Maintain KES-compatible external KMS support, including OpenBao

[bagutzu]

I would like to be able to continue to have the KES feature provided in MinIO by https://github.com/minio/kes

The repo is deprecated, but the API is intact and a similar approach to the main repo could be taken.

I have tested this and it works pretty well with OpenBAO.

If needed I can provide support + hardware for forking, testing, etc.

I already tested it via the operator and it still works perfectly.

[Vonng]

20260903 release inventory update: this remains an enhancement request and is not closed by the SSE-C authentication fixes in the server release.

The existing KES-compatible integration is preserved, but RELEASE.2026-09-03 does not create or publish a maintained KES fork, add an OpenBao support guarantee, or change the operator integration. Those are separate component ownership, compatibility, test-matrix, and release-chain decisions.

Keeping this open for a focused proposal; the offered OpenBao test support and hardware would be useful when that work is scoped.