grafana

Commit Graph

Author	SHA1	Message	Date
Alexander Zobnin	fcb88f6ccc	Zanzana: revert cluster store for fixed roles (#100958 ) * Zanzana: revert cluster store for fixed roles * update go workspace	3 months ago
Alexander Zobnin	5118e82e8c	Zanzana: Run reconciliation in its own service (#100361 ) * Zanzana: Start reconciliation in its own service * cleanup * update go workspaces * refactor * remove unused code * move func definition	3 months ago
Karl Persson	39d94eabcd	Auth: Fix function name (#100122 ) Fix spelling	4 months ago
Misi	437b7a565d	Auth: Add access token to in-proc communication and ServiceIdentity (#98926 ) Use fake access token for in-proc grpc and add ServiceIdentity --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Karl Persson <23356117+kalleep@users.noreply.github.com>	4 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243 )	4 months ago
Karl Persson	fb5783691d	Zanzana: Fix reconciliation of fixed roles (#98696 ) Remove "globalReconciler" and reuse the same one but only run them for cluster namespace	5 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201 ) * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	5 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884 ) * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	5 months ago
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443 ) * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	5 months ago
Jo	40d3b02648	Auth: Separate anonymous settings to its own struct (#97791 ) separate anonymous settings to its own struct	5 months ago
Alexander Zobnin	61d71ec5b1	Zanzana: Handle anonymous users (#97171 ) * add anonymous users to schema * sync anonymous user role * remove unused * fix linter * only add anonymous reconciler if feature is enabled	6 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638 ) * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	6 months ago
Alexander Zobnin	c8caf787d4	Zanzana: handle service accounts (#97123 ) * add service account to the schema * sync managed permissions for service accounts * sync SA basic roles * sync SA roles * Fix endless loop in reconciler while read openfga	6 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705 ) * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	6 months ago
Karl Persson	e995d4f682	Zanzana: Add setting zanzana reconciliation interval (#96687 ) Add config option under RBAC for zanzana reconciliation interval	6 months ago
Karl Persson	7e442efa9c	Zanzana: sync roles and bindings (#96661 ) * Sync fix and custom roles and team bindings. * Add collector for user role bindings	6 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473 ) * Add reconciler for basic roles * Add reconciler for basic role bindings	6 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254 ) * Authz: Move extension proto up a layer * Lint	6 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205 ) * Special handling for zanzana reconciliation if stack id is configured * remove sync call	7 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015 ) * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	7 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019 ) * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	7 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648 ) * Change schema so that resource checks on a folder walks the tree	7 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492 ) * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	7 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	7 months ago

24 Commits (55aaf4aac0db76bba135ea5e4b91e231b99bbeaa)