From ef14992f00edbbc1e0cbc26ba60cd3f155d67cf8 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Tue, 27 May 2025 14:23:29 +0200 Subject: [PATCH] Zanzana: Fix reconciling role with empty UID (#106045) --- pkg/services/accesscontrol/dualwrite/collectors.go | 5 ++++- pkg/services/accesscontrol/dualwrite/reconciler.go | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/pkg/services/accesscontrol/dualwrite/collectors.go b/pkg/services/accesscontrol/dualwrite/collectors.go index 34b50b16549..b78a8d00ba1 100644 --- a/pkg/services/accesscontrol/dualwrite/collectors.go +++ b/pkg/services/accesscontrol/dualwrite/collectors.go @@ -154,8 +154,11 @@ func managedPermissionsCollector(store db.DB, kind string) legacyTupleCollector subject = zanzana.NewTupleEntry(zanzana.TypeUser, p.UserUID, "") } else if len(p.TeamUID) > 0 { subject = zanzana.NewTupleEntry(zanzana.TypeTeam, p.TeamUID, zanzana.RelationTeamMember) - } else { + } else if len(p.BasicRoleName) > 0 { subject = zanzana.NewTupleEntry(zanzana.TypeRole, zanzana.TranslateBasicRole(p.BasicRoleName), zanzana.RelationAssignee) + } else { + reconcilerLogger.Debug("unrecognized permission", "permission", p) + continue } tuple, ok := zanzana.TranslateToResourceTuple(subject, p.Action, p.Kind, p.Identifier) diff --git a/pkg/services/accesscontrol/dualwrite/reconciler.go b/pkg/services/accesscontrol/dualwrite/reconciler.go index 6aa17b67c52..9648f9b9b4e 100644 --- a/pkg/services/accesscontrol/dualwrite/reconciler.go +++ b/pkg/services/accesscontrol/dualwrite/reconciler.go @@ -21,6 +21,7 @@ import ( ) var tracer = otel.Tracer("github.com/grafana/grafana/pkg/accesscontrol/migrator") +var reconcilerLogger = log.New("zanzana.reconciler") // ZanzanaReconciler is a component to reconcile RBAC permissions to zanzana. // We should rewrite the migration after we have "migrated" all possible actions @@ -40,7 +41,7 @@ type ZanzanaReconciler struct { func ProvideZanzanaReconciler(cfg *setting.Cfg, features featuremgmt.FeatureToggles, client zanzana.Client, store db.DB, lock *serverlock.ServerLockService, folderService folder.Service) *ZanzanaReconciler { zanzanaReconciler := &ZanzanaReconciler{ cfg: cfg, - log: log.New("zanzana.reconciler"), + log: reconcilerLogger, features: features, client: client, lock: lock,