mirror of https://github.com/grafana/grafana
IAM: Register CoreRole apis (#106924)
* IAM: Register CoreRole apis
* one line store instantiation
* Small refactor for readability
* Add authorizer for CoreRole
* Nit
* Error strings should not end with punctiation
* Account for error
* Switch to use the local resource client
* error should not start with upper casing
* noopStorageErr should have a name starting with err
* Update workspace
* I don't know why I don't have the same output as the CI 🤷
* Dependency xOwnership
* imports
* Import order
* Rename alias to make it clear this is legacy
pull/101501/head^2
Gabriel MABILLE
21 hours ago
committed by
GitHub
parent
6f8e33f360
commit
3d543a336f
@ -0,0 +1,73 @@ |
|||||||
|
package v0alpha1 |
||||||
|
|
||||||
|
import ( |
||||||
|
"fmt" |
||||||
|
"time" |
||||||
|
|
||||||
|
"github.com/grafana/grafana/pkg/apimachinery/utils" |
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||||
|
"k8s.io/apimachinery/pkg/runtime" |
||||||
|
"k8s.io/apimachinery/pkg/runtime/schema" |
||||||
|
) |
||||||
|
|
||||||
|
const ( |
||||||
|
GROUP = "iam.grafana.app" |
||||||
|
VERSION = "v0alpha1" |
||||||
|
APIVERSION = GROUP + "/" + VERSION |
||||||
|
) |
||||||
|
|
||||||
|
var CoreRoleInfo = utils.NewResourceInfo(GROUP, VERSION, |
||||||
|
"coreroles", "corerole", "CoreRole", |
||||||
|
func() runtime.Object { return &CoreRole{} }, |
||||||
|
func() runtime.Object { return &CoreRoleList{} }, |
||||||
|
utils.TableColumns{ |
||||||
|
Definition: []metav1.TableColumnDefinition{ |
||||||
|
{Name: "Name", Type: "string", Format: "name"}, |
||||||
|
{Name: "Title", Type: "string", Format: "string", Description: "Core role name"}, // Not sure this is actually needed
|
||||||
|
{Name: "Created At", Type: "date"}, |
||||||
|
}, |
||||||
|
Reader: func(obj any) ([]interface{}, error) { |
||||||
|
core, ok := obj.(*CoreRole) |
||||||
|
if ok { |
||||||
|
if core != nil { |
||||||
|
return []interface{}{ |
||||||
|
core.Name, |
||||||
|
core.Spec.Title, |
||||||
|
core.CreationTimestamp.UTC().Format(time.RFC3339), |
||||||
|
}, nil |
||||||
|
} |
||||||
|
} |
||||||
|
return nil, fmt.Errorf("expected core role") |
||||||
|
}, |
||||||
|
}, |
||||||
|
) |
||||||
|
|
||||||
|
var ( |
||||||
|
SchemeBuilder runtime.SchemeBuilder |
||||||
|
localSchemeBuilder = &SchemeBuilder |
||||||
|
AddToScheme = localSchemeBuilder.AddToScheme |
||||||
|
schemeGroupVersion = schema.GroupVersion{Group: GROUP, Version: VERSION} |
||||||
|
) |
||||||
|
|
||||||
|
func init() { |
||||||
|
localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs) |
||||||
|
} |
||||||
|
|
||||||
|
// Adds the list of known types to the given scheme.
|
||||||
|
func addKnownTypes(scheme *runtime.Scheme) error { |
||||||
|
scheme.AddKnownTypes(schemeGroupVersion, |
||||||
|
&CoreRole{}, |
||||||
|
&CoreRoleList{}, |
||||||
|
|
||||||
|
// What is this about?
|
||||||
|
&metav1.PartialObjectMetadata{}, |
||||||
|
&metav1.PartialObjectMetadataList{}, |
||||||
|
) |
||||||
|
metav1.AddToGroupVersion(scheme, schemeGroupVersion) |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
func addDefaultingFuncs(scheme *runtime.Scheme) error { |
||||||
|
// return RegisterDefaults(scheme)
|
||||||
|
return nil |
||||||
|
} |
||||||
@ -0,0 +1,44 @@ |
|||||||
|
package iam |
||||||
|
|
||||||
|
import ( |
||||||
|
"github.com/grafana/authlib/types" |
||||||
|
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy" |
||||||
|
"github.com/grafana/grafana/pkg/registry/apis/iam/user" |
||||||
|
"github.com/grafana/grafana/pkg/services/apiserver/builder" |
||||||
|
"github.com/grafana/grafana/pkg/services/ssosettings" |
||||||
|
"github.com/grafana/grafana/pkg/storage/unified/resource" |
||||||
|
"github.com/prometheus/client_golang/prometheus" |
||||||
|
"k8s.io/apiserver/pkg/authorization/authorizer" |
||||||
|
) |
||||||
|
|
||||||
|
var _ builder.APIGroupBuilder = (*IdentityAccessManagementAPIBuilder)(nil) |
||||||
|
var _ builder.APIGroupRouteProvider = (*IdentityAccessManagementAPIBuilder)(nil) |
||||||
|
|
||||||
|
// CoreRoleStorageBackend uses the resource.StorageBackend interface to provide storage for core roles.
|
||||||
|
// Used wire to identify the storage backend for core roles.
|
||||||
|
type CoreRoleStorageBackend interface{ resource.StorageBackend } |
||||||
|
|
||||||
|
// This is used just so wire has something unique to return
|
||||||
|
type IdentityAccessManagementAPIBuilder struct { |
||||||
|
// Stores
|
||||||
|
store legacy.LegacyIdentityStore |
||||||
|
coreRolesStorage CoreRoleStorageBackend |
||||||
|
|
||||||
|
// Access Control
|
||||||
|
authorizer authorizer.Authorizer |
||||||
|
// legacyAccessClient is used for the identity apis, we need to migrate to the access client
|
||||||
|
legacyAccessClient types.AccessClient |
||||||
|
// accessClient is used for the core role apis
|
||||||
|
accessClient types.AccessClient |
||||||
|
|
||||||
|
reg prometheus.Registerer |
||||||
|
|
||||||
|
// non-k8s api route
|
||||||
|
display *user.LegacyDisplayREST |
||||||
|
|
||||||
|
// Not set for multi-tenant deployment for now
|
||||||
|
sso ssosettings.Service |
||||||
|
|
||||||
|
// Toggle for enabling authz management apis
|
||||||
|
enableAuthZApis bool |
||||||
|
} |
||||||
@ -0,0 +1,56 @@ |
|||||||
|
package noopstorage |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"errors" |
||||||
|
"net/http" |
||||||
|
|
||||||
|
"github.com/grafana/grafana/pkg/storage/unified/resource" |
||||||
|
"github.com/grafana/grafana/pkg/storage/unified/resourcepb" |
||||||
|
) |
||||||
|
|
||||||
|
var ( |
||||||
|
_ resource.StorageBackend = &StorageBackendImpl{} |
||||||
|
|
||||||
|
errNoopStorage = errors.New("unavailable functionality") |
||||||
|
) |
||||||
|
|
||||||
|
type StorageBackendImpl struct{} |
||||||
|
|
||||||
|
func ProvideStorageBackend() *StorageBackendImpl { |
||||||
|
return &StorageBackendImpl{} |
||||||
|
} |
||||||
|
|
||||||
|
// GetResourceStats implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) GetResourceStats(ctx context.Context, namespace string, minCount int) ([]resource.ResourceStats, error) { |
||||||
|
return []resource.ResourceStats{}, errNoopStorage |
||||||
|
} |
||||||
|
|
||||||
|
// ListHistory implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) ListHistory(context.Context, *resourcepb.ListRequest, func(resource.ListIterator) error) (int64, error) { |
||||||
|
return 0, errNoopStorage |
||||||
|
} |
||||||
|
|
||||||
|
// ListIterator implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) ListIterator(context.Context, *resourcepb.ListRequest, func(resource.ListIterator) error) (int64, error) { |
||||||
|
return 0, errNoopStorage |
||||||
|
} |
||||||
|
|
||||||
|
// ReadResource implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) ReadResource(_ context.Context, req *resourcepb.ReadRequest) *resource.BackendReadResponse { |
||||||
|
return &resource.BackendReadResponse{ |
||||||
|
Key: req.GetKey(), |
||||||
|
Error: &resourcepb.ErrorResult{Code: http.StatusForbidden, Message: errNoopStorage.Error()}, |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// WatchWriteEvents implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) WatchWriteEvents(ctx context.Context) (<-chan *resource.WrittenEvent, error) { |
||||||
|
stream := make(chan *resource.WrittenEvent, 10) |
||||||
|
return stream, nil |
||||||
|
} |
||||||
|
|
||||||
|
// WriteEvent implements resource.StorageBackend.
|
||||||
|
func (c *StorageBackendImpl) WriteEvent(context.Context, resource.WriteEvent) (int64, error) { |
||||||
|
return 0, errNoopStorage |
||||||
|
} |
||||||
Loading…
Reference in new issue