134 Commits (2e2e89a81663dfdab284e945bc508c33a6eadddb)

Author	SHA1	Message	Date
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883) ... * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	1 year ago
maicon	766d645d82	Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409) ... Refactor folder service to use Unified Storage Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com> Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>	1 year ago
Matthew Jacobson	ad1417b732	Alerting: Return default builtin templates in k8s templategroup API and UI (#96330) ... * Alerting: PoC - default template in k8s templategroup API * Move code to grafana/alerting * Move validation to admission validation abstraction * Testing * Linting * Workspace update * Update grafana/alerting hash to the merged commit * More user-friendly name and remove need for CREATE/UPDATE validation Use __default__ for k8s object name and UID so that we don't need to restrict CREATE/UPDATE for similarly named user-owned templates.	1 year ago
Yuri Tseretyan	3e68731600	Alerting: Enable flag alertingApiServer by default (#98282) ... * enable flag alertingApiServer by default * remove feature flag toggle in integration tests * disable flag for old API tests	1 year ago
Stephanie Hingtgen	5ed2a4c624	K8s: Dashboards: Add deletion validation for provisioned dashboards (#98504)	1 year ago
Ryan McKinley	b506fcb11c	K8s: Fix the gitVersion response (required for kubectl) (#98571)	1 year ago
Ryan McKinley	1a46039037	K8s/Dashboards: Pass the legacy internal ID into labels (#98311) ... --------- Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com> Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com>	1 year ago
Adam Simpson	57d94ed01f	ds-querier: return error if failed to get ds client (#97698) ... * ds-querier: return error if failed to get ds client * add log line * no empty ref * fix test	1 year ago
Todd Treece	8b0cd9dbb9	K8s: Increment generation in generic strategy (#97946) ... --------- Co-authored-by: Ryan McKinley <ryantxu@gmail.com>	1 year ago
Leonor Oliveira	62c1735a61	Implement k8s count handler (#97955) ... * Implement k8s count handler * Fix endpoint * Fix type converstions * Add tests for foldercounts * Add more tests * Only use sql-fallback if no values in unistore * Update gomod * Fix test * Update pkg/api/folder_test.go Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com> * Go.mod --------- Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com>	1 year ago
Stephanie Hingtgen	b05d60e5b5	k8s: dashboards: remove FT (#97758)	1 year ago
Yuri Tseretyan	2d386e6704	Alerting: Migrate notification models to generated by grafnaa-app-sdk (#95430) ... * create notifications module and generate models * switch template group to app models * switch time intervals to use app models * switch receiver to use app models * switch routing tree to use app models * move schema registration to resource packages * fix package names to match app * fix codeowners * fix UI to use metadata.name instead of uid * update dockerfile * move generated models to pkg * remove provenance from field selector * move client factories to test files * rename GenericClient to TypedClient	1 year ago
Kévin Gomez	c8d3ea58f8	Support importing local cue modules when generating TS types with cog (#96876) ... * Support importing local cue modules when generating TS types with cog * Generate enums as unions of values instead of an actual `enum` statement * Update transformers to use the new TS enums * Update go workspaces --------- Co-authored-by: Ivan Ortega <ivanortegaalba@gmail.com>	2 years ago
Carl Bergquist	722af820a5	Scopes: Use new flag + app_mode=prod in integration tests (#97081) ... Signed-off-by: bergquist <carl.bergquist@gmail.com>	2 years ago
Arati R.	6d04023aa6	K8s/Folders: Improve k8s client implementation of get (#96434) ... * Enable getting folders with kubernetes client * Add TestIntegrationFolderGetPermissions * Set full path as part of legacy get * Replace implementation for setting fullpath * Add folder get test * Escape forward slash in parent titles * Replace test for access control metadata * Add test case to TestIntegrationFolderGetPermissions * Improve fetching of access control	2 years ago
Ryan McKinley	94262fd095	Search: expose search on dashboard apiserver (v0alpha1) (#96907)	2 years ago
Leonor Oliveira	2a74778776	Support delete endpoint for folders (#96573) ... * Support delete endpoint for folders * Include authorizer * Add test for delete verb * Add delete command to delete options * Pass query string to context to admission * Dont support nested folder deletion for now * Skip test if feature flag is present * Add test case * Remove comment * Only rely on the storage type config to run alerting tests * Dont change legacy subpath * Remove unised function * Add test case when an editor can delete alert rules * Lint	2 years ago
maicon	bbae396db4	Unistore: Add GetFolders endpoint backed by UnifiedStorage (#96399) ... * Unistore: Add GetFolders endpoint backed by UnifiedStorage Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com> Co-authored-by: Arati R. <33031346+suntala@users.noreply.github.com>	2 years ago
Ryan McKinley	29cdfdff87	Storage: Revert using real gRPC for integration tests (#96410) ... --------- Co-authored-by: Todd Treece <todd.treece@grafana.com>	2 years ago
Todd Treece	66d5c051aa	Dashboards: Add v1alpha1 and v2alpha1 conversion (#96415) ... --------- Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>	2 years ago
Ryan McKinley	4e1f0dadbd	UnifiedStorage: Default to running unified-grpc in integration tests (#93492)	2 years ago
maicon	af1a732821	UniStore: test folders circular reference (#95496) ... Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	2 years ago
Ryan McKinley	2f40fd6741	Dashboards: Remove unique name constraints (#90687)	2 years ago
maicon	f6a5e03bfb	UniStore: Add testcase for trimming folder title (#95405) ... Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	2 years ago
Arati R.	4a13580a2f	K8s/Folders: Fix folder status error message (#95464) ... * Fix folder status error message * Add test for folder creation response message * Add TestFoldersCreateAPIEndpointK8S fixes * Fix message returned when user has no permissions	2 years ago
maicon	f5ed2f52f7	UniStore: expand nested folders testing (#95374) ... Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	2 years ago
Yuri Tseretyan	2deced7d40	Alerting: Notifications Routes API (#91550) ... * Introduce new models RoutingTree, RouteDefaults and Route and api-server to serve them that is backed by provisioning notification policy service. * update method UpdatePolicyTree of notification policy service to return route and new version * declare new actions alert.notifications.routes:read and alert.notifications.routes:write and two corresponding fixed roles. --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	2 years ago
maicon	f379329127	UniStore: add FoldersCreate Endpoint test (#95253) ... * UniStore: add FoldersCreate Endpoint test Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	2 years ago
Claudiu Dragalina-Paraipan	830600dab0	AuthN: Optionally use tokens for unified storage client authentication (#91665) ... * extracted in-proc mode to #93124 * allow insecure conns in dev mode + refactoring * removed ModeCloud, relying on ModeGrpc and stackID instead to discover if we're running in Cloud * remove the NamespaceAuthorizer would fail in legacy mode. It will be added back in the future. * use FlagAppPlatformGrpcClientAuth to enable new behavior, instead of legacy * extracted authz package changes in #95120 * extracted server side changes in #95086 --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Dan Cech <dcech@grafana.com>	2 years ago
Adam Simpson	61b9ffd324	ds-querier: return QDR instead of k8s error (#95184) ... * ds-querier: return QDR instead of k8s error After parseQuery we know the request is a valid k8s request but we don't know if the query is valid, therefore this change returns a QDR that other systems, e.g. alerting ruler, can de-serialize properly. Co-authored-by: Gábor Farkas <gabor.farkas@gmail.com> * ds-querier: fix tests Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com> * tweak status * refactor refID to empty --------- Co-authored-by: Gábor Farkas <gabor.farkas@gmail.com> Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com>	2 years ago
Leonor Oliveira	a03652494c	Dual Writer simplification (#93852) ... * All objects should have an UID * Now with a different error message * Simplify create on DW 2: use the same object to write to both storages * Run only one test * Add check for status code * Add name if it's not present in mode2 * Populate UID in legacy * Remove logs and commented code * Change dualwriter1 * Remove commented code * Fix list test * remove get on update from dualwriter 2 * Get object before updating. Better var renaming * Finish rebasing * Comment test * Uncomment tests * Update legacy first. Add preconditions * Remove preconditions * Fix update test * copy RV from unified to legacy objects * revert changes to playlist xorm store * Improve logging. Add go routines for mode3 * Add tests for async funcs in mode3 * Lint * Lint * Lint. Start to fix tests * Fix watcher tests * Fix store tests * Fiinish fixing watcher tests * Fix server tests * add name check * Update pkg/apiserver/rest/dualwriter_mode1.go Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com> * All objects should have an UID * Now with a different error message * Simplify create on DW 2: use the same object to write to both storages * Run only one test * Add check for status code * Add name if it's not present in mode2 * Populate UID in legacy * Remove logs and commented code * Change dualwriter1 * Remove commented code * Fix list test * remove get on update from dualwriter 2 * Get object before updating. Better var renaming * Finish rebasing * Comment test * Uncomment tests * Fix update test * revert changes to playlist xorm store * Improve logging. Add go routines for mode3 * Lint * Fix watcher tests * Fiinish fixing watcher tests * Add mode 5 with etcd test case. Add early check to fail on populated RV in payload * we can't set RV to the found object when updating * Lint * Don't fail on update playlists * Name should not be different when updating and it should be not empty on creating * Fix tests * Update pkg/apiserver/rest/dualwriter_mode2.go Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> * Lint * Fix mode 5 tests * Lint * Add generateName condition on every mode. Fix tests * Lint * Add condition on where name or generate name have to be set * Fix test * Lint * Fix folders test * We dont need to send name for mode1 * Fail if UID is not present * Remove change from not running test * Remove unused line * Lint * Update pkg/storage/unified/apistore/store.go Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> * Improve error message * Fix broken watcher test * Fail on name mismatch on update * Remove log * Make sure UIDs match on create in both stores * Lint * Write first to unified storage * Remove uid setting * Remove RV only in mode2 * Fix test. Remove log line * test * No need to asser on RV in mode3 * Remove RV check due to race condition * Update dualwriter.go Co-authored-by: Georges Chaudy <chaudyg@gmail.com> * Update pkg/storage/unified/client.go * remove unused parameter * log an error for object is missing UID instead of returning an error * remove obj.SetResourceVersion("") * log an error for object is missing UID instead of returning an error * FInalise merge * Move RV check to where it was * Remove name check * Remove server check for backwards compatibility * Remove unused fn * Move test checks for another PR * Dont commit go work sum changes * Only log error if RV is present for now. --------- Co-authored-by: Todd Treece <todd.treece@grafana.com> Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com> Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> Co-authored-by: Georges Chaudy <chaudyg@gmail.com>	2 years ago
Matthew Jacobson	26162a53e6	Alerting: Allow config api receiver create/delete with alertingApiServer (#95207) ... Previously all receiver modifications were denied with alertingApiServer enabled. This allows pure creates and deletes through as these specific cases can be handled simply and without risk of rbac shenanigans.	2 years ago
Matthew Jacobson	4aad44e848	Alerting: Fix per-receiver RBAC for receivers with long names (#95084) ... * Implement uidToResourceID * add middleware * Move uidToResourceID to alerting package * Only hash uid if it's too long * Use hashed uid in access control * Move ReceiverUidToResourceId to ScopeProvider * resolve uid in middleware only if param exists * Tests * Linting --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>	2 years ago
Arati R.	f3a93a0303	K8s/Folders: Enhance k8s folder update (#95033) ... * Put folder update behind feature toggle * Set more fields when doing k8s update * Check update in folder tests * Uncomment remaining k8s handler methods	2 years ago
Arati R.	8abfcdbb78	Ks8/Folders: Fix status codes returned on create (#95055) ... * Fix status codes returned by k8s folder handler * Add test for status code when creating duplicate folder	2 years ago
Yuri Tseretyan	00bb3215cb	Alerting: Fix time-interval conversion to return bad request if payload is incorrect (#94995)	2 years ago
Stephanie Hingtgen	644a16048f	K8s: add feature toggle for dashboard backend (#94753)	2 years ago
William Wernert	19a9a79467	Alerting: Publish event when one or more rules are created or changed (#93637) ... * Publish event when one or more rules are changed * Publish affected rules * Use a fake bus to test publish event without listening * Wire alerting store into provisioning service	2 years ago
Arati R.	992186c88f	K8s/Folders: Require create permissions when creating folder (#94514) ... * Require create permissions when creating folder * Test folder create permissions * Add test for nested folder permissions on creation * Replace hardcoded verbs	2 years ago
Prem Saraswat	5c03c14b25	resource-api: Loosen name validation to match K8s requirements (#93404) ... * resource-api: Loosen name validation to match K8s requirements This patch modifies some of the requirements for name validation of objects in Resource API to match Kubernetes. The limit we have on characters in name is 64, but some resources allow upto 253 characters. Similarly we also include `:` in the regex, as many objects in default K8s setup use it in the name (the group `system:masters` for example) Signed-off-by: Prem Kumar <prem.saraswat@grafana.com> * Update the name column length in migrator and update e2e test to verify --------- Signed-off-by: Prem Kumar <prem.saraswat@grafana.com>	2 years ago
Arati R.	011978e81b	K8s/Folders: Remove folder service from client (#94450) ... * Support getting full path of UIDs * Use full path to set parents field * Update get folder test * Add folder store test for getting with full path UIDs * Add test for parsing parent titles * Test nested folder create payload	2 years ago
Gábor Farkas	0a7b731242	datasources: querier: request parsing failures are not http 500 (#94488) ... * datasources: querier: request parsing failures are not http500 * fix test --------- Co-authored-by: Adam Simpson <adam@adamsimpson.net>	2 years ago
Arati R.	a42caa7a61	K8s/Folders: Fix tests for creating folders (#94192) ... * Add feature toggle grafanaAPIServerTestingWithExperimentalAPIs * Customise registration of FolderAPIBuilder for tests and fix tests	2 years ago
Tom Ratcliffe	fc51ec70ba	Alerting: Add manage permissions UI logic for Contact Points (#92885) ... * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>	2 years ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551) ... * Revert "chore: add replDB to team service (#91799)" This reverts commit c6ae2d7999. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit 54177ca619. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit 299c142f6a. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit ac0b4bb34d. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit daedb358dd. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit af19f039b6. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit 27b52b1507. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit 8a6107cd35. * Revert "accesscontrol service read replica (#89963)" This reverts commit 77a4869fca. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit ab5a079bcc. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit d988f5c3b0. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit 50244ed4a1.	2 years ago
Yuri Tseretyan	10582e48f7	Alerting: Notifications Templates API (#91349)	2 years ago
Andres Martinez Gotor	225600a08b	Expose queryconvert endpoint (#93656)	2 years ago
Todd Treece	177965704d	Storage: Test mode 5 (#93714)	2 years ago
Karl Persson	c28b37a67b	RBAC: Add option to skip rbac check for specified verbs (#93654) ... * Add option to skip rbac check for specified verbs	2 years ago
Claudiu Dragalina-Paraipan	a8b07b0c81	[authn] use authlib client+interceptors for in-proc mode (#93124) ... * Add authlib gRPC authenticators for in-proc mode * implement `StaticRequester` signing in the unified resource client - [x] when the `claims.AuthInfo` value type is `identity.StaticRequester`, and there's no ID token set, create an internal token and sign it with symmetrical key. This is a workaround for `go-jose` not offering the possibility to create an unsigned token. - [x] update `IDClaimsWrapper` to support the scenario above - [x] Switch to using `claims.From()` in `dashboardSqlAccess.SaveDashboard()` --------- Co-authored-by: gamab <gabriel.mabille@grafana.com>	2 years ago