725 Commits

Author SHA1 Message Date
20cea80795 Provisioning: Add bulk delete job (#108580)
* Add delete job type

* Regenerate spec

* Add first implementation of worker

* Move interface and mock to repository package

* Add unit tests

* Add integration tests

* Fix linting and spec

* Regenerate client

* Format file

* go fmt

* fix

---------

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-07-25 16:38:10 +00:00
b1b9cc43a8 SecretsManager: Adding ability to disable all DEKs (#108444)
* Adding dek deactivation and rename list dek

* disable data keys from manager

* separate interface and don't use in encryption manager
2025-07-25 17:11:17 +01:00
5f6fc38430 iam/authn: Introduce feature flag for authz resource mutations (#108698)
* iam/authz: introduce feature flag for authz resource mutations

* lint: fix typo
2025-07-25 12:05:32 -03:00
16339b0788 Provisioning: Move repository file API (#108514)
* Bump nanogit version
* Embed git repository in the Github one
2025-07-24 23:28:59 -05:00
d3b6d7c45e OpenFeature: Add config setting to disable API (#108620)
* Add config option to disable ofrep api

* Apply review feedback
2025-07-24 19:45:22 +00:00
e9b9618fb0 Provisioning: Fix stage options for export (#108585)
* Add ref option to stage options

* Fix the issue with ref in export worker

* Add unit tests for export stage options

* Do not fail if ref is equal to the stage branch

* Format code again

* fix test

---------

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-07-24 16:53:33 +00:00
915f47befd Provisioning: commit only once staged changes (#108590) 2025-07-24 10:57:02 -05:00
4c17c1cbb6 IAM: Instantiate DualWriter only when in single-tenant mode (#108558)
* Instantiate dual writer only in ST case

* minor cleanup

---------

Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
2025-07-24 09:33:53 -03:00
60e0d2d136 OpenFeature: Update authenticated request check (#108539) 2025-07-23 20:27:21 +02:00
0e7b041b27 Secrets: Move decrypt types to contracts and export public at root pkg (#108376)
* Secrets: Move decrypt types to contracts and export public at root pkg

* Provisioning: Replace decrypt pkg imports

* Merge wire changes
2025-07-23 12:14:28 +02:00
946358900c Provisioning: Add warning job status and different strictness (#108446)
* Add warning job status

* Different strictness for export than for pulling

* Fix some unit tests

* Fix unit tests

* Update frontend to display the warning status

* Fix status badge

* Add missing return statement

* Improve text in alert
2025-07-23 09:33:25 +00:00
482872c3bf Provisioning: Fix bug in job progress recording (#108440)
Fix bug in job progress recording
2025-07-22 14:21:22 +00:00
9402071d33 Secrets: Create more granular fixed roles for SecureValues (#108382) 2025-07-22 16:20:54 +02:00
71cb623cb7 improve logging and fail unified-storage migration with more than 0 errors (#108471)
improve logging and fail unified-storage migration with more than 0 errors
2025-07-22 13:44:04 +00:00
d72a70d246 Dashboards API: v2alpha2 missing pieces (#108293)
* Dashboards API: v2alpha2 missing pieces

* Fix issue with dashboard client scope for alpha versions

As we now have 2 different alpha versions for v2 we need to store the
clients separately.

* Improve debuggability of provisioning export test

- Add a helper function to print the tree structure.
- Be explicit about the expected file names expected in each case.

* Update pkg/registry/apis/dashboard/mutate.go

* Update pkg/services/authz/zanzana/server/server.go

Co-authored-by: Igor Suleymanov <radiohead@users.noreply.github.com>

* Review

* go lint

---------

Co-authored-by: Roberto Jimenez Sanchez <roberto.jimenez@grafana.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
Co-authored-by: Igor Suleymanov <radiohead@users.noreply.github.com>
2025-07-22 11:44:05 +02:00
e5d2f92384 K8s: Add App SDK installer (#107773) 2025-07-21 13:32:15 -04:00
be79eb0ace fix: handle dashboards without version entries in unified storage migration (#108139)
* fix: handle dashboards without version entries in migration

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

* fix: adds AllowFallback flag to enable COALESCE logic explicitly during migrations

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

* fix: update dependencies

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

* fix: maintain original behavior when not using AllowFallback option

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

---------

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>
2025-07-21 15:32:24 +02:00
9e4f2cad47 Secrets: Re-export and map domain errors into K8s API errors in ST client (#108226) 2025-07-21 09:32:20 +00:00
f7e55f2c5d Secrets: Add authz checks for the single-tenant SecureValue client (#108216) 2025-07-21 11:09:07 +02:00
47abf5f811 Secrets: Clean up unused code (#108366)
* Secrets: Remove unused tracectx pkg

* Secrets: Remove unused assert pkg

* Secrets: Remove unused encryption interface

* Secrets: Remove unused encryption file/ref
2025-07-21 11:08:49 +02:00
2dba473015 Feature/unified storage search dual reader (#108291)
* Add UnifiedStorageSearchDualReaderEnabled feature flag

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Refactor UniSearch Dual Reader

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Run make gen-feature-toggles

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* fix: unit tests search_client

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

* feat: cancels shadow search requests after 500ms

Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>
Co-authored-by: Will Assis <william@williamassis.com>
Co-authored-by: Bruno Abrantes <bruno@brunoabrantes.com>
2025-07-18 14:43:56 +02:00
4847882ee7 Provisioning: handle .git extension more gracefully (#108213)
* Move .git to repository packages

* Bump nanogit 2025-07-17

This version handles `.git` extension internally so that the client
doesn't have to worry about it

* Put back mutation for Github

* Mutate also git URL for clarity
2025-07-18 13:25:21 +02:00
446054a61d Provisioning: fix race condition in usage metrics collection (#108289)
* Register usage stats after lister is created

For enterprise where metrics are collected more frequently and in
different ways the collection was happening before the listing was
initialized.

* Move usage to separate package
2025-07-18 13:24:58 +02:00
e3422c415f Provisioning: fix hack-introduced bug on repository updates (#108298)
* Add log line to see which secret service we are using
* Add hack to make test and create endpoint work until we have InLineSecureValues
2025-07-18 10:18:07 +00:00
d5f47d2a6b IAM: Comment out DualWriter setup for Users (#108241)
* Try 1

* Comment out DW setup for users
2025-07-18 09:29:09 +00:00
5cf48294f7 Provisioning: fix authorized github client initialization (#108290)
* Add logging

* Fix the condition for the github token

* Revert "Add logging"

This reverts commit 71cbc675f6d258ef69adbe21b12b68786ecbdeff.

* Fix condition
2025-07-18 10:23:55 +02:00
3fad863fd1 Query Service: Combine SSE handling in single tenant and multi tenant paths (#108041)
* parse via sse

I need to figure out how to handle the pipeline.execute with our own
client. I think this is important for MT reasons, just like using our
own cache (via legacy) is important.

parsing is done though!

* WIP nonsense

* horrible code but i think it works

* Add support for sql expressions config settings

* Cleanup:
- remove spew from nodes.go
- uncomment out plugin context and use in single tenant flow
- make code more readable and add comments

* Cleanup:
- create separate file for mt ds client builder
- ensure error handling is the same for both expressions and regular queries
- other cleanup

* not working but good thoughts

* WIP, vector not working for non sse

* super hacky but i think vectors work now

* delete delete delete

* Comments for future ref

* break out query handling and start test

* add prom debugger

* clean up: remove comments and commented out bits

* fix query_test

* add prom debugger

* create table-driven tests with testsdata files

* Fix test

* Add test

* go mod??

* idk

* Remove comment

* go enterprise issue maybe

* Fix codeowners

* Delete

* Remove test data

* Clean up

* logger

* Remove go changes hopefully

* idk go man

* sad

* idk i ran go mod tidy and this is what it wants

* Fix readme, with much help from adam

* some linting and testing errors

* lint

* fix lint

* fix lint register.go

* another lint

* address lint in test

* fix dead code and linters for query_test

* Go mod?

* Struggling with go mod

* Fix test

* Fix another test

* Revert headers change

* Its difficult to test this in OSS as it depends on functionality defined in enterprise, let's bring these tests back in some form in enterprise

* Fix codeowners

---------

Co-authored-by: Adam Simpson <adam@adamsimpson.net>
2025-07-17 17:22:55 -04:00
810868c156 Provisioning: use new secure value client (#108227)
* Use provider in Webhooks registration

* First stab at using the new client

* Simplify mock

* Able to generate graph in OSS

* Remove line already ensured by provider

* Handle the K8s not found error as well

* Commit regenerated wire file

* Add the hack also for deletion

* Fix secrets test util

* Format file
2025-07-17 15:17:14 +02:00
c6a6b9fdd2 IAM: Create and delete user from the legacy store (#107694)
* Add Create for User + DualWriter setup

* Add delete User

* Fix delete + access check

* Add tests for delete user

* Add tests for create user

* Fixes

* Use sqlx session to fix database locked issues

* wip authz checks

* legacyAccessClient

* Update legacyAccessClient, add tests for create user

* Close rows before running other queries

* Use ExecWithReturningId

* Verify deletion in the tests

* Add Validate and Mutate

* Other changes

* Address feedback

* Update tests

---------

Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
2025-07-17 11:50:40 +02:00
8e663b50e9 Advisor: Allow to define enterprise checks (#108114) 2025-07-17 11:37:32 +02:00
6c69ae244e Secrets: Add single tenant SecureValueClient (#108099)
* Secrets: Add single tenant SecureValueClient

* SecureValueClient: Rename file

* SecureValueClient: Move original type to contracts package and export it by aliasing
2025-07-17 10:56:49 +02:00
ae4dc181d1 Provisioning: Add user token to git and bitbucket repository specs (#108186)
* Add token user to git and bitbucket specs

* Use token user if available in git type
2025-07-17 10:25:02 +02:00
01692bc876 Secrets: remove unused SecureValueMetadataStorage.ReadForDecrypt method (#108181)
* Secrets: remove unused SecureValueMetadataStorage.ReadForDecrypt method

* remove unused struct: secureValueForDecrypt
2025-07-16 11:52:26 -03:00
7186aa4bd7 OpenFeature: Fix bulk evaluation request postprocessing (#108155) 2025-07-16 15:54:36 +02:00
b4738c57e4 Dashboards API: Add v2alpha2 (#108121)
* Dashboards API: Register v2alpha2 API

* Prepare conversion functions

* Fix test

* Move to the bottom the v2aplha2 until is ready

---------

Co-authored-by: Ivan Ortega <ivanortegaalba@gmail.com>
2025-07-16 12:22:50 +00:00
b232ba5396 Provisioning: Move provisioning extras to OSS extensions (#108167)
* Move provisioning extensions to OSS

* Fix the wire stuff

* Move it to extras packages

* Add hack to assert test differently for enterprise
2025-07-16 13:24:24 +02:00
2c4bbf8b1d Secrets: Reduce amount of feature toggle checks to only app entrypoint (#108110)
* Secrets: Reduce amount of feature toggle checks to only app entrypoint

* Wire: Fix merge conflict

* Wire: Fix merge conflict
2025-07-16 10:56:59 +02:00
3cda233468 Secrets: Remove temporary allowlist (#108118) 2025-07-16 09:39:33 +02:00
56543db16a Provisioning: delete secrets on repository deletion (#108113)
- Add hooks to git, github and github webhooks to remove the. 
- Implement deletion in secrets package.
- Add `Mutator` interface and hooks so that we can register any mutator. 
- Add unit test coverage to those mutators. 
- Move provider specific mutation from the massive `register.go` to the respective packages (e.g. `git` , `github`, etc). 
- Add integration test for removal. 
- Change the decryption fallback to simply check for the repository prefix.
2025-07-16 07:38:42 +00:00
ab51794bdb SecretsManager: Unify KMS across OSS and Enterprise (#108085)
* everything is compiling

* tests passing

* remove used object

* write a test for secret key upgrades

* misc cleanup

* clean up some wording

* lint issues

* fix a typo

* import hashicorp dependency explicitly

* simplify oss kmsprovider package structure

* consolidate current provider and available providers

* add a new manager configuration test

* fix hashivault import

* fix import issue

* fix unit tests

* Update go.mod

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
2025-07-15 14:39:20 -04:00
c06c1b1e8a fix: Makes created and updated by nullable strings for library panel migration (#108122)
Signed-off-by: Bruno Abrantes <bruno@brunoabrantes.com>
2025-07-15 16:30:31 +02:00
d39a47a89b Provisioning: Begin using secrets store (#108044)
- Provisioning: Begin using secrets store
- Refactor integration with secrets store
- Add back the legacy service
- Separate concerns for encrypt and decrypt
- Handle update within Encrypt function
- Add interface for secure value service
- Add feature flag for using secrets service
- Add the dual service for temporary solution.

* Add first integration tests for encrypted tokens
* Add integration test for app platform secrets
* Validate it has the name or not
* Create wire provider
* Always save to the secret if provided secret

---------

Co-authored-by: Roberto Jimenez Sanchez <roberto.jimenez@grafana.com>
Co-authored-by: Roberto Jiménez Sánchez <jszroberto@gmail.com>
2025-07-15 15:43:17 +02:00
4954822cbb Secrets: Add separate package for resource validation (#108097)
* Secrets: Add SecureValueService interface

* Secrets: Move resource validators to their own package/structs for reusing
2025-07-15 12:33:14 +02:00
868791d751 ds-querier: handle response-headers explicitly (#107304) 2025-07-15 08:31:57 +02:00
403d6380fa Secrets: Remove gating with experimental APIs feature toggle (#108058) 2025-07-14 17:46:17 +02:00
e079cb3738 Simplify open feature setup (#107632)
* Simplify open feature setup

* Fix linter issues

* Apply review feedback

* Fix integration tests setup
2025-07-14 16:22:04 +02:00
baa89f3eac Secrets: encryption encryption storage uses versioning (#108036)
* Secrets: delete unused FakeKeeper

* Secrets: encrypted value storage stores versions

* add version to span

* trigger build

* remove ineffectual assignment

* lint

* drop secret_encrypted_value.uid / add name and version columns
2025-07-14 09:28:07 -03:00
b49b103f42 Provisioning: Return available repository types in settings endpoint (#107977)
* Add types for other repositories

* Inject the types from extras

* Fix go-lint

* Fix typecheck

* Add it to the tests

---------

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-07-11 22:07:04 +00:00
4b8e565a16 Fix innefectual assigment 2025-07-11 23:02:19 +02:00
cff66e8b45 Remove TODOs 2025-07-11 23:02:19 +02:00