public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Backport 8a3c6ab21c to release 12.1.2 (#110041)

Browse Source 
* backport

* Backport
This commit is contained in:
Anna Urbiztondo
2025-08-22 15:24:08 +02:00
committed by GitHub
parent 4f90459ce8
commit 0a2cda1a4e
7 changed files with 414 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/administration/plugin-management/_index.md
+34 -226
View File
@@ -16,53 +16,29 @@ weight: 600
# Plugin management
You can enhance your Grafana experience with _plugins_, extensions to Grafana beyond the wide range of visualizations and data sources that are built-in.
Plugins enhance your Grafana experience with new ways to connect to and visualize data.
This guide shows you how to [install](#install-a-plugin) plugins that are built by Grafana Labs, commercial partners, our community, or plugins that you have [built yourself](/developers/plugin-tools).
Read on for an overview on how to get started with plugins:
- Plugins are available in the [plugin catalog](#plugin-catalog). They can be built by Grafana Labs, commercial partners, our community, or you can [build a plugin yourself](/developers/plugin-tools).
- There are three [types of plugins](#types-of-plugins): panel, data source, and app plugins.
- Learn [how to install](#install-a-plugin), [update](#update-a-plugin) and [verify](#verify-your-plugins) your plugins.
[Advanced options](#advanced-options) allow you to:
- Customize where app plugin pages appear in the navigation menu.
- Configure backend communication between installed plugins.
- Improve security by isolating plugins with the Plugin Frontend Sandbox.
## Types of plugins
Grafana supports three types of plugins:
- [Panels](/grafana/plugins/panel-plugins) - These plugins make it easy to create and add any kind of panel, to show your data, or improve your favorite dashboards.
- [Panels](/grafana/plugins/panel-plugins) - These plugins make it easy to create and add any kind of visualization, to show your data, or improve your favorite dashboards.
- [Data sources](/grafana/plugins/data-source-plugins) - These plugins allow you to pull data from various data sources such as databases, APIs, log files, and so on, and display it in the form of graphs, charts, and dashboards in Grafana.
- [Apps](/grafana/plugins/app-plugins) - These plugins enable the bundling of data sources, panels, dashboards, and Grafana pages into a cohesive experience.
## Panel plugins
Add new visualizations to your dashboard with panel plugins, such as the [Clock](/grafana/plugins/grafana-clock-panel), [Mosaic](/grafana/plugins/boazreicher-mosaicplot-panel) and [Variable](/grafana/plugins/volkovlabs-variable-panel) panels.
Use panel plugins when you want to:
- Visualize data returned by data source queries.
- Navigate between dashboards.
- Control external systems, such as smart home devices.
## Data source plugins
Data source plugins add support for new databases, such as [Google BigQuery](/grafana/plugins/grafana-bigquery-datasource).
Data source plugins communicate with external sources of data and return the data in a format that Grafana understands. By adding a data source plugin, you can immediately use the data in any of your existing dashboards.
Use data source plugins when you want to query data from external or third-party systems.
## App plugins
Applications, or _app plugins_, bundle data sources and panels to provide a cohesive experience, such as the [Zabbix](/grafana/plugins/alexanderzobnin-zabbix-app) app.
Apps can also add custom pages for things like control panels.
Use app plugins when you want an out-of-the-box monitoring experience.
### Managing access for app plugins
Customize access to app plugins with [RBAC](../roles-and-permissions/access-control/rbac-for-app-plugins/).
By default, the Viewer, Editor and Admin roles have access to all app plugins that their Organization role allows them to access. Access is granted by the `fixed:plugins.app:reader` role.
{{< admonition type="note" >}}
To prevent users from seeing an app plugin, refer to [these permissions scenarios](../roles-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin).
{{< /admonition >}}
Read more in [Types of plugins](plugin-types).
## Plugin catalog
@@ -74,96 +50,31 @@ The following access rules apply depending on the user role:
- If you are a **Server Admin**, you can't configure app plugins, but you can install, uninstall, or update them.
- If you are both **Org Admin** and **Server Admin**, you can configure app plugins and also install, uninstall, or update them.
{{< admonition type="note" >}}
The Grafana plugin catalog is designed to work with a single Grafana server instance only. Support for Grafana clusters is planned for future Grafana releases.
{{< /admonition >}}
<div class="medium-6 columns">
<video width="700" height="600" controls>
<source src="/static/assets/videos/plugins-catalog-install-9.2.mp4" type="video/mp4">
Your browser does not support the video tag.
</video>
</div>
_Video shows the Plugin catalog in a previous version of Grafana._
{{< admonition type="note" >}}
If required, the Grafana plugin catalog can be disabled using the `plugin_admin_enabled` flag in the [configuration](../../setup-grafana/configure-grafana/#plugin_admin_enabled) file.
{{< /admonition >}}
<a id="#plugin-catalog-entry"></a>
### Browse plugins
To browse for available plugins:
1. While logged into Grafana as an administrator, click **Administration > Plugins and data > Plugins** in the side menu to view installed and available plugins.
1. Use the search to filter based on name, keywords, organization and other metadata.
1. Use the search box to filter based on name, keywords, organization and other metadata.
1. Click the **Data sources**, **Panels**, or **Applications** buttons to filter by plugin type.
## Manage your plugins
We strongly recommend running the latest plugin version. Use [Grafana Advisor](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/grafana-advisor) to check the status of your data sources and plugins.
### Install a plugin
The most common way to install a plugin is through the Grafana UI, but alternative methods are also available.
The most common way to install a plugin is through the Grafana UI.
1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
1. Browse and find a plugin.
1. Click the plugin's logo.
1. Click **Install**.
There are also additional ways to install plugins depending on your setup.
#### Install a plugin using Grafana CLI
Grafana CLI allows you to install, upgrade, and manage your Grafana plugins using a command line. For more information about Grafana CLI plugin commands, refer to [Plugin commands](../../cli/#plugins-commands).
#### Install a plugin from a ZIP file
This method is typically used for plugins not available in the Plugin Catalog or in environments without internet access.
Download the archive containing the plugin assets, and install it by extracting the archive into the plugin directory. For example:
```bash
unzip my-plugin-0.2.0.zip -d YOUR_PLUGIN_DIR/my-plugin
```
The path to the plugin directory is defined in the configuration file. For more information, refer to [Configuration](../../setup-grafana/configure-grafana/#plugins).
#### Install a plugin using Grafana configuration
{{< admonition type="note" >}}
This feature requires Grafana 11.5.0 or later.
To see additional ways to install plugins refer to [Install a plugin](plugin-install).
{{< /admonition >}}
You can install plugins by adding the plugin ID to the `plugins.preinstall` section in the Grafana configuration file. This prevents the plugin from being accidentally uninstalled and can be auto-updated. For more information, refer to [Configuration](../../setup-grafana/configure-grafana/#plugins).
#### Install a plugin in air-gapped environment
Plugin installation usually requires an internet connection. You can check which endpoints are used during the installation on your instance and add them to your instance’s allowlist.
If this is not possible you can go via installing a plugin using [Grafana CLI](#install-a-plugin-using-grafana-cli) or as a [ZIP file](#install-a-plugin-from-a-zip-file).
You can fetch any plugin from Grafana.com API following the download link referenced in the API.
Here is an example based on `grafana-lokiexplore-app` plugins.
1. Open `https://grafana.com/api/plugins/grafana-lokiexplore-app` and look for `links` section
1. Find a `download` url which looks something like `https://grafana.com/api/plugins/grafana-lokiexplore-app/versions/1.0.2/download`
1. Use this URL to download the plugin ZIP file, which you can then install as described above.
#### Install plugins using the Grafana Helm chart
With the Grafana Helm chart, add the plugins you want to install as a list using the `plugins` field in the your values file. For more information about the configuration, refer to [the Helm chart configuration reference](https://github.com/grafana/helm-charts/tree/main/charts/grafana#configuration).
The following YAML snippet installs v1.9.0 of the Grafana OnCall App plugin and the Redis data source plugin.
You must incorporate this snippet within your Helm values file.
```yaml
plugins:
- https://grafana.com/api/plugins/grafana-oncall-app/versions/v1.9.0/download;grafana-oncall-app
- redis-datasource
```
When the update is complete, a confirmation message will indicate the installation was successful.
### Update a plugin
To update a plugin:
@@ -186,89 +97,24 @@ To uninstall a plugin:
When the update is complete, a confirmation message will indicate the installation was successful.
## Plugin signatures
### Verify your plugins
Plugin signature verification, also known as _signing_, is a security measure to make sure plugins haven't been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned when inspecting and verifying its digital signature.
Plugin signature verification, also known as _signing_, is a security measure to make sure plugins haven't been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned. Read more in [Plugin signatures](plugin-sign).
At startup, Grafana verifies the signatures of every plugin in the plugin directory. If a plugin is unsigned, then Grafana neither loads nor starts it. To see the result of this verification for each plugin, navigate to **Configuration** -> **Plugins**.
## Advanced options
Grafana also writes an error message to the server log:
### Customize navigation placement of plugin pages
```bash
WARN[05-26|12:00:00] Some plugin scanning errors were found errors="plugin '<plugin id>' is unsigned, plugin '<plugin id>' has an invalid signature"
```
You can relocate app plugin pages to customize the navigation menu structure, as explained in [Customize navigation placement of plugin pages](customize-nav-bar).
If you are a plugin developer and want to know how to sign your plugin, refer to [Sign a plugin](/developers/plugin-tools/publish-a-plugin/sign-a-plugin).
### Allow plugin backend communication
| Signature status | Description |
| ------------------ | ------------------------------------------------------------------------------- |
| Core | Core plugin built into Grafana. |
| Invalid signature | The plugin has an invalid signature. |
| Modified signature | The plugin has changed since it was signed. This may indicate malicious intent. |
| Unsigned | The plugin is not signed. |
| Signed | The plugin signature was successfully verified. |
You can configure your Grafana instance to let the frontends of installed plugins directly communicate locally with the backends of other installed plugins. See how in [Configure backend communication between installed plugins](plugin-integrate).
### Plugin signature levels
### Isolate plugin code with the Frontend Sandbox
All plugins are signed under a _signature level_. The signature level determines how the plugin can be distributed.
You can use the [Plugin Frontend Sandbox](plugin-frontend-sandbox) to securely isolate plugin frontend code from the main Grafana application.
| **Plugin Level** | **Description** |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Private | <p>Private plugins are for use on your own Grafana. They may not be distributed to the Grafana community, and are not published in the Grafana catalog.</p> |
| Community | <p>Community plugins have dependent technologies that are open source and not for profit.</p><p>Community plugins are published in the official Grafana catalog, and are available to the Grafana community.</p> |
| Commercial | <p>Commercial plugins have dependent technologies that are closed source or commercially backed.</p><p>Commercial plugins are published on the official Grafana catalog, and are available to the Grafana community.</p> |
### Allow unsigned plugins
{{< admonition type="note" >}}
Unsigned plugins are not supported in Grafana Cloud.
{{< /admonition >}}
We strongly recommend that you don't run unsigned plugins in your Grafana instance. However, if you're aware of the risks and you still want to load an unsigned plugin, refer to [Configuration](../../setup-grafana/configure-grafana/#allow_loading_unsigned_plugins).
If you've allowed loading of an unsigned plugin, then Grafana writes a warning message to the server log:
```bash
WARN[06-01|16:45:59] Running an unsigned plugin pluginID=<plugin id>
```
{{< admonition type="note" >}}
If you're developing a plugin, then you can enable development mode to allow all unsigned plugins.
{{< /admonition >}}
## Integrate plugins
You can configure your Grafana instance to let the frontends of installed plugins directly communicate locally with the backends of other installed plugins. By default, you can only communicate with plugin backends remotely. You can use this configuration to, for example, enable a [canvas panel](https://grafana.com/docs/grafana/latest/panels-visualizations/visualizations/canvas/) to call an application resource API that is permitted by the `actions_allow_post_url` option.
To enable backend communication between plugins:
1. Set the plugins you want to communicate with. In your configuration file (`grafana.ini` or `custom.ini` depending on your operating system) remove the semicolon to enable and then set the following configuration option:
```
actions_allow_post_url=
```
This is a comma-separated list that uses glob matching.
- To allow access to all plugins that have a backend:
```
actions_allow_post_url=/api/plugins/*
```
- To access to the backend of only one plugin:
```
actions_allow_post_url=/api/plugins/<GRAFANA_SPECIAL_APP>
```
## Plugin Frontend Sandbox
{{< admonition type="caution" >}}
Plugin Frontend Sandbox is currently in [public preview](/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.
{{< /admonition >}}
The Plugin Frontend Sandbox is a security feature that isolates plugin frontend code from the main Grafana application.
When enabled, plugins run in a separate JavaScript context, which provides several security benefits:
- Prevents plugins from modifying parts of the Grafana interface outside their designated areas
@@ -276,46 +122,8 @@ When enabled, plugins run in a separate JavaScript context, which provides sever
- Protects core Grafana features from being altered by plugins
- Prevents plugins from modifying global browser objects and behaviors
Plugins running inside the Frontend Sandbox should continue to work normally without any noticeable changes in their intended functionality.
### Learn more
### Enable Frontend Sandbox
The Frontend Sandbox feature is currently behind the `pluginsFrontendSandbox` feature flag. To enable it, you'll need to:
1. Enable the feature flag in your Grafana configuration. For more information about enabling feature flags, refer to [Configure feature toggles](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/).
2. For self-hosted Grafana installations, add the plugin IDs you want to sandbox in the `security` section using the `enable_frontend_sandbox_for_plugins` configuration option.
For Grafana Cloud users, you can simply use the toggle switch in the plugin catalog page to enable or disable the sandbox for each plugin. By default, the sandbox is disabled for all plugins.
{{< admonition type="note" >}}
Enabling the Frontend Sandbox might impact the performance of certain plugins. Only disable the sandbox if you fully trust the plugin and understand the security implications.
{{< /admonition >}}
### Compatibility
The Frontend Sandbox is available in public preview in Grafana >=11.5. It is compatible with all types of plugins including app plugins, panel plugins, and data source plugins. Angular-based plugins are not supported. Plugins developed and signed by Grafana Labs are excluded and cannot be sandboxed.
### When to Use Frontend Sandbox
We strongly recommend enabling the Frontend Sandbox for plugins that allow users to write custom JavaScript code for data visualization or manipulation. These plugins, while powerful, can potentially execute arbitrary JavaScript code in your Grafana instance. The sandbox provides an additional layer of security by restricting what this code can access and modify.
Examples of plugins where the sandbox is particularly important include:
- Panel plugins that allow users to write custom JavaScript code
- Plugins from untrusted sources
### Troubleshooting
If a plugin isn't functioning correctly with the Frontend Sandbox enabled:
1. Temporarily disable the sandbox for that specific plugin
1. Test if the plugin works correctly without the sandbox
1. If the plugin only works with the sandbox disabled, ensure you trust the plugin source before continuing to use it without sandbox protection
1. Report any sandbox-related issues to the plugin developer
## Learn more
- [Browse plugins](/grafana/plugins)
- [Develop plugins](/developers/plugin-tools)
- [Plugin development Community](https://community.grafana.com/c/plugin-development/30)
- [Browse available plugins](/grafana/plugins)
- [Develop your own plugins](/developers/plugin-tools)
- [Reach out to the plugin development Community](https://community.grafana.com/c/plugin-development/30)
docs/sources/administration/plugin-management/customize-nav-bar.md
+5 -6
View File
@@ -5,7 +5,6 @@ labels:
products:
- enterprise
- oss
- cloud
keywords:
- grafana
- plugins
@@ -14,7 +13,7 @@ keywords:
- customize
- configuration
- grafana.ini
weight: 100
weight: 300
---
# Customize navigation placement of app plugin pages
@@ -73,12 +72,12 @@ org-example-app = explore 50
/a/org-example-app/logs = alerting 75
```
## Understanding page paths
## Find page paths
To move individual pages, you need to know their paths. Page paths in app plugins follow this format:
`/a/PLUGIN_ID/PAGE_PATH`
To move individual pages you need to know their paths. To identify a plugin page path:
You can identify a plugin page path by visiting the page in the browser and observing the URL in the address bar.
- Visit the page in the browser and check the URL in the address bar.
- Page paths in app plugins follow the format `/a/PLUGIN_ID/PAGE_PATH`
## Troubleshooting
docs/sources/administration/plugin-management/plugin-frontend-sandbox.md
+75
View File
@@ -0,0 +1,75 @@
---
title: Isolate plugin code with the Plugin Frontend Sandbox
description: Use the Plugin Frontend Sandbox to securely isolate plugin frontend code from the main Grafana application.
labels:
products:
- enterprise
- oss
- cloud
keywords:
- grafana
- plugins
- plugin
- navigation
- customize
- configuration
- grafana.ini
- sandbox
- frontend
weight: 400
---
# Isolate plugin code with the Plugin Frontend Sandbox
{{< admonition type="caution" >}}
Plugin Frontend Sandbox is currently in [public preview](https://grafana.com/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.
{{< /admonition >}}
The Plugin Frontend Sandbox is a security feature that isolates plugin frontend code from the main Grafana application. When enabled, plugins run in a separate JavaScript context, which provides several security benefits:
- Prevents plugins from modifying parts of the Grafana interface outside their designated areas
- Stops plugins from interfering with other plugins functionality
- Protects core Grafana features from being altered by plugins
- Prevents plugins from modifying global browser objects and behaviors
Plugins running inside the Frontend Sandbox should continue to work normally without any noticeable changes in their intended functionality.
## When to use the Plugin Frontend Sandbox
We strongly recommend enabling the Frontend Sandbox for plugins that allow users to write custom JavaScript code for data visualization or manipulation, since they can potentially execute arbitrary JavaScript code in your Grafana instance. The sandbox provides an additional layer of security by restricting what this code can access and modify.
These are examples of plugins where the sandbox is particularly useful:
- Panel plugins that allow users to write custom JavaScript code
- Plugins from untrusted sources
## Compatibility and requirements
The following applies:
- The Frontend Sandbox is available in public preview in Grafana >=11.5. It's compatible with all types of plugins including app plugins, panel plugins, and data source plugins.
- Angular-based plugins are not supported.
- Plugins developed and signed by Grafana Labs are excluded and cannot be sandboxed.
## Enable the Frontend Sandbox
The Frontend Sandbox feature is currently behind the `pluginsFrontendSandbox` feature flag. To enable it, you need to:
1. Enable the feature flag in your Grafana configuration. For more information about enabling feature flags, refer to [Configure feature toggles](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/).
2. For self-hosted Grafana installations, add the plugin IDs you want to sandbox in the `security` section using the `enable_frontend_sandbox_for_plugins` configuration option.
For Grafana Cloud users, you can simply use the toggle switch in the plugin catalog page to enable or disable the sandbox for each plugin. By default, the sandbox is disabled for all plugins.
{{< admonition type="note" >}}
Enabling the Frontend Sandbox might impact the performance of certain plugins. Only disable the sandbox if you fully trust the plugin and understand the security implications.
{{< /admonition >}}
## Troubleshooting
If a plugin isn't functioning correctly with the Frontend Sandbox enabled:
1. Temporarily disable the sandbox for that specific plugin
1. Test if the plugin works correctly without the sandbox
1. If the plugin only works with the sandbox disabled, ensure you trust the plugin source before continuing to use it without sandbox protection
1. Report any sandbox-related issues to the plugin developer
docs/sources/administration/plugin-management/plugin-install.md
+101
View File
@@ -0,0 +1,101 @@
---
title: Install a plugin
description: Learn about alternative ways to install a plugin.
labels:
products:
- enterprise
- oss
- cloud
keywords:
- grafana
- plugins
- plugin
- navigation
- customize
- configuration
- grafana.ini
- sandbox
- frontend
weight: 120
---
# Install a plugin
Besides the UI, you can use alternative methods to install a plugin depending on your environment or set-up.
## Install a plugin using Grafana CLI
The Grafana CLI allows you to install, upgrade, and manage your Grafana plugins using a command line tool. For more information about Grafana CLI plugin commands, refer to [Plugin commands](/docs/grafana/<GRAFANA_VERSION>/cli/#plugins-commands).
## Install a plugin from a ZIP file
This method is typically used for plugins not available in the Plugin Catalog or in environments without internet access.
Download the archive containing the plugin assets, and install it by extracting the archive into the plugin directory. For example:
```bash
unzip my-plugin-0.2.0.zip -d YOUR_PLUGIN_DIR/my-plugin
```
The path to the plugin directory is defined in the configuration file. For more information, refer to [Configuration](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#plugins).
## Install a plugin using Grafana configuration
{{< admonition type="note" >}}
This feature requires Grafana 11.5.0 or later.
{{< /admonition >}}
You can install plugins by adding the plugin ID to the `plugins.preinstall` section in the Grafana configuration file. This prevents the plugin from being accidentally uninstalled and can be auto-updated. For more information, refer to [Configuration](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#preinstall).
## Install a plugin in air-gapped environment
Plugin installation usually requires an Internet connection. You can check which endpoints are used during the installation on your instance and add them to your instance’s allow list.
If this is not possible try installing a plugin using the [Grafana CLI](#install-a-plugin-using-grafana-cli) or as a [ZIP file](#install-a-plugin-from-a-zip-file).
You can fetch any plugin from Grafana.com API following the download link referenced in the API.
Here's an example based on `grafana-lokiexplore-app` plugins.
1. Open `https://grafana.com/api/plugins/grafana-lokiexplore-app` and look for `links` section
1. Find a `download` url which looks something like `https://grafana.com/api/plugins/grafana-lokiexplore-app/versions/1.0.2/download`
1. Use this URL to download the plugin ZIP file, which you can then install as described above.
## Install plugins using the Grafana Helm chart
With the Grafana Helm chart, you can install plugins using one of the methods described in this section. All the YAML snippets install v1.9.0 of the Grafana OnCall App plugin and the Redis data source plugin. When installation is complete you'll get a confirmation message indicating that the plugins were successfully installed.
### Method 1: Use the `plugins` field
Add the plugins you want to install as a list in your values file. For more information about the configuration, refer to [the Helm chart configuration reference](https://github.com/grafana/helm-charts/tree/main/charts/grafana#configuration).
```yaml
plugins:
- https://grafana.com/api/plugins/grafana-oncall-app/versions/v1.9.0/download;grafana-oncall-app
- redis-datasource
```
### Method 2: Use `GF_PLUGINS_PREINSTALL_SYNC`
Add the following to your `values.yaml` file:
```yaml
env:
# Format: <plugin ID>@[<plugin version>]@<url to plugin zip>
GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app@1.9.0@https://grafana.com/api/plugins/grafana-oncall-app/versions/v1.9.0/download
# Or without version and URL (latest version will be used)
# GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app
# Multiple plugins (comma-separated)
# GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app,redis-datasource
```
### Method 3: Use `GF_PLUGINS_INSTALL` (Deprecated since v12.1.0)
Add the following to your `values.yaml` file:
```yaml
env:
# Comma-separated list of plugin IDs
GF_PLUGINS_INSTALL: grafana-oncall-app,redis-datasource
```
docs/sources/administration/plugin-management/plugin-integrate.md
+47
View File
@@ -0,0 +1,47 @@
---
title: Plugin backend communication
description: Allow plugin frontends to communicate locally with the backends of other installed plugins.
labels:
products:
- enterprise
- oss
keywords:
- grafana
- plugins
- plugin
- navigation
- customize
- configuration
- grafana.ini
- sandbox
- frontend
weight: 350
---
# Allow plugin backend communication
By default, you can only communicate with plugin backends remotely.
However, you can configure your Grafana instance to let the frontends of installed plugins to directly communicate with the backends of other plugins installed locally. You can use this configuration to, for example, enable a [canvas panel](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/canvas/) to call an application resource API that is permitted by the `actions_allow_post_url` option.
## Integrate your plugins
To enable backend communication between plugins, set the plugins you want to communicate with. In your configuration file (`grafana.ini` or `custom.ini` depending on your operating system), remove the semicolon to enable and then set the following configuration option:
```
actions_allow_post_url=
```
This is a comma-separated list that uses glob matching.
- To allow access to all plugins that have a backend, use:
```
actions_allow_post_url=/api/plugins/*
```
- To access the backend of only one plugin, use:
```
actions_allow_post_url=/api/plugins/<GRAFANA_SPECIAL_APP>
```
docs/sources/administration/plugin-management/plugin-sign.md
+80
View File
@@ -0,0 +1,80 @@
---
title: Plugin signatures
description: Sign your plugins to make sure they haven't been tampered with.
labels:
products:
- enterprise
- oss
- cloud
keywords:
- grafana
- plugins
- plugin
- navigation
- customize
- configuration
- grafana.ini
- sandbox
- frontend
weight: 200
---
# Plugin signatures
Plugin signature verification, also known as _signing_, is a security measure to make sure plugins haven't been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned when inspecting and verifying its digital signature.
Learn more at [plugin policies](https://grafana.com/legal/plugins/).
## How does verifiction work?
At startup, Grafana verifies the signatures of every plugin in the plugin directory.
To see the result of this verification for each plugin, navigate to **Configuration** -> **Plugins**. A signature can have any of the following signature status:
| Signature status | Description |
| ------------------ | ------------------------------------------------------------------------------- |
| Core | Core plugin built into Grafana. |
| Invalid signature | The plugin has an invalid signature. |
| Modified signature | The plugin has changed since it was signed. This may indicate malicious intent. |
| Unsigned | The plugin is not signed. |
| Signed | The plugin signature was successfully verified. |
### What happens if a plugin is not signed?
If a plugin is unsigned, then Grafana neither loads nor starts it. Grafana also writes an error message to the server log:
```bash
WARN[05-26|12:00:00] Some plugin scanning errors were found errors="plugin '<plugin id>' is unsigned, plugin '<plugin id>' has an invalid signature"
```
## Plugin signature levels
All plugins are signed under a _signature level_. The signature level determines how the plugin can be distributed.
| **Plugin Level** | **Description** |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Private | <p>Private plugins are for use on your own Grafana. They may not be distributed to the Grafana community, and are not published in the Grafana catalog.</p> |
| Community | <p>Community plugins have dependent technologies that are open source and not for profit.</p><p>Community plugins are published in the official Grafana catalog, and are available to the Grafana community.</p> |
| Commercial | <p>Commercial plugins have dependent technologies that are closed source or commercially backed.</p><p>Commercial plugins are published on the official Grafana catalog, and are available to the Grafana community.</p> |
## Allow unsigned plugins
{{< admonition type="note" >}}
Unsigned plugins are not supported in Grafana Cloud.
{{< /admonition >}}
We strongly recommend that you don't run unsigned plugins in your Grafana instance. However, if you're aware of the risks and you still want to load an unsigned plugin, refer to [Configuration](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#allow_loading_unsigned_plugins).
If you've allowed loading of an unsigned plugin, then Grafana writes a warning message to the server log:
```bash
WARN[06-01|16:45:59] Running an unsigned plugin pluginID=<plugin id>
```
{{< admonition type="note" >}}
If you're developing a plugin, then you can enable development mode to allow all unsigned plugins.
{{< /admonition >}}
## Sign a plugin you've developed
If you are a plugin developer and want to know how to sign your plugin, refer to [Sign a plugin](https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin).
docs/sources/administration/plugin-management/plugin-types.md
+72
View File
@@ -0,0 +1,72 @@
---
title: Types of plugins
description: Learn about the types of plugins available in Grafana.
labels:
products:
- enterprise
- oss
- cloud
keywords:
- grafana
- plugins
- plugin
- navigation
- customize
- configuration
- grafana.ini
- sandbox
- frontend
weight: 100
---
# Types of plugins
Grafana supports three types of plugins:
- [Panels](/grafana/plugins/panel-plugins) - These plugins make it easy to create and add any kind of panel, to show your data, or improve your favorite dashboards.
- [Data sources](/grafana/plugins/data-source-plugins) - These plugins allow you to pull data from various data sources such as databases, APIs, log files, and so on, and display it in the form of graphs, charts, and dashboards in Grafana.
- [Apps](/grafana/plugins/app-plugins) - These plugins enable the bundling of data sources, panels, dashboards, and Grafana pages into a cohesive experience.
## Panel plugins
Add new visualizations to your dashboard with panel plugins, such as the [Clock](/grafana/plugins/grafana-clock-panel), [Mosaic](/grafana/plugins/boazreicher-mosaicplot-panel) and [Variable](/grafana/plugins/volkovlabs-variable-panel) panels.
Use panel plugins when you want to:
- Visualize data returned by data source queries.
- Navigate between dashboards.
- Control external systems, such as smart home devices.
## Data source plugins
Data source plugins add support for new databases, such as [Google BigQuery](/grafana/plugins/grafana-bigquery-datasource).
Data source plugins communicate with external sources of data and return the data in a format that Grafana understands. By adding a data source plugin, you can immediately use the data in any of your existing dashboards.
Use data source plugins when you want to query data from external or third-party systems.
### Managing access for data source plugins
Administrators can grant access to data source plugins with [LBAC](/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/).
Label Based Access Control (LBAC) customizes access rights based on team memberships, ensuring that users only query data relevant to their assigned permissions.
## App plugins
Applications, or app plugins, bundle data sources and panels to provide a cohesive experience, such as the [Zabbix](/grafana/plugins/alexanderzobnin-zabbix-app) app.
Apps can also add custom pages for things like control panels.
Use app plugins when you want an out-of-the-box monitoring experience.
### Managing access for app plugins
Customize access to app plugins with [RBAC](/docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/rbac-for-app-plugins/).
By default, the Viewer, Editor and Admin roles have access to all app plugins that their Organization role allows them to access.
Access is granted by the `fixed:plugins.app:reader` role.
{{< admonition type="note" >}}
To prevent users from seeing an app plugin, refer to [these permissions scenarios](/docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin).
{{< /admonition >}}