Authz: Define app resources (#105050)

* Authz: Define app resources

* Add coreroles and cluster roles

* Restore CODEOWNERS from main

* ManagedPermissions -> ResourcePermissions

* Rework changes

* Update apps/authz/kinds/v0alpha1/rolebindingspec.cue

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Update apps/authz/kinds/v0alpha1/rolespec.cue

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Make

* WIP first set of comments

* typox

* Copy folder Makefile

* Remove uid

* Rename authz -> iam

* Rename to iam

* Dockerfile

* Remove name

* Mv up

* Try with postprocess

* linting

* Use same version

* apimachinery v0.32.3

* update-workspace

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

apps/iam/pkg/apis/iam/v0alpha1/constants.go

@@ -0,0 +1,18 @@
+package v0alpha1
+
+import "k8s.io/apimachinery/pkg/runtime/schema"
+
+const (
+	// Group is the API group used by all kinds in this package
+	Group = "iam.grafana.app"
+	// Version is the API version used by all kinds in this package
+	Version = "v0alpha1"
+)
+
+var (
+	// GroupVersion is a schema.GroupVersion consisting of the Group and Version constants for this package
+	GroupVersion = schema.GroupVersion{
+		Group:   Group,
+		Version: Version,
+	}
+)

apps/iam/pkg/apis/iam/v0alpha1/corerole_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// CoreRoleJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type CoreRoleJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*CoreRoleJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*CoreRoleJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &CoreRoleJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/corerole_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type CoreRoleMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewCoreRoleMetadata creates a new CoreRoleMetadata object.
+func NewCoreRoleMetadata() *CoreRoleMetadata {
+	return &CoreRoleMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/corerole_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type CoreRole struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the CoreRole
+	Spec CoreRoleSpec `json:"spec" yaml:"spec"`
+
+	Status CoreRoleStatus `json:"status" yaml:"status"`
+}
+
+func (o *CoreRole) GetSpec() any {
+	return o.Spec
+}
+
+func (o *CoreRole) SetSpec(spec any) error {
+	cast, ok := spec.(CoreRoleSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *CoreRole) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *CoreRole) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *CoreRole) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(CoreRoleStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type CoreRoleStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *CoreRole) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *CoreRole) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *CoreRole) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *CoreRole) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *CoreRole) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *CoreRole) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *CoreRole) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *CoreRole) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *CoreRole) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *CoreRole) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *CoreRole) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *CoreRole) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *CoreRole) DeepCopy() *CoreRole {
+	cpy := &CoreRole{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *CoreRole) DeepCopyInto(dst *CoreRole) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &CoreRole{}
+
+// +k8s:openapi-gen=true
+type CoreRoleList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []CoreRole `json:"items" yaml:"items"`
+}
+
+func (o *CoreRoleList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *CoreRoleList) Copy() resource.ListObject {
+	cpy := &CoreRoleList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]CoreRole, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*CoreRole); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *CoreRoleList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *CoreRoleList) SetItems(items []resource.Object) {
+	o.Items = make([]CoreRole, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*CoreRole)
+	}
+}
+
+func (o *CoreRoleList) DeepCopy() *CoreRoleList {
+	cpy := &CoreRoleList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *CoreRoleList) DeepCopyInto(dst *CoreRoleList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &CoreRoleList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *CoreRoleSpec) DeepCopy() *CoreRoleSpec {
+	cpy := &CoreRoleSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *CoreRoleSpec) DeepCopyInto(dst *CoreRoleSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of CoreRoleStatus
+func (s *CoreRoleStatus) DeepCopy() *CoreRoleStatus {
+	cpy := &CoreRoleStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies CoreRoleStatus into another CoreRoleStatus object
+func (s *CoreRoleStatus) DeepCopyInto(dst *CoreRoleStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/corerole_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaCoreRole = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &CoreRole{}, &CoreRoleList{}, resource.WithKind("CoreRole"),
+		resource.WithPlural("coreroles"), resource.WithScope(resource.NamespacedScope))
+	kindCoreRole = resource.Kind{
+		Schema: schemaCoreRole,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &CoreRoleJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func CoreRoleKind() resource.Kind {
+	return kindCoreRole
+}
+
+// Schema returns a resource.SimpleSchema representation of CoreRole
+func CoreRoleSchema() *resource.SimpleSchema {
+	return schemaCoreRole
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindCoreRole

apps/iam/pkg/apis/iam/v0alpha1/corerole_spec_gen.go

@@ -0,0 +1,34 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type CoreRolespecPermission struct {
+	// RBAC action (e.g: "dashbaords:read")
+	Action string `json:"action"`
+	// RBAC scope (e.g: "dashboards:uid:dash1")
+	Scope string `json:"scope"`
+}
+
+// NewCoreRolespecPermission creates a new CoreRolespecPermission object.
+func NewCoreRolespecPermission() *CoreRolespecPermission {
+	return &CoreRolespecPermission{}
+}
+
+// +k8s:openapi-gen=true
+type CoreRoleSpec struct {
+	// Display name of the role
+	Title   string `json:"title"`
+	Version int64  `json:"version"`
+	Group   string `json:"group"`
+	// TODO:
+	// delegatable?: bool
+	// created?
+	// updated?
+	Permissions []CoreRolespecPermission `json:"permissions"`
+}
+
+// NewCoreRoleSpec creates a new CoreRoleSpec object.
+func NewCoreRoleSpec() *CoreRoleSpec {
+	return &CoreRoleSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/corerole_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type CoreRolestatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State CoreRoleStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewCoreRolestatusOperatorState creates a new CoreRolestatusOperatorState object.
+func NewCoreRolestatusOperatorState() *CoreRolestatusOperatorState {
+	return &CoreRolestatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type CoreRoleStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]CoreRolestatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewCoreRoleStatus creates a new CoreRoleStatus object.
+func NewCoreRoleStatus() *CoreRoleStatus {
+	return &CoreRoleStatus{}
+}
+
+// +k8s:openapi-gen=true
+type CoreRoleStatusOperatorStateState string
+
+const (
+	CoreRoleStatusOperatorStateStateSuccess    CoreRoleStatusOperatorStateState = "success"
+	CoreRoleStatusOperatorStateStateInProgress CoreRoleStatusOperatorStateState = "in_progress"
+	CoreRoleStatusOperatorStateStateFailed     CoreRoleStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/globalrole_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// GlobalRoleJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type GlobalRoleJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*GlobalRoleJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*GlobalRoleJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &GlobalRoleJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/globalrole_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type GlobalRoleMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewGlobalRoleMetadata creates a new GlobalRoleMetadata object.
+func NewGlobalRoleMetadata() *GlobalRoleMetadata {
+	return &GlobalRoleMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/globalrole_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type GlobalRole struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the GlobalRole
+	Spec GlobalRoleSpec `json:"spec" yaml:"spec"`
+
+	Status GlobalRoleStatus `json:"status" yaml:"status"`
+}
+
+func (o *GlobalRole) GetSpec() any {
+	return o.Spec
+}
+
+func (o *GlobalRole) SetSpec(spec any) error {
+	cast, ok := spec.(GlobalRoleSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *GlobalRole) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *GlobalRole) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *GlobalRole) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(GlobalRoleStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type GlobalRoleStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *GlobalRole) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *GlobalRole) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *GlobalRole) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *GlobalRole) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *GlobalRole) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *GlobalRole) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *GlobalRole) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *GlobalRole) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *GlobalRole) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *GlobalRole) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *GlobalRole) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *GlobalRole) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *GlobalRole) DeepCopy() *GlobalRole {
+	cpy := &GlobalRole{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *GlobalRole) DeepCopyInto(dst *GlobalRole) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &GlobalRole{}
+
+// +k8s:openapi-gen=true
+type GlobalRoleList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []GlobalRole `json:"items" yaml:"items"`
+}
+
+func (o *GlobalRoleList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *GlobalRoleList) Copy() resource.ListObject {
+	cpy := &GlobalRoleList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]GlobalRole, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*GlobalRole); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *GlobalRoleList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *GlobalRoleList) SetItems(items []resource.Object) {
+	o.Items = make([]GlobalRole, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*GlobalRole)
+	}
+}
+
+func (o *GlobalRoleList) DeepCopy() *GlobalRoleList {
+	cpy := &GlobalRoleList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *GlobalRoleList) DeepCopyInto(dst *GlobalRoleList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &GlobalRoleList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *GlobalRoleSpec) DeepCopy() *GlobalRoleSpec {
+	cpy := &GlobalRoleSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *GlobalRoleSpec) DeepCopyInto(dst *GlobalRoleSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of GlobalRoleStatus
+func (s *GlobalRoleStatus) DeepCopy() *GlobalRoleStatus {
+	cpy := &GlobalRoleStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies GlobalRoleStatus into another GlobalRoleStatus object
+func (s *GlobalRoleStatus) DeepCopyInto(dst *GlobalRoleStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/globalrole_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaGlobalRole = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &GlobalRole{}, &GlobalRoleList{}, resource.WithKind("GlobalRole"),
+		resource.WithPlural("globalroles"), resource.WithScope(resource.NamespacedScope))
+	kindGlobalRole = resource.Kind{
+		Schema: schemaGlobalRole,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &GlobalRoleJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func GlobalRoleKind() resource.Kind {
+	return kindGlobalRole
+}
+
+// Schema returns a resource.SimpleSchema representation of GlobalRole
+func GlobalRoleSchema() *resource.SimpleSchema {
+	return schemaGlobalRole
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindGlobalRole

apps/iam/pkg/apis/iam/v0alpha1/globalrole_spec_gen.go

@@ -0,0 +1,34 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type GlobalRolespecPermission struct {
+	// RBAC action (e.g: "dashbaords:read")
+	Action string `json:"action"`
+	// RBAC scope (e.g: "dashboards:uid:dash1")
+	Scope string `json:"scope"`
+}
+
+// NewGlobalRolespecPermission creates a new GlobalRolespecPermission object.
+func NewGlobalRolespecPermission() *GlobalRolespecPermission {
+	return &GlobalRolespecPermission{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleSpec struct {
+	// Display name of the role
+	Title   string `json:"title"`
+	Version int64  `json:"version"`
+	Group   string `json:"group"`
+	// TODO:
+	// delegatable?: bool
+	// created?
+	// updated?
+	Permissions []GlobalRolespecPermission `json:"permissions"`
+}
+
+// NewGlobalRoleSpec creates a new GlobalRoleSpec object.
+func NewGlobalRoleSpec() *GlobalRoleSpec {
+	return &GlobalRoleSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/globalrole_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type GlobalRolestatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State GlobalRoleStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewGlobalRolestatusOperatorState creates a new GlobalRolestatusOperatorState object.
+func NewGlobalRolestatusOperatorState() *GlobalRolestatusOperatorState {
+	return &GlobalRolestatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]GlobalRolestatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewGlobalRoleStatus creates a new GlobalRoleStatus object.
+func NewGlobalRoleStatus() *GlobalRoleStatus {
+	return &GlobalRoleStatus{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleStatusOperatorStateState string
+
+const (
+	GlobalRoleStatusOperatorStateStateSuccess    GlobalRoleStatusOperatorStateState = "success"
+	GlobalRoleStatusOperatorStateStateInProgress GlobalRoleStatusOperatorStateState = "in_progress"
+	GlobalRoleStatusOperatorStateStateFailed     GlobalRoleStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// GlobalRoleBindingJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type GlobalRoleBindingJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*GlobalRoleBindingJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*GlobalRoleBindingJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &GlobalRoleBindingJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type GlobalRoleBindingMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewGlobalRoleBindingMetadata creates a new GlobalRoleBindingMetadata object.
+func NewGlobalRoleBindingMetadata() *GlobalRoleBindingMetadata {
+	return &GlobalRoleBindingMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type GlobalRoleBinding struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the GlobalRoleBinding
+	Spec GlobalRoleBindingSpec `json:"spec" yaml:"spec"`
+
+	Status GlobalRoleBindingStatus `json:"status" yaml:"status"`
+}
+
+func (o *GlobalRoleBinding) GetSpec() any {
+	return o.Spec
+}
+
+func (o *GlobalRoleBinding) SetSpec(spec any) error {
+	cast, ok := spec.(GlobalRoleBindingSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *GlobalRoleBinding) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *GlobalRoleBinding) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *GlobalRoleBinding) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(GlobalRoleBindingStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type GlobalRoleBindingStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *GlobalRoleBinding) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *GlobalRoleBinding) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *GlobalRoleBinding) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *GlobalRoleBinding) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *GlobalRoleBinding) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *GlobalRoleBinding) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *GlobalRoleBinding) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *GlobalRoleBinding) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *GlobalRoleBinding) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *GlobalRoleBinding) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *GlobalRoleBinding) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *GlobalRoleBinding) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *GlobalRoleBinding) DeepCopy() *GlobalRoleBinding {
+	cpy := &GlobalRoleBinding{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *GlobalRoleBinding) DeepCopyInto(dst *GlobalRoleBinding) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &GlobalRoleBinding{}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []GlobalRoleBinding `json:"items" yaml:"items"`
+}
+
+func (o *GlobalRoleBindingList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *GlobalRoleBindingList) Copy() resource.ListObject {
+	cpy := &GlobalRoleBindingList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]GlobalRoleBinding, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*GlobalRoleBinding); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *GlobalRoleBindingList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *GlobalRoleBindingList) SetItems(items []resource.Object) {
+	o.Items = make([]GlobalRoleBinding, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*GlobalRoleBinding)
+	}
+}
+
+func (o *GlobalRoleBindingList) DeepCopy() *GlobalRoleBindingList {
+	cpy := &GlobalRoleBindingList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *GlobalRoleBindingList) DeepCopyInto(dst *GlobalRoleBindingList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &GlobalRoleBindingList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *GlobalRoleBindingSpec) DeepCopy() *GlobalRoleBindingSpec {
+	cpy := &GlobalRoleBindingSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *GlobalRoleBindingSpec) DeepCopyInto(dst *GlobalRoleBindingSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of GlobalRoleBindingStatus
+func (s *GlobalRoleBindingStatus) DeepCopy() *GlobalRoleBindingStatus {
+	cpy := &GlobalRoleBindingStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies GlobalRoleBindingStatus into another GlobalRoleBindingStatus object
+func (s *GlobalRoleBindingStatus) DeepCopyInto(dst *GlobalRoleBindingStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaGlobalRoleBinding = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &GlobalRoleBinding{}, &GlobalRoleBindingList{}, resource.WithKind("GlobalRoleBinding"),
+		resource.WithPlural("globalrolebindings"), resource.WithScope(resource.NamespacedScope))
+	kindGlobalRoleBinding = resource.Kind{
+		Schema: schemaGlobalRoleBinding,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &GlobalRoleBindingJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func GlobalRoleBindingKind() resource.Kind {
+	return kindGlobalRoleBinding
+}
+
+// Schema returns a resource.SimpleSchema representation of GlobalRoleBinding
+func GlobalRoleBindingSchema() *resource.SimpleSchema {
+	return schemaGlobalRoleBinding
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindGlobalRoleBinding

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_spec_gen.go

@@ -0,0 +1,60 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingspecSubject struct {
+	// kind of the identity getting the permission
+	Kind GlobalRoleBindingSpecSubjectKind `json:"kind"`
+	// uid of the identity
+	Name string `json:"name"`
+}
+
+// NewGlobalRoleBindingspecSubject creates a new GlobalRoleBindingspecSubject object.
+func NewGlobalRoleBindingspecSubject() *GlobalRoleBindingspecSubject {
+	return &GlobalRoleBindingspecSubject{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingspecRoleRef struct {
+	// kind of role
+	Kind GlobalRoleBindingSpecRoleRefKind `json:"kind"`
+	// uid of the role
+	Name string `json:"name"`
+}
+
+// NewGlobalRoleBindingspecRoleRef creates a new GlobalRoleBindingspecRoleRef object.
+func NewGlobalRoleBindingspecRoleRef() *GlobalRoleBindingspecRoleRef {
+	return &GlobalRoleBindingspecRoleRef{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingSpec struct {
+	Subjects []GlobalRoleBindingspecSubject `json:"subjects"`
+	RoleRef  GlobalRoleBindingspecRoleRef   `json:"roleRef"`
+}
+
+// NewGlobalRoleBindingSpec creates a new GlobalRoleBindingSpec object.
+func NewGlobalRoleBindingSpec() *GlobalRoleBindingSpec {
+	return &GlobalRoleBindingSpec{
+		RoleRef: *NewGlobalRoleBindingspecRoleRef(),
+	}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingSpecSubjectKind string
+
+const (
+	GlobalRoleBindingSpecSubjectKindUser           GlobalRoleBindingSpecSubjectKind = "User"
+	GlobalRoleBindingSpecSubjectKindServiceAccount GlobalRoleBindingSpecSubjectKind = "ServiceAccount"
+	GlobalRoleBindingSpecSubjectKindTeam           GlobalRoleBindingSpecSubjectKind = "Team"
+	GlobalRoleBindingSpecSubjectKindBasicRole      GlobalRoleBindingSpecSubjectKind = "BasicRole"
+)
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingSpecRoleRefKind string
+
+const (
+	GlobalRoleBindingSpecRoleRefKindCoreRole   GlobalRoleBindingSpecRoleRefKind = "CoreRole"
+	GlobalRoleBindingSpecRoleRefKindGlobalRole GlobalRoleBindingSpecRoleRefKind = "GlobalRole"
+)

apps/iam/pkg/apis/iam/v0alpha1/globalrolebinding_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State GlobalRoleBindingStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewGlobalRoleBindingstatusOperatorState creates a new GlobalRoleBindingstatusOperatorState object.
+func NewGlobalRoleBindingstatusOperatorState() *GlobalRoleBindingstatusOperatorState {
+	return &GlobalRoleBindingstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]GlobalRoleBindingstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewGlobalRoleBindingStatus creates a new GlobalRoleBindingStatus object.
+func NewGlobalRoleBindingStatus() *GlobalRoleBindingStatus {
+	return &GlobalRoleBindingStatus{}
+}
+
+// +k8s:openapi-gen=true
+type GlobalRoleBindingStatusOperatorStateState string
+
+const (
+	GlobalRoleBindingStatusOperatorStateStateSuccess    GlobalRoleBindingStatusOperatorStateState = "success"
+	GlobalRoleBindingStatusOperatorStateStateInProgress GlobalRoleBindingStatusOperatorStateState = "in_progress"
+	GlobalRoleBindingStatusOperatorStateStateFailed     GlobalRoleBindingStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// ResourcePermissionJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type ResourcePermissionJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*ResourcePermissionJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*ResourcePermissionJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &ResourcePermissionJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type ResourcePermissionMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewResourcePermissionMetadata creates a new ResourcePermissionMetadata object.
+func NewResourcePermissionMetadata() *ResourcePermissionMetadata {
+	return &ResourcePermissionMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type ResourcePermission struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the ResourcePermission
+	Spec ResourcePermissionSpec `json:"spec" yaml:"spec"`
+
+	Status ResourcePermissionStatus `json:"status" yaml:"status"`
+}
+
+func (o *ResourcePermission) GetSpec() any {
+	return o.Spec
+}
+
+func (o *ResourcePermission) SetSpec(spec any) error {
+	cast, ok := spec.(ResourcePermissionSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *ResourcePermission) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *ResourcePermission) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *ResourcePermission) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(ResourcePermissionStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type ResourcePermissionStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *ResourcePermission) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *ResourcePermission) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *ResourcePermission) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *ResourcePermission) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *ResourcePermission) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *ResourcePermission) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *ResourcePermission) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *ResourcePermission) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *ResourcePermission) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *ResourcePermission) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *ResourcePermission) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *ResourcePermission) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ResourcePermission) DeepCopy() *ResourcePermission {
+	cpy := &ResourcePermission{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ResourcePermission) DeepCopyInto(dst *ResourcePermission) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &ResourcePermission{}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []ResourcePermission `json:"items" yaml:"items"`
+}
+
+func (o *ResourcePermissionList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ResourcePermissionList) Copy() resource.ListObject {
+	cpy := &ResourcePermissionList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]ResourcePermission, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*ResourcePermission); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *ResourcePermissionList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *ResourcePermissionList) SetItems(items []resource.Object) {
+	o.Items = make([]ResourcePermission, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*ResourcePermission)
+	}
+}
+
+func (o *ResourcePermissionList) DeepCopy() *ResourcePermissionList {
+	cpy := &ResourcePermissionList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ResourcePermissionList) DeepCopyInto(dst *ResourcePermissionList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &ResourcePermissionList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *ResourcePermissionSpec) DeepCopy() *ResourcePermissionSpec {
+	cpy := &ResourcePermissionSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *ResourcePermissionSpec) DeepCopyInto(dst *ResourcePermissionSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of ResourcePermissionStatus
+func (s *ResourcePermissionStatus) DeepCopy() *ResourcePermissionStatus {
+	cpy := &ResourcePermissionStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies ResourcePermissionStatus into another ResourcePermissionStatus object
+func (s *ResourcePermissionStatus) DeepCopyInto(dst *ResourcePermissionStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaResourcePermission = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &ResourcePermission{}, &ResourcePermissionList{}, resource.WithKind("ResourcePermission"),
+		resource.WithPlural("resourcepermissions"), resource.WithScope(resource.NamespacedScope))
+	kindResourcePermission = resource.Kind{
+		Schema: schemaResourcePermission,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &ResourcePermissionJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func ResourcePermissionKind() resource.Kind {
+	return kindResourcePermission
+}
+
+// Schema returns a resource.SimpleSchema representation of ResourcePermission
+func ResourcePermissionSchema() *resource.SimpleSchema {
+	return schemaResourcePermission
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindResourcePermission

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_spec_gen.go

@@ -0,0 +1,56 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type ResourcePermissionspecResource struct {
+	// api group of the resource (e.g: "folder.grafana.app")
+	ApiGroup string `json:"apiGroup"`
+	// kind of the resource (e.g: "folders")
+	Resource string `json:"resource"`
+	// uid of the resource (e.g: "fold1")
+	Name string `json:"name"`
+}
+
+// NewResourcePermissionspecResource creates a new ResourcePermissionspecResource object.
+func NewResourcePermissionspecResource() *ResourcePermissionspecResource {
+	return &ResourcePermissionspecResource{}
+}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionspecPermission struct {
+	// kind of the identity getting the permission
+	Kind ResourcePermissionSpecPermissionKind `json:"kind"`
+	// uid of the identity getting the permission
+	Name string `json:"name"`
+	// list of actions granted to the user (e.g. "admin" or "get", "update")
+	Verbs []string `json:"verbs"`
+}
+
+// NewResourcePermissionspecPermission creates a new ResourcePermissionspecPermission object.
+func NewResourcePermissionspecPermission() *ResourcePermissionspecPermission {
+	return &ResourcePermissionspecPermission{}
+}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionSpec struct {
+	Resource    ResourcePermissionspecResource     `json:"resource"`
+	Permissions []ResourcePermissionspecPermission `json:"permissions"`
+}
+
+// NewResourcePermissionSpec creates a new ResourcePermissionSpec object.
+func NewResourcePermissionSpec() *ResourcePermissionSpec {
+	return &ResourcePermissionSpec{
+		Resource: *NewResourcePermissionspecResource(),
+	}
+}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionSpecPermissionKind string
+
+const (
+	ResourcePermissionSpecPermissionKindUser           ResourcePermissionSpecPermissionKind = "User"
+	ResourcePermissionSpecPermissionKindServiceAccount ResourcePermissionSpecPermissionKind = "ServiceAccount"
+	ResourcePermissionSpecPermissionKindTeam           ResourcePermissionSpecPermissionKind = "Team"
+	ResourcePermissionSpecPermissionKindBasicRole      ResourcePermissionSpecPermissionKind = "BasicRole"
+)

apps/iam/pkg/apis/iam/v0alpha1/resourcepermission_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type ResourcePermissionstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State ResourcePermissionStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewResourcePermissionstatusOperatorState creates a new ResourcePermissionstatusOperatorState object.
+func NewResourcePermissionstatusOperatorState() *ResourcePermissionstatusOperatorState {
+	return &ResourcePermissionstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]ResourcePermissionstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewResourcePermissionStatus creates a new ResourcePermissionStatus object.
+func NewResourcePermissionStatus() *ResourcePermissionStatus {
+	return &ResourcePermissionStatus{}
+}
+
+// +k8s:openapi-gen=true
+type ResourcePermissionStatusOperatorStateState string
+
+const (
+	ResourcePermissionStatusOperatorStateStateSuccess    ResourcePermissionStatusOperatorStateState = "success"
+	ResourcePermissionStatusOperatorStateStateInProgress ResourcePermissionStatusOperatorStateState = "in_progress"
+	ResourcePermissionStatusOperatorStateStateFailed     ResourcePermissionStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/role_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// RoleJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type RoleJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*RoleJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*RoleJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &RoleJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/role_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type RoleMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewRoleMetadata creates a new RoleMetadata object.
+func NewRoleMetadata() *RoleMetadata {
+	return &RoleMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/role_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type Role struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the Role
+	Spec RoleSpec `json:"spec" yaml:"spec"`
+
+	Status RoleStatus `json:"status" yaml:"status"`
+}
+
+func (o *Role) GetSpec() any {
+	return o.Spec
+}
+
+func (o *Role) SetSpec(spec any) error {
+	cast, ok := spec.(RoleSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *Role) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *Role) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *Role) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(RoleStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type RoleStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *Role) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *Role) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *Role) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *Role) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *Role) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *Role) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *Role) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *Role) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *Role) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *Role) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *Role) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *Role) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *Role) DeepCopy() *Role {
+	cpy := &Role{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *Role) DeepCopyInto(dst *Role) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &Role{}
+
+// +k8s:openapi-gen=true
+type RoleList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []Role `json:"items" yaml:"items"`
+}
+
+func (o *RoleList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *RoleList) Copy() resource.ListObject {
+	cpy := &RoleList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]Role, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*Role); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *RoleList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *RoleList) SetItems(items []resource.Object) {
+	o.Items = make([]Role, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*Role)
+	}
+}
+
+func (o *RoleList) DeepCopy() *RoleList {
+	cpy := &RoleList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *RoleList) DeepCopyInto(dst *RoleList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &RoleList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *RoleSpec) DeepCopy() *RoleSpec {
+	cpy := &RoleSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *RoleSpec) DeepCopyInto(dst *RoleSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of RoleStatus
+func (s *RoleStatus) DeepCopy() *RoleStatus {
+	cpy := &RoleStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies RoleStatus into another RoleStatus object
+func (s *RoleStatus) DeepCopyInto(dst *RoleStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/role_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaRole = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &Role{}, &RoleList{}, resource.WithKind("Role"),
+		resource.WithPlural("roles"), resource.WithScope(resource.NamespacedScope))
+	kindRole = resource.Kind{
+		Schema: schemaRole,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &RoleJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func RoleKind() resource.Kind {
+	return kindRole
+}
+
+// Schema returns a resource.SimpleSchema representation of Role
+func RoleSchema() *resource.SimpleSchema {
+	return schemaRole
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindRole

apps/iam/pkg/apis/iam/v0alpha1/role_spec_gen.go

@@ -0,0 +1,34 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type RolespecPermission struct {
+	// RBAC action (e.g: "dashbaords:read")
+	Action string `json:"action"`
+	// RBAC scope (e.g: "dashboards:uid:dash1")
+	Scope string `json:"scope"`
+}
+
+// NewRolespecPermission creates a new RolespecPermission object.
+func NewRolespecPermission() *RolespecPermission {
+	return &RolespecPermission{}
+}
+
+// +k8s:openapi-gen=true
+type RoleSpec struct {
+	// Display name of the role
+	Title   string `json:"title"`
+	Version int64  `json:"version"`
+	Group   string `json:"group"`
+	// TODO:
+	// delegatable?: bool
+	// created?
+	// updated?
+	Permissions []RolespecPermission `json:"permissions"`
+}
+
+// NewRoleSpec creates a new RoleSpec object.
+func NewRoleSpec() *RoleSpec {
+	return &RoleSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/role_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type RolestatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State RoleStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewRolestatusOperatorState creates a new RolestatusOperatorState object.
+func NewRolestatusOperatorState() *RolestatusOperatorState {
+	return &RolestatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type RoleStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]RolestatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewRoleStatus creates a new RoleStatus object.
+func NewRoleStatus() *RoleStatus {
+	return &RoleStatus{}
+}
+
+// +k8s:openapi-gen=true
+type RoleStatusOperatorStateState string
+
+const (
+	RoleStatusOperatorStateStateSuccess    RoleStatusOperatorStateState = "success"
+	RoleStatusOperatorStateStateInProgress RoleStatusOperatorStateState = "in_progress"
+	RoleStatusOperatorStateStateFailed     RoleStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// RoleBindingJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type RoleBindingJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*RoleBindingJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*RoleBindingJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &RoleBindingJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_metadata_gen.go

@@ -0,0 +1,28 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type RoleBindingMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewRoleBindingMetadata creates a new RoleBindingMetadata object.
+func NewRoleBindingMetadata() *RoleBindingMetadata {
+	return &RoleBindingMetadata{}
+}

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type RoleBinding struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the RoleBinding
+	Spec RoleBindingSpec `json:"spec" yaml:"spec"`
+
+	Status RoleBindingStatus `json:"status" yaml:"status"`
+}
+
+func (o *RoleBinding) GetSpec() any {
+	return o.Spec
+}
+
+func (o *RoleBinding) SetSpec(spec any) error {
+	cast, ok := spec.(RoleBindingSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *RoleBinding) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *RoleBinding) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *RoleBinding) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(RoleBindingStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type RoleBindingStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *RoleBinding) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *RoleBinding) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *RoleBinding) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *RoleBinding) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *RoleBinding) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *RoleBinding) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *RoleBinding) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *RoleBinding) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *RoleBinding) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *RoleBinding) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *RoleBinding) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *RoleBinding) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *RoleBinding) DeepCopy() *RoleBinding {
+	cpy := &RoleBinding{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *RoleBinding) DeepCopyInto(dst *RoleBinding) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &RoleBinding{}
+
+// +k8s:openapi-gen=true
+type RoleBindingList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []RoleBinding `json:"items" yaml:"items"`
+}
+
+func (o *RoleBindingList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *RoleBindingList) Copy() resource.ListObject {
+	cpy := &RoleBindingList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]RoleBinding, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*RoleBinding); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *RoleBindingList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *RoleBindingList) SetItems(items []resource.Object) {
+	o.Items = make([]RoleBinding, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*RoleBinding)
+	}
+}
+
+func (o *RoleBindingList) DeepCopy() *RoleBindingList {
+	cpy := &RoleBindingList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *RoleBindingList) DeepCopyInto(dst *RoleBindingList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &RoleBindingList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *RoleBindingSpec) DeepCopy() *RoleBindingSpec {
+	cpy := &RoleBindingSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *RoleBindingSpec) DeepCopyInto(dst *RoleBindingSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of RoleBindingStatus
+func (s *RoleBindingStatus) DeepCopy() *RoleBindingStatus {
+	cpy := &RoleBindingStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies RoleBindingStatus into another RoleBindingStatus object
+func (s *RoleBindingStatus) DeepCopyInto(dst *RoleBindingStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaRoleBinding = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &RoleBinding{}, &RoleBindingList{}, resource.WithKind("RoleBinding"),
+		resource.WithPlural("rolebindings"), resource.WithScope(resource.NamespacedScope))
+	kindRoleBinding = resource.Kind{
+		Schema: schemaRoleBinding,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &RoleBindingJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func RoleBindingKind() resource.Kind {
+	return kindRoleBinding
+}
+
+// Schema returns a resource.SimpleSchema representation of RoleBinding
+func RoleBindingSchema() *resource.SimpleSchema {
+	return schemaRoleBinding
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindRoleBinding

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_spec_gen.go

@@ -0,0 +1,61 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type RoleBindingspecSubject struct {
+	// kind of the identity getting the permission
+	Kind RoleBindingSpecSubjectKind `json:"kind"`
+	// uid of the identity
+	Name string `json:"name"`
+}
+
+// NewRoleBindingspecSubject creates a new RoleBindingspecSubject object.
+func NewRoleBindingspecSubject() *RoleBindingspecSubject {
+	return &RoleBindingspecSubject{}
+}
+
+// +k8s:openapi-gen=true
+type RoleBindingspecRoleRef struct {
+	// kind of role
+	Kind RoleBindingSpecRoleRefKind `json:"kind"`
+	// uid of the role
+	Name string `json:"name"`
+}
+
+// NewRoleBindingspecRoleRef creates a new RoleBindingspecRoleRef object.
+func NewRoleBindingspecRoleRef() *RoleBindingspecRoleRef {
+	return &RoleBindingspecRoleRef{}
+}
+
+// +k8s:openapi-gen=true
+type RoleBindingSpec struct {
+	Subjects []RoleBindingspecSubject `json:"subjects"`
+	RoleRef  RoleBindingspecRoleRef   `json:"roleRef"`
+}
+
+// NewRoleBindingSpec creates a new RoleBindingSpec object.
+func NewRoleBindingSpec() *RoleBindingSpec {
+	return &RoleBindingSpec{
+		RoleRef: *NewRoleBindingspecRoleRef(),
+	}
+}
+
+// +k8s:openapi-gen=true
+type RoleBindingSpecSubjectKind string
+
+const (
+	RoleBindingSpecSubjectKindUser           RoleBindingSpecSubjectKind = "User"
+	RoleBindingSpecSubjectKindServiceAccount RoleBindingSpecSubjectKind = "ServiceAccount"
+	RoleBindingSpecSubjectKindTeam           RoleBindingSpecSubjectKind = "Team"
+	RoleBindingSpecSubjectKindBasicRole      RoleBindingSpecSubjectKind = "BasicRole"
+)
+
+// +k8s:openapi-gen=true
+type RoleBindingSpecRoleRefKind string
+
+const (
+	RoleBindingSpecRoleRefKindRole       RoleBindingSpecRoleRefKind = "Role"
+	RoleBindingSpecRoleRefKindCoreRole   RoleBindingSpecRoleRefKind = "CoreRole"
+	RoleBindingSpecRoleRefKindGlobalRole RoleBindingSpecRoleRefKind = "GlobalRole"
+)

apps/iam/pkg/apis/iam/v0alpha1/rolebinding_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type RoleBindingstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State RoleBindingStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewRoleBindingstatusOperatorState creates a new RoleBindingstatusOperatorState object.
+func NewRoleBindingstatusOperatorState() *RoleBindingstatusOperatorState {
+	return &RoleBindingstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type RoleBindingStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]RoleBindingstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewRoleBindingStatus creates a new RoleBindingStatus object.
+func NewRoleBindingStatus() *RoleBindingStatus {
+	return &RoleBindingStatus{}
+}
+
+// +k8s:openapi-gen=true
+type RoleBindingStatusOperatorStateState string
+
+const (
+	RoleBindingStatusOperatorStateStateSuccess    RoleBindingStatusOperatorStateState = "success"
+	RoleBindingStatusOperatorStateStateInProgress RoleBindingStatusOperatorStateState = "in_progress"
+	RoleBindingStatusOperatorStateStateFailed     RoleBindingStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam_manifest.go

@@ -0,0 +1,100 @@
+//
+// This file is generated by grafana-app-sdk
+// DO NOT EDIT
+//
+
+package apis
+
+import (
+	"encoding/json"
+
+	"github.com/grafana/grafana-app-sdk/app"
+)
+
+var ()
+
+var appManifestData = app.ManifestData{
+	AppName: "iam",
+	Group:   "iam.grafana.app",
+	Kinds: []app.ManifestKind{
+		{
+			Kind:       "GlobalRole",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "GlobalRoleBinding",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "CoreRole",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "Role",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "RoleBinding",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "ResourcePermission",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+	},
+}
+
+func jsonToMap(j string) map[string]any {
+	m := make(map[string]any)
+	json.Unmarshal([]byte(j), &j)
+	return m
+}
+
+func LocalManifest() app.Manifest {
+	return app.NewEmbeddedManifest(appManifestData)
+}
+
+func RemoteManifest() app.Manifest {
+	return app.NewAPIServerManifest("iam")
+}