From 4c17c1cbb6b8c14b4097a84922460b7e29ce01a4 Mon Sep 17 00:00:00 2001
From: Victor Cinaglia <victor@grafana.com>
Date: Thu, 24 Jul 2025 09:33:53 -0300
Subject: [PATCH] IAM: Instantiate DualWriter only when in single-tenant mode
 (#108558)

* Instantiate dual writer only in ST case

* minor cleanup

---------

Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
---
 pkg/registry/apis/iam/models.go   |  3 +++
 pkg/registry/apis/iam/register.go | 31 ++++++++++++++++---------------
 2 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/pkg/registry/apis/iam/models.go b/pkg/registry/apis/iam/models.go
index 64c4b40655c..63c74d6ed0e 100644
--- a/pkg/registry/apis/iam/models.go
+++ b/pkg/registry/apis/iam/models.go
@@ -43,4 +43,7 @@ type IdentityAccessManagementAPIBuilder struct {
 
 	// Toggle for enabling authz management apis
 	enableAuthZApis bool
+
+	// Toggle for enabling dual writer
+	enableDualWriter bool
 }
diff --git a/pkg/registry/apis/iam/register.go b/pkg/registry/apis/iam/register.go
index 936c11c23d9..eac9f6340c3 100644
--- a/pkg/registry/apis/iam/register.go
+++ b/pkg/registry/apis/iam/register.go
@@ -65,6 +65,7 @@ func RegisterAPIService(
 		display:            user.NewLegacyDisplayREST(store),
 		reg:                reg,
 		enableAuthZApis:    features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis),
+		enableDualWriter:   true,
 	}
 	apiregistration.RegisterAPI(builder)
 
@@ -127,23 +128,23 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 
 	userResource := legacyiamv0.UserResourceInfo
 	legacyStore := user.NewLegacyStore(b.store, b.legacyAccessClient)
-
-	// TODO: Figure out what's missing for the DualWriter setup in a MT setup
-	// MT app is unable to start if DW is configured
-	// store, err := grafanaregistry.NewRegistryStore(opts.Scheme, userResource, opts.OptsGetter)
-	// if err != nil {
-	// 	return err
-	// }
-
-	// dw, err := opts.DualWriteBuilder(userResource.GroupResource(), legacyStore, store)
-	// if err != nil {
-	// 	return err
-	// }
-
-	// storage[userResource.StoragePath()] = dw
 	storage[userResource.StoragePath()] = legacyStore
-	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
 
+	if b.enableDualWriter {
+		store, err := grafanaregistry.NewRegistryStore(opts.Scheme, userResource, opts.OptsGetter)
+		if err != nil {
+			return err
+		}
+
+		dw, err := opts.DualWriteBuilder(userResource.GroupResource(), legacyStore, store)
+		if err != nil {
+			return err
+		}
+
+		storage[userResource.StoragePath()] = dw
+	}
+
+	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
 	serviceAccountResource := legacyiamv0.ServiceAccountResourceInfo
 	storage[serviceAccountResource.StoragePath()] = serviceaccount.NewLegacyStore(b.store, b.legacyAccessClient)
 	storage[serviceAccountResource.StoragePath("tokens")] = serviceaccount.NewLegacyTokenREST(b.store)