Hotfix: Granting None role Viewer access for a fixed API group list (#114310)

pkg/services/apiserver/auth/authorizer/role.go

@@ -3,6 +3,7 @@ package authorizer
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 
@@ -12,6 +13,10 @@ import (
 
 var _ authorizer.Authorizer = &roleAuthorizer{}
 
+var orgRoleNoneAsViewerAPIGroups = []string{
+	"productactivation.ext.grafana.com",
+}
+
 type roleAuthorizer struct{}
 
 func newRoleAuthorizer() *roleAuthorizer {
@@ -43,6 +48,16 @@ func (auth roleAuthorizer) Authorize(ctx context.Context, a authorizer.Attribute
 			return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
 		}
 	case org.RoleNone:
+		// HOTFIX: granting Viewer actions to None roles to a fixed group of APIs,
+		//  while we work on a proper fix.
+		if slices.Contains(orgRoleNoneAsViewerAPIGroups, a.GetAPIGroup()) {
+			switch a.GetVerb() {
+			case "get", "list", "watch":
+				return authorizer.DecisionAllow, "", nil
+			default:
+				return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
+			}
+		}
 		return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
 	}
 	return authorizer.DecisionDeny, "", nil