public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ExtJwt: don't log verify errors as they spam for grafana-agent (#90351)

Browse Source 
* ExtJwt: don't log verify errors as they spam for grafana-agent

* remove dead code

* revert unintended change

* revert unintended change
This commit is contained in:
Charandas
2024-07-11 18:23:43 -07:00
committed by GitHub
parent d2bc4f3255
commit 4abb4d1662
3 changed files with 44 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apiserver/endpoints/filters/requester.go
+43 -40
View File
@@ -16,54 +16,57 @@ func WithRequester(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
ctx := req.Context()
requester, err := identity.GetRequester(ctx)
if err != nil {
// Find the kubernetes user info
info, ok := request.UserFrom(ctx)
if ok {
if info.GetName() == user.Anonymous {
requester = &identity.StaticRequester{
Namespace: identity.NamespaceAnonymous,
Name: info.GetName(),
Login: info.GetName(),
Permissions: map[int64]map[string][]string{},
}
if err == nil {
handler.ServeHTTP(w, req)
return
}
// Find the kubernetes user info
info, ok := request.UserFrom(ctx)
if ok {
if info.GetName() == user.Anonymous {
requester = &identity.StaticRequester{
Namespace: identity.NamespaceAnonymous,
Name: info.GetName(),
Login: info.GetName(),
Permissions: map[int64]map[string][]string{},
}
}
if info.GetName() == user.APIServerUser ||
slices.Contains(info.GetGroups(), user.SystemPrivilegedGroup) {
orgId := int64(1)
requester = &identity.StaticRequester{
Namespace: identity.NamespaceServiceAccount, // system:apiserver
UserID: 1,
OrgID: orgId,
Name: info.GetName(),
Login: info.GetName(),
OrgRole: identity.RoleAdmin,
if info.GetName() == user.APIServerUser ||
slices.Contains(info.GetGroups(), user.SystemPrivilegedGroup) {
orgId := int64(1)
requester = &identity.StaticRequester{
Namespace: identity.NamespaceServiceAccount, // system:apiserver
UserID: 1,
OrgID: orgId,
Name: info.GetName(),
Login: info.GetName(),
OrgRole: identity.RoleAdmin,
IsGrafanaAdmin: true,
AllowedKubernetesNamespace: "default",
IsGrafanaAdmin: true,
AllowedKubernetesNamespace: "default",
Permissions: map[int64]map[string][]string{
orgId: {
"*": {"*"}, // all resources, all scopes
Permissions: map[int64]map[string][]string{
orgId: {
"*": {"*"}, // all resources, all scopes
// Dashboards do not support wildcard action
// dashboards.ActionDashboardsRead: {"*"},
// dashboards.ActionDashboardsCreate: {"*"},
// dashboards.ActionDashboardsWrite: {"*"},
// dashboards.ActionDashboardsDelete: {"*"},
// dashboards.ActionFoldersCreate: {"*"},
// dashboards.ActionFoldersRead: {dashboards.ScopeFoldersAll}, // access to read all folders
},
// Dashboards do not support wildcard action
// dashboards.ActionDashboardsRead: {"*"},
// dashboards.ActionDashboardsCreate: {"*"},
// dashboards.ActionDashboardsWrite: {"*"},
// dashboards.ActionDashboardsDelete: {"*"},
// dashboards.ActionFoldersCreate: {"*"},
// dashboards.ActionFoldersRead: {dashboards.ScopeFoldersAll}, // access to read all folders
},
}
},
}
}
if requester != nil {
req = req.WithContext(identity.WithRequester(ctx, requester))
} else {
klog.V(5).Info("unable to map the k8s user to grafana requester", "user", info)
}
if requester != nil {
req = req.WithContext(identity.WithRequester(ctx, requester))
} else {
klog.V(5).Info("unable to map the k8s user to grafana requester", "user", info)
}
}
handler.ServeHTTP(w, req)