Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)

* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations

pkg/registry/apis/secret/contracts/encryption.go

@@ -1,6 +1,10 @@
 package contracts
 
-import "context"
+import (
+	"context"
+
+	"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
+)
 
 // EncryptionManager is an envelope encryption service in charge of encrypting/decrypting secrets.
 type EncryptionManager interface {
@@ -8,17 +12,23 @@ type EncryptionManager interface {
 	// For those specific use cases where the encryption operation cannot be moved outside
 	// the database transaction, look at database-specific methods present at the specific
 	// implementation present at manager.EncryptionService.
-	Encrypt(ctx context.Context, namespace string, payload []byte) ([]byte, error)
-	Decrypt(ctx context.Context, namespace string, payload []byte) ([]byte, error)
+	Encrypt(ctx context.Context, namespace xkube.Namespace, payload []byte) (EncryptedPayload, error)
+	Decrypt(ctx context.Context, namespace xkube.Namespace, payload EncryptedPayload) ([]byte, error)
+}
+
+type EncryptedPayload struct {
+	DataKeyID     string
+	EncryptedData []byte
 }
 
 type EncryptedValue struct {
-	Namespace     string
-	Name          string
-	Version       int64
-	EncryptedData []byte
-	Created       int64
-	Updated       int64
+	EncryptedPayload
+
+	Namespace string
+	Name      string
+	Version   int64
+	Created   int64
+	Updated   int64
 }
 
 // ListOpts defines pagination options for listing encrypted values.
@@ -28,10 +38,10 @@ type ListOpts struct {
 }
 
 type EncryptedValueStorage interface {
-	Create(ctx context.Context, namespace, name string, version int64, encryptedData []byte) (*EncryptedValue, error)
-	Update(ctx context.Context, namespace, name string, version int64, encryptedData []byte) error
-	Get(ctx context.Context, namespace, name string, version int64) (*EncryptedValue, error)
-	Delete(ctx context.Context, namespace, name string, version int64) error
+	Create(ctx context.Context, namespace xkube.Namespace, name string, version int64, encryptedData EncryptedPayload) (*EncryptedValue, error)
+	Update(ctx context.Context, namespace xkube.Namespace, name string, version int64, encryptedData EncryptedPayload) error
+	Get(ctx context.Context, namespace xkube.Namespace, name string, version int64) (*EncryptedValue, error)
+	Delete(ctx context.Context, namespace xkube.Namespace, name string, version int64) error
 }
 
 type GlobalEncryptedValueStorage interface {
@@ -39,6 +49,10 @@ type GlobalEncryptedValueStorage interface {
 	CountAll(ctx context.Context, untilTime *int64) (int64, error)
 }
 
+type EncryptedValueMigrationExecutor interface {
+	Execute(ctx context.Context) (int, error)
+}
+
 type ConsolidationService interface {
 	Consolidate(ctx context.Context) error
 }