IAM: Add ExternalGroupMapping kind for TeamSync (#113052)

* wip

* wip

* Add authorizer -> VERIFY it's working correctly

* Update openapi definitions

* Authorizer wip

* regen apis

* Increase timeout of pg int tests to 20m

* Revert "Increase timeout of pg int tests to 20m"

This reverts commit 8c20568217.

* Fix NewTestStore when Truncate is enabled

pkg/registry/apis/iam/authorizer.go

@@ -35,6 +35,7 @@ func newIAMAuthorizer(accessClient authlib.AccessClient, legacyAccessClient auth
 	resourceAuthorizer[iamv0.RoleBindingInfo.GetName()] = authorizer
 	resourceAuthorizer[iamv0.ServiceAccountResourceInfo.GetName()] = authorizer
 	resourceAuthorizer[iamv0.UserResourceInfo.GetName()] = authorizer
+	resourceAuthorizer[iamv0.ExternalGroupMappingResourceInfo.GetName()] = authorizer
 	resourceAuthorizer[iamv0.TeamResourceInfo.GetName()] = authorizer
 
 	return &iamAuthorizer{resourceAuthorizer: resourceAuthorizer}

pkg/registry/apis/iam/models.go

@@ -35,14 +35,19 @@ type RoleStorageBackend interface{ resource.StorageBackend }
 // Used by wire to identify the storage backend for role bindings.
 type RoleBindingStorageBackend interface{ resource.StorageBackend }
 
+// ExternalGroupMappingStorageBackend uses the resource.StorageBackend interface to provide storage for external group mappings.
+// Used by wire to identify the storage backend for external group mappings.
+type ExternalGroupMappingStorageBackend interface{ resource.StorageBackend }
+
 // This is used just so wire has something unique to return
 type IdentityAccessManagementAPIBuilder struct {
 	// Stores
-	store                      legacy.LegacyIdentityStore
-	coreRolesStorage           CoreRoleStorageBackend
-	rolesStorage               RoleStorageBackend
-	resourcePermissionsStorage resource.StorageBackend
-	roleBindingsStorage        RoleBindingStorageBackend
+	store                       legacy.LegacyIdentityStore
+	coreRolesStorage            CoreRoleStorageBackend
+	rolesStorage                RoleStorageBackend
+	resourcePermissionsStorage  resource.StorageBackend
+	roleBindingsStorage         RoleBindingStorageBackend
+	externalGroupMappingStorage ExternalGroupMappingStorageBackend
 
 	// Access Control
 	authorizer authorizer.Authorizer

pkg/registry/apis/iam/register.go

@@ -63,6 +63,7 @@ func RegisterAPIService(
 	coreRolesStorage CoreRoleStorageBackend,
 	rolesStorage RoleStorageBackend,
 	roleBindingsStorage RoleBindingStorageBackend,
+	externalGroupMappingStorageBackend ExternalGroupMappingStorageBackend,
 	dual dualwrite.Service,
 	unified resource.ResourceClient,
 	userService legacyuser.Service,
@@ -74,25 +75,26 @@ func RegisterAPIService(
 	registerMetrics(reg)
 
 	builder := &IdentityAccessManagementAPIBuilder{
-		store:                      store,
-		coreRolesStorage:           coreRolesStorage,
-		rolesStorage:               rolesStorage,
-		resourcePermissionsStorage: resourcepermission.ProvideStorageBackend(dbProvider),
-		roleBindingsStorage:        roleBindingsStorage,
-		sso:                        ssoService,
-		authorizer:                 authorizer,
-		legacyAccessClient:         legacyAccessClient,
-		accessClient:               accessClient,
-		zClient:                    zClient,
-		zTickets:                   make(chan bool, MaxConcurrentZanzanaWrites),
-		display:                    user.NewLegacyDisplayREST(store),
-		reg:                        reg,
-		logger:                     log.New("iam.apis"),
-		features:                   features,
-		enableDualWriter:           true,
-		dual:                       dual,
-		unified:                    unified,
-		userSearchClient:           resource.NewSearchClient(dualwrite.NewSearchAdapter(dual), iamv0.UserResourceInfo.GroupResource(), unified, user.NewUserLegacySearchClient(userService), features),
+		store:                       store,
+		coreRolesStorage:            coreRolesStorage,
+		rolesStorage:                rolesStorage,
+		resourcePermissionsStorage:  resourcepermission.ProvideStorageBackend(dbProvider),
+		roleBindingsStorage:         roleBindingsStorage,
+		externalGroupMappingStorage: externalGroupMappingStorageBackend,
+		sso:                         ssoService,
+		authorizer:                  authorizer,
+		legacyAccessClient:          legacyAccessClient,
+		accessClient:                accessClient,
+		zClient:                     zClient,
+		zTickets:                    make(chan bool, MaxConcurrentZanzanaWrites),
+		display:                     user.NewLegacyDisplayREST(store),
+		reg:                         reg,
+		logger:                      log.New("iam.apis"),
+		features:                    features,
+		enableDualWriter:            true,
+		dual:                        dual,
+		unified:                     unified,
+		userSearchClient:            resource.NewSearchClient(dualwrite.NewSearchAdapter(dual), iamv0.UserResourceInfo.GroupResource(), unified, user.NewUserLegacySearchClient(userService), features),
 	}
 	apiregistration.RegisterAPI(builder)
 
@@ -289,6 +291,27 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 		storage[ssoResource.StoragePath()] = sso.NewLegacyStore(b.sso)
 	}
 
+	externalGroupMappingResource := iamv0.ExternalGroupMappingResourceInfo
+	externalGroupMappingLegacyStore, err := NewLocalStore(externalGroupMappingResource, apiGroupInfo.Scheme, opts.OptsGetter, b.reg, b.accessClient, b.externalGroupMappingStorage)
+	if err != nil {
+		return err
+	}
+	storage[externalGroupMappingResource.StoragePath()] = externalGroupMappingLegacyStore
+
+	if b.enableDualWriter {
+		externalGroupMappingStore, err := grafanaregistry.NewRegistryStore(opts.Scheme, externalGroupMappingResource, opts.OptsGetter)
+		if err != nil {
+			return err
+		}
+
+		externalGroupMappingDW, err := opts.DualWriteBuilder(externalGroupMappingResource.GroupResource(), externalGroupMappingLegacyStore, externalGroupMappingStore)
+		if err != nil {
+			return err
+		}
+
+		storage[externalGroupMappingResource.StoragePath()] = externalGroupMappingDW
+	}
+
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis) {
 		// v0alpha1

pkg/registry/apis/wireset.go

@@ -28,6 +28,7 @@ var WireSetExts = wire.NewSet(
 	wire.Bind(new(iam.CoreRoleStorageBackend), new(*noopstorage.StorageBackendImpl)),
 	wire.Bind(new(iam.RoleStorageBackend), new(*noopstorage.StorageBackendImpl)),
 	wire.Bind(new(iam.RoleBindingStorageBackend), new(*noopstorage.StorageBackendImpl)),
+	wire.Bind(new(iam.ExternalGroupMappingStorageBackend), new(*noopstorage.StorageBackendImpl)),
 )
 
 var provisioningExtras = wire.NewSet(