grafana

Commit Graph

Author	SHA1	Message	Date
Leonor Oliveira	55afbdc6be	[Folder] Add general UID validation (#95549 ) * Add general UID validation * [REVIEW] group all folder validation rules into struct * Fix test	7 months ago
Todd Treece	5533b30135	K8s: Add validation support to builder (#95502 )	7 months ago
Leonor Oliveira	5cf86c981f	Test Folder's GetAuthorizer (#95266 ) * WIP: setup to test folders GetAuthorizer * Setup test * Extract authorizer fn for tests * Setup internal test fn * Better define test inputs * Add FolderAPI builder to the test * First test passing * Test getAuthorize for the create method * Change authorizerFunc's signature * [REVIEW] code readability * Name error * [REVIEW] add one more test case. Lint * Remove empty line	7 months ago
Yuri Tseretyan	2deced7d40	Alerting: Notifications Routes API (#91550 ) * Introduce new models RoutingTree, RouteDefaults and Route and api-server to serve them that is backed by provisioning notification policy service. * update method UpdatePolicyTree of notification policy service to return route and new version * declare new actions alert.notifications.routes:read and alert.notifications.routes:write and two corresponding fixed roles. --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	7 months ago
Sarah Zinger	59f5c1edfb	Query Service: Add trace ids to logs in expressions (#95203 )	7 months ago
Adam Simpson	61b9ffd324	ds-querier: return QDR instead of k8s error (#95184 ) * ds-querier: return QDR instead of k8s error After parseQuery we know the request is a valid k8s request but we don't know if the query is valid, therefore this change returns a QDR that other systems, e.g. alerting ruler, can de-serialize properly. Co-authored-by: Gábor Farkas <gabor.farkas@gmail.com> * ds-querier: fix tests Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com> * tweak status * refactor refID to empty --------- Co-authored-by: Gábor Farkas <gabor.farkas@gmail.com> Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com>	7 months ago
Leonor Oliveira	a03652494c	Dual Writer simplification (#93852 ) * All objects should have an UID * Now with a different error message * Simplify create on DW 2: use the same object to write to both storages * Run only one test * Add check for status code * Add name if it's not present in mode2 * Populate UID in legacy * Remove logs and commented code * Change dualwriter1 * Remove commented code * Fix list test * remove get on update from dualwriter 2 * Get object before updating. Better var renaming * Finish rebasing * Comment test * Uncomment tests * Update legacy first. Add preconditions * Remove preconditions * Fix update test * copy RV from unified to legacy objects * revert changes to playlist xorm store * Improve logging. Add go routines for mode3 * Add tests for async funcs in mode3 * Lint * Lint * Lint. Start to fix tests * Fix watcher tests * Fix store tests * Fiinish fixing watcher tests * Fix server tests * add name check * Update pkg/apiserver/rest/dualwriter_mode1.go Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com> * All objects should have an UID * Now with a different error message * Simplify create on DW 2: use the same object to write to both storages * Run only one test * Add check for status code * Add name if it's not present in mode2 * Populate UID in legacy * Remove logs and commented code * Change dualwriter1 * Remove commented code * Fix list test * remove get on update from dualwriter 2 * Get object before updating. Better var renaming * Finish rebasing * Comment test * Uncomment tests * Fix update test * revert changes to playlist xorm store * Improve logging. Add go routines for mode3 * Lint * Fix watcher tests * Fiinish fixing watcher tests * Add mode 5 with etcd test case. Add early check to fail on populated RV in payload * we can't set RV to the found object when updating * Lint * Don't fail on update playlists * Name should not be different when updating and it should be not empty on creating * Fix tests * Update pkg/apiserver/rest/dualwriter_mode2.go Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> * Lint * Fix mode 5 tests * Lint * Add generateName condition on every mode. Fix tests * Lint * Add condition on where name or generate name have to be set * Fix test * Lint * Fix folders test * We dont need to send name for mode1 * Fail if UID is not present * Remove change from not running test * Remove unused line * Lint * Update pkg/storage/unified/apistore/store.go Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> * Improve error message * Fix broken watcher test * Fail on name mismatch on update * Remove log * Make sure UIDs match on create in both stores * Lint * Write first to unified storage * Remove uid setting * Remove RV only in mode2 * Fix test. Remove log line * test * No need to asser on RV in mode3 * Remove RV check due to race condition * Update dualwriter.go Co-authored-by: Georges Chaudy <chaudyg@gmail.com> * Update pkg/storage/unified/client.go * remove unused parameter * log an error for object is missing UID instead of returning an error * remove obj.SetResourceVersion("") * log an error for object is missing UID instead of returning an error * FInalise merge * Move RV check to where it was * Remove name check * Remove server check for backwards compatibility * Remove unused fn * Move test checks for another PR * Dont commit go work sum changes * Only log error if RV is present for now. --------- Co-authored-by: Todd Treece <todd.treece@grafana.com> Co-authored-by: Bruno Abrantes <bruno.abrantes@grafana.com> Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com> Co-authored-by: Georges Chaudy <chaudyg@gmail.com>	7 months ago
Arati R.	f3a93a0303	K8s/Folders: Enhance k8s folder update (#95033 ) * Put folder update behind feature toggle * Set more fields when doing k8s update * Check update in folder tests * Uncomment remaining k8s handler methods	7 months ago
Arati R.	8abfcdbb78	Ks8/Folders: Fix status codes returned on create (#95055 ) * Fix status codes returned by k8s folder handler * Add test for status code when creating duplicate folder	7 months ago
Yuri Tseretyan	00bb3215cb	Alerting: Fix time-interval conversion to return bad request if payload is incorrect (#94995 )	7 months ago
Karl Persson	a82d01214d	Auth: Update authlib (#94947 ) * Update authlib	7 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	7 months ago
Ryan McKinley	8b9bb2acf6	K8s/Folders: Warn against using full path in metadata (#94829 )	7 months ago
Ryan McKinley	3457f219be	Storage: Add blob storage interfaces (#90932 ) Co-authored-by: Jean-Philippe Quémémer <jeanphilippe.quemener@grafana.com>	7 months ago
Arati R.	65fc7cf004	K8s/Folders: Fix mode 2 folder creation (#94796 ) * Use user UID as identifier instead of ID * Remove malformed error	7 months ago
Stephanie Hingtgen	644a16048f	K8s: add feature toggle for dashboard backend (#94753 )	7 months ago
Ryan McKinley	36c38b5310	APIServer: add prometheus.Registerer to every init request (#94684 )	8 months ago
Arati R.	992186c88f	K8s/Folders: Require create permissions when creating folder (#94514 ) * Require create permissions when creating folder * Test folder create permissions * Add test for nested folder permissions on creation * Replace hardcoded verbs	8 months ago
Karl Persson	86fc8da703	RBAC: Add legacy authorization checks to teams (#94524 ) * Setup team authorization for teams * Add list filter for teams	8 months ago
Arati R.	011978e81b	K8s/Folders: Remove folder service from client (#94450 ) * Support getting full path of UIDs * Use full path to set parents field * Update get folder test * Add folder store test for getting with full path UIDs * Add test for parsing parent titles * Test nested folder create payload	8 months ago
Gábor Farkas	0a7b731242	datasources: querier: request parsing failures are not http 500 (#94488 ) * datasources: querier: request parsing failures are not http500 * fix test --------- Co-authored-by: Adam Simpson <adam@adamsimpson.net>	8 months ago
owensmallwood	612b864772	Indexing PoC: Add search/browse (#94126 ) * adds Filter gRPC and make protobuf * adds route for querying the filter gRPC * wires up Filter gRPC call * [WIP] index from start * renames gRPC endpoint to "Search" * adds /apis/search route into k8s routes. Hacky for now. * updates readme - wrong casing * adds feature toggle for unified storage search * hides US search behind feature flag. Clean up print statements. * removes indexer - will be added in another PR * Search: Add API Builder * adds required method * implementing UpdateAPIGroupInfo (WIP) * adds groupversion * commenting out for now * remove unneeded code from experimenting and update register.go to match interface required * list resources and load into index * pass context * namespaces search route * lint * watch * add todo * add todo * merge * cleanup * add todo * gen protobuf * lint; fix migration issue * Updates index mapping function to map unified storage object Value * Changes Index() to pointer receiver - fixes panic * add delete * cleanup * gets search/browse functioning. Results show up as base64 encoded. Still a WIP. * Doesnt json re-encode gRPC response in search handler * add kind to SearchRequest proto * Updates query interface to be more generic. Make proto. Parses query params in api server. * make protobuf * removes unused method and imports * Returns all indexed fields in search results. Adds pagination support (limit + offset). * remove comment * remove unused struct * gets tenant in search k8s api handler * adds hardcoded spec field mappings - starting with playlists * adds all spec fields to search results * moved helper function for field mappings into index * only includes allowed spec fields in search results * cleans up error handling * removes debug log --------- Co-authored-by: leonorfmartins <leonorfmartins@gmail.com> Co-authored-by: Todd Treece <todd.treece@grafana.com> Co-authored-by: Scott Lepper <scott.lepper@gmail.com>	8 months ago
Arati R.	ea5cf7c51f	Unified Storage /Folders: Allow Unified Storage subfolders creation (#94327 ) * Add parents field to folder DTO * Allow subfolder creation when folder flag is enabled * Update UnstructuredToLegacyFolder * Include parents field when creating folder	8 months ago
Arati R.	5a9bd1d1cf	K8s/Folders: Fix folder create payload (#94273 ) * Fix createdBy and updatedBy * Fix refreshing permission cache * Update created time * Fix user identifier parsing	8 months ago
maicon	261be0facd	UniStore: Evaluate Folder DTO attributes (#93968 ) * UniStore: Evaluate Folder DTO attributes * Handle AccessControl * Reduce the number of parameters to newToFolderDto * Detach Metadata helpers from HTTPServer * Add tests --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	8 months ago
Arati R.	a42caa7a61	K8s/Folders: Fix tests for creating folders (#94192 ) * Add feature toggle grafanaAPIServerTestingWithExperimentalAPIs * Customise registration of FolderAPIBuilder for tests and fix tests	8 months ago
Karl Persson	d75a9b6aeb	User: Pass name to list users to filter out the correct one (#94153 ) Pass name to list users to filter out the correct one	8 months ago
owensmallwood	6a3eb276ef	Grafana Indexing PoC: Adds feature flag and gRPC endpoint (#93356 ) * adds Filter gRPC and make protobuf * adds route for querying the filter gRPC * wires up Filter gRPC call * [WIP] index from start * renames gRPC endpoint to "Search" * adds /apis/search route into k8s routes. Hacky for now. * updates readme - wrong casing * adds feature toggle for unified storage search * hides US search behind feature flag. Clean up print statements. * removes indexer - will be added in another PR * Search: Add API Builder * adds required method * implementing UpdateAPIGroupInfo (WIP) * adds groupversion * commenting out for now * remove unneeded code from experimenting and update register.go to match interface required * namespaces search route --------- Co-authored-by: leonorfmartins <leonorfmartins@gmail.com> Co-authored-by: Todd Treece <todd.treece@grafana.com>	8 months ago
Adela Almasan	f9f85131a9	FieldConfig: Add support for Actions (#92874 ) Co-authored-by: Leon Sorokin <leeoniya@gmail.com>	8 months ago
Tom Ratcliffe	fc51ec70ba	Alerting: Add manage permissions UI logic for Contact Points (#92885 ) * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>	8 months ago
Karl Persson	0160f4f72c	RBAC: Add legacy authorization checks to service accounts (#93753 ) * Extract a helper funtion to perform list with authorization checks * Add k8s verb to utils package * Construct default mapping when no custom mapping is passed * Configure authorization checks for service accounts * Fix helper and add filtering to service accounts	8 months ago
Ryan McKinley	afe464bc20	K8s/Storage: add a reusable generic storage builder (#93778 )	8 months ago
Yuri Tseretyan	10582e48f7	Alerting: Notifications Templates API (#91349 )	8 months ago
Andres Martinez Gotor	225600a08b	Expose queryconvert endpoint (#93656 )	8 months ago
Todd Treece	177965704d	Storage: Test mode 5 (#93714 )	8 months ago
Arati R.	2c26053be8	K8s/Folders: Convert additional fields when creating k8s resources (#93395 ) * Add separate folder registration function * Convert to k8s resource directly after legacy create * Use create command when creating folders * Set additional fields when converting to k8s resource * Add created/updated timestamps during conversion * Refactor UnstructuredToLegacyFolderDTO * Return errors when doing k8s conversions	8 months ago
Karl Persson	c28b37a67b	RBAC: Add option to skip rbac check for specified verbs (#93654 ) * Add option to skip rbac check for specified verbs	8 months ago
Todd Treece	3221f493f9	K8s: Prevent registration of frontend datasources (#93635 )	8 months ago
Claudiu Dragalina-Paraipan	a8b07b0c81	[authn] use authlib client+interceptors for in-proc mode (#93124 ) * Add authlib gRPC authenticators for in-proc mode * implement `StaticRequester` signing in the unified resource client - [x] when the `claims.AuthInfo` value type is `identity.StaticRequester`, and there's no ID token set, create an internal token and sign it with symmetrical key. This is a workaround for `go-jose` not offering the possibility to create an unsigned token. - [x] update `IDClaimsWrapper` to support the scenario above - [x] Switch to using `claims.From()` in `dashboardSqlAccess.SaveDashboard()` --------- Co-authored-by: gamab <gabriel.mabille@grafana.com>	8 months ago
Charandas	db97da3465	K8s: handle multiple versions of the same group in standalone mode (#93199 )	8 months ago
Karl Persson	2e38329026	RBAC: Add required component to perform access control checks for user api when running single tenant (#93104 ) * Unexport store and create new constructor function * Add ResourceAuthorizer and LegacyAccessClient * Configure checks for user store * List with checks if AccessClient is configured * Allow system user service account to read all users --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	8 months ago
Matthew Jacobson	1ede1e32b8	Alerting: Receiver resource permissions service (#93552 )	8 months ago
Jean-Philippe Quéméner	caa967b270	fix(querier): handle single alerting queries without expression (#93497 )	8 months ago
Ryan McKinley	1e3816a6f8	K8s/Dashboard: Read DTO from the registered storage, not just legacy (#93406 )	8 months ago
Ryan McKinley	f21a5987a2	Plugins: Expose datasources as apiservers feature toggle (#93250 )	8 months ago
Yuri Tseretyan	0f788d8d83	Alerting: Support for renaming receivers (#93349 ) * update RenameReceiverInNotificationSettings in DbStore to check for provisioning * implement renaming in receiver service and provisioning * do not patch route when stitching * fix bug in stitching because it returned new name but the old one was expected * update receiver service to always return result converted from storage model this makes sure that UID and version are consistent with GET\LIST operations * use provided metadata.name for UID of domain model because rename changes UID and request fails * remove rename guard * update UI to not disable receiver name when k8s api enabled * create should calculate uid from name because new receiver does not have UID yet.	8 months ago
Todd Treece	d1ffcc22d9	Playlists: Migrate to App SDK codegen (#93246 )	9 months ago
Matthew Jacobson	3bf77d2e05	Alerting: Include in-use metadata in k8s receiver LIST & GET (#93016 ) * Include in-use metadata in k8s receiver List & Get	9 months ago
Carl Bergquist	56616e69a1	scopes: sort scope dashboard bindings on dashboard title (#93305 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	9 months ago
Andres Martinez Gotor	01a4e6b9af	Remove the need for plugins to implement AdmissionHandler for v0alpha1 (#93272 )	9 months ago

... 3 4 5 6 7 ...

486 Commits (7ea0fab6065f2b6cdf604cd83ee03da0c9237cdf)