RBAC: add a feature toggle for annotation permission changes (#77432)

add a feature toggle for annotation permission changes

docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md

@@ -159,6 +159,7 @@ Experimental features might be changed or removed without prior notice.
 | `alertmanagerRemoteSecondary`               | Enable Grafana to sync configuration and state with a remote Alertmanager.                                                                                                                                                                                                        |
 | `alertmanagerRemotePrimary`                 | Enable Grafana to have a remote Alertmanager instance as the primary Alertmanager.                                                                                                                                                                                                |
 | `alertmanagerRemoteOnly`                    | Disable the internal Alertmanager and only use the external one defined.                                                                                                                                                                                                          |
+| `annotationPermissionUpdate`                | Separate annotation permissions from dashboard permissions to allow for more granular control.                                                                                                                                                                                    |
 
 ## Development feature toggles
 

packages/grafana-data/src/types/featureToggles.gen.ts

@@ -153,4 +153,5 @@ export interface FeatureToggles {
   alertmanagerRemoteSecondary?: boolean;
   alertmanagerRemotePrimary?: boolean;
   alertmanagerRemoteOnly?: boolean;
+  annotationPermissionUpdate?: boolean;
 }

pkg/services/featuremgmt/registry.go

@@ -945,5 +945,12 @@ var (
 			Stage:       FeatureStageExperimental,
 			Owner:       grafanaAlertingSquad,
 		},
+		{
+			Name:            "annotationPermissionUpdate",
+			Description:     "Separate annotation permissions from dashboard permissions to allow for more granular control.",
+			Stage:           FeatureStageExperimental,
+			RequiresDevMode: false,
+			Owner:           grafanaAuthnzSquad,
+		},
 	}
 )

pkg/services/featuremgmt/toggles_gen.csv

@@ -134,3 +134,4 @@ prometheusPromQAIL,experimental,@grafana/observability-metrics,false,false,false
 alertmanagerRemoteSecondary,experimental,@grafana/alerting-squad,false,false,false,false
 alertmanagerRemotePrimary,experimental,@grafana/alerting-squad,false,false,false,false
 alertmanagerRemoteOnly,experimental,@grafana/alerting-squad,false,false,false,false
+annotationPermissionUpdate,experimental,@grafana/grafana-authnz-team,false,false,false,false

pkg/services/featuremgmt/toggles_gen.go

@@ -546,4 +546,8 @@ const (
 	// FlagAlertmanagerRemoteOnly
 	// Disable the internal Alertmanager and only use the external one defined.
 	FlagAlertmanagerRemoteOnly = "alertmanagerRemoteOnly"
+
+	// FlagAnnotationPermissionUpdate
+	// Separate annotation permissions from dashboard permissions to allow for more granular control.
+	FlagAnnotationPermissionUpdate = "annotationPermissionUpdate"
 )