Zanzana: Refactor fixed roles (use global store) (#97884)

* Zanzana: Pass contextual tuples for authorization

* global reconciler for fixed roles

* inject tuples from global store

* fix adding contextual tuples

* cleanup

* don't error on auth context fail

* add todo

* add context for List

* add caching

* remove unused

* use constant for global namespace

* Rename global namespace to cluster namespace

pkg/services/accesscontrol/dualwrite/reconciler.go

@@ -32,7 +32,8 @@ type ZanzanaReconciler struct {
 	lock   *serverlock.ServerLockService
 	// reconcilers are migrations that tries to reconcile the state of grafana db to zanzana store.
 	// These are run periodically to try to maintain a consistent state.
-	reconcilers []resourceReconciler
+	reconcilers       []resourceReconciler
+	globalReconcilers []globalReconciler
 }
 
 func NewZanzanaReconciler(cfg *setting.Cfg, client zanzana.Client, store db.DB, lock *serverlock.ServerLockService, folderService folder.Service) *ZanzanaReconciler {
@@ -92,6 +93,14 @@ func NewZanzanaReconciler(cfg *setting.Cfg, client zanzana.Client, store db.DB,
 				client,
 			),
 		},
+		globalReconcilers: []globalReconciler{
+			newGlobalReconciler(
+				"fixed role pemissions",
+				fixedRolePermissionsCollector(store),
+				zanzanaCollector([]string{zanzana.RelationAssignee}),
+				client,
+			),
+		},
 	}
 
 	if cfg.Anonymous.Enabled {
@@ -134,8 +143,19 @@ func (r *ZanzanaReconciler) ReconcileSync(ctx context.Context) error {
 }
 
 func (r *ZanzanaReconciler) reconcile(ctx context.Context) {
+	runGlobal := func(ctx context.Context) {
+		for _, reconciler := range r.globalReconcilers {
+			r.log.Debug("Performing zanzana reconciliation", "reconciler", reconciler.name)
+			if err := reconciler.reconcile(ctx); err != nil {
+				r.log.Warn("Failed to perform reconciliation for resource", "err", err)
+			}
+		}
+	}
+
 	run := func(ctx context.Context, namespace string) {
 		now := time.Now()
+		r.log.Debug("Started reconciliation")
+
 		for _, reconciler := range r.reconcilers {
 			r.log.Debug("Performing zanzana reconciliation", "reconciler", reconciler.name)
 			if err := reconciler.reconcile(ctx, namespace); err != nil {
@@ -167,6 +187,7 @@ func (r *ZanzanaReconciler) reconcile(ctx context.Context) {
 	}
 
 	if r.lock == nil {
+		runGlobal(ctx)
 		for _, ns := range namespaces {
 			run(ctx, ns)
 		}
@@ -175,6 +196,7 @@ func (r *ZanzanaReconciler) reconcile(ctx context.Context) {
 
 	// We ignore the error for now
 	err := r.lock.LockExecuteAndRelease(ctx, "zanzana-reconciliation", 10*time.Hour, func(ctx context.Context) {
+		runGlobal(ctx)
 		for _, ns := range namespaces {
 			run(ctx, ns)
 		}