diff --git a/docs/sources/administration/configuration.md b/docs/sources/administration/configuration.md
index ccd81b165f7..bacf313b423 100644
--- a/docs/sources/administration/configuration.md
+++ b/docs/sources/administration/configuration.md
@@ -471,9 +471,10 @@ Google Tag Manager ID, only enabled if you enter an ID here.
### application_insights_connection_string
If you want to track Grafana usage via Azure Application Insights, then specify _your_ Application Insights connection string. Since the connection string contains semicolons, you need to wrap it in backticks (`). By default, tracking usage is disabled.
-
+
### application_insights_endpoint_url
- Optionally, use this option to override the default endpoint address for Application Insights data collecting. For details, refer to the [Azure documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/custom-endpoints?tabs=js).
+
+ Optionally, use this option to override the default endpoint address for Application Insights data collecting. For details, refer to the [Azure documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/custom-endpoints?tabs=js).
diff --git a/docs/sources/alerting/unified-alerting/silences.md b/docs/sources/alerting/unified-alerting/silences.md
index d31684d1d74..c013c4d0089 100644
--- a/docs/sources/alerting/unified-alerting/silences.md
+++ b/docs/sources/alerting/unified-alerting/silences.md
@@ -50,7 +50,7 @@ Grafana alerting UI supports managing external Alertmanager silences. Once you a
## Create a URL to silence form with defaults filled in
-When linking to a silence form, provide the default matching labels and comment via `matchers` and `comment` query parameters. The `matchers` parameter requires one more matching labels of the type `[label][operator][value]` joined by a comma while the `operator` parameter can be one of the following: `=` (equals, not regex), `!=` (not equals, not regex), `=~` (equals, regex), `!~` (not equals, regex).
+When linking to a silence form, provide the default matching labels and comment via `matchers` and `comment` query parameters. The `matchers` parameter requires one more matching labels of the type `[label][operator][value]` joined by a comma while the `operator` parameter can be one of the following: `=` (equals, not regex), `!=` (not equals, not regex), `=~` (equals, regex), `!~` (not equals, regex).
For example, to link to silence form with matching labels `severity=critical` & `cluster!~europe-.*` and comment `Silence critical EU alerts`, create a URL `https://mygrafana/aleting/silence/new?matchers=severity%3Dcritical%2Ccluster!~europe-*&comment=Silence%20critical%20EU%20alert`.
diff --git a/docs/sources/enterprise/access-control/fine-grained-access-control-references.md b/docs/sources/enterprise/access-control/fine-grained-access-control-references.md
index 288487cc5eb..b828e9cef79 100644
--- a/docs/sources/enterprise/access-control/fine-grained-access-control-references.md
+++ b/docs/sources/enterprise/access-control/fine-grained-access-control-references.md
@@ -15,7 +15,7 @@ The reference information that follows complements conceptual information about
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `fixed:permissions:admin:read` | `roles:read`
`roles:list`
`roles.builtin:list` | Allows to list and get available roles and built-in role assignments. |
| `fixed:permissions:admin:edit` | All permissions from `fixed:permissions:admin:read` and
`roles:write`
`roles:delete`
`roles.builtin:add`
`roles.builtin:remove` | Allows every read action and in addition allows to create, change and delete custom roles and create or remove built-in role assignments. |
-| `fixed:provisioning:admin` | `provisioning:reload` | Allow provisioning configurations to be reloaded. |
+| `fixed:provisioning:admin` | `provisioning:reload` | Allow provisioning configurations to be reloaded. |
| `fixed:reporting:admin:read` | `reports:read`
`reports:send`
`reports.settings:read` | Allows to read reports and report settings. |
| `fixed:reporting:admin:edit` | All permissions from `fixed:reporting:admin:read` and
`reports.admin:write`
`reports:delete`
`reports.settings:write` | Allows every read action for reports and in addition allows to administer reports. |
| `fixed:users:admin:read` | `users.authtoken:list`
`users.quotas:list`
`users:read`
`users.teams:read` | Allows to list and get users and related information. |
@@ -31,8 +31,8 @@ The reference information that follows complements conceptual information about
## Default built-in role assignments
-| Built-in role | Associated role | Description |
-| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Grafana Admin | `fixed:permissions:admin:edit`
`fixed:permissions:admin:read`
`fixed:provisioning:admin`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:users:admin:edit`
`fixed:users:admin:read`
`fixed:users:org:edit`
`fixed:users:org:read`
`fixed:ldap:admin:edit`
`fixed:ldap:admin:read`
`fixed:server:admin:read`
`fixed:settings:admin:read`
`fixed:settings:admin:edit` | Allow access to the same resources and permissions that the [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) has by default. |
-| Admin | `fixed:users:org:edit`
`fixed:users:org:read`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read` | Allow access to the same resources and permissions that the [Organization Admin]({{< relref "../../permissions/organization_roles.md" >}}) has by default. |
-| Editor | `fixed:datasource:editor:read` |
+| Built-in role | Associated role | Description |
+| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Grafana Admin | `fixed:permissions:admin:edit`
`fixed:permissions:admin:read`
`fixed:provisioning:admin`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read`
`fixed:users:admin:edit`
`fixed:users:admin:read`
`fixed:users:org:edit`
`fixed:users:org:read`
`fixed:ldap:admin:edit`
`fixed:ldap:admin:read`
`fixed:server:admin:read`
`fixed:settings:admin:read`
`fixed:settings:admin:edit` | Allow access to the same resources and permissions the [Grafana server administrator]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) has by default. |
+| Admin | `fixed:users:org:edit`
`fixed:users:org:read`
`fixed:reporting:admin:edit`
`fixed:reporting:admin:read` | Allow access to the same resources and permissions that the [Grafana organization administrator]({{< relref "../../permissions/organization_roles.md" >}}) has by default. |
+| Editor | `fixed:datasource:editor:read` |
diff --git a/docs/sources/enterprise/access-control/permissions.md b/docs/sources/enterprise/access-control/permissions.md
index c3657882dc5..1436bf9e5fe 100644
--- a/docs/sources/enterprise/access-control/permissions.md
+++ b/docs/sources/enterprise/access-control/permissions.md
@@ -23,50 +23,50 @@ scope
The following list contains fine-grained access control actions.
-| Action | Applicable scope | Description |
-| -------------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `roles:list` | `roles:*` | List available roles without permissions. |
-| `roles:read` | `roles:*` | Read a specific role with its permissions. |
-| `roles:write` | `permissions:delegate` | Create or update a custom role. |
-| `roles:delete` | `permissions:delegate` | Delete a custom role. |
-| `roles.builtin:list` | `roles:*` | List built-in role assignments. |
-| `roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment. |
-| `roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment. |
-| `reports.admin:create` | `reports:*` | Create reports. |
-| `reports.admin:write` | `reports:*` | Update reports. |
-| `reports:delete` | `reports:*` | Delete reports. |
-| `reports:read` | `reports:*` | List all available reports or get a specific report. |
-| `reports:send` | `reports:*` | Send a report email. |
-| `reports.settings:write` | n/a | Update report settings. |
-| `reports.settings:read` | n/a | Read report settings. |
+| Action | Applicable scope | Description |
+| -------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `roles:list` | `roles:*` | List available roles without permissions. |
+| `roles:read` | `roles:*` | Read a specific role with its permissions. |
+| `roles:write` | `permissions:delegate` | Create or update a custom role. |
+| `roles:delete` | `permissions:delegate` | Delete a custom role. |
+| `roles.builtin:list` | `roles:*` | List built-in role assignments. |
+| `roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment. |
+| `roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment. |
+| `reports.admin:create` | `reports:*` | Create reports. |
+| `reports.admin:write` | `reports:*` | Update reports. |
+| `reports:delete` | `reports:*` | Delete reports. |
+| `reports:read` | `reports:*` | List all available reports or get a specific report. |
+| `reports:send` | `reports:*` | Send a report email. |
+| `reports.settings:write` | n/a | Update report settings. |
+| `reports.settings:read` | n/a | Read report settings. |
| `provisioning:reload` | `provisioners:*` | Reload provisioning files. To find the exact scope for specific provisioner, see [Scope definitions]({{< relref "./permissions.md#scope-definitions" >}}). |
-| `users:read` | `global:users:*` | Read or search user profiles. |
-| `users:write` | `global:users:*` | Update a user’s profile. |
-| `users.teams:read` | `global:users:*` | Read a user’s teams. |
-| `users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user. |
-| `users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user. |
-| `users.password:update` | `global:users:*` | Update a user’s password. |
-| `users:delete` | `global:users:*` | Delete a user. |
-| `users:create` | n/a | Create a user. |
-| `users:enable` | `global:users:*` | Enable a user. |
-| `users:disable` | `global:users:*` | Disable a user. |
-| `users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions. |
-| `users:logout` | `global:users:*` | Sign out a user. |
-| `users.quotas:list` | `global:users:*` | List a user’s quotas. |
-| `users.quotas:update` | `global:users:*` | Update a user’s quotas. |
-| `org.users.read` | `users:*` | Get user profiles within an organization. |
-| `org.users.add` | `users:*` | Add a user to an organization. |
-| `org.users.remove` | `users:*` | Remove a user from an organization. |
+| `users:read` | `global:users:*` | Read or search user profiles. |
+| `users:write` | `global:users:*` | Update a user’s profile. |
+| `users.teams:read` | `global:users:*` | Read a user’s teams. |
+| `users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user. |
+| `users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user. |
+| `users.password:update` | `global:users:*` | Update a user’s password. |
+| `users:delete` | `global:users:*` | Delete a user. |
+| `users:create` | n/a | Create a user. |
+| `users:enable` | `global:users:*` | Enable a user. |
+| `users:disable` | `global:users:*` | Disable a user. |
+| `users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions. |
+| `users:logout` | `global:users:*` | Sign out a user. |
+| `users.quotas:list` | `global:users:*` | List a user’s quotas. |
+| `users.quotas:update` | `global:users:*` | Update a user’s quotas. |
+| `org.users.read` | `users:*` | Get user profiles within an organization. |
+| `org.users.add` | `users:*` | Add a user to an organization. |
+| `org.users.remove` | `users:*` | Remove a user from an organization. |
| `org.users.role:update` | `users:*` | Update the organization role (`Viewer`, `Editor`, or `Admin`) of an organization. |
-| `ldap.user:read` | n/a | Get a user via LDAP. |
-| `ldap.user:sync` | n/a | Sync a user via LDAP. |
-| `ldap.status:read` | n/a | Verify the availability of the LDAP server or servers. |
-| `ldap.config:reload` | n/a | Reload the LDAP configuration. |
-| `status:accesscontrol` | `services:accesscontrol` | Get access-control enabled status. |
-| `settings:read` | `settings:*`
`settings:auth.saml:*`
`settings:auth.saml:enabled` (property level) | Read the [Grafana configuration settings]({{< relref "../../administration/configuration/_index.md" >}}) |
-| `settings:write` | `settings:*`
`settings:auth.saml:*`
`settings:auth.saml:enabled` (property level) | Update any Grafana configuration settings that can be [updated at runtime]({{< relref "../../enterprise/settings-updates/_index.md" >}}). |
-| `server.stats:read` | n/a | Read server stats |
-| `datasources:explore` | n/a | Enable explore |
+| `ldap.user:read` | n/a | Get a user via LDAP. |
+| `ldap.user:sync` | n/a | Sync a user via LDAP. |
+| `ldap.status:read` | n/a | Verify the availability of the LDAP server or servers. |
+| `ldap.config:reload` | n/a | Reload the LDAP configuration. |
+| `status:accesscontrol` | `services:accesscontrol` | Get access-control enabled status. |
+| `settings:read` | `settings:*`
`settings:auth.saml:*`
`settings:auth.saml:enabled` (property level) | Read the [Grafana configuration settings]({{< relref "../../administration/configuration/_index.md" >}}) |
+| `settings:write` | `settings:*`
`settings:auth.saml:*`
`settings:auth.saml:enabled` (property level) | Update any Grafana configuration settings that can be [updated at runtime]({{< relref "../../enterprise/settings-updates/_index.md" >}}). |
+| `server.stats:read` | n/a | Read server stats |
+| `datasources:explore` | n/a | Enable explore |
## Scope definitions
@@ -77,8 +77,8 @@ The following list contains fine-grained access control scopes.
| `roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles. |
| `permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment. |
| `reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:1` matches the report with id `1`. |
-| `services:accesscontrol` | Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the `status:accesscontrol` actions. |
+| `services:accesscontrol` | Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the `status:accesscontrol` actions. |
| `global:users:*` | Restrict an action to a set of global users. |
| `users:*` | Restrict an action to a set of users from an organization. |
| `settings:*` | Restrict an action to a subset of settings. For example, `settings:*` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings. |
-| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the fine-grained access control [provisioner]({{< relref "./provisioning.md" >}}). |
+| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the fine-grained access control [provisioner]({{< relref "./provisioning.md" >}}). |
diff --git a/pkg/services/ngalert/notifier/multiorg_alertmanager_test.go b/pkg/services/ngalert/notifier/multiorg_alertmanager_test.go
index b4fb5cc1e42..17759642ae0 100644
--- a/pkg/services/ngalert/notifier/multiorg_alertmanager_test.go
+++ b/pkg/services/ngalert/notifier/multiorg_alertmanager_test.go
@@ -3,6 +3,8 @@ package notifier
import (
"bytes"
"context"
+ "io/ioutil"
+ "os"
"testing"
"time"
@@ -23,13 +25,19 @@ func TestMultiOrgAlertmanager_SyncAlertmanagersForOrgs(t *testing.T) {
orgStore := &FakeOrgStore{
orgs: []int64{1, 2, 3},
}
+
+ tmpDir, err := ioutil.TempDir("", "test")
+ require.NoError(t, err)
+
SyncOrgsPollInterval = 10 * time.Minute // Don't poll in unit tests.
kvStore := newFakeKVStore(t)
reg := prometheus.NewPedanticRegistry()
m := metrics.NewNGAlert(reg)
- mam := NewMultiOrgAlertmanager(&setting.Cfg{}, configStore, orgStore, kvStore, m.GetMultiOrgAlertmanagerMetrics())
+ mam := NewMultiOrgAlertmanager(&setting.Cfg{DataPath: tmpDir}, configStore, orgStore, kvStore, m.GetMultiOrgAlertmanagerMetrics())
ctx := context.Background()
+ t.Cleanup(cleanOrgDirectories(tmpDir, t))
+
// Ensure that one Alertmanager is created per org.
{
require.NoError(t, mam.LoadAndSyncAlertmanagersForOrgs(ctx))
@@ -82,13 +90,18 @@ func TestMultiOrgAlertmanager_AlertmanagerFor(t *testing.T) {
orgs: []int64{1, 2, 3},
}
+ tmpDir, err := ioutil.TempDir("", "test")
+ require.NoError(t, err)
+
SyncOrgsPollInterval = 10 * time.Minute // Don't poll in unit tests.
kvStore := newFakeKVStore(t)
reg := prometheus.NewPedanticRegistry()
m := metrics.NewNGAlert(reg)
- mam := NewMultiOrgAlertmanager(&setting.Cfg{}, configStore, orgStore, kvStore, m.GetMultiOrgAlertmanagerMetrics())
+ mam := NewMultiOrgAlertmanager(&setting.Cfg{DataPath: tmpDir}, configStore, orgStore, kvStore, m.GetMultiOrgAlertmanagerMetrics())
ctx := context.Background()
+ t.Cleanup(cleanOrgDirectories(tmpDir, t))
+
// Ensure that one Alertmanagers is created per org.
{
require.NoError(t, mam.LoadAndSyncAlertmanagersForOrgs(ctx))
@@ -126,3 +139,10 @@ func TestMultiOrgAlertmanager_AlertmanagerFor(t *testing.T) {
require.EqualError(t, err, ErrNoAlertmanagerForOrg.Error())
}
}
+
+// nolint:unused
+func cleanOrgDirectories(path string, t *testing.T) func() {
+ return func() {
+ require.NoError(t, os.RemoveAll(path))
+ }
+}