153 Commits (unistore-distributor-option2)

Author	SHA1	Message	Date
Serge Zaitsev	694b9dfe50	Chore: Replace xorm.io/xorm imports (#104458) ... * replace xorm.io/xorm imports * replace xorm from other go.mod files * clean up workspace * nolint does not make sense anymore as it is not a module * try if nolint directive helps * use nolint:all for xorm * add more nolints * try to skip xorm in linter config * exclude xorm differently * retrigger ci	3 weeks ago
Alexander Zobnin	da32b9e16f	Zanzana: Fix health check endpoint (#104670)	3 weeks ago
Eric Leijonmarck	15bddb3712	IAM: Add `datasources:query` support for using the authlib/authzservice (#104107) ... * feat(add): datasources:query support for using the authlib/authzservice * added test for datasources * refactor to create the translation right away * Update pkg/services/authz/rbac/mapper.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix tests --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 weeks ago
Alexander Zobnin	1584349b99	Zanzana: Use authz client (#104037) ... * Zanzana: use client from authzlib * update go.sum * use user UID for debugging * Remove unused function	4 weeks ago
Ryan McKinley	b09d79b21c	K8s/Dashboard: Promote from alpha1 to beta1 (#104009)	4 weeks ago
Stephanie Hingtgen	b887e8aa05	K8s: Dashboards: Add fine grained access control checks to /apis (#104347) ... --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com> Co-authored-by: Marco de Abreu <marco.deabreu@grafana.com> Co-authored-by: Georges Chaudy <chaudyg@gmail.com>	4 weeks ago
Eric Leijonmarck	4bf32f3651	Zanzana: Adds readme with configuration for openfga cli (#104276)	4 weeks ago
Alexander Zobnin	073e6dc98c	Zanzana: Fix OpenFGA HTTP server (#104088) ... Zanzana: Fix OpenFGA grpc server	4 weeks ago
Matheus Macabu	fc9f32a9f6	SQLTemplates: Add helper to ensure all templates have a test-case (#103964) ... * SQLTemplates: Add helper to ensure all templates have a test-case associated * UnifiedStorage: Add missing sql template test case * LegacyDashboards: Add sql templates fs to test cases for exhaustiveness check * RBACStore: Add sql templates fs to test cases for exhaustiveness check * LegacyIAM: Add missing sql template test cases	4 weeks ago
Ryan McKinley	0283c98e30	K8s/Folders: Use v1beta1 and app-sdk based spec (#103975)	1 month ago
Ryan McKinley	664e5255fe	Provisioning: Use role based access when the target does not yet exist (#103862) ... * role based fallback * disable permissions cache with provisioning * fallback to role based * test with editor (not admin) * test with editor (not admin) * fix imports * lint * editor can create folders	1 month ago
Stephanie Hingtgen	f5ad1ef69b	K8s: Folders: Add v1 api (#103842)	1 month ago
Gabriel MABILLE	45d6bfe7cf	AuthZ: Make cache ttl configurable (#103769) ... * AuthZ: Configure cache ttl Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * Client side conf Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * 0 -> No caching * Make it possible to disable cache on the remote client as well * Comment * Move ttl parsing up for in-proc to have it --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 month ago
Stephanie Hingtgen	6eba5d74e1	Anonymous access: Allow setting org role in new authz service (#103669) ... * Anonymous access: Allow setting org role in new authz service * back out change that is not needed; rename struct * cleanup * Fix tests --------- Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>	1 month ago
Ieva	d9dc93c4a6	AuthZService: improve authz caching (#103633) ... * remove the use of client side cache for in-proc authz client Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com> * add a permission denial cache, fetch perms if not in either of the caches Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com> * Clean up tests Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Cache tests Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Add test to list + cache Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Add outdated cache test Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Re-organize metrics Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com>	1 month ago
Alexander Zobnin	4bc9203cf6	Zanzana: Perform shadow requests (#103444) ... * Zanzana: Execute checks in the background * add metrics * collect metrics * cleanup * shadow compile checker * add time metrics for compiler * run compile in parallel * prevent deadlock	1 month ago
Leonor Oliveira	e9ed7223a6	Use authlib repo. Use otel (#103178) ... * Use authlib repo. Use otel * Use interceptors on the provider level * Create a new wire set with otel * Lint * Fix test * make update-workflow * make update-workspace * make update-workspace. Try to add authlib as enterprise imports * make update-workspace	1 month ago
mohammad-hamid	192d3783d5	Zanzana/enable TLS for client side gRPC (#103000) ... * zanzana - add tls to the client * remove todo * gofmt * adjust comment	2 months ago
Mariell Hoversholm	d0d7078953	App Platform: Remove mutable globals (#102962) ... * App Platform: Remove mutable globals * chore: clarify why this exists * fix: support multi-tenant mode * refactor: call builder providers directly * CI: Force re-build	2 months ago
Alexander Zobnin	63a2ce7214	Zanzana: Support subresources for users and service accounts (#102874) ... * Zanzana: Support subresources for users and service accounts * rename relationsFolder * fix linter error	2 months ago
Karl Persson	c236a22284	Authz: Include context in logs when using cache (#102810) ... Include context in logs when using cache	2 months ago
Stephanie Hingtgen	7c2890384a	K8s: Dashboards: Set v1alpha1 as priority (#102729)	2 months ago
Alexander Zobnin	c34394f385	Zanzana: Support subresources for typed resources (#102470) ... * Zanzana: Support subresources for folders * refactor * fix subresource requests * implement listing for folders subresources * teams subresources PoC * re-enable tests * use team resource def from iam * fix tests * remove unused code * refactor: rename to subresource * split resource schema * update workspaces * rename folder relation to subresource * refactor: rename folder resources to subresources * update readme * fix listing * rename params in subresource filter	2 months ago
Gabriel MABILLE	8767a8f9a1	AuthZ: Improve getUserPermissions query (INNER JOIN, UNION ALL) (#102441)	2 months ago
Matheus Macabu	2ade94bbf7	SecretsManager: Add roles and access control to APIs (#102456)	2 months ago
Gabriel MABILLE	9a556fbde6	AuthZService: Add attributes to traces (#102433)	2 months ago
Igor Suleymanov	5d2ba10113	K8s/Dashboards: Extract Dashboard APIs to an app submodule (#102029) ... * Move dashboard k8s APIs to a separate app Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com> * Copy dashboard code in Dockerfile Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com> * Fix conversion generation Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com> * Update OpenAPI snapshot for dashboard/v0alpha1 Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com> --------- Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com>	2 months ago
Alexander Zobnin	f6f6ae4496	Zanzana: Update docs with subresources description (#101948) ... * Zanzana: Update docs with subresources description * clarify resource name	2 months ago
Gabriel MABILLE	c8f810b422	Authz: Check namespace is set in the context (#101723) ... * Authz: Test List * Anonymous case * Cover rendering * Authz: Check namespace is set in the context * Explicitly request a namespace check in the storage functions * Revert logic	2 months ago
Gabriel MABILLE	6a1e5dd128	AuthZ: Test List (#101721) ... * Authz: Test List * Anonymous case * Cover rendering	3 months ago
Gabriel MABILLE	6accf13597	AuthZService: Test Check (#101675) ... * wip * deny case * Reorganise * WIP * Check cache * Add anonymous test * Add test for rendering * Lint import * Refactor slightly * more input validation coverage * Require user * typo	3 months ago
Gabriel MABILLE	a91081a2fc	AuthZService: Add certificates to the client (#101603)	3 months ago
Alexander Zobnin	c23bb36956	Zanzana: Fix health check endpoint (#101612)	3 months ago
Ryan McKinley	806c043e45	UnifiedStorage: Rename Batch processing to Bulk (#101413)	3 months ago
Gabriel MABILLE	c3505f0864	AuthZ: Make `NewGrpcTokenAuth` public (#101352) ... * AuthZ: Expose NewGrpcTokenAuth * Lint	3 months ago
Karl Persson	fa74d1c36d	Authn: Sync authlib and update how we construct authn client interceptor (#101124) ... * Sync authlib and update how we construct authn client interceptor * Remove namespace from checker	3 months ago
Karl Persson	74632a25c3	Authz: folder api tls settings (#101213) ... * Skip certificate verification * Add more settings for folder api	3 months ago
Todd Treece	9e80b0f913	K8s: Add error to GetRestConfig (#101147) ... K8s: Add error to RestConfigProvider return values	3 months ago
Karl Persson	14886410d6	Zanzana: Use shared auth interceptor for zanzana and pass tracer (#100968) ... * Use shared auth interceptor for zanzana and pass tracer	3 months ago
Alexander Zobnin	fcb88f6ccc	Zanzana: revert cluster store for fixed roles (#100958) ... * Zanzana: revert cluster store for fixed roles * update go workspace	3 months ago
Karl Persson	4df398c084	Authz: Sync authlib and update authz client setup code (#100817) ... * Sync authlib and update setup code for authz client	3 months ago
Karl Persson	e9b2f69137	Authz: Only have two modes for authz client (#100803) ... * Only have "inproc" and "clod" mode	3 months ago
Karl Persson	1b1954de28	Authz: add support to use folder api to fetch folder tree (#100038) ... * Add FolderStore interface * Authz: add implementation to use folders api and use it inproc with loopback config * Add tracing and add rest.Config for talking with folder api using access tokens * Restructure test to get rid of circular dependencies in tests * use correct group version kind --------- Co-authored-by: gamab <gabriel.mabille@grafana.com>	3 months ago
Alexander Zobnin	7234a17d1d	Zanzana: Use authzService audience (#100417)	3 months ago
Karl Persson	bfa4fa3c68	Authz: Refactor folder tree (#99554) ... * Refactor folder tree to its own structure * Make it possible to json encode the tree * Use iterations for Ancestors and Children --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 months ago
Karl Persson	011301f06f	Authz: client cache (#100195) ... * Reduce client permissions cache for authz client * Adjust server cache ttl	3 months ago
Karl Persson	d16374d339	Authz: For list collect all folder permisions into items (#99955) ... * For list collect all folder permisions into items --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Alexander Zobnin	a95005eab5	Zanzana: Disable broken OpenFGA health check (#99818) ... * Zanzana: Disable broken OpenFGA health check * simplify return Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Ieva	33a53d170b	AuthZ service: Add metrics (#99007) ... * add metrics for authZ MT service * remove metrics that are already tracked by the GRPC server metrics Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * undo unneeded change * test fix --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Gabriel MABILLE	a9f0e15778	AuthZ: Change cache interface (#99058) ... * Authz: Switch to remotecache * Todos * lint * lint test * test readibility * Remove ttls * implement a cache wrap * Rm unused func * Comment * Update workspace: * Use cache * Fix comment	4 months ago