Issue #3594067: Make Master KEK rotation pick up a new Vault/OpenBao Transit key version

Frank Mablyrequested to merge
issue/pdv-3594067:3594067-make-master-kek into 1.x

Implements #3594067: Master KEK rotation is now version-aware, so "Rotate to current Master KEK" also re-keys subjects left behind an in-place Vault/OpenBao Transit key rotation.

  • Version tracking: a master_key_version field on pdv_subject_key; the wrap plugin reports supportsRekey() / currentVersion() / versionOf() (Transit reads latest_version and the vault:vN: prefix; local has no versions).
  • Convergence: a subject is current only on the target id AND at its current version, so the existing rotation (and its count, UI, and "stale only" filter) now catches an in-place version bump. The version read degrades gracefully if the store is briefly unreachable.
  • Scale: the in-place re-key chunk is re-wrapped in one transit/rewrap batch_input call via a new rewrapMany() primitive, so a 100k vault re-keys in a handful of requests.
  • Report: the Vault subjects table shows each subject's key version and flags those behind (for example openbao_master (v1, behind current v2)).

Data model: one new base field; pre-release, so a field add plus fresh install, no update path. Tests: a kernel test bumps a versioned fake plugin and asserts the rotation re-keys the batch (verified to fail without the version-awareness); full suite green, phpcs + phpstan clean. Docs: the handbook rotation section. Validated live against OpenBao.

Merge request reports