From 7299651a3220e3660a51f16a629fdc1df6adec19 Mon Sep 17 00:00:00 2001 From: Daniele Stefano Ferru Date: Fri, 21 Nov 2025 17:50:25 +0100 Subject: [PATCH] Hotfix: Granting None role Viewer access for a fixed API group list (#114310) --- pkg/services/apiserver/auth/authorizer/role.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/pkg/services/apiserver/auth/authorizer/role.go b/pkg/services/apiserver/auth/authorizer/role.go index 82e80b38164..39b3b440665 100644 --- a/pkg/services/apiserver/auth/authorizer/role.go +++ b/pkg/services/apiserver/auth/authorizer/role.go @@ -3,6 +3,7 @@ package authorizer import ( "context" "fmt" + "slices" "k8s.io/apiserver/pkg/authorization/authorizer" @@ -12,6 +13,10 @@ import ( var _ authorizer.Authorizer = &roleAuthorizer{} +var orgRoleNoneAsViewerAPIGroups = []string{ + "productactivation.ext.grafana.com", +} + type roleAuthorizer struct{} func newRoleAuthorizer() *roleAuthorizer { @@ -43,6 +48,16 @@ func (auth roleAuthorizer) Authorize(ctx context.Context, a authorizer.Attribute return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil } case org.RoleNone: + // HOTFIX: granting Viewer actions to None roles to a fixed group of APIs, + // while we work on a proper fix. + if slices.Contains(orgRoleNoneAsViewerAPIGroups, a.GetAPIGroup()) { + switch a.GetVerb() { + case "get", "list", "watch": + return authorizer.DecisionAllow, "", nil + default: + return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil + } + } return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil } return authorizer.DecisionDeny, "", nil