Information Disclosure

diff --git a/apps/alerting/rules/pkg/app/app.go b/apps/alerting/rules/pkg/app/app.go index 38b71636e8b50..2eee8a7134d72 100644 --- a/apps/alerting/rules/pkg/app/app.go +++ b/apps/alerting/rules/pkg/app/app.go @@ -30,6 +30,11 @@ func New(cfg app.Config) (app.App, error) { Mutator: buildKindMutator(kind, runtimeCfg), Watcher: buildKindWatcher(kind, runtimeCfg), } + // Only kinds with a watcher run an informer (RuleSequence), so this + // scopes that watch to WatchNamespace; empty means all namespaces. + if managedKind.Watcher != nil && runtimeCfg.WatchNamespace != "" { + managedKind.ReconcileOptions.Namespace = runtimeCfg.WatchNamespace + } managedKinds = append(managedKinds, managedKind) } } diff --git a/apps/alerting/rules/pkg/app/config/runtime.go b/apps/alerting/rules/pkg/app/config/runtime.go index ed1695ed48bff..26dd68789ec98 100644 --- a/apps/alerting/rules/pkg/app/config/runtime.go +++ b/apps/alerting/rules/pkg/app/config/runtime.go @@ -42,4 +42,8 @@ type RuntimeConfig struct { // RuleSequence (if any) owns a rule UID. The default implementation is a // watch-backed in-memory index that provides O(1) lookups. MembershipResolver RuleSequenceMembershipResolver + // WatchNamespace scopes the RuleSequence informer to one namespace. Empty + // watches all namespaces (on-prem default); in cloud it must be the stack + // namespace, else the all-namespace watch is rejected as a mismatch. + WatchNamespace string } diff --git a/pkg/registry/apps/alerting/rules/register.go b/pkg/registry/apps/alerting/rules/register.go index b480b7a65de6b..58f8df082307e 100644 --- a/pkg/registry/apps/alerting/rules/register.go +++ b/pkg/registry/apps/alerting/rules/register.go @@ -71,6 +71,7 @@ func RegisterAppInstaller( ResolveRuleRef: newRuleRefResolver(ng), MembershipResolver: membershipIndex, NotificationSettingsValidator: newNotificationSettingsValidator(ng), + WatchNamespace: watchNamespace(cfg), } provider := simple.NewAppProvider(rulesManifest.LocalManifest(), appSpecificConfig, rulesApp.New) @@ -89,6 +90,18 @@ func RegisterAppInstaller( return installer, nil } +// watchNamespace returns the namespace the RuleSequence informer should watch. +// In cloud each instance serves one stack namespace and its storage identity is +// scoped to it, so an all-namespace watch is rejected as a mismatch; on-prem +// (no stack ID) returns "" to watch all namespaces. +func watchNamespace(cfg *setting.Cfg) string { + if cfg == nil || cfg.StackID == "" { + return "" + } + // The cloud mapper ignores the org ID and returns the stack namespace. + return reqns.GetNamespaceMapper(cfg)(0) +} + func resolveOrgID(ctx context.Context) int64 { orgID, err := reqns.OrgIDForList(ctx) if err != nil || orgID < 1 { diff --git a/pkg/registry/apps/alerting/rules/register_test.go b/pkg/registry/apps/alerting/rules/register_test.go index 852a8494a6e6f..5e1af084a2079 100644 --- a/pkg/registry/apps/alerting/rules/register_test.go +++ b/pkg/registry/apps/alerting/rules/register_test.go @@ -9,6 +9,24 @@ import ( "github.com/stretchr/testify/require" ) +func TestWatchNamespace(t *testing.T) { + tests := []struct { + name string + cfg *setting.Cfg + want string + }{ + {name: "nil cfg watches all namespaces", cfg: nil, want: ""}, + {name: "on-prem (no stack id) watches all namespaces", cfg: &setting.Cfg{}, want: ""}, + {name: "cloud scopes to the stack namespace", cfg: &setting.Cfg{StackID: "42"}, want: "stacks-42"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + require.Equal(t, tt.want, watchNamespace(tt.cfg)) + }) + } +} + func TestRegisterAppInstaller_UnifiedAlertingEnabled(t *testing.T) { tests := []struct { name string