Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)

* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_create-create.sql

@@ -3,6 +3,7 @@ INSERT INTO `secret_encrypted_value` (
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 ) VALUES (
@@ -10,6 +11,7 @@ INSERT INTO `secret_encrypted_value` (
   'n1',
   1,
   '[115 101 99 114 101 116]',
+  'test-data-key-id',
   1234,
   5678
 );

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_list_all-list_all.sql

@@ -3,6 +3,7 @@ SELECT
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 FROM

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_list_all-list_all_until_time.sql

@@ -3,6 +3,7 @@ SELECT
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 FROM

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_list_all-list_limit_10_offset_0.sql

@@ -3,6 +3,7 @@ SELECT
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 FROM

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_list_all-list_limit_10_offset_2.sql

@@ -3,6 +3,7 @@ SELECT
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 FROM

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_read-read.sql

@@ -3,6 +3,7 @@ SELECT
   `name`,
   `version`,
   `encrypted_data`,
+  `data_key_id`,
   `created`,
   `updated`
 FROM

pkg/storage/secret/encryption/testdata/mysql--encrypted_value_update-update.sql

@@ -2,6 +2,7 @@ UPDATE
   `secret_encrypted_value`
 SET
   `encrypted_data` = '[115 101 99 114 101 116]',
+  `data_key_id` = 'test-data-key-id',
   `updated` = 5679
 WHERE 
   `namespace` = 'ns' AND

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_create-create.sql

@@ -3,6 +3,7 @@ INSERT INTO "secret_encrypted_value" (
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 ) VALUES (
@@ -10,6 +11,7 @@ INSERT INTO "secret_encrypted_value" (
   'n1',
   1,
   '[115 101 99 114 101 116]',
+  'test-data-key-id',
   1234,
   5678
 );

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_list_all-list_all.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_list_all-list_all_until_time.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_list_all-list_limit_10_offset_0.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_list_all-list_limit_10_offset_2.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_read-read.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/postgres--encrypted_value_update-update.sql

@@ -2,6 +2,7 @@ UPDATE
   "secret_encrypted_value"
 SET
   "encrypted_data" = '[115 101 99 114 101 116]',
+  "data_key_id" = 'test-data-key-id',
   "updated" = 5679
 WHERE 
   "namespace" = 'ns' AND

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_create-create.sql

@@ -3,6 +3,7 @@ INSERT INTO "secret_encrypted_value" (
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 ) VALUES (
@@ -10,6 +11,7 @@ INSERT INTO "secret_encrypted_value" (
   'n1',
   1,
   '[115 101 99 114 101 116]',
+  'test-data-key-id',
   1234,
   5678
 );

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_list_all-list_all.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_list_all-list_all_until_time.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_list_all-list_limit_10_offset_0.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_list_all-list_limit_10_offset_2.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_read-read.sql

@@ -3,6 +3,7 @@ SELECT
   "name",
   "version",
   "encrypted_data",
+  "data_key_id",
   "created",
   "updated"
 FROM

pkg/storage/secret/encryption/testdata/sqlite--encrypted_value_update-update.sql

@@ -2,6 +2,7 @@ UPDATE
   "secret_encrypted_value"
 SET
   "encrypted_data" = '[115 101 99 114 101 116]',
+  "data_key_id" = 'test-data-key-id',
   "updated" = 5679
 WHERE 
   "namespace" = 'ns' AND