mirror of https://github.com/grafana/grafana
IAM: Register CoreRole apis (#106924)
* IAM: Register CoreRole apis
* one line store instantiation
* Small refactor for readability
* Add authorizer for CoreRole
* Nit
* Error strings should not end with punctiation
* Account for error
* Switch to use the local resource client
* error should not start with upper casing
* noopStorageErr should have a name starting with err
* Update workspace
* I don't know why I don't have the same output as the CI 🤷
* Dependency xOwnership
* imports
* Import order
* Rename alias to make it clear this is legacy
pull/101501/head^2
Gabriel MABILLE
1 day ago
committed by
GitHub
parent
6f8e33f360
commit
3d543a336f
@ -0,0 +1,73 @@ |
||||
package v0alpha1 |
||||
|
||||
import ( |
||||
"fmt" |
||||
"time" |
||||
|
||||
"github.com/grafana/grafana/pkg/apimachinery/utils" |
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||
"k8s.io/apimachinery/pkg/runtime" |
||||
"k8s.io/apimachinery/pkg/runtime/schema" |
||||
) |
||||
|
||||
const ( |
||||
GROUP = "iam.grafana.app" |
||||
VERSION = "v0alpha1" |
||||
APIVERSION = GROUP + "/" + VERSION |
||||
) |
||||
|
||||
var CoreRoleInfo = utils.NewResourceInfo(GROUP, VERSION, |
||||
"coreroles", "corerole", "CoreRole", |
||||
func() runtime.Object { return &CoreRole{} }, |
||||
func() runtime.Object { return &CoreRoleList{} }, |
||||
utils.TableColumns{ |
||||
Definition: []metav1.TableColumnDefinition{ |
||||
{Name: "Name", Type: "string", Format: "name"}, |
||||
{Name: "Title", Type: "string", Format: "string", Description: "Core role name"}, // Not sure this is actually needed
|
||||
{Name: "Created At", Type: "date"}, |
||||
}, |
||||
Reader: func(obj any) ([]interface{}, error) { |
||||
core, ok := obj.(*CoreRole) |
||||
if ok { |
||||
if core != nil { |
||||
return []interface{}{ |
||||
core.Name, |
||||
core.Spec.Title, |
||||
core.CreationTimestamp.UTC().Format(time.RFC3339), |
||||
}, nil |
||||
} |
||||
} |
||||
return nil, fmt.Errorf("expected core role") |
||||
}, |
||||
}, |
||||
) |
||||
|
||||
var ( |
||||
SchemeBuilder runtime.SchemeBuilder |
||||
localSchemeBuilder = &SchemeBuilder |
||||
AddToScheme = localSchemeBuilder.AddToScheme |
||||
schemeGroupVersion = schema.GroupVersion{Group: GROUP, Version: VERSION} |
||||
) |
||||
|
||||
func init() { |
||||
localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs) |
||||
} |
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error { |
||||
scheme.AddKnownTypes(schemeGroupVersion, |
||||
&CoreRole{}, |
||||
&CoreRoleList{}, |
||||
|
||||
// What is this about?
|
||||
&metav1.PartialObjectMetadata{}, |
||||
&metav1.PartialObjectMetadataList{}, |
||||
) |
||||
metav1.AddToGroupVersion(scheme, schemeGroupVersion) |
||||
return nil |
||||
} |
||||
|
||||
func addDefaultingFuncs(scheme *runtime.Scheme) error { |
||||
// return RegisterDefaults(scheme)
|
||||
return nil |
||||
} |
||||
@ -0,0 +1,44 @@ |
||||
package iam |
||||
|
||||
import ( |
||||
"github.com/grafana/authlib/types" |
||||
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy" |
||||
"github.com/grafana/grafana/pkg/registry/apis/iam/user" |
||||
"github.com/grafana/grafana/pkg/services/apiserver/builder" |
||||
"github.com/grafana/grafana/pkg/services/ssosettings" |
||||
"github.com/grafana/grafana/pkg/storage/unified/resource" |
||||
"github.com/prometheus/client_golang/prometheus" |
||||
"k8s.io/apiserver/pkg/authorization/authorizer" |
||||
) |
||||
|
||||
var _ builder.APIGroupBuilder = (*IdentityAccessManagementAPIBuilder)(nil) |
||||
var _ builder.APIGroupRouteProvider = (*IdentityAccessManagementAPIBuilder)(nil) |
||||
|
||||
// CoreRoleStorageBackend uses the resource.StorageBackend interface to provide storage for core roles.
|
||||
// Used wire to identify the storage backend for core roles.
|
||||
type CoreRoleStorageBackend interface{ resource.StorageBackend } |
||||
|
||||
// This is used just so wire has something unique to return
|
||||
type IdentityAccessManagementAPIBuilder struct { |
||||
// Stores
|
||||
store legacy.LegacyIdentityStore |
||||
coreRolesStorage CoreRoleStorageBackend |
||||
|
||||
// Access Control
|
||||
authorizer authorizer.Authorizer |
||||
// legacyAccessClient is used for the identity apis, we need to migrate to the access client
|
||||
legacyAccessClient types.AccessClient |
||||
// accessClient is used for the core role apis
|
||||
accessClient types.AccessClient |
||||
|
||||
reg prometheus.Registerer |
||||
|
||||
// non-k8s api route
|
||||
display *user.LegacyDisplayREST |
||||
|
||||
// Not set for multi-tenant deployment for now
|
||||
sso ssosettings.Service |
||||
|
||||
// Toggle for enabling authz management apis
|
||||
enableAuthZApis bool |
||||
} |
||||
@ -0,0 +1,56 @@ |
||||
package noopstorage |
||||
|
||||
import ( |
||||
"context" |
||||
"errors" |
||||
"net/http" |
||||
|
||||
"github.com/grafana/grafana/pkg/storage/unified/resource" |
||||
"github.com/grafana/grafana/pkg/storage/unified/resourcepb" |
||||
) |
||||
|
||||
var ( |
||||
_ resource.StorageBackend = &StorageBackendImpl{} |
||||
|
||||
errNoopStorage = errors.New("unavailable functionality") |
||||
) |
||||
|
||||
type StorageBackendImpl struct{} |
||||
|
||||
func ProvideStorageBackend() *StorageBackendImpl { |
||||
return &StorageBackendImpl{} |
||||
} |
||||
|
||||
// GetResourceStats implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) GetResourceStats(ctx context.Context, namespace string, minCount int) ([]resource.ResourceStats, error) { |
||||
return []resource.ResourceStats{}, errNoopStorage |
||||
} |
||||
|
||||
// ListHistory implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) ListHistory(context.Context, *resourcepb.ListRequest, func(resource.ListIterator) error) (int64, error) { |
||||
return 0, errNoopStorage |
||||
} |
||||
|
||||
// ListIterator implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) ListIterator(context.Context, *resourcepb.ListRequest, func(resource.ListIterator) error) (int64, error) { |
||||
return 0, errNoopStorage |
||||
} |
||||
|
||||
// ReadResource implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) ReadResource(_ context.Context, req *resourcepb.ReadRequest) *resource.BackendReadResponse { |
||||
return &resource.BackendReadResponse{ |
||||
Key: req.GetKey(), |
||||
Error: &resourcepb.ErrorResult{Code: http.StatusForbidden, Message: errNoopStorage.Error()}, |
||||
} |
||||
} |
||||
|
||||
// WatchWriteEvents implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) WatchWriteEvents(ctx context.Context) (<-chan *resource.WrittenEvent, error) { |
||||
stream := make(chan *resource.WrittenEvent, 10) |
||||
return stream, nil |
||||
} |
||||
|
||||
// WriteEvent implements resource.StorageBackend.
|
||||
func (c *StorageBackendImpl) WriteEvent(context.Context, resource.WriteEvent) (int64, error) { |
||||
return 0, errNoopStorage |
||||
} |
||||
Loading…
Reference in new issue