaderValue used to append values to prefix+key
+func (h Headers) AddHeader(key string) HeaderValue {
+	return h.newHeaderValue(key, true)
+}
+
+// SetHeader returns a HeaderValue used to set the value of prefix+key
+func (h Headers) SetHeader(key string) HeaderValue {
+	return h.newHeaderValue(key, false)
+}
+
+func (h Headers) newHeaderValue(key string, append bool) HeaderValue {
+	return newHeaderValue(h.header, h.prefix+strings.TrimSpace(key), append)
+}
+
+// HeaderValue is used to encode values to an HTTP header
+type HeaderValue struct {
+	header http.Header
+	key    string
+	append bool
+}
+
+func newHeaderValue(header http.Header, key string, append bool) HeaderValue {
+	return HeaderValue{header: header, key: strings.TrimSpace(key), append: append}
+}
+
+func (h HeaderValue) modifyHeader(value string) {
+	if h.append {
+		h.header[h.key] = append(h.header[h.key], value)
+	} else {
+		h.header[h.key] = append(h.header[h.key][:0], value)
+	}
+}
+
+// String encodes the value v as the header string value
+func (h HeaderValue) String(v string) {
+	h.modifyHeader(v)
+}
+
+// Byte encodes the value v as a query string value
+func (h HeaderValue) Byte(v int8) {
+	h.Long(int64(v))
+}
+
+// Short encodes the value v as a query string value
+func (h HeaderValue) Short(v int16) {
+	h.Long(int64(v))
+}
+
+// Integer encodes the value v as the header string value
+func (h HeaderValue) Integer(v int32) {
+	h.Long(int64(v))
+}
+
+// Long encodes the value v as the header string value
+func (h HeaderValue) Long(v int64) {
+	h.modifyHeader(strconv.FormatInt(v, 10))
+}
+
+// Boolean encodes the value v as a query string value
+func (h HeaderValue) Boolean(v bool) {
+	h.modifyHeader(strconv.FormatBool(v))
+}
+
+// Float encodes the value v as a query string value
+func (h HeaderValue) Float(v float32) {
+	h.float(float64(v), 32)
+}
+
+// Double encodes the value v as a query string value
+func (h HeaderValue) Double(v float64) {
+	h.float(v, 64)
+}
+
+func (h HeaderValue) float(v float64, bitSize int) {
+	switch {
+	case math.IsNaN(v):
+		h.String(floatNaN)
+	case math.IsInf(v, 1):
+		h.String(floatInfinity)
+	case math.IsInf(v, -1):
+		h.String(floatNegInfinity)
+	default:
+		h.modifyHeader(strconv.FormatFloat(v, 'f', -1, bitSize))
+	}
+}
+
+// BigInteger encodes the value v as a query string value
+func (h HeaderValue) BigInteger(v *big.Int) {
+	h.modifyHeader(v.String())
+}
+
+// BigDecimal encodes the value v as a query string value
+func (h HeaderValue) BigDecimal(v *big.Float) {
+	if i, accuracy := v.Int64(); accuracy == big.Exact {
+		h.Long(i)
+		return
+	}
+	h.modifyHeader(v.Text('e', -1))
+}
+
+// Blob encodes the value v as a base64 header string value
+func (h HeaderValue) Blob(v []byte) {
+	encodeToString := base64.StdEncoding.EncodeToString(v)
+	h.modifyHeader(encodeToString)
+}

vendor/github.com/aws/smithy-go/encoding/httpbinding/path_replace.go

@@ -0,0 +1,108 @@
+package httpbinding
+
+import (
+	"bytes"
+	"fmt"
+)
+
+const (
+	uriTokenStart = '{'
+	uriTokenStop  = '}'
+	uriTokenSkip  = '+'
+)
+
+func bufCap(b []byte, n int) []byte {
+	if cap(b) < n {
+		return make([]byte, 0, n)
+	}
+
+	return b[0:0]
+}
+
+// replacePathElement replaces a single element in the path []byte.
+// Escape is used to control whether the value will be escaped using Amazon path escape style.
+func replacePathElement(path, fieldBuf []byte, key, val string, escape bool) ([]byte, []byte, error) {
+	fieldBuf = bufCap(fieldBuf, len(key)+3) // { <key> [+] }
+	fieldBuf = append(fieldBuf, uriTokenStart)
+	fieldBuf = append(fieldBuf, key...)
+
+	start := bytes.Index(path, fieldBuf)
+	end := start + len(fieldBuf)
+	if start < 0 || len(path[end:]) == 0 {
+		// TODO what to do about error?
+		return path, fieldBuf, fmt.Errorf("invalid path index, start=%d,end=%d. %s", start, end, path)
+	}
+
+	encodeSep := true
+	if path[end] == uriTokenSkip {
+		// '+' token means do not escape slashes
+		encodeSep = false
+		end++
+	}
+
+	if escape {
+		val = EscapePath(val, encodeSep)
+	}
+
+	if path[end] != uriTokenStop {
+		return path, fieldBuf, fmt.Errorf("invalid path element, does not contain token stop, %s", path)
+	}
+	end++
+
+	fieldBuf = bufCap(fieldBuf, len(val))
+	fieldBuf = append(fieldBuf, val...)
+
+	keyLen := end - start
+	valLen := len(fieldBuf)
+
+	if keyLen == valLen {
+		copy(path[start:], fieldBuf)
+		return path, fieldBuf, nil
+	}
+
+	newLen := len(path) + (valLen - keyLen)
+	if len(path) < newLen {
+		path = path[:cap(path)]
+	}
+	if cap(path) < newLen {
+		newURI := make([]byte, newLen)
+		copy(newURI, path)
+		path = newURI
+	}
+
+	// shift
+	copy(path[start+valLen:], path[end:])
+	path = path[:newLen]
+	copy(path[start:], fieldBuf)
+
+	return path, fieldBuf, nil
+}
+
+// EscapePath escapes part of a URL path in Amazon style.
+func EscapePath(path string, encodeSep bool) string {
+	var buf bytes.Buffer
+	for i := 0; i < len(path); i++ {
+		c := path[i]
+		if noEscape[c] || (c == '/' && !encodeSep) {
+			buf.WriteByte(c)
+		} else {
+			fmt.Fprintf(&buf, "%%%02X", c)
+		}
+	}
+	return buf.String()
+}
+
+var noEscape [256]bool
+
+func init() {
+	for i := 0; i < len(noEscape); i++ {
+		// AWS expects every character except these to be escaped
+		noEscape[i] = (i >= 'A' && i <= 'Z') ||
+			(i >= 'a' && i <= 'z') ||
+			(i >= '0' && i <= '9') ||
+			i == '-' ||
+			i == '.' ||
+			i == '_' ||
+			i == '~'
+	}
+}

vendor/github.com/aws/smithy-go/encoding/httpbinding/query.go

@@ -0,0 +1,107 @@
+package httpbinding
+
+import (
+	"encoding/base64"
+	"math"
+	"math/big"
+	"net/url"
+	"strconv"
+)
+
+// QueryValue is used to encode query key values
+type QueryValue struct {
+	query  url.Values
+	key    string
+	append bool
+}
+
+// NewQueryValue creates a new QueryValue which enables encoding
+// a query value into the given url.Values.
+func NewQueryValue(query url.Values, key string, append bool) QueryValue {
+	return QueryValue{
+		query:  query,
+		key:    key,
+		append: append,
+	}
+}
+
+func (qv QueryValue) updateKey(value string) {
+	if qv.append {
+		qv.query.Add(qv.key, value)
+	} else {
+		qv.query.Set(qv.key, value)
+	}
+}
+
+// Blob encodes v as a base64 query string value
+func (qv QueryValue) Blob(v []byte) {
+	encodeToString := base64.StdEncoding.EncodeToString(v)
+	qv.updateKey(encodeToString)
+}
+
+// Boolean encodes v as a query string value
+func (qv QueryValue) Boolean(v bool) {
+	qv.updateKey(strconv.FormatBool(v))
+}
+
+// String encodes v as a query string value
+func (qv QueryValue) String(v string) {
+	qv.updateKey(v)
+}
+
+// Byte encodes v as a query string value
+func (qv QueryValue) Byte(v int8) {
+	qv.Long(int64(v))
+}
+
+// Short encodes v as a query string value
+func (qv QueryValue) Short(v int16) {
+	qv.Long(int64(v))
+}
+
+// Integer encodes v as a query string value
+func (qv QueryValue) Integer(v int32) {
+	qv.Long(int64(v))
+}
+
+// Long encodes v as a query string value
+func (qv QueryValue) Long(v int64) {
+	qv.updateKey(strconv.FormatInt(v, 10))
+}
+
+// Float encodes v as a query string value
+func (qv QueryValue) Float(v float32) {
+	qv.float(float64(v), 32)
+}
+
+// Double encodes v as a query string value
+func (qv QueryValue) Double(v float64) {
+	qv.float(v, 64)
+}
+
+func (qv QueryValue) float(v float64, bitSize int) {
+	switch {
+	case math.IsNaN(v):
+		qv.String(floatNaN)
+	case math.IsInf(v, 1):
+		qv.String(floatInfinity)
+	case math.IsInf(v, -1):
+		qv.String(floatNegInfinity)
+	default:
+		qv.updateKey(strconv.FormatFloat(v, 'f', -1, bitSize))
+	}
+}
+
+// BigInteger encodes v as a query string value
+func (qv QueryValue) BigInteger(v *big.Int) {
+	qv.updateKey(v.String())
+}
+
+// BigDecimal encodes v as a query string value
+func (qv QueryValue) BigDecimal(v *big.Float) {
+	if i, accuracy := v.Int64(); accuracy == big.Exact {
+		qv.Long(i)
+		return
+	}
+	qv.updateKey(v.Text('e', -1))
+}

vendor/github.com/aws/smithy-go/encoding/httpbinding/uri.go

@@ -0,0 +1,108 @@
+package httpbinding
+
+import (
+	"math"
+	"math/big"
+	"strconv"
+	"strings"
+)
+
+// URIValue is used to encode named URI parameters
+type URIValue struct {
+	path, rawPath, buffer *[]byte
+
+	key string
+}
+
+func newURIValue(path *[]byte, rawPath *[]byte, buffer *[]byte, key string) URIValue {
+	return URIValue{path: path, rawPath: rawPath, buffer: buffer, key: key}
+}
+
+func (u URIValue) modifyURI(value string) (err error) {
+	*u.path, *u.buffer, err = replacePathElement(*u.path, *u.buffer, u.key, value, false)
+	*u.rawPath, *u.buffer, err = replacePathElement(*u.rawPath, *u.buffer, u.key, value, true)
+	return err
+}
+
+// Boolean encodes v as a URI string value
+func (u URIValue) Boolean(v bool) error {
+	return u.modifyURI(strconv.FormatBool(v))
+}
+
+// String encodes v as a URI string value
+func (u URIValue) String(v string) error {
+	return u.modifyURI(v)
+}
+
+// Byte encodes v as a URI string value
+func (u URIValue) Byte(v int8) error {
+	return u.Long(int64(v))
+}
+
+// Short encodes v as a URI string value
+func (u URIValue) Short(v int16) error {
+	return u.Long(int64(v))
+}
+
+// Integer encodes v as a URI string value
+func (u URIValue) Integer(v int32) error {
+	return u.Long(int64(v))
+}
+
+// Long encodes v as a URI string value
+func (u URIValue) Long(v int64) error {
+	return u.modifyURI(strconv.FormatInt(v, 10))
+}
+
+// Float encodes v as a query string value
+func (u URIValue) Float(v float32) error {
+	return u.float(float64(v), 32)
+}
+
+// Double encodes v as a query string value
+func (u URIValue) Double(v float64) error {
+	return u.float(v, 64)
+}
+
+func (u URIValue) float(v float64, bitSize int) error {
+	switch {
+	case math.IsNaN(v):
+		return u.String(floatNaN)
+	case math.IsInf(v, 1):
+		return u.String(floatInfinity)
+	case math.IsInf(v, -1):
+		return u.String(floatNegInfinity)
+	default:
+		return u.modifyURI(strconv.FormatFloat(v, 'f', -1, bitSize))
+	}
+}
+
+// BigInteger encodes v as a query string value
+func (u URIValue) BigInteger(v *big.Int) error {
+	return u.modifyURI(v.String())
+}
+
+// BigDecimal encodes v as a query string value
+func (u URIValue) BigDecimal(v *big.Float) error {
+	if i, accuracy := v.Int64(); accuracy == big.Exact {
+		return u.Long(i)
+	}
+	return u.modifyURI(v.Text('e', -1))
+}
+
+// SplitURI parses a Smithy HTTP binding trait URI
+func SplitURI(uri string) (path, query string) {
+	queryStart := strings.IndexRune(uri, '?')
+	if queryStart == -1 {
+		path = uri
+		return path, query
+	}
+
+	path = uri[:queryStart]
+	if queryStart+1 >= len(uri) {
+		return path, query
+	}
+	query = uri[queryStart+1:]
+
+	return path, query
+}