public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

LBAC for data sources: Cleanup service needs serviceIdentity to reach teams (#112378)

Browse Source 
service identity
This commit is contained in:
Eric Leijonmarck
2025-10-15 09:19:32 +02:00
committed by GitHub
parent e5ef29c202
commit 2b4292fcfd
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/cleanup/cleanup.go
+8 -3
View File
@@ -454,8 +454,11 @@ func (srv *CleanUpService) cleanupStaleLBACRules(ctx context.Context) {
totalDataSources++ totalDataSources++
// needed for permissions to search teams and update data source
// msg="Failed to get teams for LBAC cleanup" error="missing permissions"
ctx, systemIdentity := identity.WithServiceIdentity(ctx, ds.OrgID)
// Extract team UIDs and check if teams still exist // Extract team UIDs and check if teams still exist
cleanedRules, removedCount := srv.getLBACRulesForTeamsStillExisting(ctx, teamHTTPHeaders, ds.OrgID) cleanedRules, removedCount := srv.getLBACRulesForTeamsStillExisting(ctx, teamHTTPHeaders, ds.OrgID, systemIdentity)
if removedCount > 0 { if removedCount > 0 {
// Update the datasource with cleaned rules // Update the datasource with cleaned rules
@@ -478,13 +481,15 @@ func (srv *CleanUpService) cleanupStaleLBACRules(ctx context.Context) {
} }
} }
func (srv *CleanUpService) getLBACRulesForTeamsStillExisting(ctx context.Context, teamHeaders *datasources.TeamHTTPHeaders, orgID int64) (*datasources.TeamHTTPHeaders, int) { func (srv *CleanUpService) getLBACRulesForTeamsStillExisting(ctx context.Context, teamHeaders *datasources.TeamHTTPHeaders, orgID int64, systemIdentity identity.Requester) (*datasources.TeamHTTPHeaders, int) {
logger := srv.log.FromContext(ctx) logger := srv.log.FromContext(ctx)
cleanedHeaders := &datasources.TeamHTTPHeaders{Headers: make(map[string][]datasources.AccessRule)} cleanedHeaders := &datasources.TeamHTTPHeaders{Headers: make(map[string][]datasources.AccessRule)}
removedCount := 0 removedCount := 0
// needed for permissions to search for teams
allTeams, err := srv.teamService.SearchTeams(ctx, &team.SearchTeamsQuery{ allTeams, err := srv.teamService.SearchTeams(ctx, &team.SearchTeamsQuery{
OrgID: orgID, OrgID: orgID,
SignedInUser: systemIdentity,
}) })
if err != nil { if err != nil {
logger.Error("Failed to get teams for LBAC cleanup", "error", err) logger.Error("Failed to get teams for LBAC cleanup", "error", err)