IAM: Instantiate DualWriter only when in single-tenant mode (#108558)

* Instantiate dual writer only in ST case

* minor cleanup

---------

Co-authored-by: Charandas Batra <charandas.batra@grafana.com>

pkg/registry/apis/iam/models.go

@@ -43,4 +43,7 @@ type IdentityAccessManagementAPIBuilder struct {
 
 	// Toggle for enabling authz management apis
 	enableAuthZApis bool
+
+	// Toggle for enabling dual writer
+	enableDualWriter bool
 }

pkg/registry/apis/iam/register.go

@@ -65,6 +65,7 @@ func RegisterAPIService(
 		display:            user.NewLegacyDisplayREST(store),
 		reg:                reg,
 		enableAuthZApis:    features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis),
+		enableDualWriter:   true,
 	}
 	apiregistration.RegisterAPI(builder)
 
@@ -127,23 +128,23 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 
 	userResource := legacyiamv0.UserResourceInfo
 	legacyStore := user.NewLegacyStore(b.store, b.legacyAccessClient)
-
-	// TODO: Figure out what's missing for the DualWriter setup in a MT setup
-	// MT app is unable to start if DW is configured
-	// store, err := grafanaregistry.NewRegistryStore(opts.Scheme, userResource, opts.OptsGetter)
-	// if err != nil {
-	// 	return err
-	// }
-
-	// dw, err := opts.DualWriteBuilder(userResource.GroupResource(), legacyStore, store)
-	// if err != nil {
-	// 	return err
-	// }
-
-	// storage[userResource.StoragePath()] = dw
 	storage[userResource.StoragePath()] = legacyStore
-	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
 
+	if b.enableDualWriter {
+		store, err := grafanaregistry.NewRegistryStore(opts.Scheme, userResource, opts.OptsGetter)
+		if err != nil {
+			return err
+		}
+
+		dw, err := opts.DualWriteBuilder(userResource.GroupResource(), legacyStore, store)
+		if err != nil {
+			return err
+		}
+
+		storage[userResource.StoragePath()] = dw
+	}
+
+	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
 	serviceAccountResource := legacyiamv0.ServiceAccountResourceInfo
 	storage[serviceAccountResource.StoragePath()] = serviceaccount.NewLegacyStore(b.store, b.legacyAccessClient)
 	storage[serviceAccountResource.StoragePath("tokens")] = serviceaccount.NewLegacyTokenREST(b.store)