Revert "Revert: DataSource: Support config CRUD from apiservers (#106996) (#110342)"

This reverts commit 72eeefabd7.
2025-10-07 14:31:07 -04:00
parent 84a2f41016
commit c3f34efb41
58 changed files with 2039 additions and 471 deletions
@@ -0,0 +1,192 @@
+package datasource
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"iter"
+	"maps"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/grafana/authlib/types"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
+	datasourceV0 "github.com/grafana/grafana/pkg/apis/datasource/v0alpha1"
+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	gapiutil "github.com/grafana/grafana/pkg/services/apiserver/utils"
+	"github.com/grafana/grafana/pkg/services/datasources"
+)
+
+type converter struct {
+	mapper request.NamespaceMapper
+	group  string   // the expected group
+	plugin string   // the expected pluginId
+	alias  []string // optional alias for the pluginId
+}
+
+func (r *converter) asDataSource(ds *datasources.DataSource) (*datasourceV0.DataSource, error) {
+	if ds.Type != r.plugin && !slices.Contains(r.alias, ds.Type) {
+		return nil, fmt.Errorf("expected datasource type: %s %v // not: %s", r.plugin, r.alias, ds.Type)
+	}
+
+	obj := &datasourceV0.DataSource{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:       ds.UID,
+			Namespace:  r.mapper(ds.OrgID),
+			Generation: int64(ds.Version),
+		},
+		Spec:   datasourceV0.UnstructuredSpec{},
+		Secure: ToInlineSecureValues(ds.Type, ds.UID, maps.Keys(ds.SecureJsonData)),
+	}
+	obj.UID = gapiutil.CalculateClusterWideUID(obj)
+	obj.Spec.SetTitle(ds.Name).
+		SetAccess(string(ds.Access)).
+		SetURL(ds.URL).
+		SetDatabase(ds.Database).
+		SetUser(ds.User).
+		SetDatabase(ds.Database).
+		SetBasicAuth(ds.BasicAuth).
+		SetBasicAuthUser(ds.BasicAuthUser).
+		SetWithCredentials(ds.WithCredentials).
+		SetIsDefault(ds.IsDefault).
+		SetReadOnly(ds.ReadOnly).
+		SetJSONData(ds.JsonData)
+
+	if !ds.Created.IsZero() {
+		obj.CreationTimestamp = metav1.NewTime(ds.Created)
+	}
+	if !ds.Updated.IsZero() {
+		obj.ResourceVersion = fmt.Sprintf("%d", ds.Updated.UnixMilli())
+		obj.Annotations = map[string]string{
+			utils.AnnoKeyUpdatedTimestamp: ds.Updated.Format(time.RFC3339),
+		}
+	}
+
+	if ds.APIVersion != "" {
+		obj.APIVersion = fmt.Sprintf("%s/%s", r.group, ds.APIVersion)
+	}
+
+	if ds.ID > 0 {
+		obj.Labels = map[string]string{
+			utils.LabelKeyDeprecatedInternalID: strconv.FormatInt(ds.ID, 10),
+		}
+	}
+	return obj, nil
+}
+
+// ToInlineSecureValues converts secure json into InlineSecureValues with reference names
+// The names are predictable and can be used while we implement dual writing for secrets
+func ToInlineSecureValues(dsType string, dsUID string, keys iter.Seq[string]) common.InlineSecureValues {
+	values := make(common.InlineSecureValues)
+	for k := range keys {
+		h := sha256.New()
+		h.Write([]byte(dsType)) // plugin id
+		h.Write([]byte("|"))
+		h.Write([]byte(dsUID)) // unique identifier
+		h.Write([]byte("|"))
+		h.Write([]byte(k)) // property name
+		n := hex.EncodeToString(h.Sum(nil))
+		values[k] = common.InlineSecureValue{
+			Name: "ds-" + n[0:10], // predictable name for dual writing
+		}
+	}
+	if len(values) == 0 {
+		return nil
+	}
+	return values
+}
+
+func (r *converter) toAddCommand(ds *datasourceV0.DataSource) (*datasources.AddDataSourceCommand, error) {
+	if r.group != "" && ds.APIVersion != "" && !strings.HasPrefix(ds.APIVersion, r.group) {
+		return nil, fmt.Errorf("expecting APIGroup: %s", r.group)
+	}
+	info, err := types.ParseNamespace(ds.Namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	cmd := &datasources.AddDataSourceCommand{
+		Name:  ds.Spec.Title(),
+		UID:   ds.Name,
+		OrgID: info.OrgID,
+		Type:  r.plugin,
+
+		Access:          datasources.DsAccess(ds.Spec.Access()),
+		URL:             ds.Spec.URL(),
+		Database:        ds.Spec.Database(),
+		User:            ds.Spec.User(),
+		BasicAuth:       ds.Spec.BasicAuth(),
+		BasicAuthUser:   ds.Spec.BasicAuthUser(),
+		WithCredentials: ds.Spec.WithCredentials(),
+		IsDefault:       ds.Spec.IsDefault(),
+		ReadOnly:        ds.Spec.ReadOnly(),
+	}
+
+	jsonData := ds.Spec.JSONData()
+	if jsonData != nil {
+		cmd.JsonData = simplejson.NewFromAny(jsonData)
+	}
+
+	cmd.SecureJsonData = toSecureJsonData(ds)
+	return cmd, nil
+}
+
+func (r *converter) toUpdateCommand(ds *datasourceV0.DataSource) (*datasources.UpdateDataSourceCommand, error) {
+	if r.group != "" && ds.APIVersion != "" && !strings.HasPrefix(ds.APIVersion, r.group) {
+		return nil, fmt.Errorf("expecting APIGroup: %s", r.group)
+	}
+	info, err := types.ParseNamespace(ds.Namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	cmd := &datasources.UpdateDataSourceCommand{
+		Name:  ds.Spec.Title(),
+		UID:   ds.Name,
+		OrgID: info.OrgID,
+		Type:  r.plugin,
+
+		Access:          datasources.DsAccess(ds.Spec.Access()),
+		URL:             ds.Spec.URL(),
+		Database:        ds.Spec.Database(),
+		User:            ds.Spec.User(),
+		BasicAuth:       ds.Spec.BasicAuth(),
+		BasicAuthUser:   ds.Spec.BasicAuthUser(),
+		WithCredentials: ds.Spec.WithCredentials(),
+		IsDefault:       ds.Spec.IsDefault(),
+		ReadOnly:        ds.Spec.ReadOnly(),
+
+		// The only field different than add
+		Version: int(ds.Generation),
+	}
+
+	jsonData := ds.Spec.JSONData()
+	if jsonData != nil {
+		cmd.JsonData = simplejson.NewFromAny(jsonData)
+	}
+	cmd.SecureJsonData = toSecureJsonData(ds)
+	return cmd, err
+}
+
+func toSecureJsonData(ds *datasourceV0.DataSource) map[string]string {
+	if ds == nil || len(ds.Secure) < 1 {
+		return nil
+	}
+
+	secure := map[string]string{}
+	for k, v := range ds.Secure {
+		if v.Create != "" {
+			secure[k] = v.Create.DangerouslyExposeAndConsumeValue()
+		}
+		if v.Remove {
+			secure[k] = "" // Weirdly, this is the best we can do with the legacy API :(
+		}
+	}
+	return secure
+}