fix (kms): Add kms.ReconcileKeys(...) to fix missing audit DEK scenario (#1711)

This fix addresses the situation where an existing boundary database
doesn't have the audit DEKs in the global scope.

internal/servers/controller/controller.go

@@ -168,6 +168,10 @@ func New(ctx context.Context, conf *Config) (*Controller, error) {
 	); err != nil {
 		return nil, fmt.Errorf("error adding config keys to kms: %w", err)
 	}
+	if err := c.kms.ReconcileKeys(ctx, c.conf.SecureRandomReader); err != nil {
+		return nil, fmt.Errorf("error reconciling kms keys: %w", err)
+	}
+
 	// now that the kms is configured, we can get the audit wrapper and rotate
 	// the eventer audit wrapper, so the emitted events can include encrypt and
 	// hmac-sha256 data

internal/servers/controller/controller_test.go

@@ -0,0 +1,34 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/stretchr/testify/require"
+)
+
+func TestController_New(t *testing.T) {
+	t.Run("ReconcileKeys", func(t *testing.T) {
+		require := require.New(t)
+		testCtx := context.Background()
+		ctx, cancel := context.WithCancel(context.Background())
+		tc := &TestController{
+			t:      t,
+			ctx:    ctx,
+			cancel: cancel,
+			opts:   nil,
+		}
+		conf := TestControllerConfig(t, ctx, tc, nil)
+
+		// this tests a scenario where there is an audit DEK
+		c, err := New(testCtx, conf)
+		require.NoError(err)
+
+		// this tests a scenario where there is NOT an audit DEK
+		require.NoError(c.conf.Server.Database.Where("1=1").Delete(kms.AllocAuditKey()).Error)
+		_, err = New(testCtx, conf)
+		require.NoError(err)
+	})
+
+}

internal/servers/controller/testing.go

@@ -406,6 +406,34 @@ func NewTestController(t *testing.T, opts *TestControllerOpts) *TestController {
 		opts:   opts,
 	}
 
+	conf := TestControllerConfig(t, ctx, tc, opts)
+	var err error
+	tc.c, err = New(ctx, conf)
+	if err != nil {
+		tc.Shutdown()
+		t.Fatal(err)
+	}
+
+	tc.buildClient()
+
+	if !opts.DisableAutoStart {
+		if err := tc.c.Start(); err != nil {
+			tc.Shutdown()
+			t.Fatal(err)
+		}
+	}
+
+	return tc
+}
+
+// TestControllerConfig provides a way to create a config for a TestController.
+// The tc passed as a parameter will be modified by this func.
+func TestControllerConfig(t *testing.T, ctx context.Context, tc *TestController, opts *TestControllerOpts) *Config {
+	const op = "controller.TestControllerConfig"
+	if opts == nil {
+		opts = new(TestControllerOpts)
+	}
+
 	// Base server
 	tc.b = base.NewServer(&base.Command{
 		Context:    ctx,
@@ -600,28 +628,11 @@ func NewTestController(t *testing.T, opts *TestControllerOpts) *TestController {
 		}
 	}
 
-	conf := &Config{
+	return &Config{
 		RawConfig:                    opts.Config,
 		Server:                       tc.b,
 		DisableAuthorizationFailures: opts.DisableAuthorizationFailures,
 	}
-
-	tc.c, err = New(ctx, conf)
-	if err != nil {
-		tc.Shutdown()
-		t.Fatal(err)
-	}
-
-	tc.buildClient()
-
-	if !opts.DisableAutoStart {
-		if err := tc.c.Start(); err != nil {
-			tc.Shutdown()
-			t.Fatal(err)
-		}
-	}
-
-	return tc
 }
 
 func (tc *TestController) AddClusterControllerMember(t *testing.T, opts *TestControllerOpts) *TestController {