public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Allow omitting default permissions when a new resource is created (#90720)

Browse Source 
* Cfg: Move rbac settings to own struct

* Cfg: Add setting to control if resource should generate managed permissions when created

* Dashboards: Check if we should generate default permissions when dashboard is created

* Folders: Check if we should generate default permissions when folder is created

* Datasource: Check if we should generate default permissions when datasource is created

* ServiceAccount: Check if we should generate default permissions when service account is created

* Cfg: Add option to specify resources for wich we should default seed

* ManagedPermissions: Move providers to their own files

* Dashboards: Default seed all possible managed permissions if configured

* Folders: Default seed all possible managed permissions if configured

* Cfg: Remove service account from list

* RBAC: Move utility function

* remove managed permission settings from the config file examples, change the setting names

* remove ini file changes from the PR

* fix setting reading

* fix linting errors

* fix tests

* fix wildcard role seeding

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: jguer <me@jguer.space>
This commit is contained in:
Ieva
2024-07-24 19:31:26 +03:00
committed by GitHub
co-authored by Karl Persson jguer
parent 82236976ae
commit 9bb2cf4968
19 changed files with 712 additions and 475 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/setting/setting.go
+2 -21
View File
@@ -322,9 +322,6 @@ type Cfg struct {
// GrafanaJavascriptAgent config
GrafanaJavascriptAgent GrafanaJavascriptAgent
// accessactionsets
OnlyStoreAccessActionSets bool
// Data sources
DataSourceLimit int
// Number of queries to be executed concurrently. Only for the datasource supports concurrency.
@@ -467,14 +464,7 @@ type Cfg struct {
OAuth2ServerGeneratedKeyTypeForClient string
OAuth2ServerAccessTokenLifespan time.Duration
// Access Control
RBACPermissionCache bool
// Enable Permission validation during role creation and provisioning
RBACPermissionValidationEnabled bool
// Reset basic roles permissions on start-up
RBACResetBasicRoles bool
// RBAC single organization. This configuration option is subject to change.
RBACSingleOrganization bool
RBAC RBACSettings
Zanzana ZanzanaSettings
@@ -1116,7 +1106,7 @@ func (cfg *Cfg) parseINIFile(iniFile *ini.File) error {
readOAuth2ServerSettings(cfg)
readAccessControlSettings(iniFile, cfg)
cfg.readRBACSettings()
cfg.readZanzanaSettings()
@@ -1657,15 +1647,6 @@ func readAuthSettings(iniFile *ini.File, cfg *Cfg) (err error) {
return nil
}
func readAccessControlSettings(iniFile *ini.File, cfg *Cfg) {
rbac := iniFile.Section("rbac")
cfg.RBACPermissionCache = rbac.Key("permission_cache").MustBool(true)
cfg.RBACPermissionValidationEnabled = rbac.Key("permission_validation_enabled").MustBool(false)
cfg.RBACResetBasicRoles = rbac.Key("reset_basic_roles").MustBool(false)
cfg.RBACSingleOrganization = rbac.Key("single_organization").MustBool(false)
cfg.OnlyStoreAccessActionSets = rbac.Key("only_store_access_action_sets").MustBool(false)
}
func readOAuth2ServerSettings(cfg *Cfg) {
oauth2Srv := cfg.SectionWithEnvOverrides("oauth2_server")
cfg.OAuth2ServerEnabled = oauth2Srv.Key("enabled").MustBool(false)