Cfg: Add a setting to configure if the local file system is available (#83616)

* Introduce environment.local_filesystem_available

* Only show TLS client cert, client key, client ca when local_filesystem_available is true

* Rename LocalFSAvailable to LocalFileSystemAvailable

conf/defaults.ini

@@ -94,6 +94,10 @@ read_timeout = 0
 #exampleHeader1 = exampleValue1
 #exampleHeader2 = exampleValue2
 
+[environment]
+# Sets whether the local file system is available for Grafana to use. Default is true for backward compatibility.
+local_file_system_available = true
+
 #################################### GRPC Server #########################
 [grpc_server]
 network = "tcp"

packages/grafana-data/src/types/config.ts

@@ -226,6 +226,7 @@ export interface GrafanaConfig {
   sqlConnectionLimits: SqlConnectionLimits;
   sharedWithMeFolderUID?: string;
   rootFolderUID?: string;
+  localFileSystemAvailable?: boolean;
 
   // The namespace to use for kubernetes apiserver requests
   namespace: string;

packages/grafana-runtime/src/config.ts

@@ -171,6 +171,7 @@ export class GrafanaBootConfig implements GrafanaConfig {
   disableFrontendSandboxForPlugins: string[] = [];
   sharedWithMeFolderUID: string | undefined;
   rootFolderUID: string | undefined;
+  localFileSystemAvailable: boolean | undefined;
 
   constructor(options: GrafanaBootConfig) {
     this.bootData = options.bootData;

pkg/api/dtos/frontend_settings.go

@@ -260,4 +260,6 @@ type FrontendSettingsDTO struct {
 	// Enterprise
 	Licensing     *FrontendSettingsLicensingDTO     `json:"licensing,omitempty"`
 	Whitelabeling *FrontendSettingsWhitelabelingDTO `json:"whitelabeling,omitempty"`
+
+	LocalFileSystemAvailable bool `json:"localFileSystemAvailable"`
 }

pkg/api/frontendsettings.go

@@ -220,6 +220,7 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
 		PublicDashboardsEnabled:             hs.Cfg.PublicDashboardsEnabled,
 		SharedWithMeFolderUID:               folder.SharedWithMeFolderUID,
 		RootFolderUID:                       accesscontrol.GeneralFolderUID,
+		LocalFileSystemAvailable:            hs.Cfg.LocalFileSystemAvailable,
 
 		BuildInfo: dtos.FrontendSettingsBuildInfoDTO{
 			HideVersion:   hideVersion,

pkg/setting/setting.go

@@ -366,6 +366,8 @@ type Cfg struct {
 	StackID string
 	Slug    string
 
+	LocalFileSystemAvailable bool
+
 	// Deprecated
 	ForceMigration bool
 
@@ -1063,6 +1065,7 @@ func (cfg *Cfg) parseINIFile(iniFile *ini.File) error {
 	cfg.Env = valueAsString(iniFile.Section(""), "app_mode", "development")
 	cfg.StackID = valueAsString(iniFile.Section("environment"), "stack_id", "")
 	cfg.Slug = valueAsString(iniFile.Section("environment"), "stack_slug", "")
+	cfg.LocalFileSystemAvailable = iniFile.Section("environment").Key("local_file_system_available").MustBool(true)
 	//nolint:staticcheck
 	cfg.ForceMigration = iniFile.Section("").Key("force_migration").MustBool(false)
 	cfg.InstanceName = valueAsString(iniFile.Section(""), "instance_name", "unknown_instance_name")

public/app/features/auth-config/fields.tsx

@@ -1,6 +1,7 @@
 import React from 'react';
 import { validate as uuidValidate } from 'uuid';
 
+import { config } from '@grafana/runtime';
 import { TextLink } from '@grafana/ui';
 import { contextSrv } from 'app/core/core';
 
@@ -342,16 +343,19 @@ export function fieldMap(provider: string): Record<string, FieldData> {
       label: 'TLS client ca',
       description: 'The file path to the trusted certificate authority list. Is not applicable on Grafana Cloud.',
       type: 'text',
+      hidden: !config.localFileSystemAvailable,
     },
     tlsClientCert: {
       label: 'TLS client cert',
       description: 'The file path to the certificate. Is not applicable on Grafana Cloud.',
       type: 'text',
+      hidden: !config.localFileSystemAvailable,
     },
     tlsClientKey: {
       label: 'TLS client key',
       description: 'The file path to the key. Is not applicable on Grafana Cloud.',
       type: 'text',
+      hidden: !config.localFileSystemAvailable,
     },
     tlsSkipVerifyInsecure: {
       label: 'TLS skip verify',