IAM: Moving code to the /pkg/apps/iam folder (#109985)

* wip

* Gen GetTeams with app sdk

* Revert some changes, cleanup

* Format iam_manifest.go

* Remove generated file

* Regenerate openapi defs

* Cleanup

* Remove TODO

apps/iam/kinds/user.cue

@@ -8,13 +8,41 @@ userKind: {
 	kind:       "User"
 	pluralName: "Users"
 	codegen: {
-		ts: { enabled: false }
-		go: { enabled: true }
+		ts: {enabled: false}
+		go: {enabled: true}
 	}
 }
 
 userv0alpha1: userKind & {
+	// TODO: Uncomment this when User will be added to ManagedKinds 
+	// validation: {
+	// 	operations: [
+	// 		"CREATE",
+	// 		"UPDATE",
+	// 	]
+	// }
+	// mutation: {
+	// 	operations: [
+	// 		"CREATE",
+	// 		"UPDATE",
+	// 	]
+	// }
 	schema: {
 		spec: v0alpha1.UserSpec
 	}
+	// TODO: Uncomment when the custom routes implementation is done
+	// routes: {
+	// 	"/teams": {
+	// 		"GET": {
+	// 			response: {
+	// 				#UserTeam: {
+	// 					title: string
+	// 					teamRef: v0alpha1.TeamRef
+	// 					permission: v0alpha1.TeamPermission
+	// 				}
+	// 				items: [...#UserTeam]
+	// 			}
+	// 		}
+	// 	}
+	// }
 }

apps/iam/pkg/apis/iam/v0alpha1/register.go

@@ -2,6 +2,7 @@ package v0alpha1
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
@@ -96,20 +97,142 @@ var ResourcePermissionInfo = utils.NewResourceInfo(GROUP, VERSION,
 	},
 )
 
+var userKind = UserKind()
+var UserResourceInfo = utils.NewResourceInfo(userKind.Group(), userKind.Version(),
+	userKind.GroupVersionResource().Resource, strings.ToLower(userKind.Kind()), userKind.Kind(),
+	func() runtime.Object { return userKind.ZeroValue() },
+	func() runtime.Object { return userKind.ZeroListValue() },
+	utils.TableColumns{
+		Definition: []metav1.TableColumnDefinition{
+			{Name: "Name", Type: "string", Format: "name"},
+			{Name: "Login", Type: "string", Format: "string", Description: "The user login"},
+			{Name: "Email", Type: "string", Format: "string", Description: "The user email"},
+			{Name: "Created At", Type: "date"},
+		},
+		Reader: func(obj any) ([]interface{}, error) {
+			u, ok := obj.(*User)
+			if ok {
+				return []interface{}{
+					u.Name,
+					u.Spec.Login,
+					u.Spec.Email,
+					u.CreationTimestamp.UTC().Format(time.RFC3339),
+				}, nil
+			}
+			return nil, fmt.Errorf("expected user")
+		},
+	},
+)
+
+var teamKind = TeamKind()
+var TeamResourceInfo = utils.NewResourceInfo(teamKind.Group(), teamKind.Version(),
+	teamKind.GroupVersionResource().Resource, strings.ToLower(teamKind.Kind()), teamKind.Kind(),
+	func() runtime.Object { return teamKind.ZeroValue() },
+	func() runtime.Object { return teamKind.ZeroListValue() },
+	utils.TableColumns{
+		Definition: []metav1.TableColumnDefinition{
+			{Name: "Name", Type: "string", Format: "name"},
+			{Name: "Title", Type: "string", Format: "string", Description: "The team name"},
+			{Name: "Email", Type: "string", Format: "string", Description: "team email"},
+			{Name: "Created At", Type: "date"},
+		},
+		Reader: func(obj any) ([]interface{}, error) {
+			m, ok := obj.(*Team)
+			if !ok {
+				return nil, fmt.Errorf("expected team")
+			}
+			return []interface{}{
+				m.Name,
+				m.Spec.Title,
+				m.Spec.Email,
+				m.CreationTimestamp.UTC().Format(time.RFC3339),
+			}, nil
+		},
+	},
+)
+
+var serviceAccountKind = ServiceAccountKind()
+var ServiceAccountResourceInfo = utils.NewResourceInfo(serviceAccountKind.Group(), serviceAccountKind.Version(),
+	serviceAccountKind.GroupVersionResource().Resource, strings.ToLower(serviceAccountKind.Kind()), serviceAccountKind.Kind(),
+	func() runtime.Object { return serviceAccountKind.ZeroValue() },
+	func() runtime.Object { return serviceAccountKind.ZeroListValue() },
+	utils.TableColumns{
+		Definition: []metav1.TableColumnDefinition{
+			{Name: "Name", Type: "string", Format: "name"},
+			{Name: "Title", Type: "string", Format: "string"},
+			{Name: "Disabled", Type: "boolean"},
+			{Name: "Created At", Type: "date"},
+		},
+		Reader: func(obj any) ([]interface{}, error) {
+			sa, ok := obj.(*ServiceAccount)
+			if ok {
+				return []interface{}{
+					sa.Name,
+					sa.Spec.Title,
+					sa.Spec.Disabled,
+					sa.CreationTimestamp.UTC().Format(time.RFC3339),
+				}, nil
+			}
+			return nil, fmt.Errorf("expected service account")
+		},
+	},
+)
+
+var teamBindingKind = TeamBindingKind()
+var TeamBindingResourceInfo = utils.NewResourceInfo(
+	teamBindingKind.Group(), teamBindingKind.Version(),
+	teamBindingKind.GroupVersionResource().Resource,
+	strings.ToLower(teamBindingKind.Kind()), teamBindingKind.Kind(),
+	func() runtime.Object { return teamBindingKind.ZeroValue() },
+	func() runtime.Object { return teamBindingKind.ZeroListValue() },
+	utils.TableColumns{
+		Definition: []metav1.TableColumnDefinition{
+			{Name: "Name", Type: "string", Format: "name"},
+			{Name: "Team", Type: "string"},
+			{Name: "Created At", Type: "string", Format: "date"},
+		},
+		Reader: func(obj any) ([]interface{}, error) {
+			m, ok := obj.(*TeamBinding)
+			if !ok {
+				return nil, fmt.Errorf("expected team binding")
+			}
+			return []interface{}{
+				m.Name,
+				m.Spec.TeamRef.Name,
+				m.CreationTimestamp.UTC().Format(time.RFC3339),
+			}, nil
+		},
+	},
+)
+
 var (
 	SchemeBuilder      runtime.SchemeBuilder
 	localSchemeBuilder = &SchemeBuilder
 	AddToScheme        = localSchemeBuilder.AddToScheme
-	schemeGroupVersion = schema.GroupVersion{Group: GROUP, Version: VERSION}
+
+	SchemeGroupVersion   = schema.GroupVersion{Group: GROUP, Version: VERSION}
+	InternalGroupVersion = schema.GroupVersion{Group: GROUP, Version: runtime.APIVersionInternal}
 )
 
 func init() {
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(func(s *runtime.Scheme) error {
+		err := AddAuthZKnownTypes(s)
+		if err != nil {
+			return err
+		}
+
+		err = AddAuthNKnownTypes(s)
+		if err != nil {
+			return err
+		}
+
+		metav1.AddToGroupVersion(s, SchemeGroupVersion)
+		return nil
+	}, addDefaultingFuncs)
 }
 
-// Adds the list of known types to the given scheme.
-func addKnownTypes(scheme *runtime.Scheme) error {
-	scheme.AddKnownTypes(schemeGroupVersion,
+func AddAuthZKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
 		&CoreRole{},
 		&CoreRoleList{},
 		&Role{},
@@ -121,7 +244,31 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&metav1.PartialObjectMetadata{},
 		&metav1.PartialObjectMetadataList{},
 	)
-	metav1.AddToGroupVersion(scheme, schemeGroupVersion)
+	return nil
+}
+
+func AddAuthNKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		// Identity
+		&User{},
+		&UserList{},
+		&ServiceAccount{},
+		&ServiceAccountList{},
+		&Team{},
+		&TeamList{},
+		&TeamBinding{},
+		&TeamBindingList{},
+		// For now these are registered in pkg/apis/iam/v0alpha1/register.go
+		// &UserTeamList{},
+		// &ServiceAccountTokenList{},
+		// &DisplayList{},
+		// &SSOSetting{},
+		// &SSOSettingList{},
+		// &TeamMemberList{},
+
+		&metav1.PartialObjectMetadata{},
+		&metav1.PartialObjectMetadataList{},
+	)
 	return nil
 }
 

pkg/apis/iam/v0alpha1/register.go

@@ -2,10 +2,8 @@ package v0alpha1
 
 import (
 	"fmt"
-	"strings"
 	"time"
 
-	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -18,87 +16,6 @@ const (
 	APIVERSION = GROUP + "/" + VERSION
 )
 
-var userKind = iamv0alpha1.UserKind()
-var UserResourceInfo = utils.NewResourceInfo(userKind.Group(), userKind.Version(),
-	userKind.GroupVersionResource().Resource, strings.ToLower(userKind.Kind()), userKind.Kind(),
-	func() runtime.Object { return userKind.ZeroValue() },
-	func() runtime.Object { return userKind.ZeroListValue() },
-	utils.TableColumns{
-		Definition: []metav1.TableColumnDefinition{
-			{Name: "Name", Type: "string", Format: "name"},
-			{Name: "Login", Type: "string", Format: "string", Description: "The user login"},
-			{Name: "Email", Type: "string", Format: "string", Description: "The user email"},
-			{Name: "Created At", Type: "date"},
-		},
-		Reader: func(obj any) ([]interface{}, error) {
-			u, ok := obj.(*iamv0alpha1.User)
-			if ok {
-				return []interface{}{
-					u.Name,
-					u.Spec.Login,
-					u.Spec.Email,
-					u.CreationTimestamp.UTC().Format(time.RFC3339),
-				}, nil
-			}
-			return nil, fmt.Errorf("expected user")
-		},
-	},
-)
-
-var teamKind = iamv0alpha1.TeamKind()
-var TeamResourceInfo = utils.NewResourceInfo(teamKind.Group(), teamKind.Version(),
-	teamKind.GroupVersionResource().Resource, strings.ToLower(teamKind.Kind()), teamKind.Kind(),
-	func() runtime.Object { return teamKind.ZeroValue() },
-	func() runtime.Object { return teamKind.ZeroListValue() },
-	utils.TableColumns{
-		Definition: []metav1.TableColumnDefinition{
-			{Name: "Name", Type: "string", Format: "name"},
-			{Name: "Title", Type: "string", Format: "string", Description: "The team name"},
-			{Name: "Email", Type: "string", Format: "string", Description: "team email"},
-			{Name: "Created At", Type: "date"},
-		},
-		Reader: func(obj any) ([]interface{}, error) {
-			m, ok := obj.(*iamv0alpha1.Team)
-			if !ok {
-				return nil, fmt.Errorf("expected team")
-			}
-			return []interface{}{
-				m.Name,
-				m.Spec.Title,
-				m.Spec.Email,
-				m.CreationTimestamp.UTC().Format(time.RFC3339),
-			}, nil
-		},
-	},
-)
-
-var serviceAccountKind = iamv0alpha1.ServiceAccountKind()
-var ServiceAccountResourceInfo = utils.NewResourceInfo(serviceAccountKind.Group(), serviceAccountKind.Version(),
-	serviceAccountKind.GroupVersionResource().Resource, strings.ToLower(serviceAccountKind.Kind()), serviceAccountKind.Kind(),
-	func() runtime.Object { return serviceAccountKind.ZeroValue() },
-	func() runtime.Object { return serviceAccountKind.ZeroListValue() },
-	utils.TableColumns{
-		Definition: []metav1.TableColumnDefinition{
-			{Name: "Name", Type: "string", Format: "name"},
-			{Name: "Title", Type: "string", Format: "string"},
-			{Name: "Disabled", Type: "boolean"},
-			{Name: "Created At", Type: "date"},
-		},
-		Reader: func(obj any) ([]interface{}, error) {
-			sa, ok := obj.(*iamv0alpha1.ServiceAccount)
-			if ok {
-				return []interface{}{
-					sa.Name,
-					sa.Spec.Title,
-					sa.Spec.Disabled,
-					sa.CreationTimestamp.UTC().Format(time.RFC3339),
-				}, nil
-			}
-			return nil, fmt.Errorf("expected service account")
-		},
-	},
-)
-
 var SSOSettingResourceInfo = utils.NewResourceInfo(
 	GROUP, VERSION, "ssosettings", "ssosetting", "SSOSetting",
 	func() runtime.Object { return &SSOSetting{} },
@@ -125,33 +42,6 @@ var SSOSettingResourceInfo = utils.NewResourceInfo(
 	},
 )
 
-var teamBindingKind = iamv0alpha1.TeamBindingKind()
-var TeamBindingResourceInfo = utils.NewResourceInfo(
-	teamBindingKind.Group(), teamBindingKind.Version(),
-	teamBindingKind.GroupVersionResource().Resource,
-	strings.ToLower(teamBindingKind.Kind()), teamBindingKind.Kind(),
-	func() runtime.Object { return teamBindingKind.ZeroValue() },
-	func() runtime.Object { return teamBindingKind.ZeroListValue() },
-	utils.TableColumns{
-		Definition: []metav1.TableColumnDefinition{
-			{Name: "Name", Type: "string", Format: "name"},
-			{Name: "Team", Type: "string"},
-			{Name: "Created At", Type: "string", Format: "date"},
-		},
-		Reader: func(obj any) ([]interface{}, error) {
-			m, ok := obj.(*iamv0alpha1.TeamBinding)
-			if !ok {
-				return nil, fmt.Errorf("expected team binding")
-			}
-			return []interface{}{
-				m.Name,
-				m.Spec.TeamRef.Name,
-				m.CreationTimestamp.UTC().Format(time.RFC3339),
-			}, nil
-		},
-	},
-)
-
 var (
 	// SchemeGroupVersion is group version used to register these objects
 	SchemeGroupVersion = schema.GroupVersion{Group: GROUP, Version: VERSION}
@@ -166,19 +56,11 @@ var (
 func AddKnownTypes(scheme *runtime.Scheme, version string) {
 	scheme.AddKnownTypes(
 		schema.GroupVersion{Group: GROUP, Version: version},
-		&iamv0alpha1.User{},
-		&iamv0alpha1.UserList{},
 		&UserTeamList{},
-		&iamv0alpha1.ServiceAccount{},
-		&iamv0alpha1.ServiceAccountList{},
 		&ServiceAccountTokenList{},
-		&iamv0alpha1.Team{},
-		&iamv0alpha1.TeamList{},
 		&DisplayList{},
 		&SSOSetting{},
 		&SSOSettingList{},
-		&iamv0alpha1.TeamBinding{},
-		&iamv0alpha1.TeamBindingList{},
 		&TeamMemberList{},
 	)
 }

pkg/registry/apis/iam/authorizer.go

@@ -9,7 +9,6 @@ import (
 	authlib "github.com/grafana/authlib/types"
 	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
-	legacyiamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	gfauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
@@ -24,9 +23,9 @@ func newIAMAuthorizer(accessClient authlib.AccessClient, legacyAccessClient auth
 
 	// Identity specific resources
 	legacyAuthorizer := gfauthorizer.NewResourceAuthorizer(legacyAccessClient)
-	resourceAuthorizer[legacyiamv0.UserResourceInfo.GetName()] = legacyAuthorizer
-	resourceAuthorizer[legacyiamv0.ServiceAccountResourceInfo.GetName()] = legacyAuthorizer
-	resourceAuthorizer[legacyiamv0.TeamResourceInfo.GetName()] = legacyAuthorizer
+	resourceAuthorizer[iamv0.UserResourceInfo.GetName()] = legacyAuthorizer
+	resourceAuthorizer[iamv0.ServiceAccountResourceInfo.GetName()] = legacyAuthorizer
+	resourceAuthorizer[iamv0.TeamResourceInfo.GetName()] = legacyAuthorizer
 	resourceAuthorizer["display"] = legacyAuthorizer
 
 	// Access specific resources
@@ -55,7 +54,7 @@ func newLegacyAccessClient(ac accesscontrol.AccessControl, store legacy.LegacyId
 	client := accesscontrol.NewLegacyAccessClient(
 		ac,
 		accesscontrol.ResourceAuthorizerOptions{
-			Resource: legacyiamv0.UserResourceInfo.GetName(),
+			Resource: iamv0.UserResourceInfo.GetName(),
 			Attr:     "id",
 			Mapping: map[string]string{
 				utils.VerbCreate: accesscontrol.ActionUsersCreate,
@@ -81,7 +80,7 @@ func newLegacyAccessClient(ac accesscontrol.AccessControl, store legacy.LegacyId
 			},
 		},
 		accesscontrol.ResourceAuthorizerOptions{
-			Resource: legacyiamv0.ServiceAccountResourceInfo.GetName(),
+			Resource: iamv0.ServiceAccountResourceInfo.GetName(),
 			Attr:     "id",
 			Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns authlib.NamespaceInfo, name string) ([]string, error) {
 				res, err := store.GetServiceAccountInternalID(ctx, ns, legacy.GetServiceAccountInternalIDQuery{
@@ -94,7 +93,7 @@ func newLegacyAccessClient(ac accesscontrol.AccessControl, store legacy.LegacyId
 			}),
 		},
 		accesscontrol.ResourceAuthorizerOptions{
-			Resource: legacyiamv0.TeamResourceInfo.GetName(),
+			Resource: iamv0.TeamResourceInfo.GetName(),
 			Attr:     "id",
 			Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns authlib.NamespaceInfo, name string) ([]string, error) {
 				res, err := store.GetTeamInternalID(ctx, ns, legacy.GetTeamInternalIDQuery{

pkg/registry/apis/iam/register.go

@@ -104,11 +104,15 @@ func (b *IdentityAccessManagementAPIBuilder) GetGroupVersion() schema.GroupVersi
 
 func (b *IdentityAccessManagementAPIBuilder) InstallSchema(scheme *runtime.Scheme) error {
 	if b.enableAuthZApis {
-		if err := iamv0.AddToScheme(scheme); err != nil {
+		if err := iamv0.AddAuthZKnownTypes(scheme); err != nil {
 			return err
 		}
 	}
 
+	if err := iamv0.AddAuthNKnownTypes(scheme); err != nil {
+		return err
+	}
+
 	legacyiamv0.AddKnownTypes(scheme, legacyiamv0.VERSION)
 
 	// Link this version to the internal representation.
@@ -116,8 +120,8 @@ func (b *IdentityAccessManagementAPIBuilder) InstallSchema(scheme *runtime.Schem
 	// "no kind is registered for the type"
 	legacyiamv0.AddKnownTypes(scheme, runtime.APIVersionInternal)
 
-	metav1.AddToGroupVersion(scheme, legacyiamv0.SchemeGroupVersion)
-	return scheme.SetVersionPriority(legacyiamv0.SchemeGroupVersion)
+	metav1.AddToGroupVersion(scheme, iamv0.SchemeGroupVersion)
+	return scheme.SetVersionPriority(iamv0.SchemeGroupVersion)
 }
 
 func (b *IdentityAccessManagementAPIBuilder) AllowedV0Alpha1Resources() []string {
@@ -127,14 +131,14 @@ func (b *IdentityAccessManagementAPIBuilder) AllowedV0Alpha1Resources() []string
 func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupInfo, opts builder.APIGroupOptions) error {
 	storage := map[string]rest.Storage{}
 
-	teamResource := legacyiamv0.TeamResourceInfo
+	teamResource := iamv0.TeamResourceInfo
 	storage[teamResource.StoragePath()] = team.NewLegacyStore(b.store, b.legacyAccessClient)
 	storage[teamResource.StoragePath("members")] = team.NewLegacyTeamMemberREST(b.store)
 
-	teamBindingResource := legacyiamv0.TeamBindingResourceInfo
+	teamBindingResource := iamv0.TeamBindingResourceInfo
 	storage[teamBindingResource.StoragePath()] = team.NewLegacyBindingStore(b.store)
 
-	userResource := legacyiamv0.UserResourceInfo
+	userResource := iamv0.UserResourceInfo
 	legacyStore := user.NewLegacyStore(b.store, b.legacyAccessClient, b.enableAuthnMutation)
 	storage[userResource.StoragePath()] = legacyStore
 
@@ -153,7 +157,7 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 	}
 
 	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
-	serviceAccountResource := legacyiamv0.ServiceAccountResourceInfo
+	serviceAccountResource := iamv0.ServiceAccountResourceInfo
 	storage[serviceAccountResource.StoragePath()] = serviceaccount.NewLegacyStore(b.store, b.legacyAccessClient)
 	storage[serviceAccountResource.StoragePath("tokens")] = serviceaccount.NewLegacyTokenREST(b.store)
 
@@ -265,7 +269,7 @@ func (b *IdentityAccessManagementAPIBuilder) GetAuthorizer() authorizer.Authoriz
 func (b *IdentityAccessManagementAPIBuilder) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	switch a.GetOperation() {
 	case admission.Create:
-		if a.GetKind() == legacyiamv0.UserResourceInfo.GroupVersionKind() {
+		if a.GetKind() == iamv0.UserResourceInfo.GroupVersionKind() {
 			return b.validateCreateUser(ctx, a, o)
 		}
 		return nil
@@ -290,7 +294,7 @@ func (b *IdentityAccessManagementAPIBuilder) validateCreateUser(ctx context.Cont
 
 	// Temporary validation that the user is not trying to create a Grafana Admin without being a Grafana Admin.
 	if userObj.Spec.GrafanaAdmin && !requester.GetIsGrafanaAdmin() {
-		return apierrors.NewForbidden(legacyiamv0.UserResourceInfo.GroupResource(),
+		return apierrors.NewForbidden(iamv0.UserResourceInfo.GroupResource(),
 			userObj.Name,
 			fmt.Errorf("only grafana admins can create grafana admins"))
 	}
@@ -308,7 +312,7 @@ func (b *IdentityAccessManagementAPIBuilder) validateCreateUser(ctx context.Cont
 func (b *IdentityAccessManagementAPIBuilder) Mutate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	switch a.GetOperation() {
 	case admission.Create:
-		if a.GetKind() == legacyiamv0.UserResourceInfo.GroupVersionKind() {
+		if a.GetKind() == iamv0.UserResourceInfo.GroupVersionKind() {
 			return b.mutateUser(ctx, a, o)
 		}
 		return nil

pkg/registry/apis/iam/serviceaccount/store.go

@@ -12,7 +12,6 @@ import (
 	claims "github.com/grafana/authlib/types"
 	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
-	iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
@@ -26,7 +25,7 @@ var (
 	_ rest.Storage              = (*LegacyStore)(nil)
 )
 
-var resource = iamv0.ServiceAccountResourceInfo
+var resource = iamv0alpha1.ServiceAccountResourceInfo
 
 func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
 	return &LegacyStore{store, ac}

pkg/registry/apis/iam/team/store.go

@@ -13,7 +13,6 @@ import (
 	claims "github.com/grafana/authlib/types"
 	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
-	iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
@@ -28,7 +27,7 @@ var (
 	_ rest.Storage              = (*LegacyStore)(nil)
 )
 
-var resource = iamv0.TeamResourceInfo
+var resource = iamv0alpha1.TeamResourceInfo
 
 func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
 	return &LegacyStore{store, ac}

pkg/registry/apis/iam/team/store_binding.go

@@ -19,7 +19,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/team"
 )
 
-var bindingResource = iamv0.TeamBindingResourceInfo
+var bindingResource = iamv0alpha1.TeamBindingResourceInfo
 
 var (
 	_ rest.Storage              = (*LegacyBindingStore)(nil)

pkg/registry/apis/iam/user/store.go

@@ -11,9 +11,8 @@ import (
 	"k8s.io/apiserver/pkg/registry/rest"
 
 	claims "github.com/grafana/authlib/types"
-	iamv0alpha "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
-	iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
@@ -35,7 +34,7 @@ var (
 	_ rest.TableConvertor       = (*LegacyStore)(nil)
 )
 
-var resource = iamv0.UserResourceInfo
+var resource = iamv0alpha1.UserResourceInfo
 
 func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient, enableAuthnMutation bool) *LegacyStore {
 	return &LegacyStore{store, ac, enableAuthnMutation}
@@ -127,7 +126,7 @@ func (s *LegacyStore) ConvertToTable(ctx context.Context, object runtime.Object,
 func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOptions) (runtime.Object, error) {
 	res, err := common.List(
 		ctx, resource, s.ac, common.PaginationFromListOptions(options),
-		func(ctx context.Context, ns claims.NamespaceInfo, p common.Pagination) (*common.ListResponse[iamv0alpha.User], error) {
+		func(ctx context.Context, ns claims.NamespaceInfo, p common.Pagination) (*common.ListResponse[iamv0alpha1.User], error) {
 			found, err := s.store.ListUsers(ctx, ns, legacy.ListUserQuery{
 				Pagination: p,
 			})
@@ -136,12 +135,12 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 				return nil, err
 			}
 
-			users := make([]iamv0alpha.User, 0, len(found.Users))
+			users := make([]iamv0alpha1.User, 0, len(found.Users))
 			for _, u := range found.Users {
 				users = append(users, toUserItem(&u, ns.Value))
 			}
 
-			return &common.ListResponse[iamv0alpha.User]{
+			return &common.ListResponse[iamv0alpha1.User]{
 				Items:    users,
 				RV:       found.RV,
 				Continue: found.Continue,
@@ -153,7 +152,7 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 		return nil, err
 	}
 
-	obj := &iamv0alpha.UserList{Items: res.Items}
+	obj := &iamv0alpha1.UserList{Items: res.Items}
 	obj.Continue = common.OptionalFormatInt(res.Continue)
 	obj.ResourceVersion = common.OptionalFormatInt(res.RV)
 	return obj, nil
@@ -192,7 +191,7 @@ func (s *LegacyStore) Create(ctx context.Context, obj runtime.Object, createVali
 		return nil, err
 	}
 
-	userObj, ok := obj.(*iamv0alpha.User)
+	userObj, ok := obj.(*iamv0alpha1.User)
 	if !ok {
 		return nil, fmt.Errorf("expected User object, got %T", obj)
 	}
@@ -227,15 +226,15 @@ func (s *LegacyStore) Create(ctx context.Context, obj runtime.Object, createVali
 	return &iamUser, nil
 }
 
-func toUserItem(u *user.User, ns string) iamv0alpha.User {
-	item := &iamv0alpha.User{
+func toUserItem(u *user.User, ns string) iamv0alpha1.User {
+	item := &iamv0alpha1.User{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:              u.UID,
 			Namespace:         ns,
 			ResourceVersion:   fmt.Sprintf("%d", u.Updated.UnixMilli()),
 			CreationTimestamp: metav1.NewTime(u.Created),
 		},
-		Spec: iamv0alpha.UserSpec{
+		Spec: iamv0alpha1.UserSpec{
 			Name:          u.Name,
 			Login:         u.Login,
 			Email:         u.Email,

pkg/registry/apis/provisioning/resources/client.go

@@ -14,7 +14,7 @@ import (
 	dashboardV2alpha1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2alpha1"
 	dashboardV2beta1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2beta1"
 	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
-	iam "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
+	iam "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/services/apiserver"
 	"github.com/grafana/grafana/pkg/services/apiserver/client"
 )

pkg/services/authz/zanzana/common/info.go

@@ -5,7 +5,7 @@ import (
 
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
-	iamalpha1 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 )
 
@@ -21,18 +21,18 @@ var typedResources = map[string]typeInfo{
 		"",
 	): {Type: "folder", Relations: RelationsTyped},
 	FormatGroupResource(
-		iamalpha1.TeamResourceInfo.GroupResource().Group,
-		iamalpha1.TeamResourceInfo.GroupResource().Resource,
+		iamv0alpha1.TeamResourceInfo.GroupResource().Group,
+		iamv0alpha1.TeamResourceInfo.GroupResource().Resource,
 		"",
 	): {Type: "team", Relations: RelationsTyped},
 	FormatGroupResource(
-		iamalpha1.UserResourceInfo.GroupResource().Group,
-		iamalpha1.UserResourceInfo.GroupResource().Resource,
+		iamv0alpha1.UserResourceInfo.GroupResource().Group,
+		iamv0alpha1.UserResourceInfo.GroupResource().Resource,
 		"",
 	): {Type: "user", Relations: RelationsTyped},
 	FormatGroupResource(
-		iamalpha1.ServiceAccountResourceInfo.GroupResource().Group,
-		iamalpha1.ServiceAccountResourceInfo.GroupResource().Resource,
+		iamv0alpha1.ServiceAccountResourceInfo.GroupResource().Group,
+		iamv0alpha1.ServiceAccountResourceInfo.GroupResource().Resource,
 		"",
 	): {Type: "service-account", Relations: RelationsTyped},
 }