grafana

Commit Graph

Author	SHA1	Message	Date
Jo	40d3b02648	Auth: Separate anonymous settings to its own struct (#97791 ) separate anonymous settings to its own struct	5 months ago
Alexander Zobnin	61d71ec5b1	Zanzana: Handle anonymous users (#97171 ) * add anonymous users to schema * sync anonymous user role * remove unused * fix linter * only add anonymous reconciler if feature is enabled	6 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638 ) * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	6 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705 ) * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	6 months ago
Karl Persson	e995d4f682	Zanzana: Add setting zanzana reconciliation interval (#96687 ) Add config option under RBAC for zanzana reconciliation interval	6 months ago
Karl Persson	7e442efa9c	Zanzana: sync roles and bindings (#96661 ) * Sync fix and custom roles and team bindings. * Add collector for user role bindings	6 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473 ) * Add reconciler for basic roles * Add reconciler for basic role bindings	6 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205 ) * Special handling for zanzana reconciliation if stack id is configured * remove sync call	7 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015 ) * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	7 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019 ) * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	7 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648 ) * Change schema so that resource checks on a folder walks the tree	7 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492 ) * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	7 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	7 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541 ) * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	8 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093 ) * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit `b0c2f072a2`. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit `ee5f14eea8`. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	8 months ago
Alexander Zobnin	0e0c877609	Zanzana: Model fixed roles as a part of schema (#92364 ) * model fixed roles for dashboards and folders * Correctly translate fixed role assignments * minor refactor * assign fixed roles to teams * fix linter errors * Migrate general folder permissions for fixed roles * fix dashboards:create permission	9 months ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864 ) Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	9 months ago
Alexander Zobnin	aaf33c7923	Zanzana: Migrate basic, fixed and custom roles (#91814 ) * Zanzana: Migrate basic roles permissions * add basic roles assignments * refactor * Sync basic roles permissions in all orgs * migrate fixed roles * map root folders to orgs * fix basic role assignments in orgs * migrate other roles * migrate team roles assignments * add notes about authorization schema * don't migrate fixed roles	9 months ago
Alexander Zobnin	1cc438a56c	Zanzana: Evaluate dashboard and folder permissions (#91539 ) * Zanzana: basic folder permissions checks * Fix managed permissions for teams * fix sync batch size * add dashboards actions translations * migrate folder tree * migrate dashboard folders * remove action sets from schema * Adding more dashboard and folder-related permissions * refactor * Correctly translate dashboard permissions in folders * fix dashboard parent permissions	10 months ago
Karl Persson	cbbc12a31b	Zanzana: Sync team memberships (#89983 ) * Zanzana: Use uid for users and teams * Zanzana: Team membership migrator --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	11 months ago
Karl Persson	e568b86ac0	Zanzana: Initial work to allow partial data migrations (#89919 ) * Zanana: Add Write method to interface * Zanzana: Add utilities for translating RBAC to openFGA tuple keys * RBAC: Add zanzana synchronizer * Run zanzana sync in access controll provider	11 months ago

13 Commits (0cce224adb641a3bccec8cee8b38eaf4d0f49327)