From adf1224e82d83277e169646db477462a9a4db8e2 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Tue, 21 Oct 2025 16:03:17 +0200 Subject: [PATCH] AuthZ: Zanzana only evaluation toggle (#112715) * Zanzana: Feature toggle to enable zanzana only evaluation * refactor * Update pkg/services/featuremgmt/toggles_gen.json Co-authored-by: Ieva --------- Co-authored-by: Ieva --- .../grafana-data/src/types/featureToggles.gen.ts | 4 ++++ pkg/services/authz/rbac.go | 11 +++++++++-- pkg/services/featuremgmt/registry.go | 8 ++++++++ pkg/services/featuremgmt/toggles_gen.csv | 1 + pkg/services/featuremgmt/toggles_gen.go | 4 ++++ pkg/services/featuremgmt/toggles_gen.json | 14 ++++++++++++++ 6 files changed, 40 insertions(+), 2 deletions(-) diff --git a/packages/grafana-data/src/types/featureToggles.gen.ts b/packages/grafana-data/src/types/featureToggles.gen.ts index 6665580aa8f..9a21f7b4cbf 100644 --- a/packages/grafana-data/src/types/featureToggles.gen.ts +++ b/packages/grafana-data/src/types/featureToggles.gen.ts @@ -621,6 +621,10 @@ export interface FeatureToggles { */ zanzana?: boolean; /** + * Use openFGA as main authorization engine and disable legacy RBAC clietn. + */ + zanzanaNoLegacyClient?: boolean; + /** * Enables reload of dashboards on scopes, time range and variables changes */ reloadDashboardsOnParamsChange?: boolean; diff --git a/pkg/services/authz/rbac.go b/pkg/services/authz/rbac.go index b59d128422b..57671913c03 100644 --- a/pkg/services/authz/rbac.go +++ b/pkg/services/authz/rbac.go @@ -23,6 +23,7 @@ import ( "github.com/grafana/authlib/cache" authlib "github.com/grafana/authlib/types" "github.com/grafana/dskit/middleware" + "github.com/grafana/grafana/pkg/infra/db" "github.com/grafana/grafana/pkg/infra/log" "github.com/grafana/grafana/pkg/infra/tracing" @@ -53,6 +54,8 @@ func ProvideAuthZClient( zanzanaClient zanzana.Client, restConfig apiserver.RestConfigProvider, ) (authlib.AccessClient, error) { + zanzanaEnabled := features.IsEnabledGlobally(featuremgmt.FlagZanzana) + authCfg, err := readAuthzClientSettings(cfg) if err != nil { return nil, err @@ -62,6 +65,10 @@ func ProvideAuthZClient( return nil, errors.New("authZGRPCServer feature toggle is required for cloud and grpc mode") } + if zanzanaEnabled && features.IsEnabledGlobally(featuremgmt.FlagZanzanaNoLegacyClient) { + return zanzanaClient, nil + } + // Provisioning uses mode 4 (read+write only to unified storage) // For G12 launch, we can disable caching for this and find a more scalable solution soon // most likely this would involve passing the RV (timestamp!) in each check method @@ -72,7 +79,7 @@ func ProvideAuthZClient( switch authCfg.mode { case clientModeCloud: rbacClient, err := newRemoteRBACClient(authCfg, tracer, reg) - if features.IsEnabledGlobally(featuremgmt.FlagZanzana) { + if zanzanaEnabled { return zanzana.WithShadowClient(rbacClient, zanzanaClient, reg) } return rbacClient, err @@ -119,7 +126,7 @@ func ProvideAuthZClient( authzlib.WithTracerClientOption(tracer), ) - if features.IsEnabledGlobally(featuremgmt.FlagZanzana) { + if zanzanaEnabled { return zanzana.WithShadowClient(rbacClient, zanzanaClient, reg) } diff --git a/pkg/services/featuremgmt/registry.go b/pkg/services/featuremgmt/registry.go index a5ba17830af..143f8b3c11f 100644 --- a/pkg/services/featuremgmt/registry.go +++ b/pkg/services/featuremgmt/registry.go @@ -1066,6 +1066,14 @@ var ( HideFromDocs: true, HideFromAdminPage: true, }, + { + Name: "zanzanaNoLegacyClient", + Description: "Use openFGA as main authorization engine and disable legacy RBAC clietn.", + Stage: FeatureStageExperimental, + Owner: identityAccessTeam, + HideFromDocs: true, + HideFromAdminPage: true, + }, { Name: "reloadDashboardsOnParamsChange", Description: "Enables reload of dashboards on scopes, time range and variables changes", diff --git a/pkg/services/featuremgmt/toggles_gen.csv b/pkg/services/featuremgmt/toggles_gen.csv index 587f8654bcf..6a7ce0b68e3 100644 --- a/pkg/services/featuremgmt/toggles_gen.csv +++ b/pkg/services/featuremgmt/toggles_gen.csv @@ -139,6 +139,7 @@ pinNavItems,GA,@grafana/grafana-frontend-platform,false,false,false authZGRPCServer,experimental,@grafana/identity-access-team,false,false,false ssoSettingsLDAP,GA,@grafana/identity-access-team,false,true,false zanzana,experimental,@grafana/identity-access-team,false,false,false +zanzanaNoLegacyClient,experimental,@grafana/identity-access-team,false,false,false reloadDashboardsOnParamsChange,experimental,@grafana/dashboards-squad,false,false,false enableScopesInMetricsExplore,experimental,@grafana/dashboards-squad,false,false,false cloudWatchRoundUpEndTime,GA,@grafana/aws-datasources,false,false,false diff --git a/pkg/services/featuremgmt/toggles_gen.go b/pkg/services/featuremgmt/toggles_gen.go index 6808c56db2d..7fa86107012 100644 --- a/pkg/services/featuremgmt/toggles_gen.go +++ b/pkg/services/featuremgmt/toggles_gen.go @@ -567,6 +567,10 @@ const ( // Use openFGA as authorization engine. FlagZanzana = "zanzana" + // FlagZanzanaNoLegacyClient + // Use openFGA as main authorization engine and disable legacy RBAC clietn. + FlagZanzanaNoLegacyClient = "zanzanaNoLegacyClient" + // FlagReloadDashboardsOnParamsChange // Enables reload of dashboards on scopes, time range and variables changes FlagReloadDashboardsOnParamsChange = "reloadDashboardsOnParamsChange" diff --git a/pkg/services/featuremgmt/toggles_gen.json b/pkg/services/featuremgmt/toggles_gen.json index d5da9712232..9a7e7eaf32e 100644 --- a/pkg/services/featuremgmt/toggles_gen.json +++ b/pkg/services/featuremgmt/toggles_gen.json @@ -4173,6 +4173,20 @@ "hideFromAdminPage": true, "hideFromDocs": true } + }, + { + "metadata": { + "name": "zanzanaNoLegacyClient", + "resourceVersion": "1760953975541", + "creationTimestamp": "2025-10-20T09:52:55Z" + }, + "spec": { + "description": "Use openFGA as main authorization engine and disable legacy RBAC client.", + "stage": "experimental", + "codeowner": "@grafana/identity-access-team", + "hideFromAdminPage": true, + "hideFromDocs": true + } } ] } \ No newline at end of file