mt first setup and cleanup access

pkg/registry/apis/apiextensions/register.go

@@ -95,7 +95,7 @@ func RegisterAPIService(
 
 // GetAuthorizer returns the authorizer for CRD resources
 // Breaks locally now for ST, will need to test in MT
-// grafanaauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
+// For ST just comment this out to test
 // func (b *Builder) GetAuthorizer() authorizer.Authorizer {
 // 	return grafanaauthorizer.NewServiceAuthorizer()
 // }
@@ -106,11 +106,13 @@ func NewAPIService(
 	unified resource.ResourceClient,
 	registerer prometheus.Registerer,
 	features featuremgmt.FeatureToggles,
+	storageProvider CRDStorageProvider,
 ) (*Builder, error) {
 	return &Builder{
-		features:      features,
-		accessClient:  accessClient,
-		unifiedClient: unified,
+		features:        features,
+		accessClient:    accessClient,
+		unifiedClient:   unified,
+		storageProvider: storageProvider,
 	}, nil
 }
 

pkg/storage/unified/resource/access.go

@@ -135,16 +135,6 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req c
 		return claims.CheckResponse{Allowed: true}, nil
 	}
 
-	// Hack, allow creation of Cluster scoped resources (ex. register CRDs)
-	// We need to make sure it is the correct service account,
-	// not just any service account.
-	// This is called when we submit a CRD (not when we list them)
-	// Currently creating them with a Service Account thus the match
-	if req.Namespace == "" && claims.IsIdentityType(id.GetIdentityType(), claims.TypeServiceAccount, claims.TypeAccessPolicy) {
-		span.SetAttributes(attribute.Bool("allowed", true))
-		return claims.CheckResponse{Allowed: true}, nil
-	}
-
 	if !claims.NamespaceMatches(id.GetNamespace(), req.Namespace) {
 		span.SetAttributes(attribute.Bool("allowed", false))
 		span.SetStatus(codes.Error, "Namespace mismatch")
@@ -195,13 +185,7 @@ func (c authzLimitedClient) Compile(ctx context.Context, id claims.AuthInfo, req
 		}, claims.NoopZookie{}, nil
 	}
 
-	// Hack, allow system tokens to be able to
-	// access Cluster scoped resources (ex. register CRDs)
-	// We need to make sure it is the correct service account,
-	// not just any service account
-	isServiceAccnt := req.Namespace == "" && claims.IsIdentityType(id.GetIdentityType(), claims.TypeAccessPolicy, claims.TypeServiceAccount)
-
-	if !claims.NamespaceMatches(id.GetNamespace(), req.Namespace) && !isServiceAccnt {
+	if !claims.NamespaceMatches(id.GetNamespace(), req.Namespace) {
 		span.SetAttributes(attribute.Bool("allowed", false))
 		span.SetStatus(codes.Error, "Namespace mismatch")
 		span.RecordError(claims.ErrNamespaceMismatch)