Advisor: App installer setup (#113525)

apps/advisor/pkg/app/app.go

@@ -20,6 +20,10 @@ import (
 )
 
 func New(cfg app.Config) (app.App, error) {
+	// Needed until https://github.com/grafana/grafana-app-sdk/pull/1077
+	if cfg.KubeConfig.APIPath == "" {
+		cfg.KubeConfig.APIPath = "apis"
+	}
 	// Read config
 	specificConfig, ok := cfg.SpecificConfig.(checkregistry.AdvisorAppConfig)
 	if !ok {

apps/advisor/pkg/app/authorizer.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
@@ -15,7 +16,22 @@ func GetAuthorizer() authorizer.Authorizer {
 			return authorizer.DecisionNoOpinion, "", nil
 		}
 
-		// require a user
+		// Check for service identity
+		if identity.IsServiceIdentity(ctx) {
+			return authorizer.DecisionAllow, "", nil
+		}
+
+		// Check for access policy identity
+		info, ok := claims.AuthInfoFrom(ctx)
+		if ok && claims.IsIdentityType(info.GetIdentityType(), claims.TypeAccessPolicy) {
+			// For access policy identities, we need to use ResourceAuthorizer
+			// This requires an AccessClient, which should be provided by the API server
+			// For now, we'll use the default ResourceAuthorizer from the API server
+			// This will be set up by the API server's authorization chain
+			return authorizer.DecisionNoOpinion, "", nil
+		}
+
+		// For regular Grafana users, check if they are admin
 		u, err := identity.GetRequester(ctx)
 		if err != nil {
 			return authorizer.DecisionDeny, "valid user is required", err

apps/advisor/pkg/app/authorizer_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/stretchr/testify/assert"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
@@ -79,4 +80,12 @@ func (m *mockUser) HasRole(role identity.RoleType) bool {
 	return role == identity.RoleAdmin && m.isGrafanaAdmin
 }
 
+func (m *mockUser) GetUID() string {
+	return "test-uid"
+}
+
+func (m *mockUser) GetIdentityType() claims.IdentityType {
+	return claims.TypeUser
+}
+
 // Implement other methods of identity.Requester as needed

apps/advisor/pkg/app/checkregistry/mockchecks/checkregistry.go

@@ -1,59 +0,0 @@
-package mockchecks
-
-import (
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks/datasourcecheck"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks/plugincheck"
-	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/plugins/repo"
-	"github.com/grafana/grafana/pkg/services/datasources"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginchecker"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-// mockchecks.CheckRegistry is a mock implementation of the checkregistry.CheckService interface
-// TODO: Add mocked checks here
-type CheckRegistry struct {
-	datasourceSvc         datasources.DataSourceService
-	pluginStore           pluginstore.Store
-	pluginClient          plugins.Client
-	pluginRepo            repo.Service
-	GrafanaVersion        string
-	pluginContextProvider datasourcecheck.PluginContextProvider
-	updateChecker         pluginchecker.PluginUpdateChecker
-	pluginErrorResolver   plugins.ErrorResolver
-}
-
-func (m *CheckRegistry) Checks() []checks.Check {
-	return []checks.Check{
-		datasourcecheck.New(
-			m.datasourceSvc,
-			m.pluginStore,
-			m.pluginContextProvider,
-			m.pluginClient,
-			m.pluginRepo,
-			m.GrafanaVersion,
-		),
-		plugincheck.New(
-			m.pluginStore,
-			m.pluginRepo,
-			m.updateChecker,
-			m.pluginErrorResolver,
-			m.GrafanaVersion,
-		),
-	}
-}
-
-func New() *CheckRegistry {
-	return &CheckRegistry{
-		datasourceSvc:         &mocksvcs.DatasourceSvc{},
-		pluginStore:           &mocksvcs.PluginStore{},
-		pluginClient:          &mocksvcs.PluginClient{},
-		pluginRepo:            &mocksvcs.PluginRepo{},
-		pluginContextProvider: &mocksvcs.PluginContextProvider{},
-		updateChecker:         &mocksvcs.UpdateChecker{},
-		pluginErrorResolver:   &mocksvcs.PluginErrorResolver{},
-		GrafanaVersion:        "1.0.0",
-	}
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/datasourcesvc.go

@@ -1,44 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/services/datasources"
-)
-
-var dss = map[string]*datasources.DataSource{
-	"prometheus-uid": {
-		ID:   1,
-		UID:  "prometheus-uid",
-		Name: "Prometheus",
-		Type: "prometheus",
-	},
-	"mysql-uid": {
-		ID:   2,
-		UID:  "mysql-uid",
-		Name: "MySQL",
-		Type: "mysql",
-	},
-	"unknown-uid": {
-		ID:   3,
-		UID:  "unknown-uid",
-		Name: "Unknown",
-		Type: "unknown",
-	},
-}
-
-type DatasourceSvc struct {
-	datasources.DataSourceService
-}
-
-func (m *DatasourceSvc) GetDataSources(ctx context.Context, query *datasources.GetDataSourcesQuery) ([]*datasources.DataSource, error) {
-	sources := make([]*datasources.DataSource, 0, len(dss))
-	for _, ds := range dss {
-		sources = append(sources, ds)
-	}
-	return sources, nil
-}
-
-func (m *DatasourceSvc) GetDataSource(ctx context.Context, query *datasources.GetDataSourceQuery) (*datasources.DataSource, error) {
-	return dss[query.UID], nil
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginclient.go

@@ -1,19 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana/pkg/plugins"
-)
-
-type PluginClient struct {
-	plugins.Client
-}
-
-func (m *PluginClient) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
-	return &backend.CheckHealthResult{
-		Status:  backend.HealthStatusOk,
-		Message: "Plugin is healthy",
-	}, nil
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/plugincontextprovider.go

@@ -1,53 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/services/datasources"
-)
-
-type PluginContextProvider struct {
-}
-
-// ACTUALLY USED by datasourcecheck
-func (m *PluginContextProvider) GetWithDataSource(ctx context.Context, pluginID string, user identity.Requester, ds *datasources.DataSource) (backend.PluginContext, error) {
-	// Create a plugin context with sample data based on the datasource
-	pluginContext := backend.PluginContext{
-		PluginID:      pluginID,
-		PluginVersion: "1.0.0",
-		OrgID:         1,
-		DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
-			ID:   ds.ID,
-			UID:  ds.UID,
-			Name: ds.Name,
-			URL:  ds.URL,
-			JSONData: []byte(`{
-				"httpMethod": "GET",
-				"timeout": "30s",
-				"keepCookies": []
-			}`),
-			DecryptedSecureJSONData: map[string]string{
-				"password": "sample-password",
-				"apiKey":   "sample-api-key",
-			},
-		},
-		GrafanaConfig: backend.NewGrafanaCfg(map[string]string{
-			"app_url":          "http://localhost:3000",
-			"default_timezone": "UTC",
-		}),
-	}
-
-	// Add user context if provided
-	if user != nil && !user.IsNil() {
-		pluginContext.User = &backend.User{
-			Login: user.GetLogin(),
-			Name:  user.GetName(),
-			Email: user.GetEmail(),
-			Role:  string(user.GetOrgRole()),
-		}
-	}
-
-	return pluginContext, nil
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginerrorresolver.go

@@ -1,19 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins"
-)
-
-type PluginErrorResolver struct {
-}
-
-// Assume no plugin with errors
-func (m *PluginErrorResolver) PluginErrors(ctx context.Context) []*plugins.Error {
-	return nil
-}
-
-func (m *PluginErrorResolver) PluginError(ctx context.Context, pluginID string) *plugins.Error {
-	return nil
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginrepo.go

@@ -1,26 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins/repo"
-)
-
-type PluginRepo struct {
-	repo.Service
-}
-
-func (m *PluginRepo) GetPluginsInfo(ctx context.Context, options repo.GetPluginsInfoOptions, compatOpts repo.CompatOpts) ([]repo.PluginInfo, error) {
-	return []repo.PluginInfo{
-		{
-			ID:      1,
-			Slug:    "grafana-piechart-panel",
-			Version: "1.6.0",
-		},
-		{
-			ID:      2,
-			Slug:    "prometheus",
-			Version: "10.0.0",
-		},
-	}, nil
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginstore.go

@@ -1,114 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-type PluginStore struct {
-}
-
-var ps = map[string]pluginstore.Plugin{
-	"prometheus": {
-		JSONData: plugins.JSONData{
-			ID:   "prometheus",
-			Type: plugins.TypeDataSource,
-			Name: "Prometheus",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "10.0.0",
-			},
-			Category: "Time series databases",
-			State:    plugins.ReleaseStateAlpha,
-			Backend:  true,
-			Metrics:  true,
-			Logs:     true,
-			Alerting: true,
-			Explore:  true,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"test-datasource": {
-		JSONData: plugins.JSONData{
-			ID:   "grafana-piechart-panel",
-			Type: plugins.TypePanel,
-			Name: "Pie Chart",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "1.6.0",
-			},
-			Category: "Visualization",
-			State:    plugins.ReleaseStateAlpha,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"grafana-piechart-panel": {
-		JSONData: plugins.JSONData{
-			ID:   "prometheus",
-			Type: plugins.TypeDataSource,
-			Name: "Prometheus",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "10.0.0",
-			},
-			Category: "Time series databases",
-			State:    plugins.ReleaseStateAlpha,
-			Backend:  true,
-			Metrics:  true,
-			Logs:     true,
-			Alerting: true,
-			Explore:  true,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"test-app": {
-		JSONData: plugins.JSONData{
-			ID:   "test-app",
-			Type: plugins.TypeApp,
-			Name: "Test App",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Test Author",
-				},
-				Version: "2.0.0",
-			},
-			Category:    "Application",
-			State:       plugins.ReleaseStateAlpha,
-			AutoEnabled: true,
-		},
-		Class:         plugins.ClassExternal,
-		Signature:     plugins.SignatureStatusValid,
-		SignatureType: plugins.SignatureTypeCommercial,
-		SignatureOrg:  "test.com",
-	},
-}
-
-func (s *PluginStore) Plugin(ctx context.Context, pluginID string) (pluginstore.Plugin, bool) {
-	p, ok := ps[pluginID]
-	return p, ok
-}
-
-func (s *PluginStore) Plugins(ctx context.Context, pluginTypes ...plugins.Type) []pluginstore.Plugin {
-	plugins := make([]pluginstore.Plugin, 0, len(ps))
-	for _, p := range ps {
-		plugins = append(plugins, p)
-	}
-	return plugins
-}

apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/updatechecker.go

@@ -1,18 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-type UpdateChecker struct {
-}
-
-func (m *UpdateChecker) IsUpdatable(ctx context.Context, plugin pluginstore.Plugin) bool {
-	return true
-}
-
-func (m *UpdateChecker) CanUpdate(pluginId string, currentVersion string, targetVersion string, onlyMinor bool) bool {
-	return true
-}

apps/advisor/pkg/standalone/server.go

@@ -1,58 +0,0 @@
-package main
-
-import (
-	"log/slog"
-	"os"
-
-	"k8s.io/apiserver/pkg/admission"
-	genericapiserver "k8s.io/apiserver/pkg/server"
-	"k8s.io/client-go/rest"
-	"k8s.io/component-base/cli"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/k8s/apiserver"
-	"github.com/grafana/grafana-app-sdk/k8s/apiserver/cmd/server"
-	"github.com/grafana/grafana-app-sdk/logging"
-	"github.com/grafana/grafana-app-sdk/simple"
-	"github.com/grafana/grafana/apps/advisor/pkg/apis"
-	advisorapp "github.com/grafana/grafana/apps/advisor/pkg/app"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry/mockchecks"
-)
-
-func main() {
-	logging.DefaultLogger = logging.NewSLogLogger(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
-		Level: slog.LevelDebug,
-	}))
-	provider := simple.NewAppProvider(apis.LocalManifest(), nil, advisorapp.New)
-	config := app.Config{
-		KubeConfig:   rest.Config{}, // this will be replaced by the apiserver loopback config
-		ManifestData: *apis.LocalManifest().ManifestData,
-		SpecificConfig: checkregistry.AdvisorAppConfig{
-			CheckRegistry: mockchecks.New(),
-			PluginConfig:  map[string]string{},
-			StackID:       "1", // Numeric stack ID for standalone mode
-			OrgService:    nil, // Not needed when StackID is set
-		},
-	}
-	installer, err := apiserver.NewDefaultAppInstaller(provider, config, &apis.GoTypeAssociator{})
-	if err != nil {
-		panic(err)
-	}
-	ctx := genericapiserver.SetupSignalContext()
-	opts := apiserver.NewOptions([]apiserver.AppInstaller{installer})
-	opts.RecommendedOptions.Authentication = nil
-	opts.RecommendedOptions.Authorization = nil
-	opts.RecommendedOptions.CoreAPI = nil
-	opts.RecommendedOptions.EgressSelector = nil
-	opts.RecommendedOptions.Admission.Plugins = admission.NewPlugins()
-	opts.RecommendedOptions.Admission.RecommendedPluginOrder = []string{}
-	opts.RecommendedOptions.Admission.EnablePlugins = []string{}
-	opts.RecommendedOptions.Features.EnablePriorityAndFairness = false
-	opts.RecommendedOptions.ExtraAdmissionInitializers = func(_ *genericapiserver.RecommendedConfig) ([]admission.PluginInitializer, error) {
-		return nil, nil
-	}
-	cmd := server.NewCommandStartServer(ctx, opts)
-	code := cli.Run(cmd)
-	os.Exit(code)
-}