Merge remote-tracking branch 'origin/main' into alerting/llm-experiment

.github/CODEOWNERS

@@ -835,6 +835,7 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/i18n-crowdin-download.yml @grafana/grafana-frontend-platform
 /.github/workflows/i18n-crowdin-create-tasks.yml @grafana/grafana-frontend-platform
 /.github/workflows/i18n-verify.yml @grafana/grafana-frontend-platform
+/.github/workflows/deploy-storybook-preview.yml @grafana/grafana-frontend-platform
 /.github/workflows/scripts/crowdin/create-tasks.ts @grafana/grafana-frontend-platform
 /.github/workflows/pr-go-workspace-check.yml @grafana/grafana-app-platform-squad
 /.github/workflows/pr-dependabot-update-go-workspace.yml @grafana/grafana-app-platform-squad

.github/workflows/deploy-storybook-preview.yml

@@ -0,0 +1,93 @@
+name: Deploy Storybook preview
+
+on:
+  pull_request:
+    paths:
+      - 'packages/grafana-ui/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  deploy-storybook-preview:
+    name: Deploy Storybook preview
+    runs-on: ubuntu-latest
+    # Don't run from forks for the moment. If we find this useful we can do the workflow_run dance
+    # to make it work for forks.
+    if: github.event.pull_request.head.repo.fork == false
+    permissions:
+      contents: read
+      id-token: write
+
+    env:
+      BUCKET_NAME: grafana-storybook-previews
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+
+      - name: Cache node_modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+          key: node_modules-${{ hashFiles('yarn.lock') }}
+          restore-keys: |
+            node_modules-
+
+      - name: Install dependencies
+        env:
+          # If the PR isn't from a fork then don't use the slower yarn checks
+          YARN_ENABLE_HARDENED_MODE: ${{ github.event.pull_request.head.repo.fork == false && '1' || '0' }}
+        run: yarn install --immutable
+
+      - name: Build storybook
+        run: yarn storybook:build
+
+      # Create the GCS folder name for the preview. Creates a consistent name for all deploys for the PR.
+      # Matches format of `pr_<PR_NUMBER>_<SANITIZED_BRANCH>`.
+      # Where `SANITIZED_BRANCH` is the branch name with only alphanumeric and hyphens, limited to 30 characters.
+      - name: Create deploy name
+        id: create-deploy-name
+        env:
+          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Convert branch name to only contain alphanumeric and hyphens
+          SANITIZED_BRANCH=$(echo "$BRANCH_NAME" | tr -cs "[:alnum:]-" "-" | sed "s/^-//;s/-$//")
+
+          # Check if SANITIZED_BRANCH is empty and fail if it is
+          if [ -z "$SANITIZED_BRANCH" ]; then
+            echo "Error: Branch name resulted in empty string after sanitization"
+            exit 1
+          fi
+
+          echo "deploy-name=pr_${PR_NUMBER}_${SANITIZED_BRANCH:0:30}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload Storybook
+        uses: grafana/shared-workflows/actions/push-to-gcs@main
+        with:
+          environment: prod
+          bucket: ${{ env.BUCKET_NAME }}
+          bucket_path: ${{ steps.create-deploy-name.outputs.deploy-name }}
+          path: packages/grafana-ui/dist/storybook
+          service_account: github-gf-storybook-preview@grafanalabs-workload-identity.iam.gserviceaccount.com
+          parent: false
+
+      - name: Write summary
+        env:
+          DEPLOY_NAME: ${{ steps.create-deploy-name.outputs.deploy-name }}
+        run: |
+          echo "## Storybook preview deployed! 🚀" >> $GITHUB_STEP_SUMMARY
+          echo "Check it out at https://storage.googleapis.com/${BUCKET_NAME}/${DEPLOY_NAME}/index.html" >> $GITHUB_STEP_SUMMARY

.github/workflows/i18n-crowdin-create-tasks.yml

@@ -2,10 +2,9 @@ name: Crowdin automatic task management
 
 on:
   workflow_dispatch:
-  # once a week on Sunday at midnight
-  # TODO enable once we're ready to create tasks automatically
-  # schedule:
-  #   - cron: "0 0 * * 0"
+  # once a month on the first day of the month at midnight
+  schedule:
+    - cron: "0 0 1 * *"
 
 jobs:
   create-tasks-in-crowdin:

apps/iam/kinds/manifest.cue

@@ -3,5 +3,16 @@ package kinds
 manifest: {
 	appName:       "iam"
 	groupOverride: "iam.grafana.app"
-	kinds: [ globalrole, globalrolebinding, corerole, role, rolebinding, resourcepermission ]
+	kinds: [
+		globalrole, 
+		globalrolebinding,
+		corerole,
+		role,
+		rolebinding,
+		resourcepermission,
+		user,
+		team,
+		teambinding,
+		serviceaccount,
+	]
 }

apps/iam/kinds/serviceaccount.cue

@@ -0,0 +1,24 @@
+package kinds
+
+import (
+	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
+)
+
+serviceaccount: {
+	kind:       "ServiceAccount"
+	pluralName: "ServiceAccounts"
+	current:    "v0alpha1"
+    
+	codegen: {
+		ts: { enabled: false }
+		go: { enabled: true }
+	}
+
+	versions: {
+		"v0alpha1": {
+			schema: {
+				spec: v0alpha1.ServiceAccountSpec
+			}
+		}
+	}
+}

apps/iam/kinds/team.cue

@@ -0,0 +1,24 @@
+package kinds
+
+import (
+	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
+)
+
+team: {
+	kind:       "Team"
+	pluralName: "Teams"
+	current:    "v0alpha1"
+
+	codegen: {
+		ts: { enabled: false }
+		go: { enabled: true }
+	}
+
+	versions: {
+		"v0alpha1": {
+			schema: {
+				spec: v0alpha1.TeamSpec
+			}
+		}
+	}
+}

apps/iam/kinds/teambinding.cue

@@ -0,0 +1,24 @@
+package kinds
+
+import (
+	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
+)
+
+teambinding: {
+	kind:       "TeamBinding"
+	pluralName: "TeamBindings"
+	current:    "v0alpha1"
+
+	codegen: {
+		ts: { enabled: false }
+		go: { enabled: true }
+	}
+
+	versions: {
+		"v0alpha1": {
+			schema: {
+				spec: v0alpha1.TeamBindingSpec
+			}
+		}
+	}
+}

apps/iam/kinds/user.cue

@@ -0,0 +1,24 @@
+package kinds
+
+import (
+	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
+)
+
+user: {
+	kind:       "User"
+	pluralName: "Users"
+	current:    "v0alpha1"
+    
+	codegen: {
+		ts: { enabled: false }
+		go: { enabled: true }
+	}
+
+	versions: {
+		"v0alpha1": {
+			schema: {
+				spec: v0alpha1.UserSpec
+			}
+		}
+	}
+}

apps/iam/kinds/v0alpha1/resourcepermission.cue

@@ -21,5 +21,3 @@ ResourcePermission: {
 	resource: #Resource
 	permissions: [...#Permission]
 }
-
-

apps/iam/kinds/v0alpha1/rolespec.cue

@@ -20,4 +20,3 @@ RoleSpec: {
 	// created?
 	// updated?
 }
-

apps/iam/kinds/v0alpha1/serviceaccountspec.cue

@@ -0,0 +1,6 @@
+package v0alpha1
+
+ServiceAccountSpec: {
+    title: string
+	disabled: bool
+}

apps/iam/kinds/v0alpha1/teambindingspec.cue

@@ -0,0 +1,20 @@
+package v0alpha1
+
+TeamBindingSpec: {
+	#Subject: {
+		// uid of the identity
+		name: string
+		// permission of the identity in the team
+		permission: TeamPermission
+	}
+
+	subjects: [...#Subject]
+	teamRef: TeamRef
+}
+
+TeamRef:{
+	// Name is the unique identifier for a team.
+	name: string
+}
+
+TeamPermission: "admin" | "member"

apps/iam/kinds/v0alpha1/teamspec.cue

@@ -0,0 +1,6 @@
+package v0alpha1
+
+TeamSpec: {
+    title: string
+    email: string
+}

apps/iam/kinds/v0alpha1/userspec.cue

@@ -0,0 +1,13 @@
+package v0alpha1
+
+UserSpec: {
+    disabled: bool
+    email: string
+    emailVerified: bool
+    grafanaAdmin: bool
+    login: string
+    name: string
+    provisioned: bool
+
+    // What to do with salt, rands and password?
+}

apps/iam/pkg/apis/iam/v0alpha1/extensions.go

@@ -0,0 +1,43 @@
+package v0alpha1
+
+import (
+	"fmt"
+
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
+)
+
+func (u User) AuthID() string {
+	meta, err := utils.MetaAccessor(&u)
+	if err != nil {
+		return ""
+	}
+	// TODO: Workaround until we move all definitions
+	// After having all resource definitions here in the app, we can remove this
+	// and we need to change the List authorization to use the MetaAccessor and the GetDeprecatedInternalID method
+	//nolint:staticcheck
+	return fmt.Sprintf("%d", meta.GetDeprecatedInternalID())
+}
+
+func (s ServiceAccount) AuthID() string {
+	meta, err := utils.MetaAccessor(&s)
+	if err != nil {
+		return ""
+	}
+	// TODO: Workaround until we move all definitions
+	// After having all resource definitions here in the app, we can remove this
+	// and we need to change the List authorization to use the MetaAccessor and the GetDeprecatedInternalID method
+	//nolint:staticcheck
+	return fmt.Sprintf("%d", meta.GetDeprecatedInternalID())
+}
+
+func (t Team) AuthID() string {
+	meta, err := utils.MetaAccessor(&t)
+	if err != nil {
+		return ""
+	}
+	// TODO: Workaround until we move all definitions
+	// After having all resource definitions here in the app, we can remove this
+	// and we need to change the List authorization to use the MetaAccessor and the GetDeprecatedInternalID method
+	//nolint:staticcheck
+	return fmt.Sprintf("%d", meta.GetDeprecatedInternalID())
+}

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// ServiceAccountJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type ServiceAccountJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*ServiceAccountJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*ServiceAccountJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &ServiceAccountJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_metadata_gen.go

@@ -0,0 +1,31 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type ServiceAccountMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewServiceAccountMetadata creates a new ServiceAccountMetadata object.
+func NewServiceAccountMetadata() *ServiceAccountMetadata {
+	return &ServiceAccountMetadata{
+		Finalizers: []string{},
+		Labels:     map[string]string{},
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type ServiceAccount struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the ServiceAccount
+	Spec ServiceAccountSpec `json:"spec" yaml:"spec"`
+
+	Status ServiceAccountStatus `json:"status" yaml:"status"`
+}
+
+func (o *ServiceAccount) GetSpec() any {
+	return o.Spec
+}
+
+func (o *ServiceAccount) SetSpec(spec any) error {
+	cast, ok := spec.(ServiceAccountSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *ServiceAccount) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *ServiceAccount) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *ServiceAccount) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(ServiceAccountStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type ServiceAccountStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *ServiceAccount) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *ServiceAccount) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *ServiceAccount) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *ServiceAccount) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *ServiceAccount) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *ServiceAccount) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *ServiceAccount) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *ServiceAccount) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *ServiceAccount) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *ServiceAccount) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *ServiceAccount) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *ServiceAccount) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ServiceAccount) DeepCopy() *ServiceAccount {
+	cpy := &ServiceAccount{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ServiceAccount) DeepCopyInto(dst *ServiceAccount) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &ServiceAccount{}
+
+// +k8s:openapi-gen=true
+type ServiceAccountList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []ServiceAccount `json:"items" yaml:"items"`
+}
+
+func (o *ServiceAccountList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *ServiceAccountList) Copy() resource.ListObject {
+	cpy := &ServiceAccountList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]ServiceAccount, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*ServiceAccount); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *ServiceAccountList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *ServiceAccountList) SetItems(items []resource.Object) {
+	o.Items = make([]ServiceAccount, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*ServiceAccount)
+	}
+}
+
+func (o *ServiceAccountList) DeepCopy() *ServiceAccountList {
+	cpy := &ServiceAccountList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *ServiceAccountList) DeepCopyInto(dst *ServiceAccountList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &ServiceAccountList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *ServiceAccountSpec) DeepCopy() *ServiceAccountSpec {
+	cpy := &ServiceAccountSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *ServiceAccountSpec) DeepCopyInto(dst *ServiceAccountSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of ServiceAccountStatus
+func (s *ServiceAccountStatus) DeepCopy() *ServiceAccountStatus {
+	cpy := &ServiceAccountStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies ServiceAccountStatus into another ServiceAccountStatus object
+func (s *ServiceAccountStatus) DeepCopyInto(dst *ServiceAccountStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaServiceAccount = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &ServiceAccount{}, &ServiceAccountList{}, resource.WithKind("ServiceAccount"),
+		resource.WithPlural("serviceaccounts"), resource.WithScope(resource.NamespacedScope))
+	kindServiceAccount = resource.Kind{
+		Schema: schemaServiceAccount,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &ServiceAccountJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func ServiceAccountKind() resource.Kind {
+	return kindServiceAccount
+}
+
+// Schema returns a resource.SimpleSchema representation of ServiceAccount
+func ServiceAccountSchema() *resource.SimpleSchema {
+	return schemaServiceAccount
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindServiceAccount

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_spec_gen.go

@@ -0,0 +1,14 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type ServiceAccountSpec struct {
+	Title    string `json:"title"`
+	Disabled bool   `json:"disabled"`
+}
+
+// NewServiceAccountSpec creates a new ServiceAccountSpec object.
+func NewServiceAccountSpec() *ServiceAccountSpec {
+	return &ServiceAccountSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/serviceaccount_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type ServiceAccountstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State ServiceAccountStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewServiceAccountstatusOperatorState creates a new ServiceAccountstatusOperatorState object.
+func NewServiceAccountstatusOperatorState() *ServiceAccountstatusOperatorState {
+	return &ServiceAccountstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type ServiceAccountStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]ServiceAccountstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewServiceAccountStatus creates a new ServiceAccountStatus object.
+func NewServiceAccountStatus() *ServiceAccountStatus {
+	return &ServiceAccountStatus{}
+}
+
+// +k8s:openapi-gen=true
+type ServiceAccountStatusOperatorStateState string
+
+const (
+	ServiceAccountStatusOperatorStateStateSuccess    ServiceAccountStatusOperatorStateState = "success"
+	ServiceAccountStatusOperatorStateStateInProgress ServiceAccountStatusOperatorStateState = "in_progress"
+	ServiceAccountStatusOperatorStateStateFailed     ServiceAccountStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/team_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// TeamJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type TeamJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*TeamJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*TeamJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &TeamJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/team_metadata_gen.go

@@ -0,0 +1,31 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type TeamMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewTeamMetadata creates a new TeamMetadata object.
+func NewTeamMetadata() *TeamMetadata {
+	return &TeamMetadata{
+		Finalizers: []string{},
+		Labels:     map[string]string{},
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/team_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type Team struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the Team
+	Spec TeamSpec `json:"spec" yaml:"spec"`
+
+	Status TeamStatus `json:"status" yaml:"status"`
+}
+
+func (o *Team) GetSpec() any {
+	return o.Spec
+}
+
+func (o *Team) SetSpec(spec any) error {
+	cast, ok := spec.(TeamSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *Team) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *Team) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *Team) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(TeamStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type TeamStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *Team) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *Team) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *Team) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *Team) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *Team) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *Team) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *Team) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *Team) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *Team) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *Team) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *Team) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *Team) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *Team) DeepCopy() *Team {
+	cpy := &Team{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *Team) DeepCopyInto(dst *Team) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &Team{}
+
+// +k8s:openapi-gen=true
+type TeamList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []Team `json:"items" yaml:"items"`
+}
+
+func (o *TeamList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *TeamList) Copy() resource.ListObject {
+	cpy := &TeamList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]Team, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*Team); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *TeamList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *TeamList) SetItems(items []resource.Object) {
+	o.Items = make([]Team, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*Team)
+	}
+}
+
+func (o *TeamList) DeepCopy() *TeamList {
+	cpy := &TeamList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *TeamList) DeepCopyInto(dst *TeamList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &TeamList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *TeamSpec) DeepCopy() *TeamSpec {
+	cpy := &TeamSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *TeamSpec) DeepCopyInto(dst *TeamSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of TeamStatus
+func (s *TeamStatus) DeepCopy() *TeamStatus {
+	cpy := &TeamStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies TeamStatus into another TeamStatus object
+func (s *TeamStatus) DeepCopyInto(dst *TeamStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/team_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaTeam = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &Team{}, &TeamList{}, resource.WithKind("Team"),
+		resource.WithPlural("teams"), resource.WithScope(resource.NamespacedScope))
+	kindTeam = resource.Kind{
+		Schema: schemaTeam,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &TeamJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func TeamKind() resource.Kind {
+	return kindTeam
+}
+
+// Schema returns a resource.SimpleSchema representation of Team
+func TeamSchema() *resource.SimpleSchema {
+	return schemaTeam
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindTeam

apps/iam/pkg/apis/iam/v0alpha1/team_spec_gen.go

@@ -0,0 +1,14 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type TeamSpec struct {
+	Title string `json:"title"`
+	Email string `json:"email"`
+}
+
+// NewTeamSpec creates a new TeamSpec object.
+func NewTeamSpec() *TeamSpec {
+	return &TeamSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/team_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type TeamstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State TeamStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewTeamstatusOperatorState creates a new TeamstatusOperatorState object.
+func NewTeamstatusOperatorState() *TeamstatusOperatorState {
+	return &TeamstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type TeamStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]TeamstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewTeamStatus creates a new TeamStatus object.
+func NewTeamStatus() *TeamStatus {
+	return &TeamStatus{}
+}
+
+// +k8s:openapi-gen=true
+type TeamStatusOperatorStateState string
+
+const (
+	TeamStatusOperatorStateStateSuccess    TeamStatusOperatorStateState = "success"
+	TeamStatusOperatorStateStateInProgress TeamStatusOperatorStateState = "in_progress"
+	TeamStatusOperatorStateStateFailed     TeamStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/teambinding_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// TeamBindingJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type TeamBindingJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*TeamBindingJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*TeamBindingJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &TeamBindingJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/teambinding_metadata_gen.go

@@ -0,0 +1,31 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type TeamBindingMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewTeamBindingMetadata creates a new TeamBindingMetadata object.
+func NewTeamBindingMetadata() *TeamBindingMetadata {
+	return &TeamBindingMetadata{
+		Finalizers: []string{},
+		Labels:     map[string]string{},
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/teambinding_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type TeamBinding struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the TeamBinding
+	Spec TeamBindingSpec `json:"spec" yaml:"spec"`
+
+	Status TeamBindingStatus `json:"status" yaml:"status"`
+}
+
+func (o *TeamBinding) GetSpec() any {
+	return o.Spec
+}
+
+func (o *TeamBinding) SetSpec(spec any) error {
+	cast, ok := spec.(TeamBindingSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *TeamBinding) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *TeamBinding) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *TeamBinding) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(TeamBindingStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type TeamBindingStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *TeamBinding) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *TeamBinding) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *TeamBinding) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *TeamBinding) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *TeamBinding) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *TeamBinding) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *TeamBinding) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *TeamBinding) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *TeamBinding) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *TeamBinding) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *TeamBinding) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *TeamBinding) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *TeamBinding) DeepCopy() *TeamBinding {
+	cpy := &TeamBinding{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *TeamBinding) DeepCopyInto(dst *TeamBinding) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &TeamBinding{}
+
+// +k8s:openapi-gen=true
+type TeamBindingList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []TeamBinding `json:"items" yaml:"items"`
+}
+
+func (o *TeamBindingList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *TeamBindingList) Copy() resource.ListObject {
+	cpy := &TeamBindingList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]TeamBinding, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*TeamBinding); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *TeamBindingList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *TeamBindingList) SetItems(items []resource.Object) {
+	o.Items = make([]TeamBinding, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*TeamBinding)
+	}
+}
+
+func (o *TeamBindingList) DeepCopy() *TeamBindingList {
+	cpy := &TeamBindingList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *TeamBindingList) DeepCopyInto(dst *TeamBindingList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &TeamBindingList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *TeamBindingSpec) DeepCopy() *TeamBindingSpec {
+	cpy := &TeamBindingSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *TeamBindingSpec) DeepCopyInto(dst *TeamBindingSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of TeamBindingStatus
+func (s *TeamBindingStatus) DeepCopy() *TeamBindingStatus {
+	cpy := &TeamBindingStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies TeamBindingStatus into another TeamBindingStatus object
+func (s *TeamBindingStatus) DeepCopyInto(dst *TeamBindingStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/teambinding_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaTeamBinding = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &TeamBinding{}, &TeamBindingList{}, resource.WithKind("TeamBinding"),
+		resource.WithPlural("teambindings"), resource.WithScope(resource.NamespacedScope))
+	kindTeamBinding = resource.Kind{
+		Schema: schemaTeamBinding,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &TeamBindingJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func TeamBindingKind() resource.Kind {
+	return kindTeamBinding
+}
+
+// Schema returns a resource.SimpleSchema representation of TeamBinding
+func TeamBindingSchema() *resource.SimpleSchema {
+	return schemaTeamBinding
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindTeamBinding

apps/iam/pkg/apis/iam/v0alpha1/teambinding_spec_gen.go

@@ -0,0 +1,49 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type TeamBindingspecSubject struct {
+	// uid of the identity
+	Name string `json:"name"`
+	// permission of the identity in the team
+	Permission TeamBindingTeamPermission `json:"permission"`
+}
+
+// NewTeamBindingspecSubject creates a new TeamBindingspecSubject object.
+func NewTeamBindingspecSubject() *TeamBindingspecSubject {
+	return &TeamBindingspecSubject{}
+}
+
+// +k8s:openapi-gen=true
+type TeamBindingTeamPermission string
+
+const (
+	TeamBindingTeamPermissionAdmin  TeamBindingTeamPermission = "admin"
+	TeamBindingTeamPermissionMember TeamBindingTeamPermission = "member"
+)
+
+// +k8s:openapi-gen=true
+type TeamBindingTeamRef struct {
+	// Name is the unique identifier for a team.
+	Name string `json:"name"`
+}
+
+// NewTeamBindingTeamRef creates a new TeamBindingTeamRef object.
+func NewTeamBindingTeamRef() *TeamBindingTeamRef {
+	return &TeamBindingTeamRef{}
+}
+
+// +k8s:openapi-gen=true
+type TeamBindingSpec struct {
+	Subjects []TeamBindingspecSubject `json:"subjects"`
+	TeamRef  TeamBindingTeamRef       `json:"teamRef"`
+}
+
+// NewTeamBindingSpec creates a new TeamBindingSpec object.
+func NewTeamBindingSpec() *TeamBindingSpec {
+	return &TeamBindingSpec{
+		Subjects: []TeamBindingspecSubject{},
+		TeamRef:  *NewTeamBindingTeamRef(),
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/teambinding_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type TeamBindingstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State TeamBindingStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewTeamBindingstatusOperatorState creates a new TeamBindingstatusOperatorState object.
+func NewTeamBindingstatusOperatorState() *TeamBindingstatusOperatorState {
+	return &TeamBindingstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type TeamBindingStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]TeamBindingstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewTeamBindingStatus creates a new TeamBindingStatus object.
+func NewTeamBindingStatus() *TeamBindingStatus {
+	return &TeamBindingStatus{}
+}
+
+// +k8s:openapi-gen=true
+type TeamBindingStatusOperatorStateState string
+
+const (
+	TeamBindingStatusOperatorStateStateSuccess    TeamBindingStatusOperatorStateState = "success"
+	TeamBindingStatusOperatorStateStateInProgress TeamBindingStatusOperatorStateState = "in_progress"
+	TeamBindingStatusOperatorStateStateFailed     TeamBindingStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/user_codec_gen.go

@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// UserJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type UserJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*UserJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*UserJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &UserJSONCodec{}

apps/iam/pkg/apis/iam/v0alpha1/user_metadata_gen.go

@@ -0,0 +1,31 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	time "time"
+)
+
+// metadata contains embedded CommonMetadata and can be extended with custom string fields
+// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
+// without external reference as using the CommonMetadata reference breaks thema codegen.
+type UserMetadata struct {
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	CreatedBy         string            `json:"createdBy"`
+	Uid               string            `json:"uid"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Generation        int64             `json:"generation"`
+	UpdatedBy         string            `json:"updatedBy"`
+	Labels            map[string]string `json:"labels"`
+}
+
+// NewUserMetadata creates a new UserMetadata object.
+func NewUserMetadata() *UserMetadata {
+	return &UserMetadata{
+		Finalizers: []string{},
+		Labels:     map[string]string{},
+	}
+}

apps/iam/pkg/apis/iam/v0alpha1/user_object_gen.go

@@ -0,0 +1,319 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type User struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
+
+	// Spec is the spec of the User
+	Spec UserSpec `json:"spec" yaml:"spec"`
+
+	Status UserStatus `json:"status" yaml:"status"`
+}
+
+func (o *User) GetSpec() any {
+	return o.Spec
+}
+
+func (o *User) SetSpec(spec any) error {
+	cast, ok := spec.(UserSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *User) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.Status,
+	}
+}
+
+func (o *User) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.Status, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *User) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(UserStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type UserStatus", value)
+		}
+		o.Status = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *User) GetStaticMetadata() resource.StaticMetadata {
+	gvk := o.GroupVersionKind()
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		Kind:      gvk.Kind,
+	}
+}
+
+func (o *User) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *User) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *User) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *User) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *User) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *User) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *User) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *User) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *User) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *User) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *User) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *User) DeepCopy() *User {
+	cpy := &User{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *User) DeepCopyInto(dst *User) {
+	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
+	dst.TypeMeta.Kind = o.TypeMeta.Kind
+	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
+	o.Spec.DeepCopyInto(&dst.Spec)
+	o.Status.DeepCopyInto(&dst.Status)
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &User{}
+
+// +k8s:openapi-gen=true
+type UserList struct {
+	metav1.TypeMeta `json:",inline" yaml:",inline"`
+	metav1.ListMeta `json:"metadata" yaml:"metadata"`
+	Items           []User `json:"items" yaml:"items"`
+}
+
+func (o *UserList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *UserList) Copy() resource.ListObject {
+	cpy := &UserList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]User, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*User); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *UserList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *UserList) SetItems(items []resource.Object) {
+	o.Items = make([]User, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*User)
+	}
+}
+
+func (o *UserList) DeepCopy() *UserList {
+	cpy := &UserList{}
+	o.DeepCopyInto(cpy)
+	return cpy
+}
+
+func (o *UserList) DeepCopyInto(dst *UserList) {
+	resource.CopyObjectInto(dst, o)
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &UserList{}
+
+// Copy methods for all subresource types
+
+// DeepCopy creates a full deep copy of Spec
+func (s *UserSpec) DeepCopy() *UserSpec {
+	cpy := &UserSpec{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies Spec into another Spec object
+func (s *UserSpec) DeepCopyInto(dst *UserSpec) {
+	resource.CopyObjectInto(dst, s)
+}
+
+// DeepCopy creates a full deep copy of UserStatus
+func (s *UserStatus) DeepCopy() *UserStatus {
+	cpy := &UserStatus{}
+	s.DeepCopyInto(cpy)
+	return cpy
+}
+
+// DeepCopyInto deep copies UserStatus into another UserStatus object
+func (s *UserStatus) DeepCopyInto(dst *UserStatus) {
+	resource.CopyObjectInto(dst, s)
+}

apps/iam/pkg/apis/iam/v0alpha1/user_schema_gen.go

@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaUser = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &User{}, &UserList{}, resource.WithKind("User"),
+		resource.WithPlural("users"), resource.WithScope(resource.NamespacedScope))
+	kindUser = resource.Kind{
+		Schema: schemaUser,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &UserJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func UserKind() resource.Kind {
+	return kindUser
+}
+
+// Schema returns a resource.SimpleSchema representation of User
+func UserSchema() *resource.SimpleSchema {
+	return schemaUser
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindUser

apps/iam/pkg/apis/iam/v0alpha1/user_spec_gen.go

@@ -0,0 +1,20 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type UserSpec struct {
+	Disabled      bool   `json:"disabled"`
+	Email         string `json:"email"`
+	EmailVerified bool   `json:"emailVerified"`
+	GrafanaAdmin  bool   `json:"grafanaAdmin"`
+	Login         string `json:"login"`
+	Name          string `json:"name"`
+	// What to do with salt, rands and password?
+	Provisioned bool `json:"provisioned"`
+}
+
+// NewUserSpec creates a new UserSpec object.
+func NewUserSpec() *UserSpec {
+	return &UserSpec{}
+}

apps/iam/pkg/apis/iam/v0alpha1/user_status_gen.go

@@ -0,0 +1,44 @@
+// Code generated - EDITING IS FUTILE. DO NOT EDIT.
+
+package v0alpha1
+
+// +k8s:openapi-gen=true
+type UserstatusOperatorState struct {
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State UserStatusOperatorStateState `json:"state"`
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+}
+
+// NewUserstatusOperatorState creates a new UserstatusOperatorState object.
+func NewUserstatusOperatorState() *UserstatusOperatorState {
+	return &UserstatusOperatorState{}
+}
+
+// +k8s:openapi-gen=true
+type UserStatus struct {
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]UserstatusOperatorState `json:"operatorStates,omitempty"`
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+}
+
+// NewUserStatus creates a new UserStatus object.
+func NewUserStatus() *UserStatus {
+	return &UserStatus{}
+}
+
+// +k8s:openapi-gen=true
+type UserStatusOperatorStateState string
+
+const (
+	UserStatusOperatorStateStateSuccess    UserStatusOperatorStateState = "success"
+	UserStatusOperatorStateStateInProgress UserStatusOperatorStateState = "in_progress"
+	UserStatusOperatorStateStateFailed     UserStatusOperatorStateState = "failed"
+)

apps/iam/pkg/apis/iam/v0alpha1/zz_openapi_gen.go

@@ -51,6 +51,28 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.RoleStatus":                            schema_pkg_apis_iam_v0alpha1_RoleStatus(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.RolespecPermission":                    schema_pkg_apis_iam_v0alpha1_RolespecPermission(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.RolestatusOperatorState":               schema_pkg_apis_iam_v0alpha1_RolestatusOperatorState(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccount":                        schema_pkg_apis_iam_v0alpha1_ServiceAccount(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountList":                    schema_pkg_apis_iam_v0alpha1_ServiceAccountList(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountSpec":                    schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountStatus":                  schema_pkg_apis_iam_v0alpha1_ServiceAccountStatus(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountstatusOperatorState":     schema_pkg_apis_iam_v0alpha1_ServiceAccountstatusOperatorState(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.Team":                                  schema_pkg_apis_iam_v0alpha1_Team(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBinding":                           schema_pkg_apis_iam_v0alpha1_TeamBinding(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingList":                       schema_pkg_apis_iam_v0alpha1_TeamBindingList(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingSpec":                       schema_pkg_apis_iam_v0alpha1_TeamBindingSpec(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingStatus":                     schema_pkg_apis_iam_v0alpha1_TeamBindingStatus(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingTeamRef":                    schema_pkg_apis_iam_v0alpha1_TeamBindingTeamRef(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingspecSubject":                schema_pkg_apis_iam_v0alpha1_TeamBindingspecSubject(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingstatusOperatorState":        schema_pkg_apis_iam_v0alpha1_TeamBindingstatusOperatorState(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamList":                              schema_pkg_apis_iam_v0alpha1_TeamList(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamSpec":                              schema_pkg_apis_iam_v0alpha1_TeamSpec(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamStatus":                            schema_pkg_apis_iam_v0alpha1_TeamStatus(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamstatusOperatorState":               schema_pkg_apis_iam_v0alpha1_TeamstatusOperatorState(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.User":                                  schema_pkg_apis_iam_v0alpha1_User(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserList":                              schema_pkg_apis_iam_v0alpha1_UserList(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserSpec":                              schema_pkg_apis_iam_v0alpha1_UserSpec(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserStatus":                            schema_pkg_apis_iam_v0alpha1_UserStatus(ref),
+		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserstatusOperatorState":               schema_pkg_apis_iam_v0alpha1_UserstatusOperatorState(ref),
 	}
 }
 
@@ -1738,3 +1760,968 @@ func schema_pkg_apis_iam_v0alpha1_RolestatusOperatorState(ref common.ReferenceCa
 		},
 	}
 }
+
+func schema_pkg_apis_iam_v0alpha1_ServiceAccount(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec is the spec of the ServiceAccount",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountStatus"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec", "status"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountSpec", "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ServiceAccountList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccount"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccount", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"title": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"disabled": {
+						SchemaProps: spec.SchemaProps{
+							Default: false,
+							Type:    []string{"boolean"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"title", "disabled"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ServiceAccountStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"operatorStates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountstatusOperatorState"),
+									},
+								},
+							},
+						},
+					},
+					"additionalFields": {
+						SchemaProps: spec.SchemaProps{
+							Description: "additionalFields is reserved for future use",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountstatusOperatorState"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_ServiceAccountstatusOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_Team(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec is the spec of the Team",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamStatus"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec", "status"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamSpec", "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBinding(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec is the spec of the TeamBinding",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingStatus"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec", "status"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingSpec", "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBinding"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBinding", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"subjects": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingspecSubject"),
+									},
+								},
+							},
+						},
+					},
+					"teamRef": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingTeamRef"),
+						},
+					},
+				},
+				Required: []string{"subjects", "teamRef"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingTeamRef", "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingspecSubject"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"operatorStates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingstatusOperatorState"),
+									},
+								},
+							},
+						},
+					},
+					"additionalFields": {
+						SchemaProps: spec.SchemaProps{
+							Description: "additionalFields is reserved for future use",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamBindingstatusOperatorState"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingTeamRef(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the unique identifier for a team.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"name"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingspecSubject(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "uid of the identity",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"permission": {
+						SchemaProps: spec.SchemaProps{
+							Description: "permission of the identity in the team",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"name", "permission"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamBindingstatusOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.Team"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.Team", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"title": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"email": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"title", "email"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"operatorStates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamstatusOperatorState"),
+									},
+								},
+							},
+						},
+					},
+					"additionalFields": {
+						SchemaProps: spec.SchemaProps{
+							Description: "additionalFields is reserved for future use",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.TeamstatusOperatorState"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_TeamstatusOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_User(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec is the spec of the User",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserStatus"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec", "status"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserSpec", "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_UserList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.User"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.User", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_UserSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"disabled": {
+						SchemaProps: spec.SchemaProps{
+							Default: false,
+							Type:    []string{"boolean"},
+							Format:  "",
+						},
+					},
+					"email": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"emailVerified": {
+						SchemaProps: spec.SchemaProps{
+							Default: false,
+							Type:    []string{"boolean"},
+							Format:  "",
+						},
+					},
+					"grafanaAdmin": {
+						SchemaProps: spec.SchemaProps{
+							Default: false,
+							Type:    []string{"boolean"},
+							Format:  "",
+						},
+					},
+					"login": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"provisioned": {
+						SchemaProps: spec.SchemaProps{
+							Description: "What to do with salt, rands and password?",
+							Default:     false,
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"disabled", "email", "emailVerified", "grafanaAdmin", "login", "name", "provisioned"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_UserStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"operatorStates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserstatusOperatorState"),
+									},
+								},
+							},
+						},
+					},
+					"additionalFields": {
+						SchemaProps: spec.SchemaProps{
+							Description: "additionalFields is reserved for future use",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.UserstatusOperatorState"},
+	}
+}
+
+func schema_pkg_apis_iam_v0alpha1_UserstatusOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}

apps/iam/pkg/apis/iam_manifest.go

@@ -14,6 +14,8 @@ import (
 	v0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 )
 
+var ()
+
 var appManifestData = app.ManifestData{
 	AppName: "iam",
 	Group:   "iam.grafana.app",
@@ -83,6 +85,50 @@ var appManifestData = app.ManifestData{
 				},
 			},
 		},
+
+		{
+			Kind:       "User",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "Team",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "TeamBinding",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
+
+		{
+			Kind:       "ServiceAccount",
+			Scope:      "Namespaced",
+			Conversion: false,
+			Versions: []app.ManifestKindVersion{
+				{
+					Name: "v0alpha1",
+				},
+			},
+		},
 	},
 }
 
@@ -101,6 +147,10 @@ var kindVersionToGoType = map[string]resource.Kind{
 	"Role/v0alpha1":               v0alpha1.RoleKind(),
 	"RoleBinding/v0alpha1":        v0alpha1.RoleBindingKind(),
 	"ResourcePermission/v0alpha1": v0alpha1.ResourcePermissionKind(),
+	"User/v0alpha1":               v0alpha1.UserKind(),
+	"Team/v0alpha1":               v0alpha1.TeamKind(),
+	"TeamBinding/v0alpha1":        v0alpha1.TeamBindingKind(),
+	"ServiceAccount/v0alpha1":     v0alpha1.ServiceAccountKind(),
 }
 
 // ManifestGoTypeAssociator returns the associated resource.Kind instance for a given Kind and Version, if one exists.

conf/defaults.ini

@@ -1121,7 +1121,7 @@ content_types = text/html
 # Use space to separate multiple modes, e.g. "console file"
 mode = console file
 
-# Either "debug", "info", "warn", "error", "critical", default is "info"
+# Either "debug", "info", "warn", "error". Default is "info"
 level = info
 
 # optional settings to set different levels for specific loggers. Ex filters = sqlstore:debug

conf/sample.ini

@@ -1105,7 +1105,7 @@
 # Use space to separate multiple modes, e.g. "console file"
 ;mode = console file
 
-# Either "debug", "info", "warn", "error", "critical", default is "info"
+# Either "debug", "info", "warn", "error". Default is "info"
 ;level = info
 
 # optional settings to set different levels for specific loggers. Ex filters = sqlstore:debug

docs/sources/dashboards/build-dashboards/_index.md

@@ -28,7 +28,3 @@ refs:
 This section includes the following topics:
 
 {{< section >}}
-
-## Dynamic dashboards
-
-You can create more interactive and dynamic dashboards by adding and using [variables](ref:variables). Instead of hard-coding things like server, application, and sensor names in your metric queries, you can use variables in their place. Read more about variables [here](ref:variables).

docs/sources/setup-grafana/configure-grafana/_index.md

@@ -1547,7 +1547,7 @@ Use spaces to separate multiple modes, for example, `console file`.
 
 #### `level`
 
-Options are `debug`, `info`, `warn`, `error`, and `critical`. Default is `info`.
+Options are `debug`, `info`, `warn`, `error`. `critical` is an alias for `error`. Default is `info`.
 
 #### `filters`
 
@@ -1576,7 +1576,7 @@ Only applicable when `console` is used in `[log]` mode.
 
 #### `level`
 
-Options are `debug`, `info`, `warn`, `error`, and `critical`. Default is inherited from `[log]` level.
+See [`[log] level`](#level) for values. Default is inherited from `[log]` level.
 
 #### `format`
 
@@ -1590,7 +1590,7 @@ Only applicable when `file` used in `[log]` mode.
 
 #### `level`
 
-Options are `debug`, `info`, `warn`, `error`, and `critical`. Default is inherited from `[log]` level.
+See [`[log] level`](#level) for values. Default is inherited from `[log]` level.
 
 #### `format`
 
@@ -1625,7 +1625,7 @@ Only applicable when `syslog` used in `[log]` mode.
 
 #### `level`
 
-Options are `debug`, `info`, `warn`, `error`, and `critical`. Default is inherited from `[log]` level.
+See [`[log] level`](#level) for values. Default is inherited from `[log]` level.
 
 #### `format`
 

go.mod

@@ -618,3 +618,8 @@ exclude github.com/prometheus/prometheus v1.8.2-0.20221021121301-51a44e6657c3
 // This was retracted, but seems to be known by the Go module proxy, and is
 // otherwise pulled in as a transitive dependency.
 exclude k8s.io/client-go v12.0.0+incompatible
+
+// This package contains test data for github.com/RoaringBitmap/roaring, which is
+// only used to run tests and not required for building the Grafana binary.
+// Since the test data doesn't contain a license file we exclude it.
+exclude github.com/RoaringBitmap/real-roaring-datasets v0.0.0-20190726190000-eb7c87156f76

go.sum

@@ -763,7 +763,6 @@ github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdko
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
 github.com/RoaringBitmap/gocroaring v0.4.0/go.mod h1:NieMwz7ZqwU2DD73/vvYwv7r4eWBKuPVSXZIpsaMwCI=
-github.com/RoaringBitmap/real-roaring-datasets v0.0.0-20190726190000-eb7c87156f76/go.mod h1:oM0MHmQ3nDsq609SS36p+oYbRi16+oVvU2Bw4Ipv0SE=
 github.com/RoaringBitmap/roaring v0.9.1/go.mod h1:h1B7iIUOmnAeb5ytYMvnHJwxMc6LUrwBnzXWRuqTQUc=
 github.com/RoaringBitmap/roaring v0.9.4/go.mod h1:icnadbWcNyfEHlYdr+tDlOTih1Bf/h+rzPpv4sbomAA=
 github.com/RoaringBitmap/roaring v1.9.3 h1:t4EbC5qQwnisr5PrP9nt0IRhRTb9gMUgQF4t4S2OByM=

go.work.sum

@@ -659,14 +659,6 @@ github.com/grafana/grafana/apps/dashboard v0.0.0-20250616145019-8d27f12428cb/go.
 github.com/grafana/grafana/apps/investigation v0.0.0-20250121113133-e747350fee2d/go.mod h1:HQprw3MmiYj5OUV9CZnkwA1FKDZBmYACuAB3oDvUOmI=
 github.com/grafana/grafana/apps/playlist v0.0.0-20250121113133-e747350fee2d/go.mod h1:DjJe5osrW/BKrzN9hAAOSElNWutj1bcriExa7iDP7kA=
 github.com/grafana/grafana/pkg/aggregator v0.0.0-20250121113133-e747350fee2d/go.mod h1:1sq0guad+G4SUTlBgx7SXfhnzy7D86K/LcVOtiQCiMA=
-github.com/grafana/grafana/pkg/build v0.0.0-20250220114259-be81314e2118/go.mod h1:STVpVboMYeBAfyn6Zw6XHhTHqUxzMy7pzRiVgk1l0W0=
-github.com/grafana/grafana/pkg/build v0.0.0-20250227105625-8f465f124924/go.mod h1:Vw0LdoMma64VgIMVpRY3i0D156jddgUGjTQBOcyeF3k=
-github.com/grafana/grafana/pkg/build v0.0.0-20250227163402-d78c646f93bb/go.mod h1:Vw0LdoMma64VgIMVpRY3i0D156jddgUGjTQBOcyeF3k=
-github.com/grafana/grafana/pkg/build v0.0.0-20250403075254-4918d8720c61/go.mod h1:LGVnSwdrS0ZnJ2WXEl5acgDoYPm74EUSFavca1NKHI8=
-github.com/grafana/grafana/pkg/build v0.0.0-20250625151647-35f89a456cc6/go.mod h1:dIu5dZy00k2TBdpVBXkvSbxHNj5H7lW/sOTpJTtKIXg=
-github.com/grafana/grafana/pkg/build v0.0.0-20250703134522-185ce90a4b20/go.mod h1:uU3TK/cKf6IdO7ou7CKgNNb8GEnW761Ecdb8tk8DQLg=
-github.com/grafana/grafana/pkg/build v0.0.0-20250703142147-cfd3b9f58211/go.mod h1:uU3TK/cKf6IdO7ou7CKgNNb8GEnW761Ecdb8tk8DQLg=
-github.com/grafana/grafana/pkg/build v0.0.0-20250703171819-20f30462ad64/go.mod h1:uU3TK/cKf6IdO7ou7CKgNNb8GEnW761Ecdb8tk8DQLg=
 github.com/grafana/grafana/pkg/semconv v0.0.0-20250121113133-e747350fee2d/go.mod h1:tfLnBpPYgwrBMRz4EXqPCZJyCjEG4Ev37FSlXnocJ2c=
 github.com/grafana/grafana/pkg/storage/unified/apistore v0.0.0-20250121113133-e747350fee2d/go.mod h1:CXpwZ3Mkw6xVlGKc0SqUxqXCP3Uv182q6qAQnLaLxRg=
 github.com/grafana/grafana/pkg/storage/unified/apistore v0.0.0-20250514132646-acbc7b54ed9e/go.mod h1:xrKQcxQxz+IUF90ybtfENFeEXtlj9nAsX/3Fw0KEIeQ=

package.json

@@ -163,8 +163,8 @@
     "@types/webpack-assets-manifest": "^5",
     "@types/webpack-env": "^1.18.4",
     "@types/yargs": "17.0.33",
-    "@typescript-eslint/eslint-plugin": "8.22.0",
-    "@typescript-eslint/parser": "8.22.0",
+    "@typescript-eslint/eslint-plugin": "8.35.1",
+    "@typescript-eslint/parser": "8.35.1",
     "autoprefixer": "10.4.20",
     "babel-loader": "9.2.1",
     "blob-polyfill": "9.0.20240710",
@@ -220,7 +220,7 @@
     "jsdom-testing-mocks": "^1.13.1",
     "lerna": "8.2.1",
     "mini-css-extract-plugin": "2.9.2",
-    "msw": "2.10.2",
+    "msw": "2.10.3",
     "mutationobserver-shim": "0.3.7",
     "node-notifier": "10.0.1",
     "nx": "20.7.1",
@@ -249,7 +249,7 @@
     "tracelib": "1.0.1",
     "ts-jest": "29.2.5",
     "ts-node": "10.9.2",
-    "typescript": "5.7.3",
+    "typescript": "5.8.3",
     "webpack": "5.97.1",
     "webpack-assets-manifest": "^5.1.0",
     "webpack-cli": "6.0.1",
@@ -268,7 +268,7 @@
     "@emotion/css": "11.13.5",
     "@emotion/react": "11.14.0",
     "@fingerprintjs/fingerprintjs": "^3.4.2",
-    "@floating-ui/react": "0.27.12",
+    "@floating-ui/react": "0.27.13",
     "@formatjs/intl-durationformat": "^0.7.0",
     "@glideapps/glide-data-grid": "^6.0.0",
     "@grafana/alerting": "workspace:*",

packages/grafana-alerting/package.json

@@ -78,7 +78,7 @@
     "rollup-plugin-esbuild": "6.2.0",
     "rollup-plugin-node-externals": "^8.0.0",
     "type-fest": "^4.40.0",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "@grafana/runtime": ">=11.6 <= 12.x",

packages/grafana-data/package.json

@@ -69,7 +69,7 @@
     "history": "4.10.1",
     "lodash": "4.17.21",
     "marked": "15.0.12",
-    "marked-mangle": "1.1.10",
+    "marked-mangle": "1.1.11",
     "moment": "2.30.1",
     "moment-timezone": "0.5.47",
     "ol": "7.4.0",
@@ -99,7 +99,7 @@
     "rollup": "^4.22.4",
     "rollup-plugin-esbuild": "6.2.0",
     "rollup-plugin-node-externals": "^8.0.0",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": "^18.0.0",

packages/grafana-data/src/utils/location.test.ts

@@ -5,13 +5,14 @@ import { GrafanaConfig } from '../types/config';
 import { locationUtil } from './location';
 
 describe('locationUtil', () => {
-  const { location } = window;
+  const win: typeof globalThis = window;
+  const { location } = win;
 
   beforeEach(() => {
     // @ts-ignore
-    delete window.location;
+    delete win.location;
 
-    window.location = {
+    win.location = {
       ...location,
       hash: '#hash',
       host: 'www.domain.com:9877',
@@ -26,7 +27,7 @@ describe('locationUtil', () => {
   });
 
   afterEach(() => {
-    window.location = location;
+    win.location = location;
   });
 
   describe('stripBaseFromUrl', () => {
@@ -106,7 +107,7 @@ describe('locationUtil', () => {
 
     describe('when origin does not have a port in it', () => {
       beforeEach(() => {
-        window.location = {
+        win.location = {
           ...location,
           hash: '#hash',
           host: 'www.domain.com',

packages/grafana-data/src/utils/url.test.ts

@@ -100,11 +100,12 @@ describe('parseKeyValue', () => {
 });
 
 describe('getUrlSearchParams', () => {
-  const { location } = window;
+  const win: typeof globalThis = window;
+  const { location } = win;
   // @ts-ignore
-  delete window.location;
+  delete win.location;
 
-  window.location = {
+  win.location = {
     ...location,
     hash: '#hash',
     host: 'www.domain.com:9877',

packages/grafana-e2e-selectors/package.json

@@ -52,6 +52,6 @@
     "@grafana/tsconfig": "^2.0.0",
     "semver": "^7.7.0",
     "tslib": "2.8.1",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   }
 }

packages/grafana-eslint-rules/README.md

@@ -18,6 +18,8 @@ Check if border-radius theme tokens are used.
 
 To improve the consistency across Grafana we encourage devs to use tokens instead of custom values. In this case, we want the `borderRadius` to use the appropriate token such as `theme.shape.radius.default`, `theme.shape.radius.pill` or `theme.shape.radius.circle`.
 
+Instead of using `0` to remove a previously set border-radius, use `unset`.
+
 ### `no-unreduced-motion`
 
 Avoid direct use of `animation*` or `transition*` properties.

packages/grafana-eslint-rules/rules/no-border-radius-literal.cjs

@@ -4,6 +4,16 @@ const createRule = ESLintUtils.RuleCreator(
   (name) => `https://github.com/grafana/grafana/blob/main/packages/grafana-eslint-rules/README.md#${name}`
 );
 
+const BORDER_RADIUS_PROPERTIES = [
+  'borderRadius',
+  'borderTopLeftRadius',
+  'borderTopRightRadius',
+  'borderBottomLeftRadius',
+  'borderBottomRightRadius',
+];
+
+const RE_ZERO_VALUE = /^0([a-zA-Z%]*)$/;
+
 const borderRadiusRule = createRule({
   create(context) {
     return {
@@ -11,13 +21,30 @@ const borderRadiusRule = createRule({
         if (
           node.type === AST_NODE_TYPES.Property &&
           node.key.type === AST_NODE_TYPES.Identifier &&
-          node.key.name === 'borderRadius' &&
+          BORDER_RADIUS_PROPERTIES.includes(node.key.name) &&
           node.value.type === AST_NODE_TYPES.Literal
         ) {
-          context.report({
-            node,
-            messageId: 'borderRadiusId',
-          });
+          const value = node.value.value;
+
+          if (value === 'unset' || value === 'initial') {
+            // Allow 'unset' or 'initial' to remove border radius
+            return;
+          } else if (value === 0 || RE_ZERO_VALUE.test(value)) {
+            // Require 'unset' or 'initial' to remove border radius instead of `0` or `0px`
+            context.report({
+              node,
+              messageId: 'borderRadiusNoZeroValue',
+              fix(fixer) {
+                return fixer.replaceText(node.value, "'unset'");
+              },
+            });
+          } else {
+            // Otherwise, require theme tokens are used
+            context.report({
+              node,
+              messageId: 'borderRadiusUseTokens',
+            });
+          }
         }
       },
     };
@@ -25,11 +52,13 @@ const borderRadiusRule = createRule({
   name: 'no-border-radius-literal',
   meta: {
     type: 'problem',
+    fixable: 'code',
     docs: {
       description: 'Check if border-radius theme tokens are used',
     },
     messages: {
-      borderRadiusId: 'Prefer using theme.shape.radius tokens instead of literal values.',
+      borderRadiusUseTokens: 'Prefer using theme.shape.radius tokens instead of literal values.',
+      borderRadiusNoZeroValue: 'Use unset or initial to remove a border radius.',
     },
     schema: [],
   },

packages/grafana-eslint-rules/tests/no-border-radius-literal.test.js

@@ -14,8 +14,12 @@ RuleTester.setDefaultConfig({
   },
 });
 
-const expectedError = {
-  messageId: 'borderRadiusId',
+const useTokenError = {
+  messageId: 'borderRadiusUseTokens',
+};
+
+const noZeroValueError = {
+  messageId: 'borderRadiusNoZeroValue',
 };
 
 const ruleTester = new RuleTester();
@@ -31,20 +35,44 @@ ruleTester.run('eslint no-border-radius-literal', noBorderRadiusLiteral, {
     {
       code: `css({ borderRadius: theme.shape.radius.pill })`,
     },
+    {
+      code: `css({ borderTopLeftRadius: theme.shape.radius.pill })`,
+    },
+    {
+      code: `css({ borderTopRightRadius: theme.shape.radius.pill })`,
+    },
+    {
+      code: `css({ borderBottomLeftRadius: theme.shape.radius.pill })`,
+    },
+    {
+      code: `css({ borderBottomRightRadius: theme.shape.radius.pill })`,
+    },
+
+    // allow values to remove border radius
+    {
+      code: `css({ borderRadius: 'initial' })`,
+    },
+    {
+      code: `css({ borderRadius: 'unset' })`,
+    },
   ],
 
   invalid: [
     {
       code: `css({ borderRadius: '2px' })`,
-      errors: [expectedError],
+      errors: [useTokenError],
+    },
+    {
+      code: `css({ borderRadius: 2 })`, // should error on px shorthand
+      errors: [useTokenError],
     },
     {
       code: `css({ lineHeight: 1 }, { borderRadius: '2px' })`,
-      errors: [expectedError],
+      errors: [useTokenError],
     },
     {
       code: `css([{ lineHeight: 1 }, { borderRadius: '2px' }])`,
-      errors: [expectedError],
+      errors: [useTokenError],
     },
     {
       name: 'nested classes',
@@ -56,7 +84,40 @@ css({
     },
   },
 })`,
-      errors: [expectedError],
+      errors: [useTokenError],
+    },
+    {
+      code: `css({ borderTopLeftRadius: 1 })`,
+      errors: [useTokenError],
+    },
+    {
+      code: `css({ borderTopRightRadius: "2px" })`,
+      errors: [useTokenError],
+    },
+    {
+      code: `css({ borderBottomLeftRadius: 3 })`,
+      errors: [useTokenError],
+    },
+    {
+      code: `css({ borderBottomRightRadius: "4px" })`,
+      errors: [useTokenError],
+    },
+
+    // should use unset or initial to remove border radius
+    {
+      code: `css({ borderRadius: 0 })`,
+      output: `css({ borderRadius: 'unset' })`,
+      errors: [noZeroValueError],
+    },
+    {
+      code: `css({ borderRadius: '0px' })`,
+      output: `css({ borderRadius: 'unset' })`,
+      errors: [noZeroValueError],
+    },
+    {
+      code: `css({ borderRadius: "0%" })`,
+      output: `css({ borderRadius: 'unset' })`,
+      errors: [noZeroValueError],
     },
   ],
 });

packages/grafana-flamegraph/package.json

@@ -81,7 +81,7 @@
     "rollup-plugin-node-externals": "^8.0.0",
     "ts-jest": "29.2.5",
     "ts-node": "10.9.2",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": "^18.0.0",

packages/grafana-i18n/package.json

@@ -67,7 +67,7 @@
     "@types/react": "18.3.18",
     "rollup": "^4.22.4",
     "rollup-plugin-copy": "3.5.0",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": ">=18"

packages/grafana-o11y-ds-frontend/package.json

@@ -43,7 +43,7 @@
     "react": "18.3.1",
     "ts-jest": "29.2.5",
     "ts-node": "10.9.2",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": "^18.0.0",

packages/grafana-plugin-configs/package.json

@@ -19,7 +19,7 @@
     "imports-loader": "^5.0.0",
     "replace-in-file-webpack-plugin": "1.0.6",
     "swc-loader": "0.2.6",
-    "typescript": "5.7.3",
+    "typescript": "5.8.3",
     "webpack": "5.97.1",
     "webpack-bundle-analyzer": "^4.10.2",
     "webpack-virtual-modules": "^0.6.2"

packages/grafana-prometheus/package.json

@@ -40,7 +40,7 @@
   },
   "dependencies": {
     "@emotion/css": "11.13.5",
-    "@floating-ui/react": "0.27.12",
+    "@floating-ui/react": "0.27.13",
     "@grafana/data": "12.1.0-pre",
     "@grafana/e2e-selectors": "12.1.0-pre",
     "@grafana/i18n": "12.1.0-pre",
@@ -53,7 +53,7 @@
     "@lezer/common": "1.2.3",
     "@lezer/highlight": "1.2.1",
     "@lezer/lr": "1.4.2",
-    "@prometheus-io/lezer-promql": "0.304.1",
+    "@prometheus-io/lezer-promql": "0.304.2",
     "@reduxjs/toolkit": "2.5.1",
     "@types/debounce-promise": "3.1.9",
     "@types/lodash": "4.17.15",
@@ -102,7 +102,7 @@
     "rollup-plugin-esbuild": "6.2.0",
     "rollup-plugin-node-externals": "^8.0.0",
     "testing-library-selector": "0.3.1",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": "^18.0.0",

packages/grafana-runtime/package.json

@@ -87,7 +87,7 @@
     "rollup-plugin-esbuild": "6.2.0",
     "rollup-plugin-node-externals": "^8.0.0",
     "rollup-plugin-sourcemaps": "0.6.3",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "react": "^18.0.0",

packages/grafana-runtime/src/utils/DataSourceWithBackend.ts

@@ -181,6 +181,7 @@ class DataSourceWithBackend<
       if (datasource.uid?.length) {
         dsUIDs.add(datasource.uid);
       }
+
       return {
         ...(shouldApplyTemplateVariables ? this.applyTemplateVariables(q, request.scopedVars, request.filters) : q),
         datasource,

packages/grafana-schema/package.json

@@ -44,7 +44,7 @@
     "rollup": "^4.22.4",
     "rollup-plugin-esbuild": "6.2.0",
     "rollup-plugin-node-externals": "^8.0.0",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "dependencies": {
     "tslib": "2.8.1"

packages/grafana-sql/package.json

@@ -53,7 +53,7 @@
     "jest": "^29.6.4",
     "ts-jest": "29.2.5",
     "ts-node": "10.9.2",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   },
   "peerDependencies": {
     "@grafana/runtime": "10.4.0-pre"

packages/grafana-test-utils/package.json

@@ -46,11 +46,11 @@
     "typecheck": "tsc --emitDeclarationOnly false --noEmit"
   },
   "dependencies": {
-    "msw": "2.10.2"
+    "msw": "2.10.3"
   },
   "devDependencies": {
     "@grafana/tsconfig": "^2.0.0",
     "@types/node": "22.15.0",
-    "typescript": "5.7.3"
+    "typescript": "5.8.3"
   }
 }

packages/grafana-ui/.storybook/preview.ts

@@ -52,6 +52,7 @@ if (process.env.NODE_ENV === 'development') {
 initialize({
   onUnhandledRequest: 'bypass',
   serviceWorker: {
+    // Important! The path must be relative to work when we deploy storybook to subpaths (e.g. /ui/canary)
     url: 'mockServiceWorker.js',
   },
 });

packages/grafana-ui/package.json

@@ -65,7 +65,7 @@
     "@emotion/css": "11.13.5",
     "@emotion/react": "11.14.0",
     "@emotion/serialize": "1.3.3",
-    "@floating-ui/react": "0.27.12",
+    "@floating-ui/react": "0.27.13",
     "@grafana/data": "12.1.0-pre",
     "@grafana/e2e-selectors": "12.1.0-pre",
     "@grafana/faro-web-sdk": "^1.13.2",
@@ -200,7 +200,7 @@
     "sass-loader": "16.0.4",
     "storybook": "^8.6.2",
     "style-loader": "4.0.0",
-    "typescript": "5.7.3",
+    "typescript": "5.8.3",
     "webpack": "5.97.1"
   },
   "peerDependencies": {

packages/grafana-ui/src/components/Button/ButtonGroup.tsx

@@ -27,14 +27,14 @@ const getStyles = (theme: GrafanaTheme2) => ({
     borderRadius: theme.shape.radius.default,
 
     '> .button-group:not(:first-child) > button, > button:not(:first-child)': {
-      borderTopLeftRadius: 0,
-      borderBottomLeftRadius: 0,
+      borderTopLeftRadius: 'unset',
+      borderBottomLeftRadius: 'unset',
       borderLeft: `1px solid rgba(255, 255, 255, 0.12)`,
     },
 
     '> .button-group:not(:last-child) > button, > button:not(:last-child)': {
-      borderTopRightRadius: 0,
-      borderBottomRightRadius: 0,
+      borderTopRightRadius: 'unset',
+      borderBottomRightRadius: 'unset',
       borderRight: `1px solid rgba(0, 0, 0, 0.12)`,
     },
   }),

packages/grafana-ui/src/components/Input/Input.tsx

@@ -168,8 +168,8 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
       '&:not(:first-child):last-child': {
         '> input': {
           borderLeft: 'none',
-          borderTopLeftRadius: 0,
-          borderBottomLeftRadius: 0,
+          borderTopLeftRadius: 'unset',
+          borderBottomLeftRadius: 'unset',
         },
       },
 
@@ -177,8 +177,8 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
       '&:first-child:not(:last-child)': {
         '> input': {
           borderRight: 'none',
-          borderTopRightRadius: 0,
-          borderBottomRightRadius: 0,
+          borderTopRightRadius: 'unset',
+          borderBottomRightRadius: 'unset',
         },
       },
 
@@ -186,10 +186,10 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
       '&:not(:first-child):not(:last-child)': {
         '> input': {
           borderRight: 'none',
-          borderTopRightRadius: 0,
-          borderBottomRightRadius: 0,
-          borderTopLeftRadius: 0,
-          borderBottomLeftRadius: 0,
+          borderTopRightRadius: 'unset',
+          borderBottomRightRadius: 'unset',
+          borderTopLeftRadius: 'unset',
+          borderBottomLeftRadius: 'unset',
         },
       },
 
@@ -238,20 +238,20 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
       position: 'relative',
 
       '&:first-child': {
-        borderTopRightRadius: 0,
-        borderBottomRightRadius: 0,
+        borderTopRightRadius: 'unset',
+        borderBottomRightRadius: 'unset',
         '> :last-child': {
-          borderTopRightRadius: 0,
-          borderBottomRightRadius: 0,
+          borderTopRightRadius: 'unset',
+          borderBottomRightRadius: 'unset',
         },
       },
 
       '&:last-child': {
-        borderTopLeftRadius: 0,
-        borderBottomLeftRadius: 0,
+        borderTopLeftRadius: 'unset',
+        borderBottomLeftRadius: 'unset',
         '> :first-child': {
-          borderTopLeftRadius: 0,
-          borderBottomLeftRadius: 0,
+          borderTopLeftRadius: 'unset',
+          borderBottomLeftRadius: 'unset',
         },
       },
       '> *:focus': {
@@ -266,8 +266,8 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
         paddingLeft: theme.spacing(1),
         paddingRight: theme.spacing(0.5),
         borderRight: 'none',
-        borderTopRightRadius: 0,
-        borderBottomRightRadius: 0,
+        borderTopRightRadius: 'unset',
+        borderBottomRightRadius: 'unset',
       })
     ),
     suffix: cx(
@@ -277,8 +277,8 @@ export const getInputStyles = stylesFactory(({ theme, invalid = false, width }:
         paddingLeft: theme.spacing(1),
         paddingRight: theme.spacing(1),
         borderLeft: 'none',
-        borderTopLeftRadius: 0,
-        borderBottomLeftRadius: 0,
+        borderTopLeftRadius: 'unset',
+        borderBottomLeftRadius: 'unset',
         right: 0,
       })
     ),

packages/grafana-ui/src/components/RefreshPicker/RefreshPicker.tsx

@@ -118,8 +118,8 @@ export class RefreshPicker extends PureComponent<Props> {
         {!noIntervalPicker && (
           <ButtonSelect
             className={css({
-              borderTopLeftRadius: 0,
-              borderBottomLeftRadius: 0,
+              borderTopLeftRadius: 'unset',
+              borderBottomLeftRadius: 'unset',
             })}
             value={selectedValue}
             options={options}

packages/grafana-ui/src/components/SecretFormField/SecretFormField.tsx

@@ -1,4 +1,3 @@
-import { css, cx } from '@emotion/css';
 import { omit } from 'lodash';
 import { InputHTMLAttributes } from 'react';
 import * as React from 'react';
@@ -26,19 +25,6 @@ export interface Props extends Omit<InputHTMLAttributes<HTMLInputElement>, 'onRe
   interactive?: boolean;
 }
 
-const getSecretFormFieldStyles = () => {
-  return {
-    noRadiusInput: css({
-      borderBottomRightRadius: '0 !important',
-      borderTopRightRadius: '0 !important',
-    }),
-    noRadiusButton: css({
-      borderBottomLeftRadius: '0 !important',
-      borderTopLeftRadius: '0 !important',
-    }),
-  };
-};
-
 /**
  * Form field that has 2 states configured and not configured. If configured it will not show its contents and adds
  * a reset button that will clear the input and makes it accessible. In non configured state it behaves like normal
@@ -58,7 +44,6 @@ export const SecretFormField = ({
   interactive,
   ...inputProps
 }: Props) => {
-  const styles = getSecretFormFieldStyles();
   return (
     <FormField
       label={label!}
@@ -70,7 +55,7 @@ export const SecretFormField = ({
           <>
             <input
               type="text"
-              className={cx(`gf-form-input width-${inputWidth}`, styles.noRadiusInput)}
+              className={`gf-form-input width-${inputWidth}`}
               disabled={true}
               value="configured"
               {...omit(inputProps, 'value')}

pkg/apimachinery/identity/context.go

@@ -115,9 +115,10 @@ var serviceIdentityPermissions = getWildcardPermissions(
 	"datasources:delete",
 	"alert.provisioning:write",
 	"alert.provisioning.secrets:read",
-	"users:read",     // accesscontrol.ActionUsersRead,
-	"org.users:read", // accesscontrol.ActionOrgUsersRead,
-	"teams:read",     // accesscontrol.ActionTeamsRead,
+	"users:read",           // accesscontrol.ActionUsersRead,
+	"org.users:read",       // accesscontrol.ActionOrgUsersRead,
+	"teams:read",           // accesscontrol.ActionTeamsRead,
+	"serviceaccounts:read", // serviceaccounts.ActionRead,
 )
 
 var serviceIdentityTokenPermissions = getTokenPermissions(

pkg/apis/iam/v0alpha1/register.go

@@ -2,8 +2,10 @@ package v0alpha1
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -16,10 +18,11 @@ const (
 	APIVERSION = GROUP + "/" + VERSION
 )
 
-var UserResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
-	"users", "user", "User",
-	func() runtime.Object { return &User{} },
-	func() runtime.Object { return &UserList{} },
+var userKind = iamv0alpha1.UserKind()
+var UserResourceInfo = utils.NewResourceInfo(userKind.Group(), userKind.Version(),
+	userKind.GroupVersionResource().Resource, strings.ToLower(userKind.Kind()), userKind.Kind(),
+	func() runtime.Object { return userKind.ZeroValue() },
+	func() runtime.Object { return userKind.ZeroListValue() },
 	utils.TableColumns{
 		Definition: []metav1.TableColumnDefinition{
 			{Name: "Name", Type: "string", Format: "name"},
@@ -28,7 +31,7 @@ var UserResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
 			{Name: "Created At", Type: "date"},
 		},
 		Reader: func(obj any) ([]interface{}, error) {
-			u, ok := obj.(*User)
+			u, ok := obj.(*iamv0alpha1.User)
 			if ok {
 				return []interface{}{
 					u.Name,
@@ -42,10 +45,11 @@ var UserResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
 	},
 )
 
-var TeamResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
-	"teams", "team", "Team",
-	func() runtime.Object { return &Team{} },
-	func() runtime.Object { return &TeamList{} },
+var teamKind = iamv0alpha1.TeamKind()
+var TeamResourceInfo = utils.NewResourceInfo(teamKind.Group(), teamKind.Version(),
+	teamKind.GroupVersionResource().Resource, strings.ToLower(teamKind.Kind()), teamKind.Kind(),
+	func() runtime.Object { return teamKind.ZeroValue() },
+	func() runtime.Object { return teamKind.ZeroListValue() },
 	utils.TableColumns{
 		Definition: []metav1.TableColumnDefinition{
 			{Name: "Name", Type: "string", Format: "name"},
@@ -54,7 +58,7 @@ var TeamResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
 			{Name: "Created At", Type: "date"},
 		},
 		Reader: func(obj any) ([]interface{}, error) {
-			m, ok := obj.(*Team)
+			m, ok := obj.(*iamv0alpha1.Team)
 			if !ok {
 				return nil, fmt.Errorf("expected team")
 			}
@@ -68,10 +72,11 @@ var TeamResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
 	},
 )
 
-var ServiceAccountResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
-	"serviceaccounts", "serviceaccount", "ServiceAccount",
-	func() runtime.Object { return &ServiceAccount{} },
-	func() runtime.Object { return &ServiceAccountList{} },
+var serviceAccountKind = iamv0alpha1.ServiceAccountKind()
+var ServiceAccountResourceInfo = utils.NewResourceInfo(serviceAccountKind.Group(), serviceAccountKind.Version(),
+	serviceAccountKind.GroupVersionResource().Resource, strings.ToLower(serviceAccountKind.Kind()), serviceAccountKind.Kind(),
+	func() runtime.Object { return serviceAccountKind.ZeroValue() },
+	func() runtime.Object { return serviceAccountKind.ZeroListValue() },
 	utils.TableColumns{
 		Definition: []metav1.TableColumnDefinition{
 			{Name: "Name", Type: "string", Format: "name"},
@@ -80,7 +85,7 @@ var ServiceAccountResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
 			{Name: "Created At", Type: "date"},
 		},
 		Reader: func(obj any) ([]interface{}, error) {
-			sa, ok := obj.(*ServiceAccount)
+			sa, ok := obj.(*iamv0alpha1.ServiceAccount)
 			if ok {
 				return []interface{}{
 					sa.Name,
@@ -120,10 +125,13 @@ var SSOSettingResourceInfo = utils.NewResourceInfo(
 	},
 )
 
+var teamBindingKind = iamv0alpha1.TeamBindingKind()
 var TeamBindingResourceInfo = utils.NewResourceInfo(
-	GROUP, VERSION, "teambindings", "teambinding", "TeamBinding",
-	func() runtime.Object { return &TeamBinding{} },
-	func() runtime.Object { return &TeamBindingList{} },
+	teamBindingKind.Group(), teamBindingKind.Version(),
+	teamBindingKind.GroupVersionResource().Resource,
+	strings.ToLower(teamBindingKind.Kind()), teamBindingKind.Kind(),
+	func() runtime.Object { return teamBindingKind.ZeroValue() },
+	func() runtime.Object { return teamBindingKind.ZeroListValue() },
 	utils.TableColumns{
 		Definition: []metav1.TableColumnDefinition{
 			{Name: "Name", Type: "string", Format: "name"},
@@ -131,13 +139,13 @@ var TeamBindingResourceInfo = utils.NewResourceInfo(
 			{Name: "Created At", Type: "string", Format: "date"},
 		},
 		Reader: func(obj any) ([]interface{}, error) {
-			m, ok := obj.(*TeamBinding)
+			m, ok := obj.(*iamv0alpha1.TeamBinding)
 			if !ok {
 				return nil, fmt.Errorf("expected team binding")
 			}
 			return []interface{}{
 				m.Name,
-				m.Spec.Team.Name,
+				m.Spec.TeamRef.Name,
 				m.CreationTimestamp.UTC().Format(time.RFC3339),
 			}, nil
 		},
@@ -158,19 +166,19 @@ var (
 func AddKnownTypes(scheme *runtime.Scheme, version string) {
 	scheme.AddKnownTypes(
 		schema.GroupVersion{Group: GROUP, Version: version},
-		&User{},
-		&UserList{},
+		&iamv0alpha1.User{},
+		&iamv0alpha1.UserList{},
 		&UserTeamList{},
-		&ServiceAccount{},
-		&ServiceAccountList{},
+		&iamv0alpha1.ServiceAccount{},
+		&iamv0alpha1.ServiceAccountList{},
 		&ServiceAccountTokenList{},
-		&Team{},
-		&TeamList{},
+		&iamv0alpha1.Team{},
+		&iamv0alpha1.TeamList{},
 		&DisplayList{},
 		&SSOSetting{},
 		&SSOSettingList{},
-		&TeamBinding{},
-		&TeamBindingList{},
+		&iamv0alpha1.TeamBinding{},
+		&iamv0alpha1.TeamBindingList{},
 		&TeamMemberList{},
 	)
 }

pkg/apis/iam/v0alpha1/types_service_account.go

@@ -0,0 +1,19 @@
+package v0alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ServiceAccountTokenList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []ServiceAccountToken `json:"items"`
+}
+
+type ServiceAccountToken struct {
+	Name     string       `json:"name,omitempty"`
+	Revoked  bool         `json:"revoked,omitempty"`
+	Expires  *metav1.Time `json:"expires,omitempty"`
+	LastUsed *metav1.Time `json:"lastUsed,omitempty"`
+	Created  metav1.Time  `json:"created"`
+}

pkg/apis/iam/v0alpha1/types_servier_account.go

@@ -1,50 +0,0 @@
-package v0alpha1
-
-import (
-	"fmt"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type ServiceAccount struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec ServiceAccountSpec `json:"spec,omitempty"`
-}
-
-func (s ServiceAccount) AuthID() string {
-	return fmt.Sprintf("%d", s.Spec.InternalID)
-}
-
-type ServiceAccountSpec struct {
-	Title    string `json:"title,omitempty"`
-	Disabled bool   `json:"disabled,omitempty"`
-	// This is currently used for authorization checks but we don't want to expose it
-	InternalID int64 `json:"-"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type ServiceAccountList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []ServiceAccount `json:"items"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type ServiceAccountTokenList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []ServiceAccountToken `json:"items"`
-}
-
-type ServiceAccountToken struct {
-	Name     string       `json:"name,omitempty"`
-	Revoked  bool         `json:"revoked,omitempty"`
-	Expires  *metav1.Time `json:"expires,omitempty"`
-	LastUsed *metav1.Time `json:"lastUsed,omitempty"`
-	Created  metav1.Time  `json:"created"`
-}

pkg/apis/iam/v0alpha1/types_team.go

@@ -1,60 +1,9 @@
 package v0alpha1
 
 import (
-	"fmt"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type Team struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec TeamSpec `json:"spec,omitempty"`
-}
-
-type TeamSpec struct {
-	Title string `json:"title,omitempty"`
-	Email string `json:"email,omitempty"`
-
-	// This is currently used for authorization checks but we don't want to expose it
-	InternalID int64 `json:"-"`
-}
-
-func (t Team) AuthID() string {
-	return fmt.Sprintf("%d", t.Spec.InternalID)
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type TeamList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []Team `json:"items"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type TeamBinding struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec TeamBindingSpec `json:"spec,omitempty"`
-}
-
-type TeamBindingSpec struct {
-	Subjects []TeamSubject `json:"subjects,omitempty"`
-	Team     TeamRef       `json:"team,omitempty"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type TeamBindingList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []TeamBinding `json:"items"`
-}
-
 type TeamSubject struct {
 	// Identity is a reference to the identity of this subject.
 	Identity IdentityRef `json:"identity"`

pkg/apis/iam/v0alpha1/types_user.go

@@ -1,40 +1,6 @@
 package v0alpha1
 
-import (
-	"fmt"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type User struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec UserSpec `json:"spec,omitempty"`
-}
-
-func (u User) AuthID() string {
-	return fmt.Sprintf("%d", u.Spec.InternalID)
-}
-
-type UserSpec struct {
-	Name          string `json:"name,omitempty"`
-	Login         string `json:"login,omitempty"`
-	Email         string `json:"email,omitempty"`
-	EmailVerified bool   `json:"emailVerified,omitempty"`
-	Disabled      bool   `json:"disabled,omitempty"`
-	// This is currently used for authorization checks but we don't want to expose it
-	InternalID int64 `json:"-"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type UserList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []User `json:"items"`
-}
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type UserTeamList struct {

pkg/apis/iam/v0alpha1/zz_generated.deepcopy.go

@@ -162,82 +162,6 @@ func (in *SSOSettingSpec) DeepCopy() *SSOSettingSpec {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ServiceAccount) DeepCopyInto(out *ServiceAccount) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccount.
-func (in *ServiceAccount) DeepCopy() *ServiceAccount {
-	if in == nil {
-		return nil
-	}
-	out := new(ServiceAccount)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *ServiceAccount) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ServiceAccountList) DeepCopyInto(out *ServiceAccountList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]ServiceAccount, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountList.
-func (in *ServiceAccountList) DeepCopy() *ServiceAccountList {
-	if in == nil {
-		return nil
-	}
-	out := new(ServiceAccountList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *ServiceAccountList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ServiceAccountSpec) DeepCopyInto(out *ServiceAccountSpec) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountSpec.
-func (in *ServiceAccountSpec) DeepCopy() *ServiceAccountSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ServiceAccountSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ServiceAccountToken) DeepCopyInto(out *ServiceAccountToken) {
 	*out = *in
@@ -296,148 +220,6 @@ func (in *ServiceAccountTokenList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Team) DeepCopyInto(out *Team) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Team.
-func (in *Team) DeepCopy() *Team {
-	if in == nil {
-		return nil
-	}
-	out := new(Team)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Team) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TeamBinding) DeepCopyInto(out *TeamBinding) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeamBinding.
-func (in *TeamBinding) DeepCopy() *TeamBinding {
-	if in == nil {
-		return nil
-	}
-	out := new(TeamBinding)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *TeamBinding) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TeamBindingList) DeepCopyInto(out *TeamBindingList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]TeamBinding, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeamBindingList.
-func (in *TeamBindingList) DeepCopy() *TeamBindingList {
-	if in == nil {
-		return nil
-	}
-	out := new(TeamBindingList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *TeamBindingList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TeamBindingSpec) DeepCopyInto(out *TeamBindingSpec) {
-	*out = *in
-	if in.Subjects != nil {
-		in, out := &in.Subjects, &out.Subjects
-		*out = make([]TeamSubject, len(*in))
-		copy(*out, *in)
-	}
-	out.Team = in.Team
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeamBindingSpec.
-func (in *TeamBindingSpec) DeepCopy() *TeamBindingSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TeamBindingSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TeamList) DeepCopyInto(out *TeamList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Team, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeamList.
-func (in *TeamList) DeepCopy() *TeamList {
-	if in == nil {
-		return nil
-	}
-	out := new(TeamList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *TeamList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TeamMember) DeepCopyInto(out *TeamMember) {
 	*out = *in
@@ -502,22 +284,6 @@ func (in *TeamRef) DeepCopy() *TeamRef {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TeamSpec) DeepCopyInto(out *TeamSpec) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeamSpec.
-func (in *TeamSpec) DeepCopy() *TeamSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TeamSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TeamSubject) DeepCopyInto(out *TeamSubject) {
 	*out = *in
@@ -535,82 +301,6 @@ func (in *TeamSubject) DeepCopy() *TeamSubject {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *User) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *UserList) DeepCopyInto(out *UserList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]User, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserList.
-func (in *UserList) DeepCopy() *UserList {
-	if in == nil {
-		return nil
-	}
-	out := new(UserList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *UserList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *UserSpec) DeepCopyInto(out *UserSpec) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserSpec.
-func (in *UserSpec) DeepCopy() *UserSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(UserSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *UserTeam) DeepCopyInto(out *UserTeam) {
 	*out = *in

pkg/apis/iam/v0alpha1/zz_generated.openapi.go

@@ -20,24 +20,12 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.SSOSetting":              schema_pkg_apis_iam_v0alpha1_SSOSetting(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.SSOSettingList":          schema_pkg_apis_iam_v0alpha1_SSOSettingList(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.SSOSettingSpec":          schema_pkg_apis_iam_v0alpha1_SSOSettingSpec(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccount":          schema_pkg_apis_iam_v0alpha1_ServiceAccount(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountList":      schema_pkg_apis_iam_v0alpha1_ServiceAccountList(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountSpec":      schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountToken":     schema_pkg_apis_iam_v0alpha1_ServiceAccountToken(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountTokenList": schema_pkg_apis_iam_v0alpha1_ServiceAccountTokenList(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.Team":                    schema_pkg_apis_iam_v0alpha1_Team(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBinding":             schema_pkg_apis_iam_v0alpha1_TeamBinding(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBindingList":         schema_pkg_apis_iam_v0alpha1_TeamBindingList(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBindingSpec":         schema_pkg_apis_iam_v0alpha1_TeamBindingSpec(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamList":                schema_pkg_apis_iam_v0alpha1_TeamList(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamMember":              schema_pkg_apis_iam_v0alpha1_TeamMember(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamMemberList":          schema_pkg_apis_iam_v0alpha1_TeamMemberList(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamRef":                 schema_pkg_apis_iam_v0alpha1_TeamRef(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSpec":                schema_pkg_apis_iam_v0alpha1_TeamSpec(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSubject":             schema_pkg_apis_iam_v0alpha1_TeamSubject(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.User":                    schema_pkg_apis_iam_v0alpha1_User(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserList":                schema_pkg_apis_iam_v0alpha1_UserList(ref),
-		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserSpec":                schema_pkg_apis_iam_v0alpha1_UserSpec(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserTeam":                schema_pkg_apis_iam_v0alpha1_UserTeam(ref),
 		"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserTeamList":            schema_pkg_apis_iam_v0alpha1_UserTeamList(ref),
 	}
@@ -328,118 +316,6 @@ func schema_pkg_apis_iam_v0alpha1_SSOSettingSpec(ref common.ReferenceCallback) c
 	}
 }
 
-func schema_pkg_apis_iam_v0alpha1_ServiceAccount(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountSpec"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccountSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_ServiceAccountList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccount"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.ServiceAccount", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"title": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-					"disabled": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"boolean"},
-							Format: "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
 func schema_pkg_apis_iam_v0alpha1_ServiceAccountToken(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -530,215 +406,6 @@ func schema_pkg_apis_iam_v0alpha1_ServiceAccountTokenList(ref common.ReferenceCa
 	}
 }
 
-func schema_pkg_apis_iam_v0alpha1_Team(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSpec"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_TeamBinding(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBindingSpec"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBindingSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_TeamBindingList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBinding"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamBinding", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_TeamBindingSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"subjects": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSubject"),
-									},
-								},
-							},
-						},
-					},
-					"team": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamRef"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamRef", "github.com/grafana/grafana/pkg/apis/iam/v0alpha1.TeamSubject"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_TeamList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.Team"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.Team", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
 func schema_pkg_apis_iam_v0alpha1_TeamMember(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -864,30 +531,6 @@ func schema_pkg_apis_iam_v0alpha1_TeamRef(ref common.ReferenceCallback) common.O
 	}
 }
 
-func schema_pkg_apis_iam_v0alpha1_TeamSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"title": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-					"email": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
 func schema_pkg_apis_iam_v0alpha1_TeamSubject(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -918,136 +561,6 @@ func schema_pkg_apis_iam_v0alpha1_TeamSubject(ref common.ReferenceCallback) comm
 	}
 }
 
-func schema_pkg_apis_iam_v0alpha1_User(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserSpec"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.UserSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_UserList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/pkg/apis/iam/v0alpha1.User"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/pkg/apis/iam/v0alpha1.User", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_UserSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"name": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-					"login": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-					"email": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"string"},
-							Format: "",
-						},
-					},
-					"emailVerified": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"boolean"},
-							Format: "",
-						},
-					},
-					"disabled": {
-						SchemaProps: spec.SchemaProps{
-							Type:   []string{"boolean"},
-							Format: "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
 func schema_pkg_apis_iam_v0alpha1_UserTeam(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{

pkg/apis/iam/v0alpha1/zz_generated.openapi_violation_exceptions.list

@@ -1,4 +1,3 @@
 API rule violation: list_type_missing,github.com/grafana/grafana/pkg/apis/iam/v0alpha1,DisplayList,Items
-API rule violation: list_type_missing,github.com/grafana/grafana/pkg/apis/iam/v0alpha1,TeamBindingSpec,Subjects
 API rule violation: names_match,github.com/grafana/grafana/pkg/apis/iam/v0alpha1,Display,InternalID
 API rule violation: names_match,github.com/grafana/grafana/pkg/apis/iam/v0alpha1,DisplayList,Items

pkg/registry/apis/iam/common/common.go

@@ -5,8 +5,9 @@ import (
 	"strconv"
 
 	authlib "github.com/grafana/authlib/types"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
+	legacyiamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/team"
 )
@@ -20,11 +21,19 @@ func OptionalFormatInt(num int64) string {
 	return ""
 }
 
-func MapTeamPermission(p team.PermissionType) iamv0.TeamPermission {
+func MapTeamPermission(p team.PermissionType) iamv0alpha1.TeamBindingTeamPermission {
 	if p == team.PermissionTypeAdmin {
-		return iamv0.TeamPermissionAdmin
+		return iamv0alpha1.TeamBindingTeamPermissionAdmin
 	} else {
-		return iamv0.TeamPermissionMember
+		return iamv0alpha1.TeamBindingTeamPermissionMember
+	}
+}
+
+func MapUserTeamPermission(p team.PermissionType) legacyiamv0.TeamPermission {
+	if p == team.PermissionTypeAdmin {
+		return legacyiamv0.TeamPermissionAdmin
+	} else {
+		return legacyiamv0.TeamPermissionMember
 	}
 }
 

pkg/registry/apis/iam/legacy/display_query.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM {{ .Ident .UserTable }} as u JOIN {{ .Ident .OrgUserTable }} as o ON u.id = o.user_id
  WHERE o.org_id = {{ .Arg .Query.OrgID }} AND ( 1=2
 {{ if .Query.UIDs }}

pkg/registry/apis/iam/legacy/testdata/mysql--display_query-display_ids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR u.id IN (1, 2)

pkg/registry/apis/iam/legacy/testdata/mysql--display_query-display_ids_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/mysql--display_query-display_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/mysql--users_query-users_page_1.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/mysql--users_query-users_page_2.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/mysql--users_query-users_uid.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/postgres--display_query-display_ids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR u.id IN (1, 2)

pkg/registry/apis/iam/legacy/testdata/postgres--display_query-display_ids_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/postgres--display_query-display_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/postgres--users_query-users_page_1.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/postgres--users_query-users_page_2.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/postgres--users_query-users_uid.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account

pkg/registry/apis/iam/legacy/testdata/sqlite--display_query-display_ids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR u.id IN (1, 2)

pkg/registry/apis/iam/legacy/testdata/sqlite--display_query-display_ids_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/sqlite--display_query-display_uids.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name, 
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 2 AND ( 1=2
    OR uid IN ('a', 'b')

pkg/registry/apis/iam/legacy/testdata/sqlite--users_query-users_page_1.sql

@@ -1,5 +1,6 @@
 SELECT o.org_id, u.id, u.uid, u.login, u.email, u.name,
-  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin
+  u.created, u.updated, u.is_service_account, u.is_disabled, u.is_admin,
+  u.email_verified, u.is_provisioned, u.last_seen_at
   FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
  WHERE o.org_id = 0
    AND NOT u.is_service_account