public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

K8s/ManagedBy: Enforce who can CRUD provisioning resources (#103322)

Browse Source
This commit is contained in:
Ryan McKinley
2025-04-08 14:17:33 +03:00
committed by GitHub
parent 577ea8f6a9
commit d3e6e308a0
8 changed files with 290 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/provisioning/resources/dualwriter.go
+6
View File
@@ -9,6 +9,7 @@ import (
"github.com/grafana/grafana-app-sdk/logging"
"github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
"github.com/grafana/grafana/pkg/apimachinery/identity"
provisioning "github.com/grafana/grafana/pkg/apis/provisioning/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/provisioning/repository"
"github.com/grafana/grafana/pkg/registry/apis/provisioning/safepath"
@@ -80,6 +81,11 @@ func (r *DualReadWriter) Delete(ctx context.Context, path string, ref string, me
// Delete the file in the grafana database
if ref == "" {
ctx, _, err := identity.WithProvisioningIdentity(ctx, parsed.Obj.GetNamespace())
if err != nil {
return parsed, err
}
// FIXME: empty folders with no repository files will remain in the system
// until the next reconciliation.
err = parsed.Client.Delete(ctx, parsed.Obj.GetName(), metav1.DeleteOptions{})
pkg/registry/apis/provisioning/resources/parser.go
+7 -1
View File
@@ -17,6 +17,7 @@ import (
"github.com/grafana/grafana-app-sdk/logging"
dashboard "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1"
"github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
provisioning "github.com/grafana/grafana/pkg/apis/provisioning/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/provisioning/repository"
@@ -240,7 +241,12 @@ func (f *ParsedResource) Run(ctx context.Context) error {
return fmt.Errorf("unable to find client")
}
var err error
// Always use the provisioning identity when writing
ctx, _, err := identity.WithProvisioningIdentity(ctx, f.Obj.GetNamespace())
if err != nil {
return err
}
// FIXME: shouldn't we check for the specific error?
// Run update or create
f.Existing, _ = f.Client.Get(ctx, f.Obj.GetName(), metav1.GetOptions{})