mirror of https://github.com/grafana/grafana
Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface * Zanzana: Add utilities for translating RBAC to openFGA tuple keys * RBAC: Add zanzana synchronizer * Run zanzana sync in access controll providerpull/90091/head
Karl Persson
1 year ago
committed by
GitHub
parent
f518c5978c
commit
e568b86ac0
@ -0,0 +1,128 @@ |
||||
package migrator |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
"strconv" |
||||
"strings" |
||||
|
||||
openfgav1 "github.com/openfga/api/proto/openfga/v1" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/db" |
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
"github.com/grafana/grafana/pkg/services/authz/zanzana" |
||||
) |
||||
|
||||
// A TupleCollector is responsible to build and store [openfgav1.TupleKey] into provided tuple map.
|
||||
// They key used should be a unique group key for the collector so we can skip over an already synced group.
|
||||
type TupleCollector func(ctx context.Context, tuples map[string][]*openfgav1.TupleKey) error |
||||
|
||||
// ZanzanaSynchroniser is a component to sync RBAC permissions to zanzana.
|
||||
// We should rewrite the migration after we have "migrated" all possible actions
|
||||
// into our schema. This will only do a one time migration for each action so its
|
||||
// is not really syncing the full rbac state. If a fresh sync is needed the tuple
|
||||
// needs to be cleared first.
|
||||
type ZanzanaSynchroniser struct { |
||||
log log.Logger |
||||
client zanzana.Client |
||||
collectors []TupleCollector |
||||
} |
||||
|
||||
func NewZanzanaSynchroniser(client zanzana.Client, store db.DB, collectors ...TupleCollector) *ZanzanaSynchroniser { |
||||
// Append shared collectors that is used by both enterprise and oss
|
||||
collectors = append(collectors, managedPermissionsCollector(store)) |
||||
|
||||
return &ZanzanaSynchroniser{ |
||||
log: log.New("zanzana.sync"), |
||||
collectors: collectors, |
||||
} |
||||
} |
||||
|
||||
// Sync runs all collectors and tries to write all collected tuples.
|
||||
// It will skip over any "sync group" that has already been written.
|
||||
func (z *ZanzanaSynchroniser) Sync(ctx context.Context) error { |
||||
tuplesMap := make(map[string][]*openfgav1.TupleKey) |
||||
|
||||
for _, c := range z.collectors { |
||||
if err := c(ctx, tuplesMap); err != nil { |
||||
return fmt.Errorf("failed to collect permissions: %w", err) |
||||
} |
||||
} |
||||
|
||||
for key, tuples := range tuplesMap { |
||||
if err := batch(len(tuples), 100, func(start, end int) error { |
||||
return z.client.Write(ctx, &openfgav1.WriteRequest{ |
||||
Writes: &openfgav1.WriteRequestWrites{ |
||||
TupleKeys: tuples[start:end], |
||||
}, |
||||
}) |
||||
}); err != nil { |
||||
if strings.Contains(err.Error(), "cannot write a tuple which already exists") { |
||||
z.log.Debug("Skipping already synced permissions", "sync_key", key) |
||||
continue |
||||
} |
||||
return err |
||||
} |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// managedPermissionsCollector collects managed permissions into provided tuple map.
|
||||
// It will only store actions that are supported by our schema. Managed permissions can
|
||||
// be directly mapped to user/team/role without having to write an intermediate role.
|
||||
func managedPermissionsCollector(store db.DB) TupleCollector { |
||||
return func(ctx context.Context, tuples map[string][]*openfgav1.TupleKey) error { |
||||
const collectorID = "managed" |
||||
const query = ` |
||||
SELECT ur.user_id, p.action, p.kind, p.identifier, r.org_id FROM permission p |
||||
INNER JOIN role r on p.role_id = r.id |
||||
LEFT JOIN user_role ur on r.id = ur.role_id |
||||
LEFT JOIN team_role tr on r.id = tr.role_id |
||||
LEFT JOIN builtin_role br on r.id = br.role_id |
||||
WHERE r.name LIKE 'managed:%' |
||||
` |
||||
type Permission struct { |
||||
RoleName string `xorm:"role_name"` |
||||
OrgID int64 `xorm:"org_id"` |
||||
Action string `xorm:"action"` |
||||
Kind string |
||||
Identifier string |
||||
UserID int64 `xorm:"user_id"` |
||||
TeamID int64 `xorm:"user_id"` |
||||
} |
||||
|
||||
var permissions []Permission |
||||
err := store.WithDbSession(ctx, func(sess *db.Session) error { |
||||
return sess.SQL(query).Find(&permissions) |
||||
}) |
||||
|
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
for _, p := range permissions { |
||||
var subject string |
||||
if p.UserID > 0 { |
||||
subject = zanzana.NewObject(zanzana.TypeUser, strconv.FormatInt(p.UserID, 10)) |
||||
} else if p.TeamID > 0 { |
||||
subject = zanzana.NewObject(zanzana.TypeTeam, strconv.FormatInt(p.TeamID, 10)) |
||||
} else { |
||||
// FIXME(kalleep): Unsuported role binding (org role). We need to have basic roles in place
|
||||
continue |
||||
} |
||||
|
||||
tuple, ok := zanzana.TranslateToTuple(subject, p.Action, p.Kind, p.Identifier, p.OrgID) |
||||
if !ok { |
||||
continue |
||||
} |
||||
|
||||
// our "sync key" is a combination of collectorID and action so we can run this
|
||||
// sync new data when more actions are supported
|
||||
key := fmt.Sprintf("%s-%s", collectorID, p.Action) |
||||
tuples[key] = append(tuples[key], tuple) |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
} |
||||
@ -0,0 +1,60 @@ |
||||
package zanzana |
||||
|
||||
import ( |
||||
"fmt" |
||||
"strconv" |
||||
|
||||
openfgav1 "github.com/openfga/api/proto/openfga/v1" |
||||
) |
||||
|
||||
const ( |
||||
TypeUser string = "user" |
||||
TypeTeam string = "team" |
||||
) |
||||
|
||||
func NewObject(typ, id string) string { |
||||
return fmt.Sprintf("%s:%s", typ, id) |
||||
} |
||||
|
||||
func NewScopedObject(typ, id, scope string) string { |
||||
return NewObject(typ, fmt.Sprintf("%s-%s", scope, id)) |
||||
} |
||||
|
||||
// rbac action to relation translation
|
||||
var actionTranslations = map[string]string{} |
||||
|
||||
type kindTranslation struct { |
||||
typ string |
||||
orgScoped bool |
||||
} |
||||
|
||||
// all kinds that we can translate into a openFGA object
|
||||
var kindTranslations = map[string]kindTranslation{} |
||||
|
||||
func TranslateToTuple(user string, action, kind, identifier string, orgID int64) (*openfgav1.TupleKey, bool) { |
||||
relation, ok := actionTranslations[action] |
||||
if !ok { |
||||
return nil, false |
||||
} |
||||
|
||||
t, ok := kindTranslations[kind] |
||||
if !ok { |
||||
return nil, false |
||||
} |
||||
|
||||
tuple := &openfgav1.TupleKey{ |
||||
Relation: relation, |
||||
} |
||||
|
||||
tuple.User = user |
||||
tuple.Relation = relation |
||||
|
||||
// UID in grafana are not guarantee to be unique across orgs so we need to scope them.
|
||||
if t.orgScoped { |
||||
tuple.Object = NewScopedObject(t.typ, identifier, strconv.FormatInt(orgID, 10)) |
||||
} else { |
||||
tuple.Object = NewObject(t.typ, identifier) |
||||
} |
||||
|
||||
return tuple, true |
||||
} |
||||
Loading…
Reference in new issue