Secrets: Refactor data_key_id out of the encoded secure value payload (#112077)

* Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)

* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations

* only run the migration as an MT api server

* formatting issues

* change detection of secrets running as MT server

* add todo

* use more specific initializer flags

* make secrets playwright tests work

* set new properties to true by default

* remove developer mode flag

* fix unit tests

pkg/setting/setting_secrets_manager.go

@@ -35,8 +35,13 @@ type SecretsManagerSettings struct {
 	GCWorkerPollInterval time.Duration
 	// How long to wait for the process to clean up a secure value to complete.
 	GCWorkerPerSecureValueCleanupTimeout time.Duration
-	// Whether the secrets management is running in developer mode.
-	IsDeveloperMode bool
+
+	// Whether to register the MT CRUD API
+	RegisterAPIServer bool
+	// Whether to create the MT secrets management database
+	RunSecretsDBMigrations bool
+	// Whether to run the data key id migration. Requires that RunSecretsDBMigrations is also true.
+	RunDataKeyMigration bool
 }
 
 func (cfg *Cfg) readSecretsManagerSettings() {
@@ -57,7 +62,9 @@ func (cfg *Cfg) readSecretsManagerSettings() {
 	cfg.SecretsManagement.GCWorkerPollInterval = secretsMgmt.Key("gc_worker_poll_interval").MustDuration(1 * time.Minute)
 	cfg.SecretsManagement.GCWorkerPerSecureValueCleanupTimeout = secretsMgmt.Key("gc_worker_per_request_timeout").MustDuration(5 * time.Second)
 
-	cfg.SecretsManagement.IsDeveloperMode = secretsMgmt.Key("developer_mode").MustBool(false)
+	cfg.SecretsManagement.RegisterAPIServer = secretsMgmt.Key("register_api_server").MustBool(true)
+	cfg.SecretsManagement.RunSecretsDBMigrations = secretsMgmt.Key("run_secrets_db_migrations").MustBool(true)
+	cfg.SecretsManagement.RunDataKeyMigration = secretsMgmt.Key("run_data_key_migration").MustBool(true)
 
 	// Extract available KMS providers from configuration sections
 	providers := make(map[string]map[string]string)

pkg/setting/setting_secrets_manager_test.go

@@ -171,18 +171,18 @@ domain = example.com
 		assert.Empty(t, cfg.SecretsManagement.ConfiguredKMSProviders)
 	})
 
-	t.Run("should handle configuration with developer mode on", func(t *testing.T) {
+	t.Run("should handle configuration with register_api_server disabled", func(t *testing.T) {
 		iniContent := `
 [secrets_manager]
-developer_mode = true
+register_api_server = false
 `
 		cfg, err := NewCfgFromBytes([]byte(iniContent))
 		require.NoError(t, err)
 
-		assert.True(t, cfg.SecretsManagement.IsDeveloperMode)
+		assert.False(t, cfg.SecretsManagement.RegisterAPIServer)
 	})
 
-	t.Run("should handle configuration without developer mode set", func(t *testing.T) {
+	t.Run("should handle configuration without register_api_server set", func(t *testing.T) {
 		iniContent := `
 [secrets_manager]
 encryption_provider = aws_kms
@@ -190,6 +190,50 @@ encryption_provider = aws_kms
 		cfg, err := NewCfgFromBytes([]byte(iniContent))
 		require.NoError(t, err)
 
-		assert.False(t, cfg.SecretsManagement.IsDeveloperMode)
+		assert.True(t, cfg.SecretsManagement.RegisterAPIServer)
+	})
+
+	t.Run("should handle configuration with run_secrets_db_migrations disabled", func(t *testing.T) {
+		iniContent := `
+[secrets_manager]
+run_secrets_db_migrations = false
+`
+		cfg, err := NewCfgFromBytes([]byte(iniContent))
+		require.NoError(t, err)
+
+		assert.False(t, cfg.SecretsManagement.RunSecretsDBMigrations)
+	})
+
+	t.Run("should handle configuration without run_secrets_db_migrations set", func(t *testing.T) {
+		iniContent := `
+[secrets_manager]
+encryption_provider = aws_kms
+`
+		cfg, err := NewCfgFromBytes([]byte(iniContent))
+		require.NoError(t, err)
+
+		assert.True(t, cfg.SecretsManagement.RunSecretsDBMigrations)
+	})
+
+	t.Run("should handle configuration with run_data_key_migration disabled", func(t *testing.T) {
+		iniContent := `
+[secrets_manager]
+run_data_key_migration = false
+`
+		cfg, err := NewCfgFromBytes([]byte(iniContent))
+		require.NoError(t, err)
+
+		assert.False(t, cfg.SecretsManagement.RunDataKeyMigration)
+	})
+
+	t.Run("should handle configuration without run_data_key_migration set", func(t *testing.T) {
+		iniContent := `
+[secrets_manager]
+encryption_provider = aws_kms
+`
+		cfg, err := NewCfgFromBytes([]byte(iniContent))
+		require.NoError(t, err)
+
+		assert.True(t, cfg.SecretsManagement.RunDataKeyMigration)
 	})
 }