From 657bf769225c1deed7869dedc883c928bc1af7d1 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Mon, 15 Dec 2025 15:47:12 +0100 Subject: [PATCH] `grafana-iam`: Instantiate parent provider (#115224) --- pkg/registry/apis/iam/authorizer/resource_permissions.go | 5 ++--- pkg/registry/apis/iam/register.go | 6 ++++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/pkg/registry/apis/iam/authorizer/resource_permissions.go b/pkg/registry/apis/iam/authorizer/resource_permissions.go index 3e039e36222..0fbf413adac 100644 --- a/pkg/registry/apis/iam/authorizer/resource_permissions.go +++ b/pkg/registry/apis/iam/authorizer/resource_permissions.go @@ -40,7 +40,7 @@ func NewResourcePermissionsAuthorizer( return &ResourcePermissionsAuthorizer{ accessClient: accessClient, parentProvider: parentProvider, - logger: log.New("iam.resource-permissions-authorizer"), + logger: log.New("iam.authorizer.resource-permissions"), } } @@ -216,8 +216,7 @@ func (r *ResourcePermissionsAuthorizer) FilterList(ctx context.Context, list run // Skip item on error fetching parent r.logger.Warn("filter list: error fetching parent, skipping item", "error", err.Error(), - "namespace", - item.Namespace, + "namespace", item.Namespace, "group", target.ApiGroup, "resource", target.Resource, "name", target.Name, diff --git a/pkg/registry/apis/iam/register.go b/pkg/registry/apis/iam/register.go index 5145cf3afa4..a9a68e90d2c 100644 --- a/pkg/registry/apis/iam/register.go +++ b/pkg/registry/apis/iam/register.go @@ -21,6 +21,7 @@ import ( "k8s.io/kube-openapi/pkg/spec3" "k8s.io/kube-openapi/pkg/validation/spec" + "github.com/grafana/authlib/authn" "github.com/grafana/authlib/types" iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1" @@ -142,6 +143,8 @@ func NewAPIService( features featuremgmt.FeatureToggles, zClient zanzana.Client, reg prometheus.Registerer, + tokenExchanger authn.TokenExchanger, + authorizerDialConfigs map[schema.GroupResource]iamauthorizer.DialConfig, ) *IdentityAccessManagementAPIBuilder { store := legacy.NewLegacySQLStores(dbProvider) resourcePermissionsStorage := resourcepermission.ProvideStorageBackend(dbProvider) @@ -150,9 +153,8 @@ func NewAPIService( resourceAuthorizer := gfauthorizer.NewResourceAuthorizer(accessClient) coreRoleAuthorizer := iamauthorizer.NewCoreRoleAuthorizer(accessClient) - // TODO: in a follow up PR, make this configurable resourceParentProvider := iamauthorizer.NewApiParentProvider( - iamauthorizer.NewRemoteConfigProvider(map[schema.GroupResource]iamauthorizer.DialConfig{}, nil), + iamauthorizer.NewRemoteConfigProvider(authorizerDialConfigs, tokenExchanger), iamauthorizer.Versions, )