Access control / Authorization

diff --git a/apps/provisioning/pkg/apis/provisioning/v0alpha1/settings.go b/apps/provisioning/pkg/apis/provisioning/v0alpha1/settings.go index 4decb049da1d2..8be7e1efaf2b1 100644 --- a/apps/provisioning/pkg/apis/provisioning/v0alpha1/settings.go +++ b/apps/provisioning/pkg/apis/provisioning/v0alpha1/settings.go @@ -21,10 +21,33 @@ type RepositoryViewList struct { // AvailableRepositoryTypes is the list of repository types supported in this instance (e.g. git, bitbucket, github, etc) AvailableRepositoryTypes []RepositoryType `json:"availableRepositoryTypes,omitempty"` + // AvailableResources is the list of resource types declared for provisioning in this + // instance, including disabled ones (see SupportedResource.Disabled). + AvailableResources []SupportedResource `json:"availableResources,omitempty"` + // +mapType=atomic Items []RepositoryView `json:"items"` } +// SupportedResource describes a resource type declared for provisioning. A resource is +// identified by its group and kind; the API version and plural resource are resolved at +// runtime via discovery, so they are not part of this descriptor. +type SupportedResource struct { + // Group is the API group of the resource (e.g. "dashboard.grafana.app"). + Group string `json:"group"` + + // Kind is the kind of the resource (e.g. "Dashboard"). + Kind string `json:"kind"` + + // Disabled reports whether the resource is declared but not acted on by provisioning. + // Active resources omit this field. + Disabled bool `json:"disabled,omitempty"` +} + +func (SupportedResource) OpenAPIModelName() string { + return OpenAPIPrefix + "SupportedResource" +} + func (RepositoryViewList) OpenAPIModelName() string { return OpenAPIPrefix + "RepositoryViewList" } diff --git a/conf/defaults.ini b/conf/defaults.ini index cefd01bc79346..8e8fa0dedfa8f 100644 --- a/conf/defaults.ini +++ b/conf/defaults.ini @@ -2451,6 +2451,16 @@ max_file_size = 5242880 # host. Analogous to [rendering] callback_url for the image renderer plugin. public_root_url = +# Resources that can be managed from the UI through provisioning, comma-separated, each as +# "<group>/<Kind>[:cap...]". The API version and plural resource are resolved at runtime via +# discovery, so only the group and kind are configured. Capabilities (all default to off): +# folder - folder-scoped; carries the folder annotation on write (else org-scoped) +# skipvalidation - skip validation on write (else validated) +# disabled - declared but not acted on; still surfaced on the settings endpoint +# Adding or enabling a resource is a config change. Library panels and playlists are declared +# but disabled by default. +resources = folder.grafana.app/Folder:folder, dashboard.grafana.app/Dashboard:folder, dashboard.grafana.app/LibraryPanel:folder:disabled, playlist.grafana.app/Playlist:disabled + #################################### Unified Storage #################################### [unified_storage] # index_path is the path where unified storage can store its index files for search. diff --git a/packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts b/packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts index 708f3aa5682f7..97454f720da64 100644 --- a/packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts +++ b/packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts @@ -2285,6 +2285,14 @@ export type WebhookResponse = { /** Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds */ kind?: string; }; +export type SupportedResource = { + /** Disabled reports whether the resource is declared but not acted on by provisioning. Active resources omit this field. */ + disabled?: boolean; + /** Group is the API group of the resource (e.g. "dashboard.grafana.app"). */ + group: string; + /** Kind is the kind of the resource (e.g. "Dashboard"). */ + kind: string; +}; export type RepositoryView = { /** For git, this is the target branch */ branch?: string; @@ -2327,6 +2335,8 @@ export type RepositoryViewList = { apiVersion?: string; /** AvailableRepositoryTypes is the list of repository types supported in this instance (e.g. git, bitbucket, github, etc) */ availableRepositoryTypes?: ('bitbucket' | 'git' | 'github' | 'githubEnterprise' | 'gitlab' | 'local')[]; + /** AvailableResources is the list of resource types declared for provisioning in this instance, including disabled ones (see SupportedResource.Disabled). */ + availableResources?: SupportedResource[]; items: RepositoryView[]; /** Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds */ kind?: string; diff --git a/packages/grafana-openapi/src/apis/provisioning.grafana.app-v0alpha1.json b/packages/grafana-openapi/src/apis/provisioning.grafana.app-v0alpha1.json index 1cfa8a0b510ee..3df59e07237e7 100644 --- a/packages/grafana-openapi/src/apis/provisioning.grafana.app-v0alpha1.json +++ b/packages/grafana-openapi/src/apis/provisioning.grafana.app-v0alpha1.json @@ -5553,6 +5553,17 @@ "enum": ["bitbucket", "git", "github", "githubEnterprise", "gitlab", "local"] } }, + "availableResources": { + "description": "AvailableResources is the list of resource types declared for provisioning in this instance, including disabled ones (see SupportedResource.Disabled).", + "type": "array", + "items": { + "allOf": [ + { + "$ref": "#/components/schemas/SupportedResource" + } + ] + } + }, "items": { "type": "array", "items": { @@ -5945,6 +5956,27 @@ } } }, + "SupportedResource": { + "description": "SupportedResource describes a resource type declared for provisioning. A resource is identified by its group and kind; the API version and plural resource are resolved at runtime via discovery, so they are not part of this descriptor.", + "type": "object", + "required": ["group", "kind"], + "properties": { + "disabled": { + "description": "Disabled reports whether the resource is declared but not acted on by provisioning. Active resources omit this field.", + "type": "boolean" + }, + "group": { + "description": "Group is the API group of the resource (e.g. \"dashboard.grafana.app\").", + "type": "string", + "default": "" + }, + "kind": { + "description": "Kind is the kind of the resource (e.g. \"Dashboard\").", + "type": "string", + "default": "" + } + } + }, "SyncJobOptions": { "type": "object", "required": ["incremental"], diff --git a/packages/grafana-openapi/src/apis/provisioning.grafana.app-v1beta1.json b/packages/grafana-openapi/src/apis/provisioning.grafana.app-v1beta1.json index 1f2e7914f05a8..b10c78f50ec9d 100644 --- a/packages/grafana-openapi/src/apis/provisioning.grafana.app-v1beta1.json +++ b/packages/grafana-openapi/src/apis/provisioning.grafana.app-v1beta1.json @@ -5169,6 +5169,17 @@ "enum": ["bitbucket", "git", "github", "githubEnterprise", "gitlab", "local"] } }, + "availableResources": { + "description": "AvailableResources is the list of resource types declared for provisioning in this instance, including disabled ones (see SupportedResource.Disabled).", + "type": "array", + "items": { + "allOf": [ + { + "$ref": "#/components/schemas/SupportedResource" + } + ] + } + }, "items": { "type": "array", "items": { @@ -5496,6 +5507,27 @@ } } }, + "SupportedResource": { + "description": "SupportedResource describes a resource type declared for provisioning. A resource is identified by its group and kind; the API version and plural resource are resolved at runtime via discovery, so they are not part of this descriptor.", + "type": "object", + "required": ["group", "kind"], + "properties": { + "disabled": { + "description": "Disabled reports whether the resource is declared but not acted on by provisioning. Active resources omit this field.", + "type": "boolean" + }, + "group": { + "description": "Group is the API group of the resource (e.g. \"dashboard.grafana.app\").", + "type": "string", + "default": "" + }, + "kind": { + "description": "Kind is the kind of the resource (e.g. \"Dashboard\").", + "type": "string", + "default": "" + } + } + }, "SyncJobOptions": { "type": "object", "required": ["incremental"], diff --git a/pkg/operators/provisioning/config.go b/pkg/operators/provisioning/config.go index afecfac39e21a..c84dd93f0e55b 100644 --- a/pkg/operators/provisioning/config.go +++ b/pkg/operators/provisioning/config.go @@ -92,6 +92,7 @@ type ControllerConfig struct { // provisioning_server_public_url = // dashboards_server_url = // folders_server_url = +// aggregated_server_url = // folders_api_version = // tls_insecure = // tls_cert_file = @@ -209,11 +210,42 @@ func (c *ControllerConfig) Clients() (resources.ClientFactory, error) { return nil, fmt.Errorf("folders_server_url is required in [operator] section") } provisioningServerURL := operatorSec.Key("provisioning_server_url").String() + // aggregated_server_url serves resource groups that do not have a dedicated server URL + // (e.g. newly provisionable kinds in their own API group). Dashboards and folders keep + // their dedicated URLs for backwards compatibility. + aggregatedServerURL := operatorSec.Key("aggregated_server_url").String() apiServerURLs := map[string]string{ resources.DashboardResource.Group: dashboardsServerURL, resources.FolderResource.Group: foldersServerURL, provisioning.GROUP: provisioningServerURL, } + + supportedResources, err := resources.ParseSupportedResources(c.Settings.ProvisioningResources) + if err != nil { + return nil, fmt.Errorf("invalid [provisioning] resources configuration: %w", err) + } + + // Dashboards and folders have dedicated server URLs; everything else is served by the + // aggregated API server. Skip the built-in groups, then ensure every other active + // resource's group resolves to the aggregated server — failing loudly if a resource needs + // it and it is unset, rather than hitting "no clients provider for group" at request time. + for _, r := range supportedResources { + if !r.IsActive() { + continue + } + switch r.Group { + case resources.DashboardResource.Group, resources.FolderResource.Group, provisioning.GROUP: + continue // built-in groups with dedicated server URLs + } + if _, ok := apiServerURLs[r.Group]; ok { + continue + } + if aggregatedServerURL == "" { + return nil, fmt.Errorf("aggregated_server_url is required in [operator] section to serve resource %s/%s", r.Group, r.Kind) + } + apiServerURLs[r.Group] = aggregatedServerURL + } + configProviders := make(map[string]apiserver.RestConfigProvider) tlsConfigForTransport, err := rest.TLSConfigFor(&rest.Config{TLSClientConfig: tlsConfig}) @@ -247,7 +279,7 @@ func (c *ControllerConfig) Clients() (resources.ClientFactory, error) { configProviders[group] = NewDirectConfigProvider(config) } - clients := resources.NewClientFactoryForMultipleAPIServers(configProviders) + clients := resources.NewClientFactoryForMultipleAPIServers(configProviders, supportedResources...) c.clients = clients return clients, nil } diff --git a/pkg/registry/apis/provisioning/files.go b/pkg/registry/apis/provisioning/files.go index 02d73188e0184..4ccb9a3e0f3a5 100644 --- a/pkg/registry/apis/provisioning/files.go +++ b/pkg/registry/apis/provisioning/files.go @@ -183,7 +183,7 @@ func (c *filesConnector) createDualReadWriter(ctx context.Context, repo reposito } folders := resources.NewFolderManager(readWriter, folderClient, resources.NewEmptyFolderTree(), folderGVK, resources.WithFolderMetadataEnabled(c.folderMetadataEnabled)) - authorizer := resources.NewAuthorizer(repo.Config(), readWriter, c.access, c.folderMetadataEnabled) + authorizer := resources.NewAuthorizer(repo.Config(), readWriter, c.access, clients, c.folderMetadataEnabled) return resources.NewDualReadWriter(readWriter, parser, folders, authorizer, c.folderMetadataEnabled), authorizer, nil } diff --git a/pkg/registry/apis/provisioning/files_test.go b/pkg/registry/apis/provisioning/files_test.go index 92e9823e75cf6..5d402afeece55 100644 --- a/pkg/registry/apis/provisioning/files_test.go +++ b/pkg/registry/apis/provisioning/files_test.go @@ -515,7 +515,7 @@ func TestHandleGetRawFile(t *testing.T) { }, } mockReadWriter.EXPECT().Config().Return(repo).Maybe() - authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, false) + authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, resources.NewMockResourceClients(t), false) if tt.readError != nil { mockReadWriter.EXPECT().Read(mock.Anything, tt.path, "").Return(nil, tt.readError) @@ -568,7 +568,7 @@ func TestHandleGetRawFile_FolderScopedAuth(t *testing.T) { Check(mock.Anything, mock.Anything, mock.Anything). Return(apierrors.NewForbidden(provisioningapi.RepositoryResourceInfo.GroupResource(), "team-a", errors.New("denied"))) - authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, false) + authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, resources.NewMockResourceClients(t), false) connector := &filesConnector{access: mockAccess} _, err := connector.handleGetRawFile( @@ -612,7 +612,7 @@ func TestHandleGetRawFile_MaxFileSize(t *testing.T) { mockAccess.EXPECT().Check(mock.Anything, mock.Anything, mock.Anything).Return(nil).Maybe() mockReadWriter.EXPECT().Config().Return(repo).Maybe() - authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, false) + authorizer := resources.NewAuthorizer(repo, mockReadWriter, mockAccess, resources.NewMockResourceClients(t), false) mockReadWriter.EX ... [truncated]