public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

K8s/ManagedBy: Enforce who can CRUD provisioning resources (#103322)

Browse Source
This commit is contained in:
Ryan McKinley
2025-04-08 14:17:33 +03:00
committed by GitHub
parent 577ea8f6a9
commit d3e6e308a0
8 changed files with 290 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tests/apis/provisioning/provisioning_test.go
+27 -7
View File
@@ -14,6 +14,7 @@ import (
ghmock "github.com/migueleliasweb/go-github-mock/src/mock"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -325,7 +326,7 @@ func TestIntegrationProvisioning_ImportAllPanelsFromLocalRepository(t *testing.T
// Set up the repository and the file to import.
helper.CopyToProvisioningPath(t, "testdata/all-panels.json", "all-panels.json")
localTmp := helper.RenderObject(t, "testdata/local-readonly.json.tmpl", map[string]any{
localTmp := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
"Name": repo,
"SyncEnabled": true,
})
@@ -349,18 +350,37 @@ func TestIntegrationProvisioning_ImportAllPanelsFromLocalRepository(t *testing.T
const allPanels = "n1jR8vnnz"
_, err = helper.Dashboards.Resource.Get(ctx, allPanels, metav1.GetOptions{})
require.Error(t, err, "no all-panels dashboard should exist")
require.True(t, apierrors.IsNotFound(err))
// Now, we import it, such that it may exist
helper.SyncAndWait(t, repo, nil)
found, err := helper.Dashboards.Resource.List(ctx, metav1.ListOptions{})
_, err = helper.Dashboards.Resource.List(ctx, metav1.ListOptions{})
require.NoError(t, err, "can list values")
names := []string{}
for _, v := range found.Items {
names = append(names, v.GetName())
}
require.Contains(t, names, allPanels, "all-panels dashboard should now exist")
obj, err = helper.Dashboards.Resource.Get(ctx, allPanels, metav1.GetOptions{})
require.NoError(t, err, "all-panels dashboard should exist")
require.Equal(t, repo, obj.GetAnnotations()[utils.AnnoKeyManagerIdentity])
// Try writing the value directly
err = unstructured.SetNestedField(obj.Object, []any{"aaa", "bbb"}, "spec", "tags")
require.NoError(t, err, "set tags")
_, err = helper.Dashboards.Resource.Update(ctx, obj, metav1.UpdateOptions{})
require.Error(t, err, "only the provisionding service should be able to update")
require.True(t, apierrors.IsForbidden(err))
// Should not be able to directly delete the managed resource
err = helper.Dashboards.Resource.Delete(ctx, allPanels, metav1.DeleteOptions{})
require.Error(t, err, "only the provisioning service should be able to delete")
require.True(t, apierrors.IsForbidden(err))
// But we can delete the repository file, and this should also remove the resource
err = helper.Repositories.Resource.Delete(ctx, repo, metav1.DeleteOptions{}, "files", "all-panels.json")
require.NoError(t, err, "should delete the resource file")
_, err = helper.Dashboards.Resource.Get(ctx, allPanels, metav1.GetOptions{})
require.Error(t, err, "should delete the internal resource")
require.True(t, apierrors.IsNotFound(err))
}
func TestProvisioning_ExportUnifiedToRepository(t *testing.T) {