Encryption: Refine secrets-related commands (#45201) (#45790)

* CLI: Adjust 're-encrypt-data-keys' command

* CLI: Adjust 're-encrypt' command

* Multiple improvements on re-encrypt secrets migration

* Another bunch of code improvements

* Lint fixes

(cherry picked from commit e6a85826e9)

Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>

pkg/services/kmsproviders/kmsproviders.go

@@ -17,3 +17,11 @@ const (
 type Service interface {
 	Provide() (map[secrets.ProviderID]secrets.Provider, error)
 }
+
+func NormalizeProviderID(id secrets.ProviderID) secrets.ProviderID {
+	if id == Legacy {
+		return Default
+	}
+
+	return id
+}

pkg/services/secrets/database/database.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/services/kmsproviders"
 	"github.com/grafana/grafana/pkg/services/secrets"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"xorm.io/xorm"
@@ -100,26 +101,50 @@ func (ss *SecretsStoreImpl) ReEncryptDataKeys(
 		}
 
 		for _, k := range keys {
-			provider, ok := providers[k.Provider]
+			provider, ok := providers[kmsproviders.NormalizeProviderID(k.Provider)]
 			if !ok {
-				return fmt.Errorf("could not find encryption provider '%s'", k.Provider)
+				ss.log.Warn(
+					"Could not find provider to re-encrypt data encryption key",
+					"key_id", k.Name,
+					"provider", k.Provider,
+				)
+				continue
 			}
 
 			decrypted, err := provider.Decrypt(ctx, k.EncryptedData)
 			if err != nil {
-				return err
+				ss.log.Warn(
+					"Error while decrypting data encryption key to re-encrypt it",
+					"key_id", k.Name,
+					"provider", k.Provider,
+					"err", err,
+				)
+				continue
 			}
 
 			// Updating current data key by re-encrypting it with current provider.
 			// Accessing the current provider within providers map should be safe.
 			k.Provider = currProvider
+			k.Updated = time.Now()
 			k.EncryptedData, err = providers[currProvider].Encrypt(ctx, decrypted)
 			if err != nil {
-				return err
+				ss.log.Warn(
+					"Error while re-encrypting data encryption key",
+					"key_id", k.Name,
+					"provider", k.Provider,
+					"err", err,
+				)
+				continue
 			}
 
 			if _, err := sess.Table(dataKeysTable).Where("name = ?", k.Name).Update(k); err != nil {
-				return err
+				ss.log.Warn(
+					"Error while re-encrypting data encryption key",
+					"key_id", k.Name,
+					"provider", k.Provider,
+					"err", err,
+				)
+				continue
 			}
 		}
 

pkg/services/secrets/manager/manager.go

@@ -48,7 +48,7 @@ func ProvideSecretsService(
 
 	logger := log.New("secrets")
 	enabled := features.IsEnabled(featuremgmt.FlagEnvelopeEncryption)
-	currentProviderID := normalizeProviderID(secrets.ProviderID(
+	currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID(
 		settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
 	))
 
@@ -79,14 +79,6 @@ func ProvideSecretsService(
 	return s, nil
 }
 
-func normalizeProviderID(id secrets.ProviderID) secrets.ProviderID {
-	if id == kmsproviders.Legacy {
-		return kmsproviders.Default
-	}
-
-	return id
-}
-
 func (s *SecretsService) registerUsageMetrics() {
 	s.usageStats.RegisterMetricsFunc(func(context.Context) (map[string]interface{}, error) {
 		usageMetrics := make(map[string]interface{})
@@ -330,7 +322,7 @@ func (s *SecretsService) dataKey(ctx context.Context, name string) ([]byte, erro
 	}
 
 	// 2. decrypt data key
-	provider, exists := s.providers[normalizeProviderID(dataKey.Provider)]
+	provider, exists := s.providers[kmsproviders.NormalizeProviderID(dataKey.Provider)]
 	if !exists {
 		return nil, fmt.Errorf("could not find encryption provider '%s'", dataKey.Provider)
 	}