public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Allow role registration for plugins (#57387)

Browse Source 
* Picking role registration from OnCall POC branch

* Fix test

* Remove include actions from this PR

* Removing unused permission

* Adding test to DeclarePluginRoles

* Add testcase to RegisterFixed role

* Additional test case

* Adding tests to validate plugins roles

* Add test to plugin loader

* Nit.

* Scuemata validation

* Changing the design to decouple accesscontrol from plugin management

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>

* Fixing tests

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Add missing files

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Remove feature toggle check from loader

* Remove feature toggleimport

* Feedback

Co-Authored-By: marefr <marcus.efraimsson@gmail.com>

* Fix test'

* Make plugins.RoleRegistry interface typed

* Remove comment question

* No need for json tags anymore

* Nit. log

* Adding the schema validation

* Remove group to take plugin Name instead

* Revert sqlstore -> db

* Nit.

* Nit. on tests

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Update pkg/services/accesscontrol/plugins.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Log message

Co-Authored-By: marefr <marcus.efraimsson@gmail.com>

* Log message

Co-Authored-By: marefr <marcus.efraimsson@gmail.com>

* Remove unecessary method. Update test name.

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Fix linting

* Update cue descriptions

* Fix test

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Jguer <joao.guerreiro@grafana.com>
Co-authored-by: marefr <marcus.efraimsson@gmail.com>
Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Gabriel MABILLE
2022-11-07 11:30:45 +01:00
committed by GitHub
co-authored by Kalle Persson Jguer marefr ievaVasiljeva
parent 334b498632
commit 30fae33f66
22 changed files with 852 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/coremodel/pluginmeta/pluginmeta_gen.go
+96
View File
@@ -49,6 +49,17 @@ const (
TypeSecretsmanager Type = "secretsmanager"
)
// Defines values for BasicRole.
const (
BasicRoleAdmin BasicRole = "Admin"
BasicRoleEditor BasicRole = "Editor"
BasicRoleGrafanaAdmin BasicRole = "Grafana Admin"
BasicRoleViewer BasicRole = "Viewer"
)
// Defines values for DependencyType.
const (
DependencyTypeApp DependencyType = "app"
@@ -95,6 +106,17 @@ const (
ReleaseStateStable ReleaseState = "stable"
)
// Defines values for RoleRegistrationGrants.
const (
RoleRegistrationGrantsAdmin RoleRegistrationGrants = "Admin"
RoleRegistrationGrantsEditor RoleRegistrationGrants = "Editor"
RoleRegistrationGrantsGrafanaAdmin RoleRegistrationGrants = "Grafana Admin"
RoleRegistrationGrantsViewer RoleRegistrationGrants = "Viewer"
)
// Model is the Go representation of a pluginmeta.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
@@ -255,6 +277,13 @@ type Model struct {
MinInterval *bool `json:"minInterval,omitempty"`
} `json:"queryOptions,omitempty"`
// Optional list of RBAC RoleRegistrations.
// Describes and organizes the default permissions associated with any of the Grafana basic roles,
// which characterizes what viewers, editors, admins, or grafana admins can do on the plugin.
// The Admin basic role inherits its default permissions from the Editor basic role which in turn
// inherits them from the Viewer basic role.
Roles *[]RoleRegistration `json:"roles,omitempty"`
// Routes is a list of proxy routes, if any. For datasource plugins only.
Routes *[]Route `json:"routes,omitempty"`
@@ -291,6 +320,14 @@ type Category string
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type Type string
// BasicRole is a Grafana basic role, which can be 'Viewer', 'Editor', 'Admin' or 'Grafana Admin'.
// With RBAC, the Admin basic role inherits its default permissions from the Editor basic role which
// in turn inherits them from the Viewer basic role.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type BasicRole string
// BuildInfo is the Go representation of a pluginmeta.BuildInfo.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
@@ -475,12 +512,71 @@ type JWTTokenAuth struct {
Url string `json:"url"`
}
// Permission describes an RBAC permission on the plugin. A permission has an action and an option
// scope.
// Example: action: 'test-app.schedules:read', scope: 'test-app.schedules:*'
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type Permission struct {
Action string `json:"action"`
Scope *string `json:"scope,omitempty"`
}
// ReleaseState indicates release maturity state of a plugin.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type ReleaseState string
// Role describes an RBAC role which allows grouping multiple related permissions on the plugin,
// each of which has an action and an optional scope.
// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type Role struct {
Description string `json:"description"`
DisplayName string `json:"displayName"`
Name string `json:"name"`
Permissions []struct {
Action string `json:"action"`
Scope *string `json:"scope,omitempty"`
} `json:"permissions"`
}
// RoleRegistration describes an RBAC role and its assignments to basic roles.
// It organizes related RBAC permissions on the plugin into a role and defines which basic roles
// will get them by default.
// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin
// which will be granted to Admins by default.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type RoleRegistration struct {
// Default assignment of the role to Grafana basic roles (Viewer, Editor, Admin, Grafana Admin)
// The Admin basic role inherits its default permissions from the Editor basic role which in turn
// inherits them from the Viewer basic role.
Grants []RoleRegistrationGrants `json:"grants"`
// RBAC role definition to bundle related RBAC permissions on the plugin.
Role struct {
Description string `json:"description"`
DisplayName string `json:"displayName"`
Name string `json:"name"`
Permissions []struct {
Action string `json:"action"`
Scope *string `json:"scope,omitempty"`
} `json:"permissions"`
} `json:"role"`
}
// RoleRegistrationGrants is the Go representation of a RoleRegistration.Grants.
//
// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
type RoleRegistrationGrants string
// A proxy route used in datasource plugins for plugin authentication
// and adding headers to HTTP requests made by the plugin.
// For more information, refer to [Authentication for data source