From 505e025d18a3212710aac6c65bce66a9a3117f53 Mon Sep 17 00:00:00 2001
From: Alexander Zobnin <alexanderzobnin@gmail.com>
Date: Wed, 5 Nov 2025 11:12:41 +0100
Subject: [PATCH] Zanzana: Fix namespace in remote client (#113433)

---
 pkg/services/authz/zanzana.go   | 2 +-
 pkg/setting/settings_zanzana.go | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkg/services/authz/zanzana.go b/pkg/services/authz/zanzana.go
index 21199b502cb..3be1b18dc1d 100644
--- a/pkg/services/authz/zanzana.go
+++ b/pkg/services/authz/zanzana.go
@@ -110,7 +110,7 @@ func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.Featu
 		ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
 	}
 
-	return NewRemoteZanzanaClient(fmt.Sprintf("stacks-%s", cfg.StackID), zanzanaConfig)
+	return NewRemoteZanzanaClient(cfg.ZanzanaClient.TokenNamespace, zanzanaConfig)
 }
 
 type ZanzanaClientConfig struct {
diff --git a/pkg/setting/settings_zanzana.go b/pkg/setting/settings_zanzana.go
index be7121f3b0d..1a06ea034ef 100644
--- a/pkg/setting/settings_zanzana.go
+++ b/pkg/setting/settings_zanzana.go
@@ -27,6 +27,8 @@ type ZanzanaClientSettings struct {
 	// URL called to perform exchange request.
 	// Only used when mode is set to client.
 	TokenExchangeURL string
+	// Namespace to use for the token.
+	TokenNamespace string
 }
 
 type ZanzanaServerSettings struct {
@@ -113,6 +115,10 @@ func (cfg *Cfg) readZanzanaSettings() {
 	zc.Addr = clientSec.Key("address").MustString("")
 	zc.ServerCertFile = clientSec.Key("tls_cert").MustString("")
 
+	// TODO: read Token and TokenExchangeURL from grpc_client_authentication section
+	grpcClientAuthSection := cfg.SectionWithEnvOverrides("grpc_client_authentication")
+	zc.TokenNamespace = grpcClientAuthSection.Key("token_namespace").MustString("stacks-" + cfg.StackID)
+
 	cfg.ZanzanaClient = zc
 
 	zs := ZanzanaServerSettings{}