From 4919bce269e1274b99dce6be631e1b3ea7f3078e Mon Sep 17 00:00:00 2001 From: Gabriel Mabille Date: Wed, 14 Jan 2026 22:14:21 +0100 Subject: [PATCH] WIP --- apps/iam/pkg/apis/iam/v0alpha1/register.go | 4 +++- pkg/registry/apis/iam/authorizer.go | 3 +++ pkg/registry/apis/iam/register.go | 5 ++++- pkg/server/wire_gen.go | 6 ++++-- 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/apps/iam/pkg/apis/iam/v0alpha1/register.go b/apps/iam/pkg/apis/iam/v0alpha1/register.go index ddb053d0818..64094160854 100644 --- a/apps/iam/pkg/apis/iam/v0alpha1/register.go +++ b/apps/iam/pkg/apis/iam/v0alpha1/register.go @@ -74,7 +74,8 @@ var RoleInfo = utils.NewResourceInfo(GROUP, VERSION, }, ) -var GlobalRoleInfo = utils.NewResourceInfo(GROUP, VERSION, +var GlobalRoleInfo = globalRoleInfo.WithClusterScope() +var globalRoleInfo = utils.NewResourceInfo(GROUP, VERSION, "globalroles", "globalrole", "GlobalRole", func() runtime.Object { return &GlobalRole{} }, func() runtime.Object { return &GlobalRoleList{} }, @@ -341,6 +342,7 @@ func AddGlobalRoleKnownTypes(scheme *runtime.Scheme) error { ) return nil } + func AddAuthNKnownTypes(scheme *runtime.Scheme) error { scheme.AddKnownTypes(SchemeGroupVersion, // Identity diff --git a/pkg/registry/apis/iam/authorizer.go b/pkg/registry/apis/iam/authorizer.go index da81dd2d9a8..c7a0d7809c2 100644 --- a/pkg/registry/apis/iam/authorizer.go +++ b/pkg/registry/apis/iam/authorizer.go @@ -23,6 +23,7 @@ func newIAMAuthorizer( accessClient authlib.AccessClient, legacyAccessClient authlib.AccessClient, roleApiInstaller RoleApiInstaller, + globalRoleApiInstaller GlobalRoleApiInstaller, ) authorizer.Authorizer { resourceAuthorizer := make(map[string]authorizer.Authorizer) @@ -58,6 +59,8 @@ func newIAMAuthorizer( resourceAuthorizer["searchUsers"] = serviceAuthorizer resourceAuthorizer["searchTeams"] = serviceAuthorizer + resourceAuthorizer[iamv0.GlobalRoleInfo.GetName()] = globalRoleApiInstaller.GetAuthorizer() + return &iamAuthorizer{resourceAuthorizer: resourceAuthorizer} } diff --git a/pkg/registry/apis/iam/register.go b/pkg/registry/apis/iam/register.go index 4ae2ef164a5..4c3fcd23570 100644 --- a/pkg/registry/apis/iam/register.go +++ b/pkg/registry/apis/iam/register.go @@ -75,6 +75,7 @@ func RegisterAPIService( reg prometheus.Registerer, coreRolesStorage CoreRoleStorageBackend, roleApiInstaller RoleApiInstaller, + globalRoleApiInstaller GlobalRoleApiInstaller, tracing *tracing.TracingService, roleBindingsStorage RoleBindingStorageBackend, externalGroupMappingStorageBackend ExternalGroupMappingStorageBackend, @@ -89,7 +90,7 @@ func RegisterAPIService( dbProvider := legacysql.NewDatabaseProvider(sql) store := legacy.NewLegacySQLStores(dbProvider) legacyAccessClient := newLegacyAccessClient(ac, store) - authorizer := newIAMAuthorizer(accessClient, legacyAccessClient, roleApiInstaller) + authorizer := newIAMAuthorizer(accessClient, legacyAccessClient, roleApiInstaller, globalRoleApiInstaller) registerMetrics(reg) //nolint:staticcheck // not yet migrated to OpenFeature @@ -109,6 +110,7 @@ func RegisterAPIService( ssoLegacyStore: sso.NewLegacyStore(ssoService, tracing), coreRolesStorage: coreRolesStorage, roleApiInstaller: roleApiInstaller, + globalRoleApiInstaller: globalRoleApiInstaller, resourcePermissionsStorage: resourcepermission.ProvideStorageBackend(dbProvider), roleBindingsStorage: roleBindingsStorage, externalGroupMappingStorage: externalGroupMappingStorageBackend, @@ -174,6 +176,7 @@ func NewAPIService( zTickets: make(chan bool, MaxConcurrentZanzanaWrites), reg: reg, roleApiInstaller: roleApiInstaller, + globalRoleApiInstaller: ProvideNoopGlobalRoleApiInstaller(), // TODO: add a proper global role installer authorizer: authorizer.AuthorizerFunc( func(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error) { user, ok := types.AuthInfoFrom(ctx) diff --git a/pkg/server/wire_gen.go b/pkg/server/wire_gen.go index 218e9fabc36..4dbd7eda7f9 100644 --- a/pkg/server/wire_gen.go +++ b/pkg/server/wire_gen.go @@ -882,8 +882,9 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient) storageBackendImpl := noopstorage.ProvideStorageBackend() roleApiInstaller := iam.ProvideNoopRoleApiInstaller() + globalRoleApiInstaller := iam.ProvideNoopGlobalRoleApiInstaller() noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST() - identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider) + identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, globalRoleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider) if err != nil { return nil, err } @@ -1550,8 +1551,9 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient) storageBackendImpl := noopstorage.ProvideStorageBackend() roleApiInstaller := iam.ProvideNoopRoleApiInstaller() + globalRoleApiInstaller := iam.ProvideNoopGlobalRoleApiInstaller() noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST() - identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider) + identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, globalRoleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider) if err != nil { return nil, err }