SecretsManager: Consolidation service and ability to run via cli (#108774)

* list all encrypted values and count

* separate interfaces

* add time filter to global queries

* initial secrets consolidation

* Revert defaults

* More verbose description of the operation

* Add consolidation tests and tracing

* Fix lint

* Revert debug log

pkg/cmd/grafana-cli/commands/commands.go

@@ -7,6 +7,7 @@ import (
 	"github.com/urfave/cli/v2"
 
 	"github.com/grafana/grafana/pkg/cmd/grafana-cli/commands/datamigrations"
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/commands/secretsconsolidation"
 	"github.com/grafana/grafana/pkg/cmd/grafana-cli/commands/secretsmigrations"
 	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
 	"github.com/grafana/grafana/pkg/cmd/grafana-cli/utils"
@@ -184,6 +185,17 @@ var adminCommands = []*cli.Command{
 			},
 		},
 	},
+	{
+		Name:  "secrets-consolidation",
+		Usage: "Runs an operation that re-encrypts all encrypted values in your database with new data keys",
+		Subcommands: []*cli.Command{
+			{
+				Name:   "consolidate",
+				Usage:  "Re-encrypts all encrypted values with new data keys and deletes the old deactivated data keys. Returns ok unless there is an error. Safe to execute multiple times.",
+				Action: runRunnerCommand(secretsconsolidation.ConsolidateSecrets),
+			},
+		},
+	},
 }
 
 var Commands = []*cli.Command{

pkg/cmd/grafana-cli/commands/secretsconsolidation/secretsconsolidation.go

@@ -0,0 +1,13 @@
+package secretsconsolidation
+
+import (
+	"context"
+
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/utils"
+	"github.com/grafana/grafana/pkg/server"
+)
+
+func ConsolidateSecrets(_ utils.CommandLine, runner server.Runner) error {
+	err := runner.SecretsConsolidationService.Consolidate(context.Background())
+	return err
+}