IAM: Add the external field to the TeamBinding spec (#112382)

* add the external field to the TeamBinding spec

* fix unit tests

pkg/registry/apis/iam/legacy/team.go

@@ -509,7 +509,7 @@ func (s *legacySQLStore) ListTeamBindings(ctx context.Context, ns claims.Namespa
 
 	for rows.Next() {
 		m := TeamMember{}
-		err = rows.Scan(&m.ID, &m.TeamUID, &m.TeamID, &m.UserUID, &m.UserID, &m.Created, &m.Updated, &m.Permission)
+		err = rows.Scan(&m.ID, &m.TeamUID, &m.TeamID, &m.UserUID, &m.UserID, &m.Created, &m.Updated, &m.Permission, &m.External)
 		if err != nil {
 			return res, err
 		}

pkg/registry/apis/iam/legacy/team_bindings_query.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM {{ .Ident .TeamMemberTable }} tm
 INNER JOIN {{ .Ident .TeamTable }} t ON tm.team_id = t.id
 INNER JOIN {{ .Ident .UserTable }} u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/mysql--team_bindings_query-team_bindings_id.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM `grafana`.`team_member` tm
 INNER JOIN `grafana`.`team` t ON tm.team_id = t.id
 INNER JOIN `grafana`.`user` u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/mysql--team_bindings_query-team_bindings_page_1.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM `grafana`.`team_member` tm
 INNER JOIN `grafana`.`team` t ON tm.team_id = t.id
 INNER JOIN `grafana`.`user` u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/mysql--team_bindings_query-team_bindings_page_2.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM `grafana`.`team_member` tm
 INNER JOIN `grafana`.`team` t ON tm.team_id = t.id
 INNER JOIN `grafana`.`user` u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/postgres--team_bindings_query-team_bindings_id.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/postgres--team_bindings_query-team_bindings_page_1.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/postgres--team_bindings_query-team_bindings_page_2.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/sqlite--team_bindings_query-team_bindings_id.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/sqlite--team_bindings_query-team_bindings_page_1.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/legacy/testdata/sqlite--team_bindings_query-team_bindings_page_2.sql

@@ -1,4 +1,4 @@
-SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission
+SELECT tm.id as id, t.uid as team_uid, t.id as team_id, u.uid as user_uid, u.id as user_id, tm.created, tm.updated, tm.permission, tm.external
 FROM "grafana"."team_member" tm
 INNER JOIN "grafana"."team" t ON tm.team_id = t.id
 INNER JOIN "grafana"."user" u ON tm.user_id  = u.id

pkg/registry/apis/iam/team/store_binding.go

@@ -136,7 +136,7 @@ func (l *LegacyBindingStore) Create(ctx context.Context, obj runtime.Object, cre
 		UserID:     userObj.ID,
 		UserUID:    teamMemberObj.Spec.Subject.Name,
 		Permission: permission,
-		External:   false,
+		External:   teamMemberObj.Spec.External,
 	}
 
 	result, err := l.store.CreateTeamMember(ctx, ns, createCmd)
@@ -229,6 +229,7 @@ func mapToBindingObject(ns claims.NamespaceInfo, tm legacy.TeamMember) iamv0alph
 				Name: tm.UserUID,
 			},
 			Permission: common.MapTeamPermission(tm.Permission),
+			External:   tm.External,
 		},
 	}
 }

pkg/tests/apis/iam/team_bindings_integration_test.go

@@ -95,6 +95,7 @@ func doTeamBindingCRUDTestsUsingTheNewAPIs(t *testing.T, helper *apis.K8sTestHel
 		require.Equal(t, user.GetName(), createdSpec["subject"].(map[string]interface{})["name"])
 		require.Equal(t, team.GetName(), createdSpec["teamRef"].(map[string]interface{})["name"])
 		require.Equal(t, "admin", createdSpec["permission"])
+		require.Equal(t, false, createdSpec["external"])
 
 		createdUID := created.GetName()
 		require.NotEmpty(t, createdUID)
@@ -108,6 +109,7 @@ func doTeamBindingCRUDTestsUsingTheNewAPIs(t *testing.T, helper *apis.K8sTestHel
 		require.Equal(t, user.GetName(), fetchedSpec["subject"].(map[string]interface{})["name"])
 		require.Equal(t, team.GetName(), fetchedSpec["teamRef"].(map[string]interface{})["name"])
 		require.Equal(t, "admin", fetchedSpec["permission"])
+		require.Equal(t, false, fetchedSpec["external"])
 
 		require.Equal(t, createdUID, fetched.GetName())
 		require.Equal(t, "default", fetched.GetNamespace())

pkg/tests/apis/iam/testdata/teambinding-test-create-v0.yaml

@@ -8,3 +8,4 @@ spec:
   teamRef:
     name: ""
   permission: "admin"
+  external: false

pkg/tests/apis/openapi_snapshots/iam.grafana.app-v0alpha1.json

@@ -4343,9 +4343,14 @@
         "required": [
           "subject",
           "teamRef",
-          "permission"
+          "permission",
+          "external"
         ],
         "properties": {
+          "external": {
+            "type": "boolean",
+            "default": false
+          },
           "permission": {
             "description": "permission of the identity in the team",
             "type": "string",
@@ -6197,9 +6202,14 @@
         "required": [
           "subject",
           "teamRef",
-          "permission"
+          "permission",
+          "external"
         ],
         "properties": {
+          "external": {
+            "type": "boolean",
+            "default": false
+          },
           "permission": {
             "description": "permission of the identity in the team",
             "type": "string",