From 3b4e81244902b17492540982b45b56cb5a9cec45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joan=20L=C3=B3pez=20de=20la=20Franca=20Beltran?=
 <5459617+joanlopez@users.noreply.github.com>
Date: Wed, 2 Feb 2022 12:10:46 +0100
Subject: [PATCH] Encryption: Keep legacy default provider id on providers map
 (#44721)

* Encryption: Keep legacy default provider id on providers map

* Minor fixes

* Refactor
---
 pkg/services/secrets/manager/manager.go | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/pkg/services/secrets/manager/manager.go b/pkg/services/secrets/manager/manager.go
index 47b1d473ce3..14cf179537c 100644
--- a/pkg/services/secrets/manager/manager.go
+++ b/pkg/services/secrets/manager/manager.go
@@ -48,7 +48,9 @@ func ProvideSecretsService(
 
 	logger := log.New("secrets")
 	enabled := features.IsEnabled(featuremgmt.FlagEnvelopeEncryption)
-	currentProviderID := readCurrentProviderID(settings)
+	currentProviderID := normalizeProviderID(secrets.ProviderID(
+		settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
+	))
 
 	if _, ok := providers[currentProviderID]; enabled && !ok {
 		return nil, fmt.Errorf("missing configuration for current encryption provider %s", currentProviderID)
@@ -77,13 +79,12 @@ func ProvideSecretsService(
 	return s, nil
 }
 
-func readCurrentProviderID(settings setting.Provider) secrets.ProviderID {
-	currentProvider := settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default)
-	if currentProvider == kmsproviders.Legacy {
-		currentProvider = kmsproviders.Default
+func normalizeProviderID(id secrets.ProviderID) secrets.ProviderID {
+	if id == kmsproviders.Legacy {
+		return kmsproviders.Default
 	}
 
-	return secrets.ProviderID(currentProvider)
+	return id
 }
 
 func (s *SecretsService) registerUsageMetrics() {
@@ -329,7 +330,7 @@ func (s *SecretsService) dataKey(ctx context.Context, name string) ([]byte, erro
 	}
 
 	// 2. decrypt data key
-	provider, exists := s.providers[dataKey.Provider]
+	provider, exists := s.providers[normalizeProviderID(dataKey.Provider)]
 	if !exists {
 		return nil, fmt.Errorf("could not find encryption provider '%s'", dataKey.Provider)
 	}