Provisioning: Allow disabling of image rendering instance wide (#111359)

pkg/registry/apis/provisioning/register.go

@@ -85,7 +85,8 @@ type APIBuilder struct {
 	// TODO: Set this up in the standalone API server
 	onlyApiServer bool
 
-	allowedTargets []provisioning.SyncTargetType
+	allowedTargets      []provisioning.SyncTargetType
+	allowImageRendering bool
 
 	features   featuremgmt.FeatureToggles
 	usageStats usagestats.Service
@@ -133,6 +134,7 @@ func NewAPIBuilder(
 	extraWorkers []jobs.Worker,
 	jobHistoryConfig *JobHistoryConfig,
 	allowedTargets []provisioning.SyncTargetType,
+	allowImageRendering bool,
 	newStandaloneClientFactoryFunc func(loopbackConfigProvider apiserver.RestConfigProvider) resources.ClientFactory, // optional, only used for standalone apiserver
 ) *APIBuilder {
 	var clients resources.ClientFactory
@@ -161,6 +163,7 @@ func NewAPIBuilder(
 		jobHistoryConfig:    jobHistoryConfig,
 		extraWorkers:        extraWorkers,
 		allowedTargets:      allowedTargets,
+		allowImageRendering: allowImageRendering,
 	}
 
 	for _, builder := range extraBuilders {
@@ -244,6 +247,7 @@ func RegisterAPIService(
 		extraWorkers,
 		createJobHistoryConfigFromSettings(cfg),
 		allowedTargets,
+		cfg.ProvisioningAllowImageRendering,
 		nil,
 	)
 	apiregistration.RegisterAPI(builder)
@@ -558,7 +562,18 @@ func (b *APIBuilder) Validate(ctx context.Context, a admission.Attributes, o adm
 	cfg := repo.Config()
 
 	if !slices.Contains(b.allowedTargets, cfg.Spec.Sync.Target) {
-		return fmt.Errorf("sync target %s is not supported", cfg.Spec.Sync.Target)
+		list = append(list,
+			field.Invalid(
+				field.NewPath("spec", "target"),
+				cfg.Spec.Sync.Target,
+				"sync target is not supported"))
+	}
+
+	if !b.allowImageRendering && cfg.Spec.GitHub != nil && cfg.Spec.GitHub.GenerateDashboardPreviews {
+		list = append(list,
+			field.Invalid(field.NewPath("spec", "generateDashboardPreviews"),
+				cfg.Spec.GitHub.GenerateDashboardPreviews,
+				"image rendering is not enabled"))
 	}
 
 	if a.GetOperation() == admission.Update {

pkg/registry/apis/provisioning/routes.go

@@ -167,6 +167,7 @@ func (b *APIBuilder) handleSettings(w http.ResponseWriter, r *http.Request) {
 		// FIXME: this shouldn't be here in provisioning but at the dual writer or something about the storage
 		LegacyStorage:            legacyStorage,
 		AvailableRepositoryTypes: b.repoFactory.Types(),
+		AllowImageRendering:      b.allowImageRendering,
 	}
 
 	for i, val := range all {

pkg/setting/setting.go

@@ -133,17 +133,18 @@ type Cfg struct {
 	ProvisioningPath           string
 	PermittedProvisioningPaths []string
 	// Provisioning config
-	ProvisioningDisableControllers bool
-	ProvisioningAllowedTargets     []string
-	ProvisioningRepositoryTypes    []string
-	ProvisioningLokiURL            string
-	ProvisioningLokiUser           string
-	ProvisioningLokiPassword       string
-	ProvisioningLokiTenantID       string
-	DataPath                       string
-	LogsPath                       string
-	PluginsPath                    string
-	EnterpriseLicensePath          string
+	ProvisioningDisableControllers  bool
+	ProvisioningAllowedTargets      []string
+	ProvisioningAllowImageRendering bool
+	ProvisioningRepositoryTypes     []string
+	ProvisioningLokiURL             string
+	ProvisioningLokiUser            string
+	ProvisioningLokiPassword        string
+	ProvisioningLokiTenantID        string
+	DataPath                        string
+	LogsPath                        string
+	PluginsPath                     string
+	EnterpriseLicensePath           string
 
 	// SMTP email settings
 	Smtp SmtpSettings
@@ -2124,6 +2125,7 @@ func (cfg *Cfg) readProvisioningSettings(iniFile *ini.File) error {
 	if len(cfg.ProvisioningAllowedTargets) == 0 {
 		cfg.ProvisioningAllowedTargets = []string{"instance", "folder"}
 	}
+	cfg.ProvisioningAllowImageRendering = iniFile.Section("provisioning").Key("allow_image_rendering").MustBool(true)
 
 	// Read job history configuration
 	cfg.ProvisioningLokiURL = valueAsString(iniFile.Section("provisioning"), "loki_url", "")

pkg/tests/apis/openapi_snapshots/provisioning.grafana.app-v0alpha1.json

@@ -4349,9 +4349,15 @@
         "description": "Summary shows a view of the configuration that is sanitized and is OK for logged in users to see",
         "type": "object",
         "required": [
+          "allowImageRendering",
           "items"
         ],
         "properties": {
+          "allowImageRendering": {
+            "description": "Whether image rendering is allowed for dashboard previews",
+            "type": "boolean",
+            "default": false
+          },
           "allowedTargets": {
             "description": "The valid targets (can disable instance or folder types)",
             "type": "array",