SecretsManager: Add (en/de)cryption packages (#104923)

Merging the code as-is from the feature branch: secret-service/feature-branch

Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: Mariell Hoversholm <mariell.hoversholm@grafana.com>
Co-authored-by: Michael Mandrus <michael.mandrus@grafana.com>

pkg/setting/setting.go

@@ -558,6 +558,9 @@ type Cfg struct {
 	SprinklesApiServerPageLimit                int
 	CACertPath                                 string
 	HttpsSkipVerify                            bool
+
+	// Secrets Management
+	SecretsManagement SecretsManagerSettings
 }
 
 type UnifiedStorageConfig struct {
@@ -1367,6 +1370,7 @@ func (cfg *Cfg) parseINIFile(iniFile *ini.File) error {
 	cfg.readFeatureManagementConfig()
 	cfg.readPublicDashboardsSettings()
 	cfg.readCloudMigrationSettings()
+	cfg.readSecretsManagerSettings()
 
 	// read experimental scopes settings.
 	scopesSection := iniFile.Section("scopes")

pkg/setting/setting_secrets_manager.go

@@ -0,0 +1,37 @@
+package setting
+
+import (
+	"regexp"
+	"time"
+
+	"github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher"
+	"github.com/grafana/grafana/pkg/services/kmsproviders"
+)
+
+type EncryptionSettings struct {
+	DataKeysCacheTTL        time.Duration
+	DataKeysCleanupInterval time.Duration
+	Algorithm               string
+}
+
+type SecretsManagerSettings struct {
+	SecretKey          string
+	EncryptionProvider string
+	AvailableProviders []string
+
+	Encryption EncryptionSettings
+}
+
+func (cfg *Cfg) readSecretsManagerSettings() {
+	secretsMgmt := cfg.Raw.Section("secrets_manager")
+	cfg.SecretsManagement.EncryptionProvider = secretsMgmt.Key("encryption_provider").MustString(kmsproviders.Default)
+
+	// TODO: These are not used yet by the secrets manager because we need to distentagle the dependencies with OSS.
+	cfg.SecretsManagement.SecretKey = secretsMgmt.Key("secret_key").MustString("")
+	cfg.SecretsManagement.AvailableProviders = regexp.MustCompile(`\s*,\s*`).Split(secretsMgmt.Key("available_encryption_providers").MustString(""), -1) // parse comma separated list
+
+	encryption := cfg.Raw.Section("secrets_manager.encryption")
+	cfg.SecretsManagement.Encryption.DataKeysCacheTTL = encryption.Key("data_keys_cache_ttl").MustDuration(15 * time.Minute)
+	cfg.SecretsManagement.Encryption.DataKeysCleanupInterval = encryption.Key("data_keys_cache_cleanup_interval").MustDuration(1 * time.Minute)
+	cfg.SecretsManagement.Encryption.Algorithm = encryption.Key("algorithm").MustString(cipher.AesGcm)
+}