Provisioning: Add Connection resource (#115272)

* Provisioning: Add Connection resource * adding some more integration tests * updating openapi snapshot, linting * generating FE code, fixing issue in unit tests * addressing comments * addressing comments * adding more integration tests * fixing rebase issues * removing linting exception * addressing comments: improving validation and tests * adding Connection URL at mutation time, updating tests accordingly * linting
2025-12-16 14:37:07 +01:00
parent c0295d06a3
commit 5ecfc79e14
37 changed files with 4305 additions and 121 deletions
@@ -0,0 +1,28 @@
+package connection
+
+import (
+	"fmt"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+const (
+	githubInstallationURL = "https://github.com/settings/installations"
+)
+
+func MutateConnection(connection *provisioning.Connection) error {
+	switch connection.Spec.Type {
+	case provisioning.GithubConnectionType:
+		// Do nothing in case spec.Github is nil.
+		// If this field is required, we should fail at validation time.
+		if connection.Spec.GitHub == nil {
+			return nil
+		}
+
+		connection.Spec.URL = fmt.Sprintf("%s/%s", githubInstallationURL, connection.Spec.GitHub.InstallationID)
+		return nil
+	default:
+		// TODO: we need to setup the URL for bitbucket and gitlab.
+		return nil
+	}
+}
@@ -0,0 +1,35 @@
+package connection_test
+
+import (
+	"testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestMutateConnection(t *testing.T) {
+	t.Run("should add URL to Github connection", func(t *testing.T) {
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Name: "test-private-key",
+				},
+			},
+		}
+
+		require.NoError(t, connection.MutateConnection(c))
+		assert.Equal(t, "https://github.com/settings/installations/456", c.Spec.URL)
+	})
+}
@@ -0,0 +1,104 @@
+package connection
+
+import (
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func ValidateConnection(connection *provisioning.Connection) error {
+	list := field.ErrorList{}
+
+	if connection.Spec.Type == "" {
+		list = append(list, field.Required(field.NewPath("spec", "type"), "type must be specified"))
+	}
+
+	switch connection.Spec.Type {
+	case provisioning.GithubConnectionType:
+		list = append(list, validateGithubConnection(connection)...)
+	case provisioning.BitbucketConnectionType:
+		list = append(list, validateBitbucketConnection(connection)...)
+	case provisioning.GitlabConnectionType:
+		list = append(list, validateGitlabConnection(connection)...)
+	default:
+		list = append(
+			list, field.NotSupported(
+				field.NewPath("spec", "type"),
+				connection.Spec.Type,
+				[]provisioning.ConnectionType{
+					provisioning.GithubConnectionType,
+					provisioning.BitbucketConnectionType,
+					provisioning.GitlabConnectionType,
+				}),
+		)
+	}
+
+	return toError(connection.GetName(), list)
+}
+
+func validateGithubConnection(connection *provisioning.Connection) field.ErrorList {
+	list := field.ErrorList{}
+
+	if connection.Spec.GitHub == nil {
+		list = append(
+			list, field.Required(field.NewPath("spec", "github"), "github info must be specified for GitHub connection"),
+		)
+	}
+
+	if connection.Secure.PrivateKey.IsZero() {
+		list = append(list, field.Required(field.NewPath("secure", "privateKey"), "privateKey must be specified for GitHub connection"))
+	}
+	if !connection.Secure.ClientSecret.IsZero() {
+		list = append(list, field.Forbidden(field.NewPath("secure", "clientSecret"), "clientSecret is forbidden in GitHub connection"))
+	}
+
+	return list
+}
+
+func validateBitbucketConnection(connection *provisioning.Connection) field.ErrorList {
+	list := field.ErrorList{}
+
+	if connection.Spec.Bitbucket == nil {
+		list = append(
+			list, field.Required(field.NewPath("spec", "bitbucket"), "bitbucket info must be specified in Bitbucket connection"),
+		)
+	}
+	if connection.Secure.ClientSecret.IsZero() {
+		list = append(list, field.Required(field.NewPath("secure", "clientSecret"), "clientSecret must be specified for Bitbucket connection"))
+	}
+	if !connection.Secure.PrivateKey.IsZero() {
+		list = append(list, field.Forbidden(field.NewPath("secure", "privateKey"), "privateKey is forbidden in Bitbucket connection"))
+	}
+
+	return list
+}
+
+func validateGitlabConnection(connection *provisioning.Connection) field.ErrorList {
+	list := field.ErrorList{}
+
+	if connection.Spec.Gitlab == nil {
+		list = append(
+			list, field.Required(field.NewPath("spec", "gitlab"), "gitlab info must be specified in Gitlab connection"),
+		)
+	}
+	if connection.Secure.ClientSecret.IsZero() {
+		list = append(list, field.Required(field.NewPath("secure", "clientSecret"), "clientSecret must be specified for Gitlab connection"))
+	}
+	if !connection.Secure.PrivateKey.IsZero() {
+		list = append(list, field.Forbidden(field.NewPath("secure", "privateKey"), "privateKey is forbidden in Gitlab connection"))
+	}
+
+	return list
+}
+
+// toError converts a field.ErrorList to an error, returning nil if the list is empty
+func toError(name string, list field.ErrorList) error {
+	if len(list) == 0 {
+		return nil
+	}
+	return apierrors.NewInvalid(
+		provisioning.ConnectionResourceInfo.GroupVersionKind().GroupKind(),
+		name,
+		list,
+	)
+}
@@ -0,0 +1,253 @@
+package connection_test
+
+import (
+	"testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	"github.com/stretchr/testify/assert"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestValidateConnection(t *testing.T) {
+	tests := []struct {
+		name       string
+		connection *provisioning.Connection
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name: "empty type returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec:       provisioning.ConnectionSpec{},
+			},
+			wantErr: true,
+			errMsg:  "spec.type",
+		},
+		{
+			name: "invalid type returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: "invalid",
+				},
+			},
+			wantErr: true,
+			errMsg:  "spec.type",
+		},
+		{
+			name: "github type without github config returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+				},
+			},
+			wantErr: true,
+			errMsg:  "spec.github",
+		},
+		{
+			name: "github type without private key returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.privateKey",
+		},
+		{
+			name: "github type with client secret returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Name: "test-private-key",
+					},
+					ClientSecret: common.InlineSecureValue{
+						Name: "test-client-secret",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.clientSecret",
+		},
+		{
+			name: "github type with github config is valid",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Name: "test-private-key",
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "bitbucket type without bitbucket config returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.BitbucketConnectionType,
+				},
+			},
+			wantErr: true,
+			errMsg:  "spec.bitbucket",
+		},
+		{
+			name: "bitbucket type without client secret returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.BitbucketConnectionType,
+					Bitbucket: &provisioning.BitbucketConnectionConfig{
+						ClientID: "client-123",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.clientSecret",
+		},
+		{
+			name: "bitbucket type with private key returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.BitbucketConnectionType,
+					Bitbucket: &provisioning.BitbucketConnectionConfig{
+						ClientID: "client-123",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Name: "test-private-key",
+					},
+					ClientSecret: common.InlineSecureValue{
+						Name: "test-client-secret",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.privateKey",
+		},
+		{
+			name: "bitbucket type with bitbucket config is valid",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.BitbucketConnectionType,
+					Bitbucket: &provisioning.BitbucketConnectionConfig{
+						ClientID: "client-123",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					ClientSecret: common.InlineSecureValue{
+						Name: "test-client-secret",
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "gitlab type without gitlab config returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GitlabConnectionType,
+				},
+			},
+			wantErr: true,
+			errMsg:  "spec.gitlab",
+		},
+		{
+			name: "gitlab type without client secret returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GitlabConnectionType,
+					Gitlab: &provisioning.GitlabConnectionConfig{
+						ClientID: "client-456",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.clientSecret",
+		},
+		{
+			name: "gitlab type with private key returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GitlabConnectionType,
+					Gitlab: &provisioning.GitlabConnectionConfig{
+						ClientID: "client-456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Name: "test-private-key",
+					},
+					ClientSecret: common.InlineSecureValue{
+						Name: "test-client-secret",
+					},
+				},
+			},
+			wantErr: true,
+			errMsg:  "secure.privateKey",
+		},
+		{
+			name: "gitlab type with gitlab config is valid",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GitlabConnectionType,
+					Gitlab: &provisioning.GitlabConnectionConfig{
+						ClientID: "client-456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					ClientSecret: common.InlineSecureValue{
+						Name: "test-client-secret",
+					},
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := connection.ValidateConnection(tt.connection)
+			if tt.wantErr {
+				assert.Error(t, err)
+				if tt.errMsg != "" {
+					assert.Contains(t, err.Error(), tt.errMsg)
+				}
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}