IAM: Add ExternalGroupMapping kind for TeamSync (#113052)

* wip

* wip

* Add authorizer -> VERIFY it's working correctly

* Update openapi definitions

* Authorizer wip

* regen apis

* Increase timeout of pg int tests to 20m

* Revert "Increase timeout of pg int tests to 20m"

This reverts commit 8c20568217.

* Fix NewTestStore when Truncate is enabled

apps/iam/kinds/externalgroupmapping.cue

@@ -0,0 +1,20 @@
+package kinds
+
+import (
+	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
+)
+
+externalGroupMappingKind: {
+	kind:       "ExternalGroupMapping"
+	pluralName: "ExternalGroupMappings"
+	codegen: {
+		ts: {enabled: false}
+		go: {enabled: true}
+	}
+}
+
+externalGroupMappingv0alpha1: externalGroupMappingKind & {
+	schema: {
+		spec: v0alpha1.ExternalGroupMappingSpec
+	}
+}

apps/iam/kinds/manifest.cue

@@ -20,5 +20,6 @@ v0alpha1: {
 		teamv0alpha1,
 		teambindingv0alpha1,
 		serviceaccountv0alpha1,
+		externalGroupMappingv0alpha1
 	]
 }

apps/iam/kinds/v0alpha1/externalgroupmappingspec.cue

@@ -0,0 +1,6 @@
+package v0alpha1
+
+ExternalGroupMappingSpec: {
+	teamRef:         TeamRef
+	externalGroupId: string
+}

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_client_gen.go

@@ -0,0 +1,80 @@
+package v0alpha1
+
+import (
+	"context"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+type ExternalGroupMappingClient struct {
+	client *resource.TypedClient[*ExternalGroupMapping, *ExternalGroupMappingList]
+}
+
+func NewExternalGroupMappingClient(client resource.Client) *ExternalGroupMappingClient {
+	return &ExternalGroupMappingClient{
+		client: resource.NewTypedClient[*ExternalGroupMapping, *ExternalGroupMappingList](client, ExternalGroupMappingKind()),
+	}
+}
+
+func NewExternalGroupMappingClientFromGenerator(generator resource.ClientGenerator) (*ExternalGroupMappingClient, error) {
+	c, err := generator.ClientFor(ExternalGroupMappingKind())
+	if err != nil {
+		return nil, err
+	}
+	return NewExternalGroupMappingClient(c), nil
+}
+
+func (c *ExternalGroupMappingClient) Get(ctx context.Context, identifier resource.Identifier) (*ExternalGroupMapping, error) {
+	return c.client.Get(ctx, identifier)
+}
+
+func (c *ExternalGroupMappingClient) List(ctx context.Context, namespace string, opts resource.ListOptions) (*ExternalGroupMappingList, error) {
+	return c.client.List(ctx, namespace, opts)
+}
+
+func (c *ExternalGroupMappingClient) ListAll(ctx context.Context, namespace string, opts resource.ListOptions) (*ExternalGroupMappingList, error) {
+	resp, err := c.client.List(ctx, namespace, resource.ListOptions{
+		ResourceVersion: opts.ResourceVersion,
+		Limit:           opts.Limit,
+		LabelFilters:    opts.LabelFilters,
+		FieldSelectors:  opts.FieldSelectors,
+	})
+	if err != nil {
+		return nil, err
+	}
+	for resp.GetContinue() != "" {
+		page, err := c.client.List(ctx, namespace, resource.ListOptions{
+			Continue:        resp.GetContinue(),
+			ResourceVersion: opts.ResourceVersion,
+			Limit:           opts.Limit,
+			LabelFilters:    opts.LabelFilters,
+			FieldSelectors:  opts.FieldSelectors,
+		})
+		if err != nil {
+			return nil, err
+		}
+		resp.SetContinue(page.GetContinue())
+		resp.SetResourceVersion(page.GetResourceVersion())
+		resp.SetItems(append(resp.GetItems(), page.GetItems()...))
+	}
+	return resp, nil
+}
+
+func (c *ExternalGroupMappingClient) Create(ctx context.Context, obj *ExternalGroupMapping, opts resource.CreateOptions) (*ExternalGroupMapping, error) {
+	// Make sure apiVersion and kind are set
+	obj.APIVersion = GroupVersion.Identifier()
+	obj.Kind = ExternalGroupMappingKind().Kind()
+	return c.client.Create(ctx, obj, opts)
+}
+
+func (c *ExternalGroupMappingClient) Update(ctx context.Context, obj *ExternalGroupMapping, opts resource.UpdateOptions) (*ExternalGroupMapping, error) {
+	return c.client.Update(ctx, obj, opts)
+}
+
+func (c *ExternalGroupMappingClient) Patch(ctx context.Context, identifier resource.Identifier, req resource.PatchRequest, opts resource.PatchOptions) (*ExternalGroupMapping, error) {
+	return c.client.Patch(ctx, identifier, req, opts)
+}
+
+func (c *ExternalGroupMappingClient) Delete(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error {
+	return c.client.Delete(ctx, identifier, opts)
+}

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// ExternalGroupMappingJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type ExternalGroupMappingJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*ExternalGroupMappingJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*ExternalGroupMappingJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &ExternalGroupMappingJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_metadata_gen.go

@@ -0,0 +1,31 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type ExternalGroupMappingMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewExternalGroupMappingMetadata creates a new ExternalGroupMappingMetadata object.
+func NewExternalGroupMappingMetadata() *ExternalGroupMappingMetadata {
+	return &ExternalGroupMappingMetadata{
+		Finalizers: []string{},
+		Labels:     map[string]string{},
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_object_gen.go

@@ -0,0 +1,293 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type ExternalGroupMapping struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the ExternalGroupMapping
+	Spec ExternalGroupMappingSpec `json:"spec" yaml:"spec"`
+}
+
+func (o *ExternalGroupMapping) GetSpec() any {
+	return o.Spec
+}
+
+func (o *ExternalGroupMapping) SetSpec(spec any) error {
+	cast, ok := spec.(ExternalGroupMappingSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *ExternalGroupMapping) GetSubresources() map[string]any {
+	return map[string]any{}
+}
+
+func (o *ExternalGroupMapping) GetSubresource(name string) (any, bool) {
+	switch name {
+	default:
+		return nil, false
+	}
+}
+
+func (o *ExternalGroupMapping) SetSubresource(name string, value any) error {
+	switch name {
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *ExternalGroupMapping) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *ExternalGroupMapping) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *ExternalGroupMapping) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *ExternalGroupMapping) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *ExternalGroupMapping) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *ExternalGroupMapping) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *ExternalGroupMapping) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *ExternalGroupMapping) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *ExternalGroupMapping) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *ExternalGroupMapping) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *ExternalGroupMapping) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *ExternalGroupMapping) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ExternalGroupMapping) DeepCopy() *ExternalGroupMapping {
+	cpy := &ExternalGroupMapping{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ExternalGroupMapping) DeepCopyInto(dst *ExternalGroupMapping) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &ExternalGroupMapping{}
+
+// +k8s:openapi-gen=true
+type ExternalGroupMappingList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []ExternalGroupMapping `json:"items" yaml:"items"`
+}
+
+func (o *ExternalGroupMappingList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ExternalGroupMappingList) Copy() resource.ListObject {
+	cpy := &ExternalGroupMappingList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]ExternalGroupMapping, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*ExternalGroupMapping); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *ExternalGroupMappingList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *ExternalGroupMappingList) SetItems(items []resource.Object) {
+	o.Items = make([]ExternalGroupMapping, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*ExternalGroupMapping)
+	}
+}
+
+func (o *ExternalGroupMappingList) DeepCopy() *ExternalGroupMappingList {
+	cpy := &ExternalGroupMappingList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ExternalGroupMappingList) DeepCopyInto(dst *ExternalGroupMappingList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &ExternalGroupMappingList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *ExternalGroupMappingSpec) DeepCopy() *ExternalGroupMappingSpec {
+	cpy := &ExternalGroupMappingSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *ExternalGroupMappingSpec) DeepCopyInto(dst *ExternalGroupMappingSpec) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaExternalGroupMapping = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &ExternalGroupMapping{}, &ExternalGroupMappingList{}, resource.WithKind("ExternalGroupMapping"),
+		resource.WithPlural("externalgroupmappings"), resource.WithScope(resource.NamespacedScope))
+	kindExternalGroupMapping = resource.Kind{
+		Schema: schemaExternalGroupMapping,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &ExternalGroupMappingJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func ExternalGroupMappingKind() resource.Kind {
+	return kindExternalGroupMapping
+}
+
+// Schema returns a resource.SimpleSchema representation of ExternalGroupMapping
+func ExternalGroupMappingSchema() *resource.SimpleSchema {
+	return schemaExternalGroupMapping
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindExternalGroupMapping

apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_spec_gen.go

@@ -0,0 +1,27 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type ExternalGroupMappingTeamRef struct {
+	// Name is the unique identifier for a team.
+	Name string `json:"name"`
+}
+
+// NewExternalGroupMappingTeamRef creates a new ExternalGroupMappingTeamRef object.
+func NewExternalGroupMappingTeamRef() *ExternalGroupMappingTeamRef {
+	return &ExternalGroupMappingTeamRef{}
+}
+
+// +k8s:openapi-gen=true
+type ExternalGroupMappingSpec struct {
+	TeamRef         ExternalGroupMappingTeamRef `json:"teamRef"`
+	ExternalGroupId string                      `json:"externalGroupId"`
+}
+
+// NewExternalGroupMappingSpec creates a new ExternalGroupMappingSpec object.
+func NewExternalGroupMappingSpec() *ExternalGroupMappingSpec {
+	return &ExternalGroupMappingSpec{
+		TeamRef: *NewExternalGroupMappingTeamRef(),
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/register.go

@@ -206,6 +206,30 @@ var TeamBindingResourceInfo = utils.NewResourceInfo(
 	},
 )
 
+var ExternalGroupMappingResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
+	"externalgroupmappings", "externalgroupmapping", "ExternalGroupMapping",
+	func() runtime.Object { return &ExternalGroupMapping{} },
+	func() runtime.Object { return &ExternalGroupMappingList{} },
+	utils.TableColumns{
+		Definition: []metav1.TableColumnDefinition{
+			{Name: "Name", Type: "string", Format: "name"},
+			{Name: "Created At", Type: "date"},
+		},
+		Reader: func(obj any) ([]interface{}, error) {
+			mapping, ok := obj.(*ExternalGroupMapping)
+			if ok {
+				if mapping != nil {
+					return []interface{}{
+						mapping.Name,
+						mapping.CreationTimestamp.UTC().Format(time.RFC3339),
+					}, nil
+				}
+			}
+			return nil, fmt.Errorf("expected external group mapping")
+		},
+	},
+)
+
 var RoleBindingInfo = utils.NewResourceInfo(GROUP, VERSION,
 	"rolebindings", "rolebinding", "RoleBinding",
 	func() runtime.Object { return &RoleBinding{} },
@@ -295,6 +319,8 @@ func AddAuthNKnownTypes(scheme *runtime.Scheme) error {
 		&TeamList{},
 		&TeamBinding{},
 		&TeamBindingList{},
+		&ExternalGroupMapping{},
+		&ExternalGroupMappingList{},
 		// For now these are registered in pkg/apis/iam/v0alpha1/register.go
 		// &UserTeamList{},
 		// &ServiceAccountTokenList{},

apps/iam/pkg/apis/iam/v0alpha1/zz_openapi_gen.go

@@ -18,6 +18,10 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRoleStatus":                        schema_pkg_apis_iam_v0alpha1_CoreRoleStatus(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRolespecPermission":                schema_pkg_apis_iam_v0alpha1_CoreRolespecPermission(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRolestatusOperatorState":           schema_pkg_apis_iam_v0alpha1_CoreRolestatusOperatorState(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping":                  schema_pkg_apis_iam_v0alpha1_ExternalGroupMapping(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingList":              schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingList(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec":              schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingSpec(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef":           schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingTeamRef(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRole":                            schema_pkg_apis_iam_v0alpha1_GlobalRole(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRoleBinding":                     schema_pkg_apis_iam_v0alpha1_GlobalRoleBinding(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRoleBindingList":                 schema_pkg_apis_iam_v0alpha1_GlobalRoleBindingList(ref),
@@ -348,6 +352,145 @@ func schema_pkg_apis_iam_v0alpha1_CoreRolestatusOperatorState(ref common.Referen
 	}
 }
 
+func schema_pkg_apis_iam_v0alpha1_ExternalGroupMapping(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec is the spec of the ExternalGroupMapping",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"teamRef": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef"),
+						},
+					},
+					"externalGroupId": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"teamRef", "externalGroupId"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingTeamRef(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the unique identifier for a team.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"name"},
+			},
+		},
+	}
+}
+
 func schema_pkg_apis_iam_v0alpha1_GlobalRole(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{

apps/iam/pkg/apis/iam_manifest.go

@@ -96,6 +96,13 @@ var appManifestData = app.ManifestData{
 					Scope:      "Namespaced",
 					Conversion: false,
 				},
+
+				{
+					Kind:       "ExternalGroupMapping",
+					Plural:     "ExternalGroupMappings",
+					Scope:      "Namespaced",
+					Conversion: false,
+				},
 			},
 			Routes: app.ManifestVersionRoutes{
 				Namespaced: map[string]spec3.PathProps{},
@@ -115,16 +122,17 @@ func RemoteManifest() app.Manifest {
 }
 
 var kindVersionToGoType = map[string]resource.Kind{
-	"GlobalRole/v0alpha1":         v0alpha1.GlobalRoleKind(),
-	"GlobalRoleBinding/v0alpha1":  v0alpha1.GlobalRoleBindingKind(),
-	"CoreRole/v0alpha1":           v0alpha1.CoreRoleKind(),
-	"Role/v0alpha1":               v0alpha1.RoleKind(),
-	"RoleBinding/v0alpha1":        v0alpha1.RoleBindingKind(),
-	"ResourcePermission/v0alpha1": v0alpha1.ResourcePermissionKind(),
-	"User/v0alpha1":               v0alpha1.UserKind(),
-	"Team/v0alpha1":               v0alpha1.TeamKind(),
-	"TeamBinding/v0alpha1":        v0alpha1.TeamBindingKind(),
-	"ServiceAccount/v0alpha1":     v0alpha1.ServiceAccountKind(),
+	"GlobalRole/v0alpha1":           v0alpha1.GlobalRoleKind(),
+	"GlobalRoleBinding/v0alpha1":    v0alpha1.GlobalRoleBindingKind(),
+	"CoreRole/v0alpha1":             v0alpha1.CoreRoleKind(),
+	"Role/v0alpha1":                 v0alpha1.RoleKind(),
+	"RoleBinding/v0alpha1":          v0alpha1.RoleBindingKind(),
+	"ResourcePermission/v0alpha1":   v0alpha1.ResourcePermissionKind(),
+	"User/v0alpha1":                 v0alpha1.UserKind(),
+	"Team/v0alpha1":                 v0alpha1.TeamKind(),
+	"TeamBinding/v0alpha1":          v0alpha1.TeamBindingKind(),
+	"ServiceAccount/v0alpha1":       v0alpha1.ServiceAccountKind(),
+	"ExternalGroupMapping/v0alpha1": v0alpha1.ExternalGroupMappingKind(),
 }
 
 // ManifestGoTypeAssociator returns the associated resource.Kind instance for a given Kind and Version, if one exists.