Kafka acl: Fallback to onprem when looking up workload

internal/cmd/api/api.go

@@ -180,6 +180,7 @@ func run(ctx context.Context, cfg *Config, log logrus.FieldLogger) error {
 
 	graphHandler, err := graph.NewHandler(gengql.Config{
 		Resolvers: graph.NewResolver(
+			cfg.Tenant,
 			&graph.TopicWrapper{Topic: pubsubTopic},
 			graph.WithLogger(log),
 		),

internal/graph/kafka.resolvers.go

@@ -3,8 +3,10 @@ package graph
 import (
 	"context"
 	"errors"
+	"strings"
 
 	"github.com/nais/api/internal/auth/authz"
+	"github.com/nais/api/internal/environmentmapper"
 	"github.com/nais/api/internal/graph/gengql"
 	"github.com/nais/api/internal/graph/model"
 	"github.com/nais/api/internal/graph/pagination"
@@ -79,6 +81,15 @@ func (r *kafkaTopicAclResolver) Workload(ctx context.Context, obj *kafkatopic.Ka
 
 	w, err := tryWorkload(ctx, slug.Slug(obj.TeamName), obj.EnvironmentName, obj.WorkloadName)
 	if errors.Is(err, &watcher.ErrorNotFound{}) {
+		if r.tenantName == "nav" {
+			// For Nav, workloads might exist in another environment. Topics are always in `-gcp`, but workloads might be in `-fss`.
+			fssEnv := strings.Replace(environmentmapper.EnvironmentName(obj.EnvironmentName), "-gcp", "-fss", 1)
+			w, err = tryWorkload(ctx, slug.Slug(obj.TeamName), fssEnv, obj.WorkloadName)
+			if errors.Is(err, &watcher.ErrorNotFound{}) {
+				return nil, nil
+			}
+			return w, err
+		}
 		return nil, nil
 	}
 	return w, err

internal/graph/resolver.go

@@ -21,6 +21,7 @@ import (
 )
 
 type Resolver struct {
+	tenantName  string
 	pubsubTopic PubsubTopic
 	log         logrus.FieldLogger
 }
@@ -33,8 +34,9 @@ func WithLogger(log logrus.FieldLogger) ResolverOption {
 	}
 }
 
-func NewResolver(topic PubsubTopic, opts ...ResolverOption) *Resolver {
+func NewResolver(tenantName string, topic PubsubTopic, opts ...ResolverOption) *Resolver {
 	resolver := &Resolver{
+		tenantName:  tenantName,
 		pubsubTopic: topic,
 	}
 

internal/integration/manager.go

@@ -297,7 +297,7 @@ func newGQLRunner(
 		return nil, nil, nil, fmt.Errorf("failed to configure graph: %w", err)
 	}
 
-	resolver := graph.NewResolver(topic)
+	resolver := graph.NewResolver(config.TenantName, topic)
 
 	hlog := logrus.New()
 	srv, err := graph.NewHandler(gengql.Config{