Secrets: garbage collection (#110247)

* clean up older secret versions

* start gargbage collection worker as background service

* make gen-go

* fix typo

* make update-workspace

* undo go mod changes

* undo go work sum changes

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* default gc_worker_batch_size to 1 minute

* fix typo

* fix typo

* add test to ensure cleaning up secure values is idempotent

* make gen-go

* make update-workspace

* undo go.mod and .sum changes

* undo enterprise imports

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

pkg/setting/setting_secrets_manager.go

@@ -2,6 +2,7 @@ package setting
 
 import (
 	"strings"
+	"time"
 )
 
 const (
@@ -22,6 +23,17 @@ type SecretsManagerSettings struct {
 	GrpcServerTLSServerName string // Server name to use for TLS verification
 	GrpcServerAddress       string // Address for gRPC secrets server
 	GrpcGrafanaServiceName  string // Service name to use for background grafana decryption/inline
+
+	// Used for testing. Set to false to disable the control loop.
+	GCWorkerEnabled bool
+	// Max number of inactive secure values to fetch from the database.
+	GCWorkerMaxBatchSize uint16
+	// Max number of tasks to delete secure values that can be inflight at a time.
+	GCWorkerMaxConcurrentCleanups uint16
+	// How long to wait for between fetching inactive secure values for cleanup.
+	GCWorkerPollInterval time.Duration
+	// How long to wait for the process to clean up a secure value to complete.
+	GCWorkerPerSecureValueCleanupTimeout time.Duration
 }
 
 func (cfg *Cfg) readSecretsManagerSettings() {
@@ -35,6 +47,12 @@ func (cfg *Cfg) readSecretsManagerSettings() {
 	cfg.SecretsManagement.GrpcServerAddress = valueAsString(secretsMgmt, "grpc_server_address", "")
 	cfg.SecretsManagement.GrpcGrafanaServiceName = valueAsString(secretsMgmt, "grpc_grafana_service_name", "")
 
+	cfg.SecretsManagement.GCWorkerEnabled = secretsMgmt.Key("gc_worker_enabled").MustBool(true)
+	cfg.SecretsManagement.GCWorkerMaxBatchSize = uint16(secretsMgmt.Key("gc_worker_batch_size").MustUint(16))
+	cfg.SecretsManagement.GCWorkerMaxConcurrentCleanups = uint16(secretsMgmt.Key("gc_worker_max_concurrency").MustUint(16))
+	cfg.SecretsManagement.GCWorkerPollInterval = secretsMgmt.Key("gc_worker_poll_interval").MustDuration(1 * time.Minute)
+	cfg.SecretsManagement.GCWorkerPerSecureValueCleanupTimeout = secretsMgmt.Key("gc_worker_per_request_timeout").MustDuration(5 * time.Second)
+
 	// Extract available KMS providers from configuration sections
 	providers := make(map[string]map[string]string)
 	for _, section := range cfg.Raw.Sections() {