21 Commits

Author SHA1 Message Date
ef14992f00 Zanzana: Fix reconciling role with empty UID (#106045) 2025-05-27 14:23:29 +02:00
4ea56b2cfb Zanzana: Fix reconciliation for roles (#103889)
* Zanzana: Fix reconciliation for roles

* update go workspaces

* update go.sum
2025-04-15 11:33:40 +02:00
fcb88f6ccc Zanzana: revert cluster store for fixed roles (#100958)
* Zanzana: revert cluster store for fixed roles

* update go workspace
2025-02-19 13:53:25 +01:00
5118e82e8c Zanzana: Run reconciliation in its own service (#100361)
* Zanzana: Start reconciliation in its own service

* cleanup

* update go workspaces

* refactor

* remove unused code

* move func definition
2025-02-11 14:09:39 +01:00
680e6bc1f8 Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
fb5783691d Zanzana: Fix reconciliation of fixed roles (#98696)
Remove "globalReconciler" and reuse the same one but only run them for cluster namespace
2025-01-09 10:40:18 +01:00
7e5cb7d8d6 Zanzana: Refactor fixed roles (use global store) (#97884)
* Zanzana: Pass contextual tuples for authorization

* global reconciler for fixed roles

* inject tuples from global store

* fix adding contextual tuples

* cleanup

* don't error on auth context fail

* add todo

* add context for List

* add caching

* remove unused

* use constant for global namespace

* Rename global namespace to cluster namespace
2025-01-07 13:49:55 +01:00
6957e1f7b7 Folders: Replace sql query with folder service call when collecting folder tree (#98443)
* Replace sql query with folder service call when collecting folder tree
* Update provider for folder service implementation for wire
* Refactor provisioning of oss service in folder permissions test util
2025-01-07 09:53:09 +01:00
Jo
40d3b02648 Auth: Separate anonymous settings to its own struct (#97791)
separate anonymous settings to its own struct
2024-12-13 10:46:27 +01:00
61d71ec5b1 Zanzana: Handle anonymous users (#97171)
* add anonymous users to schema

* sync anonymous user role

* remove unused

* fix linter

* only add anonymous reconciler if feature is enabled
2024-12-11 12:22:42 +01:00
718612aabf Zanzana: Update relation names (#97638)
* Update relation names to match k8s verbs

* Only check namespace if relation is valid

* Only list for valid relations
2024-12-10 09:38:03 +01:00
170e0e1813 Zanzana: List then search implementation (#96705)
* Zanzana: Search with list

* Allow to pass werb into list request

* split list search into 2 functions

* fix listing resources

* remove unused

* refactor

* remove unused function

* Add more logging to reconciler

* Fix search for users with access to all resources

* fix findFoldersZanzanaList

* search for folders as well by default

* refactor

* use compile for list and search

* remove list from client

* remove only from client

* remove list from interface

* run compile once

* refactor

* refactor

* add search tests

* fix tests

* Fix linter
2024-11-25 14:58:34 +01:00
e995d4f682 Zanzana: Add setting zanzana reconciliation interval (#96687)
Add config option under RBAC for zanzana reconciliation interval
2024-11-21 09:20:29 +01:00
7e442efa9c Zanzana: sync roles and bindings (#96661)
* Sync fix and custom roles and team bindings.

* Add collector for user role bindings
2024-11-19 13:18:44 +01:00
1f34096fdf Zanzana: reconcile basic roles and bindings (#96473)
* Add reconciler for basic roles

* Add reconciler for basic role bindings
2024-11-15 12:10:22 +01:00
9f66843915 Zanzana: use namespace when performing reconciliation (#96205)
* Special handling for zanzana reconciliation if stack id is configured

* remove sync call
2024-11-11 13:48:49 +01:00
910ec7e7dc Zanzana: Use separate store for each org (#96015)
* Move server init into server package

* map store name to id

* refactor model loading

* pass namespace into reconcilers and collectors

* refactor

* Extend authz server with Read and Write methods

* use new read/write in reconciler

* implement server side read and write

* Sync permissions for every org

* handle namespace in check and list

* split read and write

* provide conditions

* Fix client implementation

* fix nil conditions

* remove unused client code

* use lock for store access

* move type translators to common package

* fix folder collector

* fix store creation

* remove unused AuthorizationModelId

* fix server tests

* fix linter
2024-11-08 14:54:36 +01:00
f0a5b444e3 Zanzana: generic resource only (#96019)
* Remove collectors

* Remove zanzana search check, we need to rewrite that part to the new schema

* Only use generic resource schema and cleanup code we don't want to keep / need to re-write
2024-11-08 09:30:41 +01:00
dfa8f786d2 Zanzana: fix generic schema (#95648)
* Change schema so that resource checks on a folder walks the tree
2024-10-31 14:34:48 +01:00
e0163c93c2 Zanzana: reconcile generic schema (#95492)
* Rename to CheckObject

* Implement authz.AccessClient

* Move folder tree to reconciler and use new schema

* Move shared functionality to common package

* Add reconciler for managed permissions and resource translations

* Add support for folder resources
2024-10-28 16:32:16 +01:00
4083b2208e Zanzana: periodic sync of team members (#94752)
* Rewrite zanzana collector to fetch all available pages

* Register access control as a background service

* If zanzana is enabled we run Syncs and start Reconciliation job

* Update pkg/services/authz/zanzana/client/client.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Use server lock when doing performing reconciliation
2024-10-17 15:28:33 +02:00