public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
Gabriel Mabille
2026-01-14 22:14:21 +01:00
parent c4c48da441
commit 4919bce269
4 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/iam/pkg/apis/iam/v0alpha1/register.go
+3 -1
View File
@@ -74,7 +74,8 @@ var RoleInfo = utils.NewResourceInfo(GROUP, VERSION,
},
)
var GlobalRoleInfo = utils.NewResourceInfo(GROUP, VERSION,
var GlobalRoleInfo = globalRoleInfo.WithClusterScope()
var globalRoleInfo = utils.NewResourceInfo(GROUP, VERSION,
"globalroles", "globalrole", "GlobalRole",
func() runtime.Object { return &GlobalRole{} },
func() runtime.Object { return &GlobalRoleList{} },
@@ -341,6 +342,7 @@ func AddGlobalRoleKnownTypes(scheme *runtime.Scheme) error {
)
return nil
}
func AddAuthNKnownTypes(scheme *runtime.Scheme) error {
scheme.AddKnownTypes(SchemeGroupVersion,
// Identity
pkg/registry/apis/iam/authorizer.go
+3
View File
@@ -23,6 +23,7 @@ func newIAMAuthorizer(
accessClient authlib.AccessClient,
legacyAccessClient authlib.AccessClient,
roleApiInstaller RoleApiInstaller,
globalRoleApiInstaller GlobalRoleApiInstaller,
) authorizer.Authorizer {
resourceAuthorizer := make(map[string]authorizer.Authorizer)
@@ -58,6 +59,8 @@ func newIAMAuthorizer(
resourceAuthorizer["searchUsers"] = serviceAuthorizer
resourceAuthorizer["searchTeams"] = serviceAuthorizer
resourceAuthorizer[iamv0.GlobalRoleInfo.GetName()] = globalRoleApiInstaller.GetAuthorizer()
return &iamAuthorizer{resourceAuthorizer: resourceAuthorizer}
}
pkg/registry/apis/iam/register.go
+4 -1
View File
@@ -75,6 +75,7 @@ func RegisterAPIService(
reg prometheus.Registerer,
coreRolesStorage CoreRoleStorageBackend,
roleApiInstaller RoleApiInstaller,
globalRoleApiInstaller GlobalRoleApiInstaller,
tracing *tracing.TracingService,
roleBindingsStorage RoleBindingStorageBackend,
externalGroupMappingStorageBackend ExternalGroupMappingStorageBackend,
@@ -89,7 +90,7 @@ func RegisterAPIService(
dbProvider := legacysql.NewDatabaseProvider(sql)
store := legacy.NewLegacySQLStores(dbProvider)
legacyAccessClient := newLegacyAccessClient(ac, store)
authorizer := newIAMAuthorizer(accessClient, legacyAccessClient, roleApiInstaller)
authorizer := newIAMAuthorizer(accessClient, legacyAccessClient, roleApiInstaller, globalRoleApiInstaller)
registerMetrics(reg)
//nolint:staticcheck // not yet migrated to OpenFeature
@@ -109,6 +110,7 @@ func RegisterAPIService(
ssoLegacyStore: sso.NewLegacyStore(ssoService, tracing),
coreRolesStorage: coreRolesStorage,
roleApiInstaller: roleApiInstaller,
globalRoleApiInstaller: globalRoleApiInstaller,
resourcePermissionsStorage: resourcepermission.ProvideStorageBackend(dbProvider),
roleBindingsStorage: roleBindingsStorage,
externalGroupMappingStorage: externalGroupMappingStorageBackend,
@@ -174,6 +176,7 @@ func NewAPIService(
zTickets: make(chan bool, MaxConcurrentZanzanaWrites),
reg: reg,
roleApiInstaller: roleApiInstaller,
globalRoleApiInstaller: ProvideNoopGlobalRoleApiInstaller(), // TODO: add a proper global role installer
authorizer: authorizer.AuthorizerFunc(
func(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error) {
user, ok := types.AuthInfoFrom(ctx)
pkg/server/wire_gen.go
Generated
+4 -2
View File
@@ -882,8 +882,9 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient)
storageBackendImpl := noopstorage.ProvideStorageBackend()
roleApiInstaller := iam.ProvideNoopRoleApiInstaller()
globalRoleApiInstaller := iam.ProvideNoopGlobalRoleApiInstaller()
noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, globalRoleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
if err != nil {
return nil, err
}
@@ -1550,8 +1551,9 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient)
storageBackendImpl := noopstorage.ProvideStorageBackend()
roleApiInstaller := iam.ProvideNoopRoleApiInstaller()
globalRoleApiInstaller := iam.ProvideNoopGlobalRoleApiInstaller()
noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, globalRoleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
if err != nil {
return nil, err
}