Provisioning: discontinue use of service identity based background tasks when onlyApiServer is true (#112634)

* Skip informers if Provisioning disable controllers is enabled

* Hydrate requester correctly for Grafana Live

* revert to old code because eventualRestConfig provider issues

---------

Co-authored-by: Charandas Batra <charandas.batra@grafana.com>

pkg/registry/apis/provisioning/register.go

@@ -648,11 +648,6 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 				return err
 			}
 
-			// Informer with resync interval used for health check and reconciliation
-			sharedInformerFactory := informers.NewSharedInformerFactory(c, 60*time.Second)
-			repoInformer := sharedInformerFactory.Provisioning().V0alpha1().Repositories()
-			jobInformer := sharedInformerFactory.Provisioning().V0alpha1().Jobs()
-
 			b.client = c.ProvisioningV0alpha1()
 
 			// Initialize the API client-based job store
@@ -669,6 +664,10 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 				return nil
 			}
 
+			// Informer with resync interval used for health check and reconciliation
+			sharedInformerFactory := informers.NewSharedInformerFactory(c, 60*time.Second)
+			repoInformer := sharedInformerFactory.Provisioning().V0alpha1().Repositories()
+			jobInformer := sharedInformerFactory.Provisioning().V0alpha1().Jobs()
 			go repoInformer.Informer().Run(postStartHookCtx.Done())
 			go jobInformer.Informer().Run(postStartHookCtx.Done())
 

pkg/services/apiserver/restconfig.go

@@ -11,6 +11,9 @@ import (
 )
 
 type RestConfigProvider interface {
+	// GetRestConfig returns a k8s client configuration that is used to provide connection info and auth for the loopback transport.
+	// context is only available for tracing in this immediate function and is not to be confused with the context seen by any client verb actions that are invoked with the retrieved rest config.
+	// - those client verb actions have the ability to specify their own context.
 	GetRestConfig(context.Context) (*clientrest.Config, error)
 }
 
@@ -50,6 +53,7 @@ var (
 // eventualRestConfigProvider is a RestConfigProvider that will not return a rest config until the ready channel is closed.
 // This exists to alleviate a circular dependency between the apiserver.server's dependencies and their dependencies wanting a rest config.
 // Importantly, this is handled by wire as opposed to a mutable global.
+// NOTE: this implementation's GetRestConfig can't be used in (wire-based) Provide functions, or a function called by Provide functions. TODO: determine why that is. @charandas: in one such attempt, the GetRestConfig waits forever and Grafana doesn't start.
 type eventualRestConfigProvider struct {
 	// When this channel is closed, we can start returning the rest config.
 	ready chan struct{}

pkg/services/live/features/watch.go

@@ -48,7 +48,7 @@ func (b *WatchRunner) GetHandlerForPath(_ string) (model.ChannelHandler, error)
 // Valid paths look like: {version}/{resource}[={name}]/{user.uid}
 // * v0alpha1/dashboards/u12345
 // * v0alpha1/dashboards=ABCD/u12345
-func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
+func (b *WatchRunner) OnSubscribe(_ context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
 	// To make sure we do not share resources across users, in clude the UID in the path
 	userID := u.GetIdentifier()
 	if userID == "" {
@@ -87,11 +87,14 @@ func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e m
 			fmt.Errorf("watching provisioned resources is OK allowed (for now)")
 	}
 
-	requester := types.WithAuthInfo(context.Background(), u)
-	cfg, err := b.configProvider.GetRestConfig(requester)
+	// doesn't matter what GetRestConfig sees for context, matters for watch below
+	cfg, err := b.configProvider.GetRestConfig(context.Background())
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
 	}
+
+	// add user to both requester and authInfo context keys, older implementations are still using requester
+	ctx := identity.WithRequester(types.WithAuthInfo(context.Background(), u), u)
 	uclient, err := dynamic.NewForConfig(cfg)
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
@@ -102,7 +105,7 @@ func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e m
 	if len(name) > 1 {
 		opts.FieldSelector = "metadata.name=" + name
 	}
-	watch, err := client.Watch(requester, opts)
+	watch, err := client.Watch(ctx, opts)
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
 	}