Encryption: Add support for data keys re-encryption (#43548) (#44814)

* Encryption: Add support for data keys re-encryption

* Add tests for data keys re-encryption

* Update code after refactorings

Co-authored-by: Leonard Gram <leo@xlson.com>
(cherry picked from commit b2655750e8)

Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>

pkg/cmd/grafana-cli/commands/commands.go

@@ -188,6 +188,11 @@ var adminCommands = []*cli.Command{
 				Usage:  "Rolls back secrets to legacy encryption. Returns ok unless there is an error. Safe to execute multiple times.",
 				Action: runRunnerCommand(secretsmigrations.RollBackSecrets),
 			},
+			{
+				Name:   "re-encrypt-data-keys",
+				Usage:  "Rotates persisted data encryption keys. Returns ok unless there is an error. Safe to execute multiple times.",
+				Action: runRunnerCommand(secretsmigrations.ReEncryptDEKS),
+			},
 		},
 	},
 }

pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_deks.go

@@ -0,0 +1,19 @@
+package secretsmigrations
+
+import (
+	"context"
+
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/runner"
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/utils"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+)
+
+func ReEncryptDEKS(_ utils.CommandLine, runner runner.Runner) error {
+	if !runner.Features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
+		logger.Warn("Envelope encryption is not enabled, quitting...")
+		return nil
+	}
+
+	return runner.SecretsService.ReEncryptDataKeys(context.Background())
+}