From ec42a8f83ff525d49d548826192207b95a2ac17d Mon Sep 17 00:00:00 2001
From: Tobias Skarhed <1438972+tskarhed@users.noreply.github.com>
Date: Mon, 13 Jan 2025 17:24:54 +0100
Subject: [PATCH 01/24] MultiCombobox: Add basic filtering (#98608)

Add filtering to Multi
---
 .../src/components/Combobox/Combobox.tsx      | 23 +------------------
 .../src/components/Combobox/MultiCombobox.tsx | 17 +++++---------
 .../src/components/Combobox/filter.ts         | 23 +++++++++++++++++++
 3 files changed, 30 insertions(+), 33 deletions(-)
 create mode 100644 packages/grafana-ui/src/components/Combobox/filter.ts

diff --git a/packages/grafana-ui/src/components/Combobox/Combobox.tsx b/packages/grafana-ui/src/components/Combobox/Combobox.tsx
index 6a338006b08..6a18da04294 100644
--- a/packages/grafana-ui/src/components/Combobox/Combobox.tsx
+++ b/packages/grafana-ui/src/components/Combobox/Combobox.tsx
@@ -15,6 +15,7 @@ import { Stack } from '../Layout/Stack/Stack';
 import { Portal } from '../Portal/Portal';
 import { ScrollContainer } from '../ScrollContainer/ScrollContainer';
 
+import { itemFilter, itemToString } from './filter';
 import { getComboboxStyles, MENU_OPTION_HEIGHT, MENU_OPTION_HEIGHT_DESCRIPTION } from './getComboboxStyles';
 import { useComboboxFloat } from './useComboboxFloat';
 import { StaleResultError, useLatestAsyncCall } from './useLatestAsyncCall';
@@ -86,28 +87,6 @@ export type AutoSizeConditionals =
 
 type ComboboxProps<T extends string | number> = ComboboxBaseProps<T> & AutoSizeConditionals & ClearableConditionals<T>;
 
-export function itemToString<T extends string | number>(item?: ComboboxOption<T> | null) {
-  if (!item) {
-    return '';
-  }
-  if (item.label?.includes('Custom value: ')) {
-    return item.value.toString();
-  }
-  return item.label ?? item.value.toString();
-}
-
-function itemFilter<T extends string | number>(inputValue: string) {
-  const lowerCasedInputValue = inputValue.toLowerCase();
-
-  return (item: ComboboxOption<T>) => {
-    return (
-      !inputValue ||
-      item.label?.toLowerCase().includes(lowerCasedInputValue) ||
-      item.value?.toString().toLowerCase().includes(lowerCasedInputValue)
-    );
-  };
-}
-
 const noop = () => {};
 const asyncNoop = () => Promise.resolve([]);
 
diff --git a/packages/grafana-ui/src/components/Combobox/MultiCombobox.tsx b/packages/grafana-ui/src/components/Combobox/MultiCombobox.tsx
index 0af00d221e2..81abe9f6a00 100644
--- a/packages/grafana-ui/src/components/Combobox/MultiCombobox.tsx
+++ b/packages/grafana-ui/src/components/Combobox/MultiCombobox.tsx
@@ -13,15 +13,10 @@ import { Spinner } from '../Spinner/Spinner';
 import { Text } from '../Text/Text';
 import { Tooltip } from '../Tooltip';
 
-import {
-  ComboboxOption,
-  ComboboxBaseProps,
-  AutoSizeConditionals,
-  itemToString,
-  VIRTUAL_OVERSCAN_ITEMS,
-} from './Combobox';
+import { ComboboxOption, ComboboxBaseProps, AutoSizeConditionals, VIRTUAL_OVERSCAN_ITEMS } from './Combobox';
 import { OptionListItem } from './OptionListItem';
 import { ValuePill } from './ValuePill';
+import { itemFilter, itemToString } from './filter';
 import { getComboboxStyles, MENU_OPTION_HEIGHT, MENU_OPTION_HEIGHT_DESCRIPTION } from './getComboboxStyles';
 import { getMultiComboboxStyles } from './getMultiComboboxStyles';
 import { useComboboxFloat } from './useComboboxFloat';
@@ -48,8 +43,11 @@ export const MultiCombobox = <T extends string | number>(props: MultiComboboxPro
   }, [value, options, isAsync]);
 
   const styles = useStyles2(getComboboxStyles);
+  const [inputValue, setInputValue] = useState('');
 
-  const [items, baseSetItems] = useState(isAsync ? [] : options);
+  const [baseItems, baseSetItems] = useState(isAsync ? [] : options);
+
+  const items = useMemo(() => baseItems.filter(itemFilter(inputValue)), [baseItems, inputValue]);
 
   // TODO: Improve this with async
   useEffect(() => {
@@ -73,8 +71,6 @@ export const MultiCombobox = <T extends string | number>(props: MultiComboboxPro
     [selectedItems]
   );
 
-  const [inputValue, setInputValue] = useState('');
-
   const { getSelectedItemProps, getDropdownProps, removeSelectedItem } = useMultipleSelection({
     selectedItems, //initally selected items,
     onStateChange: ({ type, selectedItems: newSelectedItems }) => {
@@ -120,7 +116,6 @@ export const MultiCombobox = <T extends string | number>(props: MultiComboboxPro
         case useCombobox.stateChangeTypes.InputBlur:
           setInputValue('');
           setIsOpen(false);
-          return changes;
         default:
           return changes;
       }
diff --git a/packages/grafana-ui/src/components/Combobox/filter.ts b/packages/grafana-ui/src/components/Combobox/filter.ts
new file mode 100644
index 00000000000..09ab4653051
--- /dev/null
+++ b/packages/grafana-ui/src/components/Combobox/filter.ts
@@ -0,0 +1,23 @@
+import { ComboboxOption } from './Combobox';
+
+export function itemToString<T extends string | number>(item?: ComboboxOption<T> | null) {
+  if (!item) {
+    return '';
+  }
+  if (item.label?.includes('Custom value: ')) {
+    return item.value.toString();
+  }
+  return item.label ?? item.value.toString();
+}
+
+export function itemFilter<T extends string | number>(inputValue: string) {
+  const lowerCasedInputValue = inputValue.toLowerCase();
+
+  return (item: ComboboxOption<T>) => {
+    return (
+      !inputValue ||
+      item.label?.toLowerCase().includes(lowerCasedInputValue) ||
+      item.value?.toString().toLowerCase().includes(lowerCasedInputValue)
+    );
+  };
+}

From c3b0eb627710b9be1ffa744b051cffd260d37dd6 Mon Sep 17 00:00:00 2001
From: Josh Hunt <joshhunt@users.noreply.github.com>
Date: Mon, 13 Jan 2025 16:44:35 +0000
Subject: [PATCH 02/24] Reverts "MetricCombobox: Fix overflowing parents"
 (#98868)

Revert MetricCombobox: Fix overflowing parents

https://github.com/grafana/grafana/pull/97049
---
 .../components/MetricCombobox.tsx             | 65 ++++---------------
 .../components/PromQueryBuilder.tsx           | 18 ++---
 .../src/components/Forms/InlineField.tsx      |  1 -
 .../src/components/Forms/InlineFieldRow.tsx   |  1 -
 4 files changed, 19 insertions(+), 66 deletions(-)

diff --git a/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx b/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
index 81b3d830779..0c156da10f0 100644
--- a/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
+++ b/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
@@ -1,11 +1,9 @@
-import { css } from '@emotion/css';
 import { useCallback, useState } from 'react';
 
-import { GrafanaTheme2, SelectableValue } from '@grafana/data';
+import { SelectableValue } from '@grafana/data';
 import { EditorField, EditorFieldGroup, InputGroup } from '@grafana/experimental';
-import { Button, ComponentSize, InlineField, InlineFieldRow, useStyles2 } from '@grafana/ui';
+import { Button, InlineField, InlineFieldRow } from '@grafana/ui';
 import { Combobox, ComboboxOption } from '@grafana/ui/src/components/Combobox/Combobox';
-import { getPropertiesForButtonSize } from '@grafana/ui/src/components/Forms/commonStyles';
 
 import { PrometheusDatasource } from '../../datasource';
 import { regexifyLabelValuesQueryString } from '../parsingUtils';
@@ -26,9 +24,6 @@ export interface MetricComboboxProps {
   variableEditor?: boolean;
 }
 
-const INLINE_FIELD_WIDTH = 20;
-const BUTTON_SIZE: ComponentSize = 'md';
-
 export function MetricCombobox({
   datasource,
   query,
@@ -88,8 +83,6 @@ export function MetricCombobox({
     return metrics;
   }, [onGetMetrics]);
 
-  const styles = useStyles2(getMectricComboboxStyles);
-
   const asyncSelect = () => {
     return (
       <InputGroup>
@@ -103,7 +96,6 @@ export function MetricCombobox({
           createCustomValue
         />
         <Button
-          size={BUTTON_SIZE}
           tooltip="Open metrics explorer"
           aria-label="Open metrics explorer"
           variant="secondary"
@@ -130,23 +122,19 @@ export function MetricCombobox({
         />
       )}
       {variableEditor ? (
-        <span className={styles.adaptToParentVariableEditor}>
-          <InlineFieldRow>
-            <InlineField
-              label="Metric"
-              labelWidth={INLINE_FIELD_WIDTH}
-              tooltip={<div>Optional: returns a list of label values for the label name in the specified metric.</div>}
-            >
-              {asyncSelect()}
-            </InlineField>
-          </InlineFieldRow>
-        </span>
+        <InlineFieldRow>
+          <InlineField
+            label="Metric"
+            labelWidth={20}
+            tooltip={<div>Optional: returns a list of label values for the label name in the specified metric.</div>}
+          >
+            {asyncSelect()}
+          </InlineField>
+        </InlineFieldRow>
       ) : (
-        <span className={styles.adaptToParentQueryEditor}>
-          <EditorFieldGroup>
-            <EditorField label="Metric">{asyncSelect()}</EditorField>
-          </EditorFieldGroup>
-        </span>
+        <EditorFieldGroup>
+          <EditorField label="Metric">{asyncSelect()}</EditorField>
+        </EditorFieldGroup>
       )}
     </>
   );
@@ -175,28 +163,3 @@ const formatKeyValueStringsForLabelValuesQuery = (query: string, labelsFilters?:
 
   return formatPrometheusLabelFiltersToString(queryString, labelsFilters);
 };
-
-const getMectricComboboxStyles = (theme: GrafanaTheme2) => {
-  const { height } = getPropertiesForButtonSize(BUTTON_SIZE, theme);
-  const buttonSpace = parseInt(theme.spacing(height), 10);
-  const inlineFieldSpace = parseInt(theme.spacing(INLINE_FIELD_WIDTH), 10);
-  const widthToSubstract = inlineFieldSpace + buttonSpace;
-  return {
-    adaptToParentQueryEditor: css({
-      // Take metrics explorer button into account
-      maxWidth: `calc(100% - ${buttonSpace}px)`,
-    }),
-    adaptToParentVariableEditor: css({
-      maxWidth: '100%',
-      display: 'flex',
-      '[class*="InlineFieldRow"]': {
-        '> div': {
-          'label + div': {
-            // Take label and the metrics explorer button into account
-            maxWidth: `calc(100% - ${widthToSubstract}px)`,
-          },
-        },
-      },
-    }),
-  };
-};
diff --git a/packages/grafana-prometheus/src/querybuilder/components/PromQueryBuilder.tsx b/packages/grafana-prometheus/src/querybuilder/components/PromQueryBuilder.tsx
index 8b1b1774426..a1d450b2452 100644
--- a/packages/grafana-prometheus/src/querybuilder/components/PromQueryBuilder.tsx
+++ b/packages/grafana-prometheus/src/querybuilder/components/PromQueryBuilder.tsx
@@ -6,7 +6,7 @@ import { DataSourceApi, PanelData } from '@grafana/data';
 import { selectors } from '@grafana/e2e-selectors';
 import { EditorRow } from '@grafana/experimental';
 import { config } from '@grafana/runtime';
-import { Drawer, useStyles2 } from '@grafana/ui';
+import { Drawer } from '@grafana/ui';
 
 import { PrometheusDatasource } from '../../datasource';
 import promqlGrammar from '../../promql';
@@ -58,7 +58,6 @@ export const PromQueryBuilder = memo<PromQueryBuilderProps>((props) => {
       checkLlms();
     }
   }, [prometheusPromQAIL]);
-  const styles = useStyles2(getPromQueryBuilderStyles);
 
   return (
     <>
@@ -72,12 +71,9 @@ export const PromQueryBuilder = memo<PromQueryBuilderProps>((props) => {
           />
         </Drawer>
       )}
-      <span className={styles.addaptToParent}>
-        <EditorRow>
-          <MetricsLabelsSection query={query} onChange={onChange} datasource={datasource} />
-        </EditorRow>
-      </span>
-
+      <EditorRow>
+        <MetricsLabelsSection query={query} onChange={onChange} datasource={datasource} />
+      </EditorRow>
       {initHints.length ? (
         <div
           className={css({
@@ -154,9 +150,5 @@ export const PromQueryBuilder = memo<PromQueryBuilderProps>((props) => {
     </>
   );
 });
-const getPromQueryBuilderStyles = () => ({
-  addaptToParent: css({
-    maxWidth: '100%',
-  }),
-});
+
 PromQueryBuilder.displayName = 'PromQueryBuilder';
diff --git a/packages/grafana-ui/src/components/Forms/InlineField.tsx b/packages/grafana-ui/src/components/Forms/InlineField.tsx
index c3c95331563..2eb4b5c1f25 100644
--- a/packages/grafana-ui/src/components/Forms/InlineField.tsx
+++ b/packages/grafana-ui/src/components/Forms/InlineField.tsx
@@ -98,7 +98,6 @@ const getStyles = (theme: GrafanaTheme2, grow?: boolean, shrink?: boolean) => {
       position: 'relative',
       flex: `${grow ? 1 : 0} ${shrink ? 1 : 0} auto`,
       margin: `0 ${theme.spacing(0.5)} ${theme.spacing(0.5)} 0`,
-      maxWidth: '100%',
     }),
     childContainer: css({
       flex: `${grow ? 1 : 0} ${shrink ? 1 : 0} auto`,
diff --git a/packages/grafana-ui/src/components/Forms/InlineFieldRow.tsx b/packages/grafana-ui/src/components/Forms/InlineFieldRow.tsx
index eab09f2480d..f77222a04d3 100644
--- a/packages/grafana-ui/src/components/Forms/InlineFieldRow.tsx
+++ b/packages/grafana-ui/src/components/Forms/InlineFieldRow.tsx
@@ -27,7 +27,6 @@ const getStyles = (theme: GrafanaTheme2) => {
       flexWrap: 'wrap',
       alignContent: 'flex-start',
       rowGap: theme.spacing(0.5),
-      maxWidth: '100%',
     }),
   };
 };

From 38c4f3d5ef8e37d7a0e0e3c493cde12f2bb30949 Mon Sep 17 00:00:00 2001
From: ismail simsek <ismailsimsek09@gmail.com>
Date: Mon, 13 Jan 2025 18:28:50 +0100
Subject: [PATCH 03/24] Prometheus: UTF8 metrics for prometheus devenv (#98237)

* utf8 metrics for prometheus devenv

* add label value with quotes
---
 .github/CODEOWNERS                            |   1 +
 devenv/docker/blocks/prometheus/Dockerfile    |   2 +-
 .../blocks/prometheus/docker-compose.yaml     |   7 +-
 .../docker/blocks/prometheus/prometheus.yml   |   6 +-
 .../docker/blocks/prometheus_utf8/Dockerfile  |  15 +++
 .../prometheus_utf8/docker-compose.yaml       |   6 +
 devenv/docker/blocks/prometheus_utf8/go.mod   |  20 ++++
 devenv/docker/blocks/prometheus_utf8/go.sum   |  34 ++++++
 devenv/docker/blocks/prometheus_utf8/main.go  | 112 ++++++++++++++++++
 9 files changed, 200 insertions(+), 3 deletions(-)
 create mode 100644 devenv/docker/blocks/prometheus_utf8/Dockerfile
 create mode 100644 devenv/docker/blocks/prometheus_utf8/docker-compose.yaml
 create mode 100644 devenv/docker/blocks/prometheus_utf8/go.mod
 create mode 100644 devenv/docker/blocks/prometheus_utf8/go.sum
 create mode 100644 devenv/docker/blocks/prometheus_utf8/main.go

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7abb5c32741..6966a9adb70 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -267,6 +267,7 @@
 /devenv/docker/blocks/prometheus/ @grafana/oss-big-tent
 /devenv/docker/blocks/prometheus_random_data/ @grafana/oss-big-tent
 /devenv/docker/blocks/prometheus_high_card/ @grafana/oss-big-tent
+/devenv/docker/blocks/prometheus_utf8/ @grafana/oss-big-tent
 /devenv/docker/blocks/pyroscope/ @grafana/observability-traces-and-profiling
 /devenv/docker/blocks/redis/ @bergquist
 /devenv/docker/blocks/sensugo/ @grafana/grafana-backend-group
diff --git a/devenv/docker/blocks/prometheus/Dockerfile b/devenv/docker/blocks/prometheus/Dockerfile
index a39b100a950..7fa6476b739 100644
--- a/devenv/docker/blocks/prometheus/Dockerfile
+++ b/devenv/docker/blocks/prometheus/Dockerfile
@@ -1,4 +1,4 @@
-FROM prom/prometheus:latest
+FROM prom/prometheus:v3.1.0
 ADD prometheus.yml /etc/prometheus/
 ADD recording.yml /etc/prometheus/
 ADD alert.yml /etc/prometheus/
diff --git a/devenv/docker/blocks/prometheus/docker-compose.yaml b/devenv/docker/blocks/prometheus/docker-compose.yaml
index 21410898b50..49b64c60fcf 100644
--- a/devenv/docker/blocks/prometheus/docker-compose.yaml
+++ b/devenv/docker/blocks/prometheus/docker-compose.yaml
@@ -15,7 +15,7 @@
   node_exporter:
     image: prom/node-exporter
     ports:
-      - "9100:9100"
+      - "9101:9100"
 
   fake-prometheus-data:
     image: grafana/fake-data-gen
@@ -42,3 +42,8 @@
     build: docker/blocks/prometheus_high_card
     ports:
       - "9111:9111"
+
+  prometheus-utf8:
+    build: docker/blocks/prometheus_utf8
+    ports:
+      - "9112:9112"
diff --git a/devenv/docker/blocks/prometheus/prometheus.yml b/devenv/docker/blocks/prometheus/prometheus.yml
index 32d0161b2fe..267dc8db7f4 100644
--- a/devenv/docker/blocks/prometheus/prometheus.yml
+++ b/devenv/docker/blocks/prometheus/prometheus.yml
@@ -24,7 +24,7 @@ scrape_configs:
 
   - job_name: 'node_exporter'
     static_configs:
-      - targets: ['node_exporter:9100']
+      - targets: ['node_exporter:9101']
 
   - job_name: 'fake-data-gen'
     static_configs:
@@ -42,6 +42,10 @@ scrape_configs:
     static_configs:
       - targets: ['prometheus-high-card:9111']
 
+  - job_name: 'prometheus-utf8'
+    static_configs:
+      - targets: [ 'prometheus-utf8:9112' ]
+
   - job_name: 'mysql'
     static_configs:
       - targets: ['mysql-exporter:9104']
diff --git a/devenv/docker/blocks/prometheus_utf8/Dockerfile b/devenv/docker/blocks/prometheus_utf8/Dockerfile
new file mode 100644
index 00000000000..2708da6c390
--- /dev/null
+++ b/devenv/docker/blocks/prometheus_utf8/Dockerfile
@@ -0,0 +1,15 @@
+FROM golang:latest AS builder
+
+ADD main.go /
+ADD go.mod /
+ADD go.sum /
+WORKDIR /
+
+RUN go mod download
+RUN CGO_ENABLED=0 GOOS=linux go build -o main .
+
+FROM scratch
+WORKDIR /
+EXPOSE 9112
+COPY --from=builder /main /main
+ENTRYPOINT ["/main"]
diff --git a/devenv/docker/blocks/prometheus_utf8/docker-compose.yaml b/devenv/docker/blocks/prometheus_utf8/docker-compose.yaml
new file mode 100644
index 00000000000..8f9ee32fae5
--- /dev/null
+++ b/devenv/docker/blocks/prometheus_utf8/docker-compose.yaml
@@ -0,0 +1,6 @@
+prometheus_utf8:
+  build: docker/blocks/prometheus_utf8
+  ports:
+    - "3012:3012"
+  extra_hosts:
+    - "host.docker.internal:host-gateway"
diff --git a/devenv/docker/blocks/prometheus_utf8/go.mod b/devenv/docker/blocks/prometheus_utf8/go.mod
new file mode 100644
index 00000000000..706d2d12e81
--- /dev/null
+++ b/devenv/docker/blocks/prometheus_utf8/go.mod
@@ -0,0 +1,20 @@
+module utf8-support
+
+go 1.22.4
+
+require (
+	github.com/prometheus/client_golang v1.20.5
+	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.60.1 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+)
diff --git a/devenv/docker/blocks/prometheus_utf8/go.sum b/devenv/docker/blocks/prometheus_utf8/go.sum
new file mode 100644
index 00000000000..5b2f91420df
--- /dev/null
+++ b/devenv/docker/blocks/prometheus_utf8/go.sum
@@ -0,0 +1,34 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
+github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.60.1 h1:FUas6GcOw66yB/73KC+BOZoFJmbo/1pojoILArPAaSc=
+github.com/prometheus/common v0.60.1/go.mod h1:h0LYf1R1deLSKtD4Vdg8gy4RuOvENW2J/h19V5NADQw=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/devenv/docker/blocks/prometheus_utf8/main.go b/devenv/docker/blocks/prometheus_utf8/main.go
new file mode 100644
index 00000000000..1aaf3f49b1f
--- /dev/null
+++ b/devenv/docker/blocks/prometheus_utf8/main.go
@@ -0,0 +1,112 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"github.com/prometheus/common/model"
+	"golang.org/x/exp/rand"
+)
+
+func randomValues(max int) func() (string, bool) {
+	i := 0
+	return func() (string, bool) {
+		i++
+		return strconv.Itoa(i), i < max+1
+	}
+}
+
+func staticList(input []string) func() string {
+	return func() string {
+		i := rand.Intn(len(input))
+
+		return input[i]
+	}
+}
+
+type dimension struct {
+	label        string
+	getNextValue func() string
+}
+
+func init() {
+	// This can be removed when the default validation scheme in common is updated.
+	model.NameValidationScheme = model.UTF8Validation
+	model.NameEscapingScheme = model.ValueEncodingEscaping
+}
+
+func main() {
+
+	fakeUtf8Metrics := []dimension{
+		{
+			label:        "a_legacy_label",
+			getNextValue: staticList([]string{"legacy"}),
+		},
+		{
+			label:        "label with space",
+			getNextValue: staticList([]string{"space"}),
+		},
+		{
+			label:        "label with 📈",
+			getNextValue: staticList([]string{"metrics"}),
+		},
+		{
+			label:        "label.with.spaß",
+			getNextValue: staticList([]string{"this_is_fun"}),
+		},
+		{
+			label:        "site",
+			getNextValue: staticList([]string{"LA-EPI"}),
+		},
+		{
+			label:        "room",
+			getNextValue: staticList([]string{`"Friends Don't Lie"`}),
+		},
+	}
+
+	dimensions := []string{}
+	for _, dim := range fakeUtf8Metrics {
+		dimensions = append(dimensions, dim.label)
+	}
+
+	utf8Metric := promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "a.utf8.metric 🤘",
+		Help: "a utf8 metric with utf8 labels",
+	}, dimensions)
+
+	opsProcessed := promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "a_utf8_http_requests_total",
+		Help: "a metric with utf8 labels",
+	}, dimensions)
+
+	http.Handle("/metrics", promhttp.Handler())
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("Hello, is it me you're looking for?"))
+	})
+
+	go func() {
+		for {
+			labels := []string{}
+			for _, dim := range fakeUtf8Metrics {
+				value := dim.getNextValue()
+				labels = append(labels, value)
+			}
+
+			utf8Metric.WithLabelValues(labels...).Inc()
+			opsProcessed.WithLabelValues(labels...).Inc()
+
+			time.Sleep(time.Second * 5)
+		}
+	}()
+
+	fmt.Printf("Server started at :9112\n")
+
+	log.Fatal(http.ListenAndServe(":9112", nil))
+}

From d0b552997d15c602e68dbe85fb1c78d9707309de Mon Sep 17 00:00:00 2001
From: Isabel Matwawana <76437239+imatwawana@users.noreply.github.com>
Date: Mon, 13 Jan 2025 13:48:35 -0500
Subject: [PATCH 04/24] Docs: Fix Vale linter errors (#98828)

---
 docs/.codespellignore                         | 10 ++++++++--
 docs/sources/dashboards/_index.md             |  6 +++---
 .../assess-dashboard-usage/index.md           |  2 +-
 .../annotate-visualizations/index.md          | 14 ++++++-------
 .../build-dashboards/best-practices/index.md  | 18 ++++++++++-------
 .../dashboards/use-dashboards/index.md        |  4 ++--
 .../variables/add-template-variables/index.md | 20 +++++++++----------
 7 files changed, 42 insertions(+), 32 deletions(-)

diff --git a/docs/.codespellignore b/docs/.codespellignore
index e91f0ba984a..43ea4f4fa93 100644
--- a/docs/.codespellignore
+++ b/docs/.codespellignore
@@ -1,7 +1,13 @@
 aks
 eror
+geomap
+Geomap
+grafanalib
+grafonnet
 iam
-wan
+Jsonnet
 [Operato Windrose](https://grafana.com/grafana/plugins/operato-windrose-panel/)
+runbook
 sergent
-sparkline
\ No newline at end of file
+sparkline
+wan
diff --git a/docs/sources/dashboards/_index.md b/docs/sources/dashboards/_index.md
index bd2fc73180e..37b0e0a1f83 100644
--- a/docs/sources/dashboards/_index.md
+++ b/docs/sources/dashboards/_index.md
@@ -15,13 +15,13 @@ hero:
   width: 110
   height: 110
   description: >-
-    Dashboards allow you to query, transform, visualize, and understand your data no matter where it’s stored.
+    Dashboards allow you to query, transform, visualize, and understand your data no matter where it's stored.
 cards:
   title_class: pt-0 lh-1
   items:
     - title: Build dashboards
       href: ./build-dashboards/
-      description: Get step-by-step directions for how to create or import your first dashboard and modify dashboard settings. Learn about reusable library panels, dashboard links, annotatations, and dashboard JSON.
+      description: Get step-by-step directions for how to create or import your first dashboard and modify dashboard settings. Learn about reusable library panels, dashboard links, annotations, and dashboard JSON.
       height: 24
     - title: Manage dashboards
       href: ./manage-dashboards/
@@ -63,7 +63,7 @@ A data source can be an SQL database, Grafana Loki, Grafana Mimir, or a JSON-bas
 
 Queries allow you to reduce the entirety of your data to a specific dataset, providing a more manageable visualization. Since data sources have their own distinct query languages, Grafana dashboards provide you with a query editor to accommodate these differences.
 
-A panel is the container that displays the visualization and provides you with various controls to manipulate it. Panel options let you customize many aspects of a visualization and the options differ based on which visualization you select. When the data format in a visualization doesn’t meet your requirements, you can apply a transformation that manipulates the data returned by a query.
+A panel is the container that displays the visualization and provides you with various controls to manipulate it. Panel options let you customize many aspects of a visualization and the options differ based on which visualization you select. When the data format in a visualization doesn't meet your requirements, you can apply a transformation that manipulates the data returned by a query.
 
 With 150+ data source plugins, you can unify all your data sources into a single dashboard to streamline data monitoring and troubleshooting. With Grafana, you can translate, transform, and visualize data in flexible and versatile dashboards.
 
diff --git a/docs/sources/dashboards/assess-dashboard-usage/index.md b/docs/sources/dashboards/assess-dashboard-usage/index.md
index 5c0c46a2e8a..e989ec12470 100644
--- a/docs/sources/dashboards/assess-dashboard-usage/index.md
+++ b/docs/sources/dashboards/assess-dashboard-usage/index.md
@@ -151,7 +151,7 @@ You can sort the dashboards by:
 
 ## Visualize usage insights data
 
-If you set up your installation to [export logs of usage insights](ref:export-logs-of-usage-insights), we've created two dashboards to help you take advantage of this data.
+If you set up your installation to [export logs of usage insights](ref:export-logs-of-usage-insights), there are two dashboards to help you take advantage of this data.
 
 1. [Usage Insights overview](/grafana/dashboards/13785) provides a top-level perspective of user activity.
 1. [Data source details](/grafana/dashboards/13786) dashboard provides a view of data source activity and health.
diff --git a/docs/sources/dashboards/build-dashboards/annotate-visualizations/index.md b/docs/sources/dashboards/build-dashboards/annotate-visualizations/index.md
index 34d5086ea22..13220b2f56a 100644
--- a/docs/sources/dashboards/build-dashboards/annotate-visualizations/index.md
+++ b/docs/sources/dashboards/build-dashboards/annotate-visualizations/index.md
@@ -74,7 +74,7 @@ To add an annotation, complete the following steps:
 1. Click **Edit** in the top-right corner of the dashboard.
 1. Click the panel to which you're adding the annotation.
 
-   A context menu will appear.
+   A context menu appears.
 
 1. In the context menu, click **Add annotation**.
    ![Add annotation context menu](/static/img/docs/time-series-panel/time-series-annotations-context-menu.png)
@@ -82,7 +82,7 @@ To add an annotation, complete the following steps:
 1. Click **Save dashboard**.
 1. Click **Exit edit**.
 
-Alternatively, to add an annotation, press Ctrl/Cmd and click the panel, and the **Add annotation** context menu will appear.
+Alternatively, to add an annotation, press Ctrl/Cmd and click the panel, and the **Add annotation** context menu appears.
 
 ### Add a region annotation
 
@@ -132,7 +132,7 @@ To add a new annotation query to a dashboard, follow these steps:
 
 1. Enter a name for the annotation query.
 
-   This name is given to the toggle (checkbox) that will allow you to enable/disable showing annotation events from this query.
+   This name is given to the toggle (checkbox) that allows you to enable/disable showing annotation events from this query.
 
 1. Select the data source for the annotations.
 
@@ -158,7 +158,7 @@ To add a new annotation query to a dashboard, follow these steps:
 
 ## Built-in query
 
-After you add an annotation, they will still be visible. This is due to the built-in annotation query that exists on all dashboards. This annotation query will fetch all annotation events that originate from the current dashboard, which are stored in Grafana, and show them on the panel where they were created. This includes alert state history annotations.
+After you add an annotation, they are still visible. This is due to the built-in annotation query that exists on all dashboards. This annotation query fetches all annotation events that originate from the current dashboard, which are stored in Grafana, and show them on the panel where they were created. This includes alert state history annotations.
 
 By default, the built-in annotation query uses the `-- Grafana --` special data source, and manual annotations are only supported using this data source. You can use another data source in the built-in annotation query, but you'll only be able to create automated annotations using the query editor for that data source.
 
@@ -182,7 +182,7 @@ You can stop annotations from being fetched and drawn by taking the following st
 1. Click **Save dashboard**.
 1. Click **Back to dashboard** and **Exit edit**.
 
-When you copy a dashboard using the **Save As** feature it will get a new dashboard id, so annotations created on the source dashboard will no longer be visible on the copy. You can still show them if you add a new **Annotation Query** and filter by tags. However, this only works if the annotations on the source dashboard had tags to filter by.
+When you copy a dashboard using the **Save As** feature it gets a new dashboard id, so annotations created on the source dashboard is no longer be visible on the copy. You can still show them if you add a new **Annotation Query** and filter by tags. However, this only works if the annotations on the source dashboard had tags to filter by.
 
 Following are some query options specific to the built-in annotation query.
 
@@ -192,7 +192,7 @@ You can create new queries to fetch annotations from the built-in annotation que
 
 Grafana also supports typeahead of existing tags, provide at least one tag.
 
-For example, create an annotation query name `outages` and specify a tag `outage`. This query will show all annotations (from any dashboard or via API) with the `outage` tag. If multiple tags are defined in an annotation query, then Grafana will only show annotations matching all the tags. To modify the behavior, enable `Match any`, and Grafana will show annotations that contain any one of the tags you provided.
+For example, create an annotation query name `outages` and specify a tag `outage`. This query shows all annotations (from any dashboard or via API) with the `outage` tag. If multiple tags are defined in an annotation query, then Grafana only shows annotations matching all the tags. To modify the behavior, enable `Match any`, and Grafana shows annotations that contain any one of the tags you provided.
 
 {{< figure src="/media/docs/grafana/dashboards/screenshot-annotations-typeahead-support-10.0.png" max-width="600px" alt="Annotation query options" >}}
 
@@ -206,6 +206,6 @@ When adding or editing an annotation, you can define a repeating time region by
 
 {{< figure src="/media/docs/grafana/dashboards/screenshot-annotation-timeregions-10-v2.png" max-width="600px" alt="Time regions options set to business hours" >}}
 
-The above configuration will produce the following result in the Time series panel:
+The above configuration produces the following result in the Time series panel:
 
 {{< figure src="/media/docs/grafana/screenshot-grafana-10-0-timeseries-time-regions.png" max-width="600px" alt="Time series visualization with time regions business hours" >}}
diff --git a/docs/sources/dashboards/build-dashboards/best-practices/index.md b/docs/sources/dashboards/build-dashboards/best-practices/index.md
index e7710fcb03e..e67a1a87ead 100644
--- a/docs/sources/dashboards/build-dashboards/best-practices/index.md
+++ b/docs/sources/dashboards/build-dashboards/best-practices/index.md
@@ -124,7 +124,7 @@ This method is similar to the RED method, but it includes saturation.
 
 ## Dashboard management maturity model
 
-_Dashboard management maturity_ refers to how well-designed and efficient your dashboard ecosystem is. We recommend periodically reviewing your dashboard setup to gauge where you are and how you can improve.
+_Dashboard management maturity_ refers to how well-designed and efficient your dashboard ecosystem is. It's recommended that you periodically review your dashboard setup to gauge where you are and how you can improve.
 
 Broadly speaking, dashboard maturity can be defined as low, medium, or high.
 
@@ -167,7 +167,7 @@ How can you tell you are here?
   - Example of meaningful color: Blue means it's good, red means it's bad. [Thresholds](ref:thresholds) can help with that.
   - Example of normalizing axes: When comparing CPU usage, measure by percentage rather than raw number, because machines can have a different number of cores. Normalizing CPU usage by the number of cores reduces cognitive load because the viewer can trust that at 100% all cores are being used, without having to know the number of CPUs.
 - Directed browsing cuts down on "guessing."
-  - Template variables make it harder to “just browse” randomly or aimlessly.
+  - Template variables make it harder to "just browse" randomly or aimlessly.
   - Most dashboards should be linked to by alerts.
   - Browsing is directed with links. For more information, refer to [Manage dashboard links](ref:manage-dashboard-links).
 - Version-controlled dashboard JSON.
@@ -204,13 +204,17 @@ Keep your graphs simple and focused on answering the question that you are askin
 
 #### Dashboards should reduce cognitive load, not add to it
 
-_Cognitive load_ is basically how hard you need to think about something in order to figure it out. Make your dashboard easy to interpret. Other users and future you (when you're trying to figure out what broke at 2AM) will appreciate it.
+<!-- vale Grafana.GoogleWill = NO -->
+
+_Cognitive load_ is basically how hard you need to think about something in order to figure it out. Make your dashboard easy to interpret. Other users and future you (when you're trying to figure out what broke at 2 AM) will appreciate it.
 
 Ask yourself:
 
 - Can I tell what exactly each graph represents? Is it obvious, or do I have to think about it?
 - If I show this to someone else, how long will it take them to figure it out? Will they get lost?
 
+<!-- vale Grafana.GoogleWill = YES -->
+
 #### Have a monitoring strategy
 
 It's easy to make new dashboards. It's harder to optimize dashboard creation and adhere to a plan, but it's worth it. This strategy should govern both your overall dashboard scheme and enforce consistency in individual dashboard design.
@@ -233,9 +237,9 @@ Once you have a strategy or design guidelines, write them down to help maintain
 - Use the left and right Y-axes when displaying time series with different units or ranges.
 - Add documentation to dashboards and panels.
   - To add documentation to a dashboard, add a [Text panel visualization](ref:text-panel-visualization) to the dashboard. Record things like the purpose of the dashboard, useful resource links, and any instructions users might need to interact with the dashboard. Check out this [Wikimedia example](https://grafana.wikimedia.org/d/000000066/resourceloader?orgId=1).
-  - To add documentation to a panel, edit the panel settings and add a description. Any text you add will appear if you hover your cursor over the small `i` in the top left corner of the panel.
+  - To add documentation to a panel, edit the panel settings and add a description. Any text you add appears if you hover your cursor over the small `i` in the top left corner of the panel.
 - Reuse your dashboards and enforce consistency by using [templates and variables](ref:templates-and-variables).
-- Be careful with stacking graph data. The visualizations can be misleading, and hide important data. We recommend turning it off in most cases.
+- Be careful with stacking graph data. The visualizations can be misleading, and hide important data. It's recommended that you turn it off in most cases.
 
 ## Best practices for managing dashboards
 
@@ -257,9 +261,9 @@ What is your dashboard maturity level? Analyze your current dashboard setup and
 
 ### Best practices to follow
 
-- Avoid dashboard sprawl, meaning the uncontrolled growth of dashboards. Dashboard sprawl negatively affects time to find the right dashboard. Duplicating dashboards and changing “one thing” (worse: keeping original tags) is the easiest kind of sprawl.
+- Avoid dashboard sprawl, meaning the uncontrolled growth of dashboards. Dashboard sprawl negatively affects time to find the right dashboard. Duplicating dashboards and changing "one thing" (worse: keeping original tags) is the easiest kind of sprawl.
   - Periodically review the dashboards and remove unnecessary ones.
-  - If you create a temporary dashboard, perhaps to test something, prefix the name with `TEST: `. Delete the dashboard when you are finished.
+  - If you create a temporary dashboard, perhaps to test something, prefix the name with `TEST:`. Delete the dashboard when you are finished.
 - Copying dashboards with no significant changes is not a good idea.
   - You miss out on updates to the original dashboard, such as documentation changes, bug fixes, or additions to metrics.
   - In many cases copies are being made to simply customize the view by setting template parameters. This should instead be done by maintaining a link to the master dashboard and customizing the view with [URL parameters](ref:url-parameters).
diff --git a/docs/sources/dashboards/use-dashboards/index.md b/docs/sources/dashboards/use-dashboards/index.md
index df3323b38f0..5292924fa86 100644
--- a/docs/sources/dashboards/use-dashboards/index.md
+++ b/docs/sources/dashboards/use-dashboards/index.md
@@ -131,14 +131,14 @@ Grafana has a number of keyboard shortcuts available. Press `?` on your keyboard
 - `d+e`: Expand all rows.
 - `d+s`: Dashboard settings.
 - `Ctrl+K`: Opens the command palette.
-- `Esc`: Exits panel when in fullscreen view or edit mode. Also returns you to the dashboard from dashboard settings.
+- `Esc`: Exits panel when in full screen view or edit mode. Also returns you to the dashboard from dashboard settings.
 
 **Focused panel**
 
 By hovering over a panel with the mouse you can use some shortcuts that will target that panel.
 
 - `e`: Toggle panel edit view
-- `v`: Toggle panel fullscreen view
+- `v`: Toggle panel full screen view
 - `pu`: Open share panel link configuration
 - `pe`: Open share panel embed configuration
 - `ps`: Open share panel snapshot configuration
diff --git a/docs/sources/dashboards/variables/add-template-variables/index.md b/docs/sources/dashboards/variables/add-template-variables/index.md
index c98f9d09472..fa4e49ef5a4 100644
--- a/docs/sources/dashboards/variables/add-template-variables/index.md
+++ b/docs/sources/dashboards/variables/add-template-variables/index.md
@@ -169,7 +169,7 @@ Query expressions are different for each data source. For more information, refe
    - If you need more room in a single input field query editor, then hover your cursor over the lines in the lower right corner of the field and drag downward to expand.
 
 1. (Optional) In the **Regex** field, type a regex expression to filter or capture specific parts of the names returned by your data source query. To see examples, refer to [Filter variables with regex](#filter-variables-with-regex).
-1. In the **Sort** drop-down list, select the sort order for values to be displayed in the dropdown list. The default option, **Disabled**, means that the order of options returned by your data source query will be used.
+1. In the **Sort** drop-down list, select the sort order for values to be displayed in the dropdown list. The default option, **Disabled**, means that the order of options returned by your data source query is used.
 1. Under **Refresh**, select when the variable should update options:
 
    - **On dashboard load** - Queries the data source every time the dashboard loads. This slows down dashboard loading, because the variable query needs to be completed before dashboard can be initialized.
@@ -268,8 +268,8 @@ You can use an interval variable as a parameter to group by time (for InfluxDB),
 
    This option allows you to specify how many times the current time range should be divided to calculate the current `auto` time span. If you turn it on, then two more options appear:
 
-   - **Step count** - Select the number of times the current time range will be divided to calculate the value, similar to the **Max data points** query option. For example, if the current visible time range is 30 minutes, then the `auto` interval groups the data into 30 one-minute increments. The default value is 30 steps.
-   - **Min interval** - The minimum threshold below which the step count intervals will not divide the time. To continue the 30 minute example, if the minimum interval is set to 2m, then Grafana would group the data into 15 two-minute increments.
+   - **Step count** - Select the number of times the current time range is divided to calculate the value, similar to the **Max data points** query option. For example, if the current visible time range is 30 minutes, then the `auto` interval groups the data into 30 one-minute increments. The default value is 30 steps.
+   - **Min interval** - The minimum threshold below which the step count intervals does not divide the time. To continue the 30 minute example, if the minimum interval is set to 2m, then Grafana would group the data into 15 two-minute increments.
 
 1. In the **Preview of values** section, Grafana displays a list of the current variable values. Review them to ensure they match what you expect.
 1. Click **Save dashboard**.
@@ -327,7 +327,7 @@ Now you can [filter data on the dashboard](ref:filter-dashboard).
 Interpolating a variable with multiple values selected is tricky as it is not straight forward how to format the multiple values into a string that is valid in the given context where the variable is used. Grafana tries to solve this by allowing each data source plugin to inform the templating interpolation engine what format to use for multiple values.
 
 {{% admonition type="note" %}}
-The **Custom all value** option on the variable must be blank for Grafana to format all values into a single string. If it is left blank, then Grafana concatenates (adds together) all the values in the query. Something like `value1,value2,value3`. If a custom `all` value is used, then instead the value will be something like `*` or `all`.
+The **Custom all value** option on the variable must be blank for Grafana to format all values into a single string. If it is left blank, then Grafana concatenates (adds together) all the values in the query. Something like `value1,value2,value3`. If a custom `all` value is used, then instead the value is something like `*` or `all`.
 {{% /admonition %}}
 
 #### Multi-value variables with a Graphite data source
@@ -363,7 +363,7 @@ Enter regex, globs, or lucene syntax in the **Custom all value** field to define
 
 By default the `All` value includes all options in combined expression. This can become very long and can have performance problems. Sometimes it can be better to specify a custom all value, like a wildcard regex.
 
-In order to have custom regex, globs, or lucene syntax in the **Custom all value** option, it is never escaped so you will have to think about what is a valid value for your data source.
+In order to have custom regex, globs, or lucene syntax in the **Custom all value** option, it is never escaped so you have to think about what is a valid value for your data source.
 
 ## Global variables
 
@@ -393,7 +393,7 @@ You can use this variable in URLs, as well. For example, you can send a user to
 
 You can use the `$__interval` variable as a parameter to group by time (for InfluxDB, MySQL, Postgres, MSSQL), Date histogram interval (for Elasticsearch), or as a _summarize_ function parameter (for Graphite).
 
-Grafana automatically calculates an interval that can be used to group by time in queries. When there are more data points than can be shown on a graph, then queries can be made more efficient by grouping by a larger interval. It is more efficient to group by 1 day than by 10s when looking at 3 months of data and the graph will look the same and the query will be faster. The `$__interval` is calculated using the time range and the width of the graph (the number of pixels).
+Grafana automatically calculates an interval that can be used to group by time in queries. When there are more data points than can be shown on a graph, then queries can be made more efficient by grouping by a larger interval. It is more efficient to group by 1 day than by 10s when looking at 3 months of data. The graph looks the same and the query is faster. The `$__interval` is calculated using the time range and the width of the graph (the number of pixels).
 
 Approximate Calculation: `(to - from) / resolution`
 
@@ -409,7 +409,7 @@ This variable is the `$__interval` variable in milliseconds, not a time interval
 
 ### $\_\_name
 
-This variable is only available in the Singlestat panel and can be used in the prefix or suffix fields on the Options tab. The variable will be replaced with the series name or alias.
+This variable is only available in the Singlestat panel and can be used in the prefix or suffix fields on the Options tab. The variable is replaced with the series name or alias.
 
 {{% admonition type="note" %}}
 The Singlestat panel is no longer available from Grafana 8.0.
@@ -453,7 +453,7 @@ This is used in several places, including:
 
 The `$__timezone` variable returns the currently selected time zone, either `utc` or an entry of the IANA time zone database (for example, `America/New_York`).
 
-If the currently selected time zone is _Browser Time_, Grafana will try to determine your browser time zone.
+If the currently selected time zone is _Browser Time_, Grafana tries to determine your browser time zone.
 
 ## Chained variables
 
@@ -605,7 +605,7 @@ SHOW TAG VALUES WITH KEY = "cpu" WHERE "datacenter" =~ /^Europe/ AND "host" =~ /
 
 ### Best practices and tips
 
-The following practices will make your dashboards and variables easier to use.
+The following practices make your dashboards and variables easier to use.
 
 #### Creating new linked variables
 
@@ -623,7 +623,7 @@ You can change the orders of variables in the dashboard variable list by clickin
 
 #### Complexity consideration
 
-The more layers of dependency you have in variables, the longer it will take to update dashboards after you change variables.
+The more layers of dependency you have in variables, the longer it takes to update dashboards after you change variables.
 
 For example, if you have a series of four linked variables (country, region, server, metric) and you change a root variable value (country), then Grafana must run queries for all the dependent variables before it updates the visualizations in the dashboard.
 

From bc398109f9e2a8b37c7af62c53631e04824e0e04 Mon Sep 17 00:00:00 2001
From: Isabel Matwawana <76437239+imatwawana@users.noreply.github.com>
Date: Mon, 13 Jan 2025 13:53:48 -0500
Subject: [PATCH 05/24] Docs: Add Google Sheets to unsupported list (#98536)

---
 .../share-dashboards-panels/shared-dashboards/index.md           | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/sources/dashboards/share-dashboards-panels/shared-dashboards/index.md b/docs/sources/dashboards/share-dashboards-panels/shared-dashboards/index.md
index 43f71608d8f..f30bcd6337e 100644
--- a/docs/sources/dashboards/share-dashboards-panels/shared-dashboards/index.md
+++ b/docs/sources/dashboards/share-dashboards-panels/shared-dashboards/index.md
@@ -245,6 +245,7 @@ guaranteed because plugin developers can override this functionality. The follow
 ### Unsupported
 
 - Graphite
+- Google Sheets
 - Dynatrace
 
 ### Unconfirmed

From dc61a8c62e739dbd121c9b572443d5d02959f750 Mon Sep 17 00:00:00 2001
From: Scott Lepper <scott.lepper@gmail.com>
Date: Mon, 13 Jan 2025 14:38:05 -0500
Subject: [PATCH 06/24] [search] playlist - support legacy uid filter (#98898)

---
 public/app/features/search/service/unified.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/public/app/features/search/service/unified.ts b/public/app/features/search/service/unified.ts
index 65e8bbf82f5..9e379873cc3 100644
--- a/public/app/features/search/service/unified.ts
+++ b/public/app/features/search/service/unified.ts
@@ -222,6 +222,11 @@ export class UnifiedSearcher implements GrafanaSearcher {
     if (query.name?.length) {
       uri += '&' + query.name.map((name) => `name=${encodeURIComponent(name)}`).join('&');
     }
+
+    if (query.uid?.length) {
+      // legacy support for filtering by dashboard uid
+      uri += '&' + query.uid.map((name) => `name=${encodeURIComponent(name)}`).join('&');
+    }
     return uri;
   }
 

From ab6d82a33c938e1527a28a276638eb00d618bc37 Mon Sep 17 00:00:00 2001
From: Larissa Wandzura <126723338+lwandz13@users.noreply.github.com>
Date: Mon, 13 Jan 2025 13:47:44 -0600
Subject: [PATCH 07/24] Docs: MySQL data source updates/revamp (#98652)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* made initial edits

* continued updates

* finished initial config doc updates

* updates

* updates to query editor

* edits to query editor

* final edits prior to PR

* more final edits :-)

* edits based on feedback meeting

* fixed some spelling and grammar issues

* final edits

* ran prettier

* minor change to intro description

* Fix prettier

* Update docs/sources/datasources/mysql/query-editor/_index.md

Co-authored-by: Zoltán Bedi <zoltan.bedi@gmail.com>

* Update docs/sources/datasources/mysql/query-editor/_index.md

Co-authored-by: Zoltán Bedi <zoltan.bedi@gmail.com>

* Update docs/sources/datasources/mysql/query-editor/_index.md

Co-authored-by: Zoltán Bedi <zoltan.bedi@gmail.com>

* edits based on feedback

* fixed mistake

* Fix prettier

* fixed ref UIs, edits based on feedback

* one minor change

* ran prettier again

---------

Co-authored-by: Zoltán Bedi <zoltan.bedi@gmail.com>
---
 docs/sources/datasources/mysql/_index.md      | 608 ++----------------
 .../datasources/mysql/configuration/_index.md | 211 ++++++
 .../datasources/mysql/query-editor/_index.md  | 440 +++++++++++++
 3 files changed, 689 insertions(+), 570 deletions(-)
 create mode 100644 docs/sources/datasources/mysql/configuration/_index.md
 create mode 100644 docs/sources/datasources/mysql/query-editor/_index.md

diff --git a/docs/sources/datasources/mysql/_index.md b/docs/sources/datasources/mysql/_index.md
index 72923a252ae..33067e51983 100644
--- a/docs/sources/datasources/mysql/_index.md
+++ b/docs/sources/datasources/mysql/_index.md
@@ -2,7 +2,7 @@
 aliases:
   - ../data-sources/mysql/
   - ../features/datasources/mysql/
-description: Guide for using MySQL in Grafana
+description: introduction to the MySQL data source in Grafana
 keywords:
   - grafana
   - mysql
@@ -16,584 +16,52 @@ menuTitle: MySQL
 title: MySQL data source
 weight: 1000
 refs:
-  add-template-variables-interval:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval
-  query-transform-data:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
-  add-template-variables-interval-ms:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval_ms
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval_ms
-  variables:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
-  provisioning-data-sources:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/provisioning/#data-sources
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/provisioning/#data-sources
-  variable-syntax-advanced-variable-format-options:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
-  data-source-management:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
-  configure-standard-options-display-name:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/#display-name
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/#display-name
   annotate-visualizations:
     - pattern: /docs/grafana/
       destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
     - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
+  configure-mysql-data-source:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configuration/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configuration/
+  mysql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+  alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/
+  transformations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/transform-data/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/transform-data/
 ---
 
 # MySQL data source
 
-> Starting from Grafana v5.1 you can name the time column _time_ in addition to earlier supported _time_sec_. Usage of _time_sec_ will eventually be deprecated.
+Grafana ships with a built-in MySQL data source plugin that allows you to query and visualize data from a MySQL-compatible database like MariaDB or Percona Server. You don't need to install a plugin in order to add the MySQL data source to your Grafana instance.
 
-Grafana ships with a built-in MySQL data source plugin that allows you to query and visualize data from a MySQL compatible database like MariaDB or Percona Server.
+Grafana offers several configuration options for this data source as well as a visual and code-based query editor.
 
-For instructions on how to add a data source to Grafana, refer to the [administration documentation](ref:data-source-management).
-Only users with the organization administrator role can add data sources.
-Administrators can also [configure the data source via YAML](#provision-the-data-source) with Grafana's provisioning system.
+## Get started with the MySQL data source
+
+The following documents will help you get started with the MySQL data source in Grafana:
+
+- [Configure the MySQL data source](ref:configure-mysql-data-source)
+- [MySQL query editor](ref:mysql-query-editor)
+
+Once you have configured the data source you can:
+
+- Add [annotations](ref:annotate-visualizations)
+- Set up [alerting](ref:alerting)
+- Add [transformations](ref:transformations)
+
+View a MySQL overview on Grafana Play:
 
 {{< docs/play title="MySQL Overview" url="https://play.grafana.org/d/edyh1ib7db6rkb/mysql-overview" >}}
-
-## Configure the data source
-
-**To access the data source configuration page:**
-
-1. Click **Connections** in the left-side menu.
-1. Under Your connections, click **Data sources**.
-1. Enter `MySQL` in the search bar.
-1. Select **MySQL**.
-
-   The **Settings** tab of the data source is displayed.
-
-1. Set the data source's basic configuration options.
-
-| Name                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Name**                      | The data source name. This is how you refer to the data source in panels and queries.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **Default**                   | Default data source means that it will be pre-selected for new panels.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| **Host**                      | The IP address/hostname and optional port of your MySQL instance.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| **Database**                  | Name of your MySQL database.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| **User**                      | Database user's login/username                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| **Password**                  | Database user's password                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| **Session Timezone**          | Specifies the timezone used in the database session, such as `Europe/Berlin` or `+02:00`. Required if the timezone of the database (or the host of the database) is set to something other than UTC. Set this to `+00:00` so Grafana can handle times properly. Set the value used in the session with `SET time_zone='...'`. If you leave this field empty, the timezone will not be updated. For more information, refer to [MySQL Server Time Zone Support](https://dev.mysql.com/doc/en/time-zone-support.html).                                                                                                                                      |
-| **Max open**                  | The maximum number of open connections to the database, default `100`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| **Max idle**                  | The maximum number of connections in the idle connection pool, default `100`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| **Auto (max idle)**           | Toggle to set the maximum number of idle connections to the number of maximum open connections. Default is `true`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| **Allow cleartext passwords** | Allows the use of the [cleartext client side plugin](https://dev.mysql.com/doc/en/cleartext-pluggable-authentication.html) as required by a specific type of account, such as one defined with the [PAM authentication plugin](https://dev.mysql.com/doc/en/pam-pluggable-authentication.html). <br />**Sending passwords in clear text may be a security problem in some configurations**. To avoid password issues, it is recommended that clients connect to a MySQL server using a method that protects the password. Possibilities include [TLS / SSL](https://github.com/go-sql-driver/mysql#tls), IPsec, or a private network. Default is `false`. |
-| **Max lifetime**              | The maximum amount of time in seconds a connection may be reused. This should always be lower than configured [wait_timeout](https://dev.mysql.com/doc/en/server-system-variables.html#sysvar_wait_timeout) in MySQL. The default is `14400` or 4 hours.                                                                                                                                                                                                                                                                                                                                                                                                  |
-
-### Min time interval
-
-The **Min time interval** setting defines a lower limit for the [`$__interval`](ref:add-template-variables-interval) and [`$__interval_ms`](ref:add-template-variables-interval-ms) variables.
-
-This value _must_ be formatted as a number followed by a valid time identifier:
-
-| Identifier | Description |
-| ---------- | ----------- |
-| `y`        | year        |
-| `M`        | month       |
-| `w`        | week        |
-| `d`        | day         |
-| `h`        | hour        |
-| `m`        | minute      |
-| `s`        | second      |
-| `ms`       | millisecond |
-
-We recommend setting this value to match your MySQL write frequency.
-For example, use `1m` if MySQL writes data every minute.
-
-You can also override this setting in a dashboard panel under its data source options.
-
-### Database User Permissions (Important!)
-
-The database user you specify when you add the data source should only be granted SELECT permissions on
-the specified database and tables you want to query. Grafana does not validate that the query is safe. The query
-could include any SQL statement. For example, statements like `USE otherdb;` and `DROP TABLE user;` would be
-executed. To protect against this we **Highly** recommend you create a specific mysql user with restricted permissions.
-
-Example:
-
-```sql
- CREATE USER 'grafanaReader' IDENTIFIED BY 'password';
- GRANT SELECT ON mydatabase.mytable TO 'grafanaReader';
-```
-
-You can use wildcards (`*`) in place of database or table if you want to grant access to more databases and tables.
-
-### Provision the data source
-
-You can define and configure the data source in YAML files as part of Grafana's provisioning system.
-For more information about provisioning, and for available configuration options, refer to [Provisioning Grafana](ref:provisioning-data-sources).
-
-#### Provisioning examples
-
-##### Basic Provisioning
-
-```yaml
-apiVersion: 1
-
-datasources:
-  - name: MySQL
-    type: mysql
-    url: localhost:3306
-    user: grafana
-    jsonData:
-      database: grafana
-      maxOpenConns: 100
-      maxIdleConns: 100
-      maxIdleConnsAuto: true
-      connMaxLifetime: 14400
-    secureJsonData:
-      password: ${GRAFANA_MYSQL_PASSWORD}
-```
-
-##### Using TLS verification
-
-```yaml
-apiVersion: 1
-
-datasources:
-  - name: MySQL
-    type: mysql
-    url: localhost:3306
-    user: grafana
-    jsonData:
-      tlsAuth: true
-      database: grafana
-      maxOpenConns: 100
-      maxIdleConns: 100
-      maxIdleConnsAuto: true
-      connMaxLifetime: 14400
-    secureJsonData:
-      password: ${GRAFANA_MYSQL_PASSWORD}
-      tlsClientCert: ${GRAFANA_TLS_CLIENT_CERT}
-      tlsCACert: ${GRAFANA_TLS_CA_CERT}
-```
-
-##### Use TLS and Skip Certificate Verification
-
-```yaml
-apiVersion: 1
-
-datasources:
-  - name: MySQL
-    type: mysql
-    url: localhost:3306
-    user: grafana
-    jsonData:
-      tlsAuth: true
-      tlsSkipVerify: true
-      database: grafana
-      maxOpenConns: 100
-      maxIdleConns: 100
-      maxIdleConnsAuto: true
-      connMaxLifetime: 14400
-    secureJsonData:
-      password: ${GRAFANA_MYSQL_PASSWORD}
-      tlsClientCert: ${GRAFANA_TLS_CLIENT_CERT}
-      tlsCACert: ${GRAFANA_TLS_CA_CERT}
-```
-
-## Query builder
-
-{{< figure src="/static/img/docs/v92/mysql_query_builder.png" class="docs-image--no-shadow" >}}
-
-The MySQL query builder is available when editing a panel using a MySQL data source.
-
-This topic explains querying specific to the MySQL data source.
-For general documentation on querying data sources in Grafana, see [Query and transform data](ref:query-transform-data).
-
-You can run the built query by pressing the `Run query` button in the top right corner of the editor.
-
-### Format
-
-The response from MySQL can be formatted as either a table or as a time series. To use the time series format one of the columns must be named `time`.
-
-### Dataset and Table selection
-
-{{% admonition type="note" %}}
-If your table or database name contains a reserved word or a [prohibited character](https://dev.mysql.com/doc/en/identifiers.html) the editor will put quotes around the name. For example, the name `table-name` will be quoted with backticks - `` `table-name` ``.
-{{% /admonition %}}
-
-In the dataset dropdown, choose the MySQL database to query. The dropdown is be populated with the databases that the user has access to.
-When the dataset is selected, the table dropdown is populated with the tables that are available.
-
-**Note:** If a default database has been configured through the Data Source Configuration page (or through a provisioning configuration file), the user will only be able to use that single preconfigured database for querying.
-
-### Columns and Aggregation functions (SELECT)
-
-Using the dropdown, select a column to include in the data. You can also specify an optional aggregation function.
-
-Add further value columns by clicking the plus button and another column dropdown appears.
-
-{{< docs/shared source="grafana" lookup="datasources/sql-query-builder-macros.md" version="<GRAFANA_VERSION>" >}}
-
-### Filter data (WHERE)
-
-To add a filter, toggle the **Filter** switch at the top of the editor.
-This reveals a **Filter by column value** section with two dropdown selectors.
-
-Use the first dropdown to choose whether all of the filters need to match (`AND`), or if only one of the filters needs to match (`OR`).
-Use the second dropdown to choose a filter.
-
-To filter on more columns, click the plus (`+`) button to the right of the condition dropdown.
-
-To remove a filter, click the `x` button next to that filter's dropdown.
-
-After selecting a date type column, you can choose Macros from the operators list and select timeFilter which will add the $\_\_timeFilter macro to the query with the selected date column.
-
-### Group By
-
-To group the results by column, flip the group switch at the top of the editor. You can then choose which column to group the results by. The group by clause can be removed by pressing the X button.
-
-### Preview
-
-By flipping the preview switch at the top of the editor, you can get a preview of the SQL query generated by the query builder.
-
-## Code editor
-
-{{< figure src="/static/img/docs/v92/sql_code_editor.png" class="docs-image--no-shadow" >}}
-
-To make advanced queries, switch to the code editor by clicking `code` in the top right corner of the editor. The code editor support autocompletion of tables, columns, SQL keywords, standard sql functions, Grafana template variables and Grafana macros. Columns cannot be completed before a table has been specified.
-
-You can expand the code editor by pressing the `chevron` pointing downwards in the lower right corner of the code editor.
-
-`CTRL/CMD + Return` works as a keyboard shortcut to run the query.
-
-## Macros
-
-To simplify syntax and to allow for dynamic parts, like date range filters, the query can contain macros.
-
-| Macro example                                         | Description                                                                                                                                                                                                  |
-| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `$__time(dateColumn)`                                 | Will be replaced by an expression to convert to a UNIX timestamp and rename the column to `time_sec`. For example, _UNIX_TIMESTAMP(dateColumn) as time_sec_                                                  |
-| `$__timeEpoch(dateColumn)`                            | Will be replaced by an expression to convert to a UNIX timestamp and rename the column to `time_sec`. For example, _UNIX_TIMESTAMP(dateColumn) as time_sec_                                                  |
-| `$__timeFilter(dateColumn)`                           | Will be replaced by a time range filter using the specified column name. For example, _dateColumn BETWEEN FROM_UNIXTIME(1494410783) AND FROM_UNIXTIME(1494410983)_                                           |
-| `$__timeFrom()`                                       | Will be replaced by the start of the currently active time selection. For example, _FROM_UNIXTIME(1494410783)_                                                                                               |
-| `$__timeTo()`                                         | Will be replaced by the end of the currently active time selection. For example, _FROM_UNIXTIME(1494410983)_                                                                                                 |
-| `$__timeGroup(dateColumn,'5m')`                       | Will be replaced by an expression usable in GROUP BY clause. For example, *cast(cast(UNIX_TIMESTAMP(dateColumn)/(300) as signed)*300 as signed),\*                                                           |
-| `$__timeGroup(dateColumn,'5m', 0)`                    | Same as above but with a fill parameter so missing points in that series will be added by grafana and 0 will be used as value (only works with time series queries).                                         |
-| `$__timeGroup(dateColumn,'5m', NULL)`                 | Same as above but NULL will be used as value for missing points (only works with time series queries).                                                                                                       |
-| `$__timeGroup(dateColumn,'5m', previous)`             | Same as above but the previous value in that series will be used as fill value if no value has been seen yet NULL will be used (only works with time series queries).                                        |
-| `$__timeGroupAlias(dateColumn,'5m')`                  | Will be replaced identical to $\_\_timeGroup but with an added column alias.                                                                                                                                 |
-| `$__unixEpochFilter(dateColumn)`                      | Will be replaced by a time range filter using the specified column name with times represented as Unix timestamp. For example, _dateColumn > 1494410783 AND dateColumn < 1494497183_                         |
-| `$__unixEpochFrom()`                                  | Will be replaced by the start of the currently active time selection as Unix timestamp. For example, _1494410783_                                                                                            |
-| `$__unixEpochTo()`                                    | Will be replaced by the end of the currently active time selection as Unix timestamp. For example, _1494497183_                                                                                              |
-| `$__unixEpochNanoFilter(dateColumn)`                  | Will be replaced by a time range filter using the specified column name with times represented as nanosecond timestamp. For example, _dateColumn > 1494410783152415214 AND dateColumn < 1494497183142514872_ |
-| `$__unixEpochNanoFrom()`                              | Will be replaced by the start of the currently active time selection as nanosecond timestamp. For example, _1494410783152415214_                                                                             |
-| `$__unixEpochNanoTo()`                                | Will be replaced by the end of the currently active time selection as nanosecond timestamp. For example, _1494497183142514872_                                                                               |
-| `$__unixEpochGroup(dateColumn,'5m', [fillmode])`      | Same as $\_\_timeGroup but for times stored as Unix timestamp (`fillMode` only works with time series queries).                                                                                              |
-| `$__unixEpochGroupAlias(dateColumn,'5m', [fillmode])` | Same as above but also adds a column alias (`fillMode` only works with time series queries).                                                                                                                 |
-
-## Table queries
-
-If the `Format as` query option is set to `Table` then you can basically do any type of SQL query. The table panel will automatically show the results of whatever columns and rows your query returns.
-
-Query editor with example query:
-
-{{< figure src="/static/img/docs/v45/mysql_table_query.png" >}}
-
-The query:
-
-```sql
-SELECT
-  title as 'Title',
-  user.login as 'Created By' ,
-  dashboard.created as 'Created On'
- FROM dashboard
-INNER JOIN user on user.id = dashboard.created_by
-WHERE $__timeFilter(dashboard.created)
-```
-
-You can control the name of the Table panel columns by using regular `as ` SQL column selection syntax.
-
-The resulting table panel:
-
-![](/static/img/docs/v43/mysql_table.png)
-
-## Time series queries
-
-The examples in this section query the following table:
-
-```text
-+---------------------+--------------+---------------------+----------+
-| time_date_time      | value_double | CreatedAt           | hostname |
-+---------------------+--------------+---------------------+----------+
-| 2020-01-02 03:05:00 | 3.0          | 2020-01-02 03:05:00 | 10.0.1.1 |
-| 2020-01-02 03:06:00 | 4.0          | 2020-01-02 03:06:00 | 10.0.1.2 |
-| 2020-01-02 03:10:00 | 6.0          | 2020-01-02 03:10:00 | 10.0.1.1 |
-| 2020-01-02 03:11:00 | 7.0          | 2020-01-02 03:11:00 | 10.0.1.2 |
-| 2020-01-02 03:20:00 | 5.0          | 2020-01-02 03:20:00 | 10.0.1.2 |
-+---------------------+--------------+---------------------+----------+
-```
-
-If the `Format as` query option is set to `Time Series` then the query must have a column named time that returns either a SQL datetime or any numeric datatype representing Unix epoch in seconds. In addition, result sets of time series queries must be sorted by time for panels to properly visualize the result.
-
-A time series query result is returned in a [wide data frame format](https://grafana.com/developers/plugin-tools/key-concepts/data-frames#wide-format). Any column except time or of type string transforms into value fields in the data frame query result. Any string column transforms into field labels in the data frame query result.
-
-> For backward compatibility, there's an exception to the above rule for queries that return three columns including a string column named metric. Instead of transforming the metric column into field labels, it becomes the field name, and then the series name is formatted as the value of the metric column. See the example with the metric column below.
-
-To optionally customize the default series name formatting, refer to [Standard options definitions](ref:configure-standard-options-display-name).
-
-**Example with `metric` column:**
-
-```sql
-SELECT
-  $__timeGroupAlias(time_date_time,'5m'),
-  min(value_double),
-  'min' as metric
-FROM test_data
-WHERE $__timeFilter(time_date_time)
-GROUP BY time
-ORDER BY time
-```
-
-Data frame result:
-
-```text
-+---------------------+-----------------+
-| Name: time          | Name: min       |
-| Labels:             | Labels:         |
-| Type: []time.Time   | Type: []float64 |
-+---------------------+-----------------+
-| 2020-01-02 03:05:00 | 3               |
-| 2020-01-02 03:10:00 | 6               |
-| 2020-01-02 03:20:00 | 5               |
-+---------------------+-----------------+
-```
-
-**Example using the fill parameter in the $\_\_timeGroupAlias macro to convert null values to be zero instead:**
-
-```sql
-SELECT
-  $__timeGroupAlias(createdAt,'5m',0),
-  sum(value_double) as value,
-  hostname
-FROM test_data
-WHERE
-  $__timeFilter(createdAt)
-GROUP BY time, hostname
-ORDER BY time
-```
-
-Given the data frame result in the following example and using the graph panel, you will get two series named _value 10.0.1.1_ and _value 10.0.1.2_. To render the series with a name of _10.0.1.1_ and _10.0.1.2_ , use a [Standard options definitions](ref:configure-standard-options-display-name) display value of `${__field.labels.hostname}`.
-
-Data frame result:
-
-```text
-+---------------------+---------------------------+---------------------------+
-| Name: time          | Name: value               | Name: value               |
-| Labels:             | Labels: hostname=10.0.1.1 | Labels: hostname=10.0.1.2 |
-| Type: []time.Time   | Type: []float64           | Type: []float64           |
-+---------------------+---------------------------+---------------------------+
-| 2020-01-02 03:05:00 | 3                         | 4                         |
-| 2020-01-02 03:10:00 | 6                         | 7                         |
-| 2020-01-02 03:15:00 | 0                         | 0                         |
-| 2020-01-02 03:20:00 | 0                         | 5                         |
-+---------------------+---------------------------+---------------------------+
-```
-
-**Example with multiple columns:**
-
-```sql
-SELECT
-  $__timeGroupAlias(time_date_time,'5m'),
-  min(value_double) as min_value,
-  max(value_double) as max_value
-FROM test_data
-WHERE $__timeFilter(time_date_time)
-GROUP BY time
-ORDER BY time
-```
-
-Data frame result:
-
-```text
-+---------------------+-----------------+-----------------+
-| Name: time          | Name: min_value | Name: max_value |
-| Labels:             | Labels:         | Labels:         |
-| Type: []time.Time   | Type: []float64 | Type: []float64 |
-+---------------------+-----------------+-----------------+
-| 2020-01-02 03:05:00 | 3               | 4               |
-| 2020-01-02 03:10:00 | 6               | 7               |
-| 2020-01-02 03:20:00 | 5               | 5               |
-+---------------------+-----------------+-----------------+
-```
-
-Currently, there is no support for a dynamic group by time based on time range and panel width.
-This is something we plan to add.
-
-## Templating
-
-This feature is currently available in the nightly builds and will be included in the 5.0.0 release.
-
-Instead of hard-coding things like server, application and sensor name in your metric queries you can use variables in their place. Variables are shown as dropdown select boxes at the top of the dashboard. These dropdowns make it easy to change the data being displayed in your dashboard.
-
-Check out the [Templating](ref:variables) documentation for an introduction to the templating feature and the different types of template variables.
-
-### Query Variable
-
-If you add a template variable of the type `Query`, you can write a MySQL query that can
-return things like measurement names, key names or key values that are shown as a dropdown select box.
-
-For example, you can have a variable that contains all values for the `hostname` column in a table if you specify a query like this in the templating variable _Query_ setting.
-
-```sql
-SELECT hostname FROM my_host
-```
-
-A query can return multiple columns and Grafana will automatically create a list from them. For example, the query below will return a list with values from `hostname` and `hostname2`.
-
-```sql
-SELECT my_host.hostname, my_other_host.hostname2 FROM my_host JOIN my_other_host ON my_host.city = my_other_host.city
-```
-
-To use time range dependent macros like `$__timeFilter(column)` in your query the refresh mode of the template variable needs to be set to _On Time Range Change_.
-
-```sql
-SELECT event_name FROM event_log WHERE $__timeFilter(time_column)
-```
-
-Another option is a query that can create a key/value variable. The query should return two columns that are named `__text` and `__value`. The `__text` column value should be unique (if it is not unique then the first value is used). The options in the dropdown will have a text and value that allows you to have a friendly name as text and an id as the value. An example query with `hostname` as the text and `id` as the value:
-
-```sql
-SELECT hostname AS __text, id AS __value FROM my_host
-```
-
-You can also create nested variables. For example if you had another variable named `region`. Then you could have
-the hosts variable only show hosts from the current selected region with a query like this (if `region` is a multi-value variable then use the `IN` comparison operator rather than `=` to match against multiple values):
-
-```sql
-SELECT hostname FROM my_host  WHERE region IN($region)
-```
-
-#### Using `__searchFilter` to filter results in Query Variable
-
-Using `__searchFilter` in the query field will filter the query result based on what the user types in the dropdown select box.
-When nothing has been entered by the user the default value for `__searchFilter` is `%`.
-
-> Important that you surround the `__searchFilter` expression with quotes as Grafana does not do this for you.
-
-The example below shows how to use `__searchFilter` as part of the query field to enable searching for `hostname` while the user types in the dropdown select box.
-
-Query
-
-```sql
-SELECT hostname FROM my_host  WHERE hostname LIKE '$__searchFilter'
-```
-
-### Using Variables in Queries
-
-Template variable values are only quoted when the template variable is a `multi-value`.
-
-If the variable is a multi-value variable then use the `IN` comparison operator rather than `=` to match against multiple values.
-
-There are two syntaxes:
-
-`$<varname>` Example with a template variable named `hostname`:
-
-```sql
-SELECT
-  UNIX_TIMESTAMP(atimestamp) as time,
-  aint as value,
-  avarchar as metric
-FROM my_table
-WHERE $__timeFilter(atimestamp) and hostname in($hostname)
-ORDER BY atimestamp ASC
-```
-
-`[[varname]]` Example with a template variable named `hostname`:
-
-```sql
-SELECT
-  UNIX_TIMESTAMP(atimestamp) as time,
-  aint as value,
-  avarchar as metric
-FROM my_table
-WHERE $__timeFilter(atimestamp) and hostname in([[hostname]])
-ORDER BY atimestamp ASC
-```
-
-#### Disabling Quoting for Multi-value Variables
-
-Grafana automatically creates a quoted, comma-separated string for multi-value variables. For example: if `server01` and `server02` are selected then it will be formatted as: `'server01', 'server02'`. To disable quoting, use the csv formatting option for variables:
-
-`${servers:csv}`
-
-Read more about variable formatting options in the [Variables](ref:variable-syntax-advanced-variable-format-options) documentation.
-
-## Annotations
-
-[Annotations](ref:annotate-visualizations) allow you to overlay rich event information on top of graphs. You add annotation queries via the Dashboard menu / Annotations view.
-
-**Example query using time column with epoch values:**
-
-```sql
-SELECT
-  epoch_time as time,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__unixEpochFilter(epoch_time)
-```
-
-**Example region query using time and timeend columns with epoch values:**
-
-```sql
-SELECT
-  epoch_time as time,
-  epoch_timeend as timeend,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__unixEpochFilter(epoch_time)
-```
-
-**Example query using time column of native SQL date/time data type:**
-
-```sql
-SELECT
-  native_date_time as time,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__timeFilter(native_date_time)
-```
-
-| Name      | Description                                                                                                       |
-| --------- | ----------------------------------------------------------------------------------------------------------------- |
-| `time`    | The name of the date/time field. Could be a column with a native SQL date/time data type or epoch value.          |
-| `timeend` | Optional name of the end date/time field. Could be a column with a native SQL date/time data type or epoch value. |
-| `text`    | Event description field.                                                                                          |
-| `tags`    | Optional field name to use for event tags as a comma separated string.                                            |
-
-## Alerting
-
-Time series queries should work in alerting conditions. Table formatted queries are not yet supported in alert rule conditions.
diff --git a/docs/sources/datasources/mysql/configuration/_index.md b/docs/sources/datasources/mysql/configuration/_index.md
new file mode 100644
index 00000000000..d98aff95019
--- /dev/null
+++ b/docs/sources/datasources/mysql/configuration/_index.md
@@ -0,0 +1,211 @@
+---
+description: This document provides instructions for configuring the MySQL data source and explains available configuration options.
+keywords:
+  - grafana
+  - mysql
+  - guide
+  - configure
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Configure the MySQL data source
+title: Configure the MySQL data source
+weight: 10
+refs:
+  add-template-variables-interval:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/add-template-variables/#__interval
+  add-template-variables-interval-ms:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/#__interval_ms
+    - pattern: /docs/grafana-cloud/
+      destination: docs/grafana-cloud/visualizations/dashboards/variables/add-template-variables/#__interval_ms
+  provisioning-data-sources:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/provisioning/#data-sources
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/provisioning/#data-sources
+  data-source-management:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
+---
+
+# Configure the MySQL data source
+
+This document provides instructions for configuring the MySQL data source and explains available configuration options. For general information on managing data sources refer to [Data source management](ref:data-source-management).
+
+## Before you begin
+
+You must have the `Organization administrator` role in order to configure the MySQL data source.
+Administrators can also [configure the data source via YAML](#provision-the-data-source) with Grafana's provisioning system.
+
+Grafana ships with the MySQL plugin, so no additional installation is required.
+
+{{< admonition type="note" >}}
+When adding a data source, ensure the database user you specify has only `SELECT` permissions on the relevant database and tables. Grafana does not validate the safety of queries, which means they can include potentially harmful SQL statements, such as `USE otherdb;` or `DROP TABLE user;`, which could get executed. To minimize this risk, Grafana strongly recommends creating a dedicated MySQL user with restricted permissions.
+{{< /admonition >}}
+
+Example:
+
+```sql
+ CREATE USER 'grafanaReader' IDENTIFIED BY 'password';
+ GRANT SELECT ON mydatabase.mytable TO 'grafanaReader';
+```
+
+Use wildcards (`*`) in place of a database or table if you want to grant access to more databases and tables.
+
+## Add the MySQL data source
+
+To add the MySQL data source complete the following steps:
+
+1. Click **Connections** in the left-side menu.
+1. Click **Add new connection** and type `MySQL` in the search bar.
+1. Select the **MySQL data source** option.
+1. Click **Add new data source** in the upper right.
+
+You are taken to the **Settings** tab where you will configure the data source.
+
+## MySQL configuration options
+
+Following is a list of MySQL configuration options:
+
+- **Name** - Sets the name you use to refer to the data source in panels and queries. Examples:
+  `mysql-assets-1`, `mysqldb1`.
+- **Default** - Toggle to make this specific MySQL data source the default pre-selected data source in panels and visualizations.
+
+**Connection:**
+
+- **Host URL** - Enter the IP address/hostname and optional port of your MySQL instance. If the port is omitted the default 3306 port will be used.
+- **Database** - Enter the name of your MySQL database.
+
+**Authentication:**
+
+- **Username**- Enter the username used to connect to your MySQL database.
+- **Password** - Enter the password used to connect to the MySQL database.
+- **Use TLS Client Auth** - Toggle to enable TLS authentication using the client certificate specified in the secure JSON configuration. Refer to [Using TLS Connections](https://dev.mysql.com/doc/refman/8.4/en/mysql-cluster-tls-using.html) and [Configuring MySQL to Use Encrypted Connections](https://dev.mysql.com/doc/refman/8.4/en/using-encrypted-connections.html) for more information regarding TLS and configuring encrypted connections in MySQL. Provide the client certificate under **TLS/SSL Client Certificate**. Provide the key under **TLS/SSL Client Key**.
+- **With CA Cert** - Toggle to authenticate using a CA certificate. Required for verifying self-signed TLS Certs. Follow the instructions of your CA (Certificate Authority) to download the certificate file. Provide the root certificate under **TLS/SSL Root Certificate** if TLS/SSL mode requires it.
+- **Skip TLS Verification** - Toggle to skip verification of the MySQL server's TLS certificate chain and host name.
+- **Allow Cleartext Passwords** - Toggle to allow the use of the [cleartext client-side plugin](https://dev.mysql.com/doc/en/cleartext-pluggable-authentication.html) when required by a specific type of account, such as one defined with the [PAM authentication plugin](https://dev.mysql.com/doc/refman/8.4/en/pam-pluggable-authentication.html). Note that transmitting passwords in plain text can pose a security risk in certain configurations. To prevent password-related issues, it is recommended that clients connect to a MySQL server using a secure method that protects the password. Options include [TLS/SSL](https://github.com/go-sql-driver/mysql#tls), IPsec, or a private network.
+
+## Additional settings
+
+The following are additional MySQL settings.
+
+**MySQL options:**
+
+- **Session Timezone** - Specifies the timezone used in the database session, such as `Europe/Berlin` or `+02:00`. Required if the timezone of the database (or the host of the database) is set to something other than UTC. Set this to `+00:00` so Grafana can handle times properly. Set the value used in the session with `SET time_zone='...'`. If you leave this field empty, the timezone will not be updated. For more information, refer to [MySQL Server Time Zone Support](https://dev.mysql.com/doc/en/time-zone-support.html).
+- **Min time interval** - Defines a lower limit for the [`$__interval`](ref:add-template-variables-interval) and [`$__interval_ms`](ref:add-template-variables-interval-ms) variables. Grafana recommends aligning this setting with the data write frequency. For example, set it to `1m` if your data is written every minute. Refer to [Min time interval](#min-time-interval) for format examples.
+
+**Connection limits:**
+
+- **Max open** - The maximum number of open connections to the database, default `100`.
+- **Max idle** - The maximum number of connections in the idle connection pool, default `100`.
+- **Auto (max idle)** - Toggle to set the maximum number of idle connections to the number of maximum open connections. The default is `true`.
+- **Max lifetime** - The maximum amount of time in seconds a connection may be reused. This should always be lower than configured [wait_timeout](https://dev.mysql.com/doc/en/server-system-variables.html#sysvar_wait_timeout) in MySQL. The default is `14400`, or 4 hours.
+
+**Private data source connect:**
+
+**Private data source connect** - _Only for Grafana Cloud users._ Private data source connect, or PDC, allows you to establish a private, secured connection between a Grafana Cloud instance, or stack, and data sources secured within a private network. Click the drop-down to locate the URL for PDC. For more information regarding Grafana PDC refer to [Private data source connect (PDC)](https://grafana.com/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/).
+
+Click **Manage private data source connect** to be taken to your PDC connection page, where you’ll find your PDC configuration details.
+
+Once you have added your MySQL connection settings, click **Save & test** to test and save the data source connection.
+
+### Min time interval
+
+The **Min time interval** setting defines a lower limit for the [`$__interval`](ref:add-template-variables-interval) and [`$__interval_ms`](ref:add-template-variables-interval-ms) variables.
+
+This value must be formatted as a number followed by a valid time identifier:
+
+| Identifier | Description |
+| ---------- | ----------- |
+| `y`        | year        |
+| `M`        | month       |
+| `w`        | week        |
+| `d`        | day         |
+| `h`        | hour        |
+| `m`        | minute      |
+| `s`        | second      |
+| `ms`       | millisecond |
+
+You can override this setting in a dashboard panel under its data source options.
+
+## Provision the data source
+
+You can define and configure the data source in YAML files as part of Grafana's provisioning system.
+For more information about provisioning, and available configuration options, refer to [Provision Grafana](ref:provisioning-data-sources).
+
+### MySQL provisioning examples
+
+**Basic provisioning:**
+
+```yaml
+apiVersion: 1
+
+datasources:
+  - name: MySQL
+    type: mysql
+    url: localhost:3306
+    user: grafana
+    jsonData:
+      database: grafana
+      maxOpenConns: 100
+      maxIdleConns: 100
+      maxIdleConnsAuto: true
+      connMaxLifetime: 14400
+    secureJsonData:
+      password: ${GRAFANA_MYSQL_PASSWORD}
+```
+
+**Using TLS verification:**
+
+```yaml
+apiVersion: 1
+
+datasources:
+  - name: MySQL
+    type: mysql
+    url: localhost:3306
+    user: grafana
+    jsonData:
+      tlsAuth: true
+      database: grafana
+      maxOpenConns: 100
+      maxIdleConns: 100
+      maxIdleConnsAuto: true
+      connMaxLifetime: 14400
+    secureJsonData:
+      password: ${GRAFANA_MYSQL_PASSWORD}
+      tlsClientCert: ${GRAFANA_TLS_CLIENT_CERT}
+      tlsCACert: ${GRAFANA_TLS_CA_CERT}
+```
+
+**Use TLS and skip certificate verification:**
+
+```yaml
+apiVersion: 1
+
+datasources:
+  - name: MySQL
+    type: mysql
+    url: localhost:3306
+    user: grafana
+    jsonData:
+      tlsAuth: true
+      tlsSkipVerify: true
+      database: grafana
+      maxOpenConns: 100
+      maxIdleConns: 100
+      maxIdleConnsAuto: true
+      connMaxLifetime: 14400
+    secureJsonData:
+      password: ${GRAFANA_MYSQL_PASSWORD}
+      tlsClientCert: ${GRAFANA_TLS_CLIENT_CERT}
+      tlsCACert: ${GRAFANA_TLS_CA_CERT}
+```
diff --git a/docs/sources/datasources/mysql/query-editor/_index.md b/docs/sources/datasources/mysql/query-editor/_index.md
new file mode 100644
index 00000000000..f11f0218ea3
--- /dev/null
+++ b/docs/sources/datasources/mysql/query-editor/_index.md
@@ -0,0 +1,440 @@
+---
+description: This document describes the MySQL query editor.
+keywords:
+  - grafana
+  - mysql
+  - query
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: MySQL query editor
+title: MySQL query editor
+weight: 30
+refs:
+  variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/
+  variable-syntax-advanced-variable-format-options:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/variable-syntax/#advanced-variable-format-options
+  annotate-visualizations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
+  explore:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
+  query-transform-data:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/
+  panel-inspector:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/panel-inspector/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/panel-inspector/
+  query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/#query-editors
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/#query-editors
+  alert-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/
+  template-annotations-and-labels:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/templates/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/templates/
+---
+
+# MySQL query editor
+
+Grafana’s query editors are unique for each data source. For general information on Grafana query editors, refer to [Query editors](ref:query-editor). For general information on querying data sources in Grafana, refer to [Query and transform data](ref:query-transform-data).
+
+The MySQL query editor is located on the [Explore page](ref:explore). You can also access the MySQL query editor from a dashboard panel. Click the ellipsis in the upper right of the panel and select **Edit**.
+
+{{% admonition type="note" %}}
+If a default database is configured in the **Data Source Configuration page**, or via a provisioning configuration file, users will be restricted to querying only that pre-configured database. This feature is behind a feature flag and is available once you enable `sqlDatasourceDatabaseSelection`.
+{{% /admonition %}}
+
+## MySQL query editor components
+
+The MySQL query editor has two modes: **Builder** and **Code**.
+
+Builder mode helps you build a query using a visual interface. Code mode allows for advanced querying and offers support for complex SQL query writing.
+
+{{% admonition type="note" %}}
+If your table or database name contains a reserved word or a [prohibited character](https://dev.mysql.com/doc/en/identifiers.html) the editor will put quotes around the name. For example, the name `table-name` will be quoted with backticks - `` `table-name` ``.
+{{% /admonition %}}
+
+## MySQL Builder mode
+
+{{< figure alt="Builder mode" src="/media/docs/mysql/screenshot-mysql-query-editor.v11.3.png" class="docs-image--no-shadow" >}}
+
+The following components will help you build a MySQL query:
+
+- **Format** - Select a format response from the drop-down for the MySQL query. The default is **Table**. If you use the **Time series** format option, one of the columns must be `time`.
+
+- **Dataset** - Select a database to query from the drop-down.
+
+  - **Table** - Select a table from the drop-down. Tables correspond to the chosen database.
+
+  - **Data operations** - _Optional_ Select an aggregation from the drop-down. You can add multiple data operations by clicking the **+ sign**. Click the **X** to remove a data operation. Click the **garbage can icon** to remove the entire column.
+
+  - **Column** - Select a column on which to run the aggregation.
+
+  - **Alias** - _Optional_ Add an alias from the drop-down. You can also add your own alias by typing it in the box and clicking **Enter**. Remove an alias by clicking the **X**.
+
+- **Filter** - Toggle to add filters.
+
+  - **Filter by column value** - _Optional_ If you toggle **Filter** you can add a column to filter by from the drop-down. To filter on more columns, click the **+ sign** to the right of the condition drop-down. You can choose a variety of operators from the drop-down next to the condition. When multiple filters are added you can add an `AND` operator to display all true conditions or an `OR` operator to display any true conditions. Use the second drop-down to choose a filter. To remove a filter, click the `X` button next to that filter's drop-down. After selecting a date type column, you can choose **Macros** from the operators list and select `timeFilter` which will add the `$\_\_timeFilter` macro to the query with the selected date column.
+
+- **Group** - Toggle to add **Group by column**.
+
+  - **Group by column** - Select a column to filter by from the drop-down. Click the **+ sign** to filter by multiple columns. Click the **X** to remove a filter.
+
+- **Order** - Toggle to add an ORDER BY statement.
+
+  - **Order by** - Select a column to order by from the drop-down. Select ascending (`ASC`) or descending (`DESC`) order.
+  - **Limit** - You can add an optional limit on the number of retrieved results. Default is 50.
+
+- **Preview** - Toggle for a preview of the SQL query generated by the query builder. Preview is toggled on by default.
+
+## MySQL Code mode
+
+To create advanced queries, switch to **Code mode** by clicking **Code** in the upper right of the editor window. Code mode supports the auto-completion of tables, columns, SQL keywords, standard SQL functions, Grafana template variables, and Grafana macros. Columns cannot be completed before a table has been specified.
+
+{{< figure src="/static/img/docs/v92/sql_code_editor.png" class="docs-image--no-shadow" >}}
+
+Select **Table** or **Time Series** as the format. Click the **{}** in the bottom right to format the query. Click the **downward caret** to expand the Code mode editor. **CTRL/CMD + Return** serves as a keyboard shortcut to execute the query.
+
+{{% admonition type="warning" %}}
+Changes made to a query in Code mode will not transfer to Builder mode and will be discarded. You will be prompted to copy your code to the clipboard to save any changes.
+{{% /admonition %}}
+
+## Macros
+
+You can add macros to your queries to simplify the syntax and enable dynamic elements, such as date range filters.
+
+| Macro example                                         | Description                                                                                                                                                                                                               |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `$__time(dateColumn)`                                 | Replaces the value with an expression to convert to a UNIX timestamp and renames the column to `time_sec`. Example: _UNIX_TIMESTAMP(dateColumn) AS time_sec_.                                                             |
+| `$__timeEpoch(dateColumn)`                            | Replaces the value with an expression to convert to a UNIX Epoch timestamp and renames the column to `time_sec`. Example: _UNIX_TIMESTAMP(dateColumn) AS time_sec_.                                                       |
+| `$__timeFilter(dateColumn)`                           | Replaces the value a time range filter using the specified column name. Example: _dateColumn BETWEEN FROM_UNIXTIME(1494410783) AND FROM_UNIXTIME(1494410983)_                                                             |
+| `$__timeFrom()`                                       | Replaces the value with the start of the currently active time selection. Example: _FROM_UNIXTIME(1494410783)_                                                                                                            |
+| `$__timeTo()`                                         | Replaces the value with the end of the currently active time selection. Example: _FROM_UNIXTIME(1494410983)_                                                                                                              |
+| `$__timeGroup(dateColumn,'5m')`                       | Replaces the value with an expression suitable for use in a GROUP BY clause. Example: *cast(cast(UNIX_TIMESTAMP(dateColumn)/(300) as signed)*300 as signed),\*                                                            |
+| `$__timeGroup(dateColumn,'5m', 0)`                    | Same as the `$__timeGroup(dateColumn,'5m')` macro, but includes a fill parameter to ensure missing points in the series are added by Grafana, using 0 as the default value. **This applies only to time series queries.** |
+| `$__timeGroup(dateColumn,'5m', NULL)`                 | Same as the `$__timeGroup(dateColumn,'5m', 0)` but NULL is used as the value for missing points. **This applies only to time series queries.**                                                                            |
+| `$__timeGroup(dateColumn,'5m', previous)`             | Same as the `$__timeGroup(dateColumn,'5m', previous)` macro, but uses the previous value in the series as the fill value. If no previous value exists,`NULL` will be used. **This applies only to time series queries.**  |
+| `$__timeGroupAlias(dateColumn,'5m')`                  | Replaces the value identical to $\_\_timeGroup but with an added column alias.                                                                                                                                            |
+| `$__unixEpochFilter(dateColumn)`                      | Replaces the value by a time range filter using the specified column name with times represented as a UNIX timestamp. Example: _dateColumn > 1494410783 AND dateColumn < 1494497183_                                      |
+| `$__unixEpochFrom()`                                  | Replaces the value with the start of the currently active time selection as a UNIX timestamp. Example: _1494410783_                                                                                                       |
+| `$__unixEpochTo()`                                    | Replaces the value with the end of the currently active time selection as UNIX timestamp. Example: _1494497183_                                                                                                           |
+| `$__unixEpochNanoFilter(dateColumn)`                  | Replaces the value with a time range filter using the specified column name with time represented as a nanosecond timestamp. Example: _dateColumn > 1494410783152415214 AND dateColumn < 1494497183142514872_             |
+| `$__unixEpochNanoFrom()`                              | Replaces the value with the start of the currently active time selection as nanosecond timestamp. Example: _1494410783152415214_                                                                                          |
+| `$__unixEpochNanoTo()`                                | Replaces the value with the end of the currently active time selection as nanosecond timestamp. Example: _1494497183142514872_                                                                                            |
+| `$__unixEpochGroup(dateColumn,'5m', [fillmode])`      | Same as $\_\_timeGroup but for times stored as Unix timestamp. **Note that `fillMode` only works with time series queries.**                                                                                              |
+| `$__unixEpochGroupAlias(dateColumn,'5m', [fillmode])` | Same as $\_\_timeGroup but also adds a column alias. **Note that `fillMode` only works with time series queries.**                                                                                                        |
+
+## Table SQL queries
+
+If the **Format** option is set to **Table**, you can execute virtually any type of SQL query. The Table panel will automatically display the resulting columns and rows from your query.
+
+You can change or customize the name of a Table panel column by using the SQL keyword `AS` syntax.
+
+```sql
+SELECT
+  title as 'Title',
+  user.login as 'Created By' ,
+  dashboard.created as 'Created On'
+ FROM dashboard
+INNER JOIN user on user.id = dashboard.created_by
+WHERE $__timeFilter(dashboard.created)
+```
+
+Table panel results:
+
+![](/static/img/docs/v43/mysql_table.png)
+
+## Time series queries
+
+Set the **Format** option to **Time series** to create and run time series queries.
+
+{{% admonition type="note" %}}
+To run a time series query you must include a column named `time` that returns either a SQL datetime value or a numeric datatype representing the UNIX epoch time in seconds. Additionally, the query results must be sorted by the `time` column for proper visualization in panels.
+{{% /admonition %}}
+
+The examples in this section refer to the data in the following table:
+
+```text
++---------------------+--------------+---------------------+----------+
+| time_date_time      | value_double | CreatedAt           | hostname |
++---------------------+--------------+---------------------+----------+
+| 2020-01-02 03:05:00 | 3.0          | 2020-01-02 03:05:00 | 10.0.1.1 |
+| 2020-01-02 03:06:00 | 4.0          | 2020-01-02 03:06:00 | 10.0.1.2 |
+| 2020-01-02 03:10:00 | 6.0          | 2020-01-02 03:10:00 | 10.0.1.1 |
+| 2020-01-02 03:11:00 | 7.0          | 2020-01-02 03:11:00 | 10.0.1.2 |
+| 2020-01-02 03:20:00 | 5.0          | 2020-01-02 03:20:00 | 10.0.1.2 |
++---------------------+--------------+---------------------+----------+
+```
+
+A time series query result is returned in a [wide data frame format](https://grafana.com/developers/plugin-tools/key-concepts/data-frames#wide-format). Any column except time or of type string transforms into value fields in the data frame query result. Any string column transforms into field labels in the data frame query result.
+
+{{% admonition type="note" %}}
+For backward compatibility, an exception to the aforementioned rule applies to queries returning three columns, including a string column named `metric`. Instead of converting the metric column into field labels, it is used as the field name, and the series name is set to the value of the metric column. Refer to the following example with a metric column.
+{{% /admonition %}}
+
+**Example with `metric` column:**
+
+```sql
+SELECT
+  $__timeGroupAlias(time_date_time,'5m'),
+  min(value_double),
+  'min' as metric
+FROM test_data
+WHERE $__timeFilter(time_date_time)
+GROUP BY time
+ORDER BY time
+```
+
+Data frame result:
+
+```text
++---------------------+-----------------+
+| Name: time          | Name: min       |
+| Labels:             | Labels:         |
+| Type: []time.Time   | Type: []float64 |
++---------------------+-----------------+
+| 2020-01-02 03:05:00 | 3               |
+| 2020-01-02 03:10:00 | 6               |
+| 2020-01-02 03:20:00 | 5               |
++---------------------+-----------------+
+```
+
+To customize the default series name formatting (optional), refer to [Standard options definitions](ref:configure-standard-options-display-name).
+
+**Example using the fill parameter in the $\_\_timeGroupAlias macro to convert null values to be zero instead:**
+
+```sql
+SELECT
+  $__timeGroupAlias(createdAt,'5m',0),
+  sum(value_double) as value,
+  hostname
+FROM test_data
+WHERE
+  $__timeFilter(createdAt)
+GROUP BY time, hostname
+ORDER BY time
+```
+
+Given the data frame result in the following example and using the graph panel, you will get two series named _value 10.0.1.1_ and _value 10.0.1.2_. To render the series with a name of _10.0.1.1_ and _10.0.1.2_ , use a [Standard options definitions](ref:configure-standard-options-display-name) display value of `${__field.labels.hostname}`.
+
+Data frame result:
+
+```text
++---------------------+---------------------------+---------------------------+
+| Name: time          | Name: value               | Name: value               |
+| Labels:             | Labels: hostname=10.0.1.1 | Labels: hostname=10.0.1.2 |
+| Type: []time.Time   | Type: []float64           | Type: []float64           |
++---------------------+---------------------------+---------------------------+
+| 2020-01-02 03:05:00 | 3                         | 4                         |
+| 2020-01-02 03:10:00 | 6                         | 7                         |
+| 2020-01-02 03:15:00 | 0                         | 0                         |
+| 2020-01-02 03:20:00 | 0                         | 5                         |
++---------------------+---------------------------+---------------------------+
+```
+
+**Example with multiple columns:**
+
+```sql
+SELECT
+  $__timeGroupAlias(time_date_time,'5m'),
+  min(value_double) as min_value,
+  max(value_double) as max_value
+FROM test_data
+WHERE $__timeFilter(time_date_time)
+GROUP BY time
+ORDER BY time
+```
+
+Data frame result:
+
+```text
++---------------------+-----------------+-----------------+
+| Name: time          | Name: min_value | Name: max_value |
+| Labels:             | Labels:         | Labels:         |
+| Type: []time.Time   | Type: []float64 | Type: []float64 |
++---------------------+-----------------+-----------------+
+| 2020-01-02 03:05:00 | 3               | 4               |
+| 2020-01-02 03:10:00 | 6               | 7               |
+| 2020-01-02 03:20:00 | 5               | 5               |
++---------------------+-----------------+-----------------+
+```
+
+## Templating
+
+Instead of hardcoding values like server, application, or sensor names in your metric queries, you can use variables. Variables appear as drop-down select boxes at the top of the dashboard. These drop-downs make it easy to change the data being displayed in your dashboard.
+
+Refer to [Templates](ref:variables) for an introduction to creating template variables as well as the different types.
+
+### Query variable
+
+If you add a `Query` template variable you can write a MySQL query to retrieve items such as measurement names, key names, or key values, which will be displayed in the drop-down menu.
+
+For example, you can use a variable to retrieve all the values from the `hostname` column in a table by creating the following query in the templating variable _Query_ setting.
+
+```sql
+SELECT hostname FROM my_host
+```
+
+A query can return multiple columns, and Grafana will automatically generate a list based on the query results. For example, the following query returns a list with values from `hostname` and `hostname2`.
+
+```sql
+SELECT my_host.hostname, my_other_host.hostname2 FROM my_host JOIN my_other_host ON my_host.city = my_other_host.city
+```
+
+To use time range dependent macros like `$__timeFilter(column)` in your query,you must set the template variable's refresh mode to _On Time Range Change_.
+
+```sql
+SELECT event_name FROM event_log WHERE $__timeFilter(time_column)
+```
+
+Another option is a query that can create a key/value variable. The query should return two columns that are named `__text` and `__value`. The `__text` column must contain unique values (if not, only the first value is used). This allows the drop-down options to display a text-friendly name as the text while using an ID as the value. For example, a query could use `hostname` as the text and `id` as the value:
+
+```sql
+SELECT hostname AS __text, id AS __value FROM my_host
+```
+
+You can also create nested variables. For example, if you have a variable named `region`, you can configure the `hosts` variable to display only the hosts within the currently selected region as shown in the following example. If `region` is a multi-value variable, use the `IN` operator instead of `=` to match multiple values.
+
+```sql
+SELECT hostname FROM my_host  WHERE region IN($region)
+```
+
+#### Use `__searchFilter` to filter results in a query variable
+
+Using `__searchFilter` in the query field allows the query results to be filtered based on the user’s input in the drop-down selection box. If you do not enter anything, the default value for `__searchFilter` is %
+
+Note that you must enclose the `__searchFilter` expression in quotes as Grafana does not add them automatically.
+
+The following example demonstrates how to use `__searchFilter` in the query field to enable real-time searching for `hostname` as the user type in the drop-down selection box.
+
+```sql
+SELECT hostname FROM my_host  WHERE hostname LIKE '$__searchFilter'
+```
+
+### Using variables in queries
+
+Template variable values are only quoted when the template variable is a `multi-value`.
+
+If the variable is a multi-value variable, use the `IN` comparison operator instead of `=` to match against multiple values.
+
+You can use two different syntaxes:
+
+`$<varname>` Example with a template variable named `hostname`:
+
+```sql
+SELECT
+  UNIX_TIMESTAMP(atimestamp) as time,
+  aint as value,
+  avarchar as metric
+FROM my_table
+WHERE $__timeFilter(atimestamp) and hostname in($hostname)
+ORDER BY atimestamp ASC
+```
+
+`[[varname]]` Example with a template variable named `hostname`:
+
+```sql
+SELECT
+  UNIX_TIMESTAMP(atimestamp) as time,
+  aint as value,
+  avarchar as metric
+FROM my_table
+WHERE $__timeFilter(atimestamp) and hostname in([[hostname]])
+ORDER BY atimestamp ASC
+```
+
+#### Disabling quoting for multi-value variables
+
+Grafana automatically creates a quoted, comma-separated string for multi-value variables. For example: if `server01` and `server02` are selected then it will be formatted as: `'server01', 'server02'`. To disable quoting, use the csv formatting option for variables:
+
+Grafana automatically formats multi-value variables as a quoted, comma-separated string. For example, if `server01` and `server02` are selected, they are formatted as `'server01'`, `'server02'`. To remove the quotes, enable the CSV formatting option for the variables.
+
+`${servers:csv}`
+
+Read more about variable formatting options in the [Variables](ref:variable-syntax-advanced-variable-format-options) documentation.
+
+## Annotations
+
+[Annotations](ref:annotate-visualizations) allow you to overlay rich event information on top of graphs. You add annotation queries via the **Dashboard settings > Annotations view**.
+
+**Example query using a`time` column with epoch values:**
+
+```sql
+SELECT
+  epoch_time as time,
+  metric1 as text,
+  CONCAT(tag1, ',', tag2) as tags
+FROM
+  public.test_data
+WHERE
+  $__unixEpochFilter(epoch_time)
+```
+
+**Example region query using `time` and `timeend` columns with epoch values:**
+
+```sql
+SELECT
+  epoch_time as time,
+  epoch_timeend as timeend,
+  metric1 as text,
+  CONCAT(tag1, ',', tag2) as tags
+FROM
+  public.test_data
+WHERE
+  $__unixEpochFilter(epoch_time)
+```
+
+**Example query using a `time` column with a native SQL date/time data type:**
+
+```sql
+SELECT
+  native_date_time as time,
+  metric1 as text,
+  CONCAT(tag1, ',', tag2) as tags
+FROM
+  public.test_data
+WHERE
+  $__timeFilter(native_date_time)
+```
+
+| Name      | Description                                                                                                           |
+| --------- | --------------------------------------------------------------------------------------------------------------------- |
+| `time`    | The name of the date/time field, which can be a column with a native SQL date/time data type or epoch value.          |
+| `timeend` | Optional name of the end date/time field, which can be a column with a native SQL date/time data type or epoch value. |
+| `text`    | Event description field.                                                                                              |
+| `tags`    | Optional field name to use for event tags as a comma separated string.                                                |
+
+## Alerting
+
+Use time series queries to create alerts. Table formatted queries aren't yet supported in alert rule conditions.
+
+For more information regarding alerting refer to the following:
+
+- [Alert rules](ref:alert-rules)
+- [Template annotations and labels](ref:template-annotations-and-labels)

From 210d73188d9b5fbfff12112dc8db80d05cab5b83 Mon Sep 17 00:00:00 2001
From: Sarah Zinger <sarah.zinger@grafana.com>
Date: Mon, 13 Jan 2025 14:58:13 -0500
Subject: [PATCH 08/24] Return a 400 instead of a 500 for empty query (#98841)

---
 pkg/tsdb/graphite/graphite.go      | 9 ++++++++-
 pkg/tsdb/graphite/graphite_test.go | 9 +++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/pkg/tsdb/graphite/graphite.go b/pkg/tsdb/graphite/graphite.go
index fa8b0166ded..e227e480d7e 100644
--- a/pkg/tsdb/graphite/graphite.go
+++ b/pkg/tsdb/graphite/graphite.go
@@ -124,7 +124,14 @@ func (s *Service) QueryData(ctx context.Context, req *backend.QueryDataRequest)
 		logger.Warn("Found query models without targets", "models without targets", strings.Join(emptyQueries, "\n"))
 		// If no queries had a valid target, return an error; otherwise, attempt with the targets we have
 		if len(emptyQueries) == len(req.Queries) {
-			return &result, errors.New("no query target found for the alert rule")
+			if result.Responses == nil {
+				result.Responses = make(map[string]backend.DataResponse)
+			}
+			// marking this downstream error as it is a user error, but arguably this is a plugin error
+			// since the plugin should have frontend validation that prevents us from getting into this state
+			missingQueryResponse := backend.ErrDataResponseWithSource(400, backend.ErrorSourceDownstream, "no query target found for the alert rule")
+			result.Responses["A"] = missingQueryResponse
+			return &result, nil
 		}
 	}
 	formData["target"] = targetList
diff --git a/pkg/tsdb/graphite/graphite_test.go b/pkg/tsdb/graphite/graphite_test.go
index edbc73b71b6..2bb94f71dea 100644
--- a/pkg/tsdb/graphite/graphite_test.go
+++ b/pkg/tsdb/graphite/graphite_test.go
@@ -125,7 +125,7 @@ func TestProcessQueries(t *testing.T) {
 		assert.Equal(t, expectedInvalid, invalids[0])
 	})
 
-	t.Run("QueryData with no valid queries returns an error", func(t *testing.T) {
+	t.Run("QueryData with no valid queries returns bad request response", func(t *testing.T) {
 		queries := []backend.DataQuery{
 			{
 				RefID: "A",
@@ -142,11 +142,12 @@ func TestProcessQueries(t *testing.T) {
 		}
 
 		service.im = fakeInstanceManager{}
-		_, err := service.QueryData(context.Background(), &backend.QueryDataRequest{
+		rsp, err := service.QueryData(context.Background(), &backend.QueryDataRequest{
 			Queries: queries,
 		})
-		assert.Error(t, err)
-		assert.Equal(t, err.Error(), "no query target found for the alert rule")
+		assert.NoError(t, err)
+		expectedResponse := backend.ErrDataResponseWithSource(400, backend.ErrorSourceDownstream, "no query target found for the alert rule")
+		assert.Equal(t, expectedResponse, rsp.Responses["A"])
 	})
 }
 

From 1c67f4084c1c317d79b9a9a493412bf51fdec638 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Jan 2025 16:05:48 -0500
Subject: [PATCH 09/24] Bump google.golang.org/api from 0.213.0 to 0.216.0
 (#98905)

* Bump google.golang.org/api from 0.213.0 to 0.216.0

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.213.0 to 0.216.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.213.0...v0.216.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* update workspace

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 apps/alerting/notifications/go.mod  |  8 ++++----
 apps/alerting/notifications/go.sum  | 16 ++++++++--------
 apps/investigation/go.mod           |  8 ++++----
 apps/investigation/go.sum           | 16 ++++++++--------
 apps/playlist/go.mod                |  8 ++++----
 apps/playlist/go.sum                | 16 ++++++++--------
 go.mod                              | 12 ++++++------
 go.sum                              | 24 ++++++++++++------------
 go.work.sum                         |  8 +++++++-
 pkg/aggregator/go.mod               |  8 ++++----
 pkg/aggregator/go.sum               | 16 ++++++++--------
 pkg/apimachinery/go.mod             |  4 ++--
 pkg/apimachinery/go.sum             |  8 ++++----
 pkg/apiserver/go.mod                |  8 ++++----
 pkg/apiserver/go.sum                | 16 ++++++++--------
 pkg/build/go.mod                    | 12 ++++++------
 pkg/build/go.sum                    | 24 ++++++++++++------------
 pkg/promlib/go.mod                  |  6 ++++--
 pkg/promlib/go.sum                  | 16 ++++++++--------
 pkg/storage/unified/apistore/go.mod | 12 ++++++------
 pkg/storage/unified/apistore/go.sum | 24 ++++++++++++------------
 pkg/storage/unified/resource/go.mod | 12 ++++++------
 pkg/storage/unified/resource/go.sum | 24 ++++++++++++------------
 23 files changed, 157 insertions(+), 149 deletions(-)

diff --git a/apps/alerting/notifications/go.mod b/apps/alerting/notifications/go.mod
index 2588eddbb0e..25ea30979b6 100644
--- a/apps/alerting/notifications/go.mod
+++ b/apps/alerting/notifications/go.mod
@@ -75,15 +75,15 @@ require (
 	golang.org/x/crypto v0.32.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/apps/alerting/notifications/go.sum b/apps/alerting/notifications/go.sum
index 8a3b02138fb..f7ba719f1f1 100644
--- a/apps/alerting/notifications/go.sum
+++ b/apps/alerting/notifications/go.sum
@@ -226,8 +226,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -245,8 +245,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -264,13 +264,13 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/apps/investigation/go.mod b/apps/investigation/go.mod
index 41b048d79fb..00294747e47 100644
--- a/apps/investigation/go.mod
+++ b/apps/investigation/go.mod
@@ -60,16 +60,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.32.0 // indirect
diff --git a/apps/investigation/go.sum b/apps/investigation/go.sum
index 9d2f347aa7f..e421f943276 100644
--- a/apps/investigation/go.sum
+++ b/apps/investigation/go.sum
@@ -145,8 +145,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -161,8 +161,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -175,12 +175,12 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/apps/playlist/go.mod b/apps/playlist/go.mod
index 8b2f7f5bf87..4059258b04f 100644
--- a/apps/playlist/go.mod
+++ b/apps/playlist/go.mod
@@ -61,16 +61,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.32.0 // indirect
diff --git a/apps/playlist/go.sum b/apps/playlist/go.sum
index 9d2f347aa7f..e421f943276 100644
--- a/apps/playlist/go.sum
+++ b/apps/playlist/go.sum
@@ -145,8 +145,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -161,8 +161,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -175,12 +175,12 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/go.mod b/go.mod
index 8892640dc02..70876ec2cc9 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 	github.com/google/go-cmp v0.6.0 // @grafana/grafana-backend-group
 	github.com/google/uuid v1.6.0 // @grafana/grafana-backend-group
 	github.com/google/wire v0.6.0 // @grafana/grafana-backend-group
-	github.com/googleapis/gax-go/v2 v2.14.0 // @grafana/grafana-backend-group
+	github.com/googleapis/gax-go/v2 v2.14.1 // @grafana/grafana-backend-group
 	github.com/gorilla/mux v1.8.1 // @grafana/grafana-backend-group
 	github.com/gorilla/websocket v1.5.3 // @grafana/grafana-app-platform-squad
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // @grafana/alerting-backend
@@ -162,15 +162,15 @@ require (
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // @grafana/alerting-backend
 	golang.org/x/mod v0.22.0 // indirect; @grafana/grafana-backend-group
 	golang.org/x/net v0.34.0 // @grafana/oss-big-tent @grafana/partner-datasources
-	golang.org/x/oauth2 v0.24.0 // @grafana/identity-access-team
+	golang.org/x/oauth2 v0.25.0 // @grafana/identity-access-team
 	golang.org/x/sync v0.10.0 // @grafana/alerting-backend
 	golang.org/x/text v0.21.0 // @grafana/grafana-backend-group
-	golang.org/x/time v0.8.0 // @grafana/grafana-backend-group
+	golang.org/x/time v0.9.0 // @grafana/grafana-backend-group
 	golang.org/x/tools v0.29.0 // indirect; @grafana/grafana-as-code
 	gonum.org/v1/gonum v0.15.1 // @grafana/oss-big-tent
-	google.golang.org/api v0.213.0 // @grafana/grafana-backend-group
+	google.golang.org/api v0.216.0 // @grafana/grafana-backend-group
 	google.golang.org/grpc v1.69.2 // @grafana/plugins-platform-backend
-	google.golang.org/protobuf v1.36.0 // @grafana/plugins-platform-backend
+	google.golang.org/protobuf v1.36.1 // @grafana/plugins-platform-backend
 	gopkg.in/ini.v1 v1.67.0 // @grafana/alerting-backend
 	gopkg.in/mail.v2 v2.3.1 // @grafana/grafana-backend-group
 	gopkg.in/yaml.v3 v3.0.1 // @grafana/alerting-backend
@@ -417,7 +417,7 @@ require (
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect; @grafana/grafana-backend-group
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect; @grafana/plugins-platform-backend
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect; @grafana/plugins-platform-backend
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.sum b/go.sum
index d4c97c1f8c4..f6c88982f6f 100644
--- a/go.sum
+++ b/go.sum
@@ -1466,8 +1466,8 @@ github.com/googleapis/gax-go/v2 v2.7.1/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38
 github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
 github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
-github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
-github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/googleapis/gnostic v0.0.0-20170426233943-68f4ded48ba9/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.3.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
@@ -2701,8 +2701,8 @@ golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
 golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2897,8 +2897,8 @@ golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -3066,8 +3066,8 @@ google.golang.org/api v0.118.0/go.mod h1:76TtD3vkgmZ66zZzp72bUUklpmQmKlhh6sYtIjY
 google.golang.org/api v0.122.0/go.mod h1:gcitW0lvnyWjSp9nKxAbdHKIZ6vF4aajGueeslZOyms=
 google.golang.org/api v0.124.0/go.mod h1:xu2HQurE5gi/3t1aFCvhPD781p0a3p11sdunTJ2BlP4=
 google.golang.org/api v0.126.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
-google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
-google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
+google.golang.org/api v0.216.0 h1:xnEHy+xWFrtYInWPy8OdGFsyIfWJjtVnO39g7pz2BFY=
+google.golang.org/api v0.216.0/go.mod h1:K9wzQMvWi47Z9IU7OgdOofvZuw75Ge3PPITImZR/UyI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -3232,8 +3232,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234015-3fc162c6f38a/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -3303,8 +3303,8 @@ google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
diff --git a/go.work.sum b/go.work.sum
index 75726c61c49..2b6d5972528 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -290,6 +290,7 @@ cloud.google.com/go/compute v1.28.1 h1:XwPcZjgMCnU2tkwY10VleUjSAfpTj9RDn+kGrbYsi
 cloud.google.com/go/compute v1.28.1/go.mod h1:b72iXMY4FucVry3NR3Li4kVyyTvbMDE7x5WsqvxjsYk=
 cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY=
+cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
 cloud.google.com/go/contactcenterinsights v1.9.1/go.mod h1:bsg/R7zGLYMVxFFzfh9ooLTruLRCG9fnzhH9KznHhbM=
 cloud.google.com/go/contactcenterinsights v1.10.0/go.mod h1:bsg/R7zGLYMVxFFzfh9ooLTruLRCG9fnzhH9KznHhbM=
 cloud.google.com/go/contactcenterinsights v1.11.0/go.mod h1:hutBdImE4XNZ1NV4vbPJKSFOnQruhC5Lj9bZqWMTKiU=
@@ -1459,7 +1460,6 @@ github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
 github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c h1:2zRrJWIt/f9c9HhNHAgrRgq0San5gRRUJTBXLkchal0=
 github.com/cockroachdb/errors v1.9.1 h1:yFVvsI0VxmRShfawbt/laCIDy/mtTqqnvoNgiy5bEV8=
 github.com/cockroachdb/errors v1.9.1/go.mod h1:2sxOtL2WIc096WSZqZ5h8fa17rdDq9HZOZLBCor4mBk=
@@ -2464,6 +2464,7 @@ golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
 golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
 golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
 golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
@@ -2567,6 +2568,7 @@ google.golang.org/api v0.191.0/go.mod h1:tD5dsFGxFza0hnQveGfVk9QQYKcfp+VzgRqyXFx
 google.golang.org/api v0.196.0/go.mod h1:g9IL21uGkYgvQ5BZg6BAtoGJQIm8r6EgaAbpNey5wBE=
 google.golang.org/api v0.197.0/go.mod h1:AuOuo20GoQ331nq7DquGHlU6d+2wN2fZ8O0ta60nRNw=
 google.golang.org/api v0.205.0/go.mod h1:NrK1EMqO8Xk6l6QwRAmrXXg2v6dzukhlOyvkYtnvUuc=
+google.golang.org/api v0.211.0/go.mod h1:XOloB4MXFH4UTlQSGuNUxw0UT74qdENK8d6JNsXKLi0=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
@@ -2637,6 +2639,7 @@ google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53/go.mod h1:riSXTwQ4+nqmPGtobMFyW5FqVAmIs0St6VPp4Ug7CE4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230807174057-1744710a1577/go.mod h1:NjCQG/D8JandXxM57PZbAJL1DCNL6EypA0vPPwfsc7c=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405/go.mod h1:GRUCuLdzVqZte8+Dl/D4N25yLzcGqqWaYkeVOwulFqw=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231212172506-995d672761c0/go.mod h1:guYXGPwC6jwxgWKW5Y405fKWOFNwlvUlUnzyp9i0uqo=
@@ -2649,6 +2652,8 @@ google.golang.org/genproto/googleapis/bytestream v0.0.0-20240814211410-ddb44dafa
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20240814211410-ddb44dafa142/go.mod h1:gQizMG9jZ0L2ADJaM+JdZV4yTCON/CQpnHRPoM+54w4=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20241209162323-e6fa225c2576 h1:H8LrtQMZ6iQnV+zpgeb0YqwdByodQltmFqIhjuwexOI=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20241209162323-e6fa225c2576/go.mod h1:qUsLYwbwz5ostUWtuFuXPlHmSJodC5NI/88ZlHj4M1o=
+google.golang.org/genproto/googleapis/bytestream v0.0.0-20250102185135-69823020774d h1:NZBSeFsuFS5YrgHMW/8xfTbzNXMshQPNgq2Yb7xipEs=
+google.golang.org/genproto/googleapis/bytestream v0.0.0-20250102185135-69823020774d/go.mod h1:s4mHJ3FfG8P6A3O+gZ8TVqB3ufjOl9UG3ANCMMwCHmo=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
@@ -2721,6 +2726,7 @@ google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQf
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
 gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
diff --git a/pkg/aggregator/go.mod b/pkg/aggregator/go.mod
index 92bffcf05ef..1c9c9d4c6d9 100644
--- a/pkg/aggregator/go.mod
+++ b/pkg/aggregator/go.mod
@@ -135,19 +135,19 @@ require (
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/pkg/aggregator/go.sum b/pkg/aggregator/go.sum
index f141aee5823..78ee1e605ae 100644
--- a/pkg/aggregator/go.sum
+++ b/pkg/aggregator/go.sum
@@ -419,8 +419,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -451,8 +451,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -483,8 +483,8 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -493,8 +493,8 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/pkg/apimachinery/go.mod b/pkg/apimachinery/go.mod
index 5bde9cfe0d0..092c89abaab 100644
--- a/pkg/apimachinery/go.mod
+++ b/pkg/apimachinery/go.mod
@@ -41,9 +41,9 @@ require (
 	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
diff --git a/pkg/apimachinery/go.sum b/pkg/apimachinery/go.sum
index b16c3dbac2b..26af7a46237 100644
--- a/pkg/apimachinery/go.sum
+++ b/pkg/apimachinery/go.sum
@@ -147,12 +147,12 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/pkg/apiserver/go.mod b/pkg/apiserver/go.mod
index 6bd04bdd257..4ce2bf40458 100644
--- a/pkg/apiserver/go.mod
+++ b/pkg/apiserver/go.mod
@@ -79,17 +79,17 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/pkg/apiserver/go.sum b/pkg/apiserver/go.sum
index 775f6299aa6..c660f18b131 100644
--- a/pkg/apiserver/go.sum
+++ b/pkg/apiserver/go.sum
@@ -252,8 +252,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -273,8 +273,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -300,8 +300,8 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -310,8 +310,8 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/pkg/build/go.mod b/pkg/build/go.mod
index 8dee7dc4bbb..0ab74fbcbf5 100644
--- a/pkg/build/go.mod
+++ b/pkg/build/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/google/go-github v17.0.0+incompatible // @grafana/grafana-developer-enablement-squad
 	github.com/google/go-github/v45 v45.2.0 // @grafana/grafana-developer-enablement-squad
 	github.com/google/uuid v1.6.0 // indirect; @grafana/grafana-backend-group
-	github.com/googleapis/gax-go/v2 v2.14.0 // indirect; @grafana/grafana-backend-group
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect; @grafana/grafana-backend-group
 	github.com/jmespath/go-jmespath v0.4.0 // indirect; @grafana/grafana-backend-group
 	github.com/stretchr/testify v1.10.0 // @grafana/grafana-backend-group
 	github.com/urfave/cli v1.22.16 // @grafana/grafana-backend-group
@@ -35,13 +35,13 @@ require (
 	golang.org/x/crypto v0.32.0 // indirect; @grafana/grafana-backend-group
 	golang.org/x/mod v0.22.0 // @grafana/grafana-backend-group
 	golang.org/x/net v0.34.0 // indirect; @grafana/oss-big-tent @grafana/partner-datasources
-	golang.org/x/oauth2 v0.24.0 // @grafana/identity-access-team
+	golang.org/x/oauth2 v0.25.0 // @grafana/identity-access-team
 	golang.org/x/sync v0.10.0 // indirect; @grafana/alerting-backend
 	golang.org/x/text v0.21.0 // indirect; @grafana/grafana-backend-group
-	golang.org/x/time v0.8.0 // indirect; @grafana/grafana-backend-group
-	google.golang.org/api v0.213.0 // @grafana/grafana-backend-group
+	golang.org/x/time v0.9.0 // indirect; @grafana/grafana-backend-group
+	google.golang.org/api v0.216.0 // @grafana/grafana-backend-group
 	google.golang.org/grpc v1.69.2 // indirect; @grafana/plugins-platform-backend
-	google.golang.org/protobuf v1.36.0 // indirect; @grafana/plugins-platform-backend
+	google.golang.org/protobuf v1.36.1 // indirect; @grafana/plugins-platform-backend
 	gopkg.in/yaml.v3 v3.0.1 // @grafana/alerting-backend
 )
 
@@ -83,7 +83,7 @@ require (
 	golang.org/x/sys v0.29.0 // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect; @grafana/grafana-backend-group
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
diff --git a/pkg/build/go.sum b/pkg/build/go.sum
index f97eb99d5a9..23bfbd25ef6 100644
--- a/pkg/build/go.sum
+++ b/pkg/build/go.sum
@@ -143,8 +143,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
 github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
-github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
-github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
@@ -293,8 +293,8 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -320,8 +320,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -334,8 +334,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
-google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
+google.golang.org/api v0.216.0 h1:xnEHy+xWFrtYInWPy8OdGFsyIfWJjtVnO39g7pz2BFY=
+google.golang.org/api v0.216.0/go.mod h1:K9wzQMvWi47Z9IU7OgdOofvZuw75Ge3PPITImZR/UyI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -345,8 +345,8 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
@@ -364,8 +364,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/pkg/promlib/go.mod b/pkg/promlib/go.mod
index 37f4ac92f0a..d02c0410320 100644
--- a/pkg/promlib/go.mod
+++ b/pkg/promlib/go.mod
@@ -105,15 +105,17 @@ require (
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/pkg/promlib/go.sum b/pkg/promlib/go.sum
index 8c634e68495..ce1ce9a4189 100644
--- a/pkg/promlib/go.sum
+++ b/pkg/promlib/go.sum
@@ -342,8 +342,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -367,8 +367,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -388,12 +388,12 @@ google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
 google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/pkg/storage/unified/apistore/go.mod b/pkg/storage/unified/apistore/go.mod
index 5bed54aedab..53a64c6a9a7 100644
--- a/pkg/storage/unified/apistore/go.mod
+++ b/pkg/storage/unified/apistore/go.mod
@@ -167,7 +167,7 @@ require (
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/wire v0.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // indirect
 	github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f // indirect
@@ -330,20 +330,20 @@ require (
 	golang.org/x/crypto v0.32.0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	gonum.org/v1/gonum v0.15.1 // indirect
-	google.golang.org/api v0.213.0 // indirect
+	google.golang.org/api v0.216.0 // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
diff --git a/pkg/storage/unified/apistore/go.sum b/pkg/storage/unified/apistore/go.sum
index 89eecbc837a..4dbbfe5ccce 100644
--- a/pkg/storage/unified/apistore/go.sum
+++ b/pkg/storage/unified/apistore/go.sum
@@ -529,8 +529,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gT
 github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
-github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
@@ -1212,8 +1212,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1326,8 +1326,8 @@ golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1409,8 +1409,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
-google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
+google.golang.org/api v0.216.0 h1:xnEHy+xWFrtYInWPy8OdGFsyIfWJjtVnO39g7pz2BFY=
+google.golang.org/api v0.216.0/go.mod h1:K9wzQMvWi47Z9IU7OgdOofvZuw75Ge3PPITImZR/UyI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1455,8 +1455,8 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -1488,8 +1488,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
diff --git a/pkg/storage/unified/resource/go.mod b/pkg/storage/unified/resource/go.mod
index 6e351c13f4a..192b0ab2be1 100644
--- a/pkg/storage/unified/resource/go.mod
+++ b/pkg/storage/unified/resource/go.mod
@@ -26,7 +26,7 @@ require (
 	gocloud.dev v0.40.0
 	golang.org/x/sync v0.10.0
 	google.golang.org/grpc v1.69.2
-	google.golang.org/protobuf v1.36.0
+	google.golang.org/protobuf v1.36.1
 	k8s.io/apimachinery v0.32.0
 )
 
@@ -114,7 +114,7 @@ require (
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/wire v0.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
@@ -219,17 +219,17 @@ require (
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.213.0 // indirect
+	google.golang.org/api v0.216.0 // indirect
 	google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/pkg/storage/unified/resource/go.sum b/pkg/storage/unified/resource/go.sum
index 96c1355d887..442003fff6b 100644
--- a/pkg/storage/unified/resource/go.sum
+++ b/pkg/storage/unified/resource/go.sum
@@ -389,8 +389,8 @@ github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk
 github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
 github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
-github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
@@ -897,8 +897,8 @@ golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAG
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -971,8 +971,8 @@ golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1004,8 +1004,8 @@ gonum.org/v1/gonum v0.15.1/go.mod h1:eZTZuRFrzu5pcyjN5wJhcIhnUdNijYxX1T2IcrOGY0o
 google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.3.2/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
-google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
+google.golang.org/api v0.216.0 h1:xnEHy+xWFrtYInWPy8OdGFsyIfWJjtVnO39g7pz2BFY=
+google.golang.org/api v0.216.0/go.mod h1:K9wzQMvWi47Z9IU7OgdOofvZuw75Ge3PPITImZR/UyI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1022,8 +1022,8 @@ google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOs
 google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 h1:ChAdCYNQFDk5fYvFZMywKLIijG7TC2m1C2CMEu11G3o=
 google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484/go.mod h1:KRUmxRI4JmbpAm8gcZM4Jsffi859fo5LQjILwuqj9z8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1046,8 +1046,8 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=

From 009d7f42b3d09b3a6be1f00f07314e2b25af7ebc Mon Sep 17 00:00:00 2001
From: Nathan Marrs <nathanielmarrs@gmail.com>
Date: Mon, 13 Jan 2025 14:13:13 -0700
Subject: [PATCH 10/24] Feature Toggles: Add two test feature toggles to test
 potential AB test setup (#98844)

* add two dummy feature toggles to use for testing potential AB testing setup

* update betterer

* update auto generated files

* fix camelcase test case
---
 .betterer.results                             | 10 -------
 .../src/types/featureToggles.gen.ts           |  2 ++
 pkg/services/dashboards/store_mock.go         |  1 -
 pkg/services/featuremgmt/registry.go          | 16 +++++++++++
 pkg/services/featuremgmt/toggles_gen.csv      |  2 ++
 pkg/services/featuremgmt/toggles_gen.go       |  8 ++++++
 pkg/services/featuremgmt/toggles_gen.json     | 28 +++++++++++++++++++
 pkg/services/featuremgmt/toggles_gen_test.go  |  3 ++
 8 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/.betterer.results b/.betterer.results
index 304cee7afcb..7e77e31e128 100644
--- a/.betterer.results
+++ b/.betterer.results
@@ -3079,11 +3079,6 @@ exports[`better eslint`] = {
       [0, 0, 0, "No untranslated strings in text props. Wrap text with <Trans /> or use t()", "0"],
       [0, 0, 0, "No untranslated strings in text props. Wrap text with <Trans /> or use t()", "1"]
     ],
-    "public/app/features/dashboard-scene/edit-pane/VizPanelEditPaneBehavior.tsx:5381": [
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "0"],
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "1"],
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "2"]
-    ],
     "public/app/features/dashboard-scene/embedding/EmbeddedDashboard.tsx:5381": [
       [0, 0, 0, "No untranslated strings in text props. Wrap text with <Trans /> or use t()", "0"]
     ],
@@ -3304,11 +3299,6 @@ exports[`better eslint`] = {
     "public/app/features/dashboard-scene/scene/UnlinkModal.tsx:5381": [
       [0, 0, 0, "No untranslated strings in text props. Wrap text with <Trans /> or use t()", "0"]
     ],
-    "public/app/features/dashboard-scene/scene/layout-rows/RowItem.tsx:5381": [
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "0"],
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "1"],
-      [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "2"]
-    ],
     "public/app/features/dashboard-scene/scene/row-actions/RowActions.tsx:5381": [
       [0, 0, 0, "No untranslated strings in text props. Wrap text with <Trans /> or use t()", "0"],
       [0, 0, 0, "No untranslated strings. Wrap text with <Trans />", "1"],
diff --git a/packages/grafana-data/src/types/featureToggles.gen.ts b/packages/grafana-data/src/types/featureToggles.gen.ts
index 88c11e84d6a..8e84aaf464e 100644
--- a/packages/grafana-data/src/types/featureToggles.gen.ts
+++ b/packages/grafana-data/src/types/featureToggles.gen.ts
@@ -249,4 +249,6 @@ export interface FeatureToggles {
   k8SFolderMove?: boolean;
   improvedExternalSessionHandlingSAML?: boolean;
   teamHttpHeadersMimir?: boolean;
+  ABTestFeatureToggleA?: boolean;
+  ABTestFeatureToggleB?: boolean;
 }
diff --git a/pkg/services/dashboards/store_mock.go b/pkg/services/dashboards/store_mock.go
index 7513af3125a..0d1e385f1dc 100644
--- a/pkg/services/dashboards/store_mock.go
+++ b/pkg/services/dashboards/store_mock.go
@@ -256,7 +256,6 @@ func (_m *FakeDashboardStore) GetAllDashboardsByOrgId(ctx context.Context, orgID
 	return r0, r1
 }
 
-
 // GetDashboard provides a mock function with given fields: ctx, query
 func (_m *FakeDashboardStore) GetDashboard(ctx context.Context, query *GetDashboardQuery) (*Dashboard, error) {
 	ret := _m.Called(ctx, query)
diff --git a/pkg/services/featuremgmt/registry.go b/pkg/services/featuremgmt/registry.go
index d626a1e1b42..95130d80dd8 100644
--- a/pkg/services/featuremgmt/registry.go
+++ b/pkg/services/featuremgmt/registry.go
@@ -1721,6 +1721,22 @@ var (
 			AllowSelfServe: false,
 			Owner:          identityAccessTeam,
 		},
+		{
+			Name:         "ABTestFeatureToggleA",
+			Description:  "Test feature toggle to see how cohorts could be set up AB testing",
+			Stage:        FeatureStageExperimental,
+			Owner:        grafanaSharingSquad,
+			Expression:   "false",
+			HideFromDocs: true,
+		},
+		{
+			Name:         "ABTestFeatureToggleB",
+			Description:  "Test feature toggle to see how cohorts could be set up AB testing",
+			Stage:        FeatureStageExperimental,
+			Owner:        grafanaSharingSquad,
+			Expression:   "false",
+			HideFromDocs: true,
+		},
 	}
 )
 
diff --git a/pkg/services/featuremgmt/toggles_gen.csv b/pkg/services/featuremgmt/toggles_gen.csv
index fb959d92242..8b5f0c8d11f 100644
--- a/pkg/services/featuremgmt/toggles_gen.csv
+++ b/pkg/services/featuremgmt/toggles_gen.csv
@@ -230,3 +230,5 @@ k8SFolderCounts,experimental,@grafana/search-and-storage,false,false,false
 k8SFolderMove,experimental,@grafana/search-and-storage,false,false,false
 improvedExternalSessionHandlingSAML,preview,@grafana/identity-access-team,false,false,false
 teamHttpHeadersMimir,experimental,@grafana/identity-access-team,false,false,false
+ABTestFeatureToggleA,experimental,@grafana/sharing-squad,false,false,false
+ABTestFeatureToggleB,experimental,@grafana/sharing-squad,false,false,false
diff --git a/pkg/services/featuremgmt/toggles_gen.go b/pkg/services/featuremgmt/toggles_gen.go
index 96c92618629..473d0603c4a 100644
--- a/pkg/services/featuremgmt/toggles_gen.go
+++ b/pkg/services/featuremgmt/toggles_gen.go
@@ -930,4 +930,12 @@ const (
 	// FlagTeamHttpHeadersMimir
 	// Enables LBAC for datasources for Mimir to apply LBAC filtering of metrics to the client requests for users in teams
 	FlagTeamHttpHeadersMimir = "teamHttpHeadersMimir"
+
+	// FlagABTestFeatureToggleA
+	// Test feature toggle to see how cohorts could be set up AB testing
+	FlagABTestFeatureToggleA = "ABTestFeatureToggleA"
+
+	// FlagABTestFeatureToggleB
+	// Test feature toggle to see how cohorts could be set up AB testing
+	FlagABTestFeatureToggleB = "ABTestFeatureToggleB"
 )
diff --git a/pkg/services/featuremgmt/toggles_gen.json b/pkg/services/featuremgmt/toggles_gen.json
index fedd1d2a2e7..49fe6f2c7ce 100644
--- a/pkg/services/featuremgmt/toggles_gen.json
+++ b/pkg/services/featuremgmt/toggles_gen.json
@@ -3,6 +3,34 @@
   "apiVersion": "featuretoggle.grafana.app/v0alpha1",
   "metadata": {},
   "items": [
+    {
+      "metadata": {
+        "name": "ABTestFeatureToggleA",
+        "resourceVersion": "1736782112674",
+        "creationTimestamp": "2025-01-13T15:28:32Z"
+      },
+      "spec": {
+        "description": "Test feature toggle to see how cohorts could be set up AB testing",
+        "stage": "experimental",
+        "codeowner": "@grafana/sharing-squad",
+        "hideFromDocs": true,
+        "expression": "false"
+      }
+    },
+    {
+      "metadata": {
+        "name": "ABTestFeatureToggleB",
+        "resourceVersion": "1736782112674",
+        "creationTimestamp": "2025-01-13T15:28:32Z"
+      },
+      "spec": {
+        "description": "Test feature toggle to see how cohorts could be set up AB testing",
+        "stage": "experimental",
+        "codeowner": "@grafana/sharing-squad",
+        "hideFromDocs": true,
+        "expression": "false"
+      }
+    },
     {
       "metadata": {
         "name": "accessActionSets",
diff --git a/pkg/services/featuremgmt/toggles_gen_test.go b/pkg/services/featuremgmt/toggles_gen_test.go
index 84319348eda..b0f6e8f745f 100644
--- a/pkg/services/featuremgmt/toggles_gen_test.go
+++ b/pkg/services/featuremgmt/toggles_gen_test.go
@@ -167,6 +167,9 @@ func TestFeatureToggleFiles(t *testing.T) {
 func verifyFlagsConfiguration(t *testing.T) {
 	legacyNames := map[string]bool{
 		"live-service-web-worker": true,
+		// TODO: Remove this when removing feature toggles
+		"ABTestFeatureToggleA": true,
+		"ABTestFeatureToggleB": true,
 	}
 	invalidNames := make([]string, 0)
 

From 766d645d827f5e6e0872ae30e5fe23226ae85785 Mon Sep 17 00:00:00 2001
From: maicon <maiconscosta@gmail.com>
Date: Mon, 13 Jan 2025 18:15:35 -0300
Subject: [PATCH 11/24] Filewalkwithme/unistore refactor folder service to hit
 folder apiserver (#98409)

Refactor folder service to use Unified Storage

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
---
 .../feature-toggles/index.md                  |   1 +
 .../src/types/featureToggles.gen.ts           |   1 +
 pkg/api/dashboard_test.go                     |   2 +-
 pkg/api/folder.go                             |   2 +-
 pkg/api/folder_bench_test.go                  |   2 +-
 pkg/registry/apis/folders/conversions.go      |   5 +
 pkg/registry/apis/folders/legacy_storage.go   |  12 +-
 pkg/registry/apis/folders/register.go         |   1 +
 .../ossaccesscontrol/testutil/testutil.go     |   2 +-
 .../accesscontrol/accesscontrol_test.go       |   2 +-
 .../annotationsimpl/annotations_test.go       |   4 +-
 .../database/database_folder_test.go          |   2 +-
 .../dashboards/database/database_test.go      |   4 +-
 .../dashboards/service/dashboard_service.go   |  14 +-
 .../service/zanzana_integration_test.go       |   1 +
 pkg/services/featuremgmt/registry.go          |   6 +
 pkg/services/featuremgmt/toggles_gen.csv      |   1 +
 pkg/services/featuremgmt/toggles_gen.go       |   4 +
 pkg/services/featuremgmt/toggles_gen.json     |  12 +
 pkg/services/folder/folderimpl/folder.go      | 147 +++-
 pkg/services/folder/folderimpl/folder_test.go |   4 +-
 .../folderimpl/folder_unifiedstorage.go       | 702 ++++++++++++++++++
 .../folderimpl/folder_unifiedstorage_test.go  | 414 +++++++++++
 .../folder/folderimpl/unifiedstore.go         | 520 +++++++++++++
 pkg/services/folder/foldertest/foldertest.go  |  30 +
 pkg/services/folder/service.go                |  28 +-
 .../libraryelements/libraryelements_test.go   |   4 +-
 .../librarypanels/librarypanels_test.go       |   4 +-
 .../ngalert/api/api_provisioning_test.go      |   2 +-
 .../ngalert/provisioning/alert_rules_test.go  |   2 +-
 pkg/services/ngalert/testutil/testutil.go     |   2 +-
 .../publicdashboards/service/service_test.go  |   2 +-
 pkg/services/quota/quotaimpl/quota_test.go    |   2 +-
 .../sqlstore/permissions/dashboard_test.go    |   2 +-
 .../permissions/dashboards_bench_test.go      |   2 +-
 pkg/storage/unified/apistore/go.sum           |  14 +
 pkg/storage/unified/federated/stats_test.go   |   2 +-
 pkg/tests/apis/folder/folders_test.go         |  12 -
 38 files changed, 1900 insertions(+), 73 deletions(-)
 create mode 100644 pkg/services/folder/folderimpl/folder_unifiedstorage.go
 create mode 100644 pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
 create mode 100644 pkg/services/folder/folderimpl/unifiedstore.go

diff --git a/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md b/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
index a9d434a91a8..f9267ad1eb5 100644
--- a/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
+++ b/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
@@ -173,6 +173,7 @@ Experimental features might be changed or removed without prior notice.
 | `kubernetesCliDashboards`                     | Use the k8s client to retrieve dashboards internally                                                                                                                                                                                                                              |
 | `kubernetesRestore`                           | Allow restoring objects in k8s                                                                                                                                                                                                                                                    |
 | `kubernetesFolders`                           | Use the kubernetes API in the frontend for folders, and route /api/folders requests to k8s                                                                                                                                                                                        |
+| `kubernetesFoldersServiceV2`                  | Use the Folders Service V2, and route Folder Service requests to k8s                                                                                                                                                                                                              |
 | `grafanaAPIServerTestingWithExperimentalAPIs` | Facilitate integration testing of experimental APIs                                                                                                                                                                                                                               |
 | `datasourceQueryTypes`                        | Show query type endpoints in datasource API servers (currently hardcoded for testdata, expressions, and prometheus)                                                                                                                                                               |
 | `queryService`                                | Register /apis/query.grafana.app/ -- will eventually replace /api/ds/query                                                                                                                                                                                                        |
diff --git a/packages/grafana-data/src/types/featureToggles.gen.ts b/packages/grafana-data/src/types/featureToggles.gen.ts
index 8e84aaf464e..8c01b34d83e 100644
--- a/packages/grafana-data/src/types/featureToggles.gen.ts
+++ b/packages/grafana-data/src/types/featureToggles.gen.ts
@@ -113,6 +113,7 @@ export interface FeatureToggles {
   kubernetesCliDashboards?: boolean;
   kubernetesRestore?: boolean;
   kubernetesFolders?: boolean;
+  kubernetesFoldersServiceV2?: boolean;
   grafanaAPIServerTestingWithExperimentalAPIs?: boolean;
   datasourceQueryTypes?: boolean;
   queryService?: boolean;
diff --git a/pkg/api/dashboard_test.go b/pkg/api/dashboard_test.go
index b5a840d0cf9..45965caa319 100644
--- a/pkg/api/dashboard_test.go
+++ b/pkg/api/dashboard_test.go
@@ -834,7 +834,7 @@ func getDashboardShouldReturn200WithConfig(t *testing.T, sc *scenarioContext, pr
 	quotaService := quotatest.New(false, nil)
 	folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashboardStore, folderStore, db, features,
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	if dashboardService == nil {
 		dashboardService, err = service.ProvideDashboardServiceImpl(
 			cfg, dashboardStore, folderStore, features, folderPermissions, dashboardPermissions,
diff --git a/pkg/api/folder.go b/pkg/api/folder.go
index 8e1738af28d..5232020efa8 100644
--- a/pkg/api/folder.go
+++ b/pkg/api/folder.go
@@ -57,7 +57,7 @@ func (hs *HTTPServer) registerFolderAPI(apiRoute routing.RouteRegister, authoriz
 				folderPermissionRoute.Post("/", authorize(accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsWrite, uidScope)), routing.Wrap(hs.UpdateFolderPermissions))
 			})
 		})
-		if hs.Features.IsEnabledGlobally(featuremgmt.FlagKubernetesFolders) {
+		if hs.Features.IsEnabledGlobally(featuremgmt.FlagKubernetesFolders) && !hs.Features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
 			// Use k8s client to implement legacy API
 			handler := newFolderK8sHandler(hs)
 			folderRoute.Post("/", handler.createFolder)
diff --git a/pkg/api/folder_bench_test.go b/pkg/api/folder_bench_test.go
index 6acd70c968a..cb0d7fe8672 100644
--- a/pkg/api/folder_bench_test.go
+++ b/pkg/api/folder_bench_test.go
@@ -461,7 +461,7 @@ func setupServer(b testing.TB, sc benchScenario, features featuremgmt.FeatureTog
 	actionSets := resourcepermissions.NewActionSetService(features)
 	fStore := folderimpl.ProvideStore(sc.db)
 	folderServiceWithFlagOn := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore,
-		folderStore, sc.db, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		folderStore, sc.db, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	acSvc := acimpl.ProvideOSSService(
 		sc.cfg, acdb.ProvideService(sc.db), actionSets, localcache.ProvideService(),
 		features, tracing.InitializeTracerForTest(), zanzana.NewNoopClient(), sc.db, permreg.ProvidePermissionRegistry(), nil, folderServiceWithFlagOn,
diff --git a/pkg/registry/apis/folders/conversions.go b/pkg/registry/apis/folders/conversions.go
index 93a40fe2981..811fe274f31 100644
--- a/pkg/registry/apis/folders/conversions.go
+++ b/pkg/registry/apis/folders/conversions.go
@@ -52,6 +52,11 @@ func LegacyUpdateCommandToUnstructured(obj *unstructured.Unstructured, cmd *fold
 	if cmd.NewDescription != nil {
 		spec["description"] = cmd.NewDescription
 	}
+	if cmd.NewParentUID != nil {
+		if err := setParentUID(obj, *cmd.NewParentUID); err != nil {
+			return &unstructured.Unstructured{}, err
+		}
+	}
 
 	return obj, nil
 }
diff --git a/pkg/registry/apis/folders/legacy_storage.go b/pkg/registry/apis/folders/legacy_storage.go
index 559933208a8..25321eea3ce 100644
--- a/pkg/registry/apis/folders/legacy_storage.go
+++ b/pkg/registry/apis/folders/legacy_storage.go
@@ -97,7 +97,7 @@ func (s *legacyStorage) List(ctx context.Context, options *internalversion.ListO
 	}
 
 	// List must return all folders
-	hits, err := s.service.GetFolders(ctx, folder.GetFoldersQuery{
+	hits, err := s.service.GetFoldersLegacy(ctx, folder.GetFoldersQuery{
 		SignedInUser: user,
 		OrgID:        orgId,
 		// TODO: enable pagination
@@ -133,7 +133,7 @@ func (s *legacyStorage) Get(ctx context.Context, name string, options *metav1.Ge
 		return nil, err
 	}
 
-	dto, err := s.service.Get(ctx, &folder.GetFolderQuery{
+	dto, err := s.service.GetLegacy(ctx, &folder.GetFolderQuery{
 		SignedInUser: user,
 		UID:          &name,
 		OrgID:        info.OrgID,
@@ -186,7 +186,7 @@ func (s *legacyStorage) Create(ctx context.Context,
 
 	parent := accessor.GetFolder()
 
-	out, err := s.service.Create(ctx, &folder.CreateFolderCommand{
+	out, err := s.service.CreateLegacy(ctx, &folder.CreateFolderCommand{
 		SignedInUser: user,
 		UID:          p.Name,
 		Title:        p.Spec.Title,
@@ -285,7 +285,7 @@ func (s *legacyStorage) Update(ctx context.Context,
 	oldParent := mOld.GetFolder()
 	newParent := mNew.GetFolder()
 	if oldParent != newParent {
-		_, err = s.service.Move(ctx, &folder.MoveFolderCommand{
+		_, err = s.service.MoveLegacy(ctx, &folder.MoveFolderCommand{
 			SignedInUser: user,
 			UID:          name,
 			OrgID:        info.OrgID,
@@ -312,7 +312,7 @@ func (s *legacyStorage) Update(ctx context.Context,
 		changed = true
 	}
 	if changed {
-		_, err = s.service.Update(ctx, cmd)
+		_, err = s.service.UpdateLegacy(ctx, cmd)
 		if err != nil {
 			return nil, false, err
 		}
@@ -340,7 +340,7 @@ func (s *legacyStorage) Delete(ctx context.Context, name string, deleteValidatio
 	if !ok {
 		return v, false, fmt.Errorf("expected a folder response from Get")
 	}
-	err = s.service.Delete(ctx, &folder.DeleteFolderCommand{
+	err = s.service.DeleteLegacy(ctx, &folder.DeleteFolderCommand{
 		UID:          name,
 		OrgID:        info.OrgID,
 		SignedInUser: user,
diff --git a/pkg/registry/apis/folders/register.go b/pkg/registry/apis/folders/register.go
index 03e2edfccfe..3c43e5fb668 100644
--- a/pkg/registry/apis/folders/register.go
+++ b/pkg/registry/apis/folders/register.go
@@ -66,6 +66,7 @@ func RegisterAPIService(cfg *setting.Cfg,
 ) *FolderAPIBuilder {
 	if !featuremgmt.AnyEnabled(features,
 		featuremgmt.FlagKubernetesFolders,
+		featuremgmt.FlagKubernetesFoldersServiceV2,
 		featuremgmt.FlagGrafanaAPIServerTestingWithExperimentalAPIs,
 		featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs,
 		featuremgmt.FlagProvisioning) {
diff --git a/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go b/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
index 57f3f43aa87..062bd27b535 100644
--- a/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
+++ b/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
@@ -49,7 +49,7 @@ func ProvideFolderPermissions(
 	folderStore := folderimpl.ProvideDashboardFolderStore(sqlStore)
 	fService := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashboardStore, folderStore, sqlStore, features,
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	acSvc := acimpl.ProvideOSSService(
 		cfg, acdb.ProvideService(sqlStore), actionSets, localcache.ProvideService(),
diff --git a/pkg/services/annotations/accesscontrol/accesscontrol_test.go b/pkg/services/annotations/accesscontrol/accesscontrol_test.go
index 3933b590311..ec6b7d5a0dc 100644
--- a/pkg/services/annotations/accesscontrol/accesscontrol_test.go
+++ b/pkg/services/annotations/accesscontrol/accesscontrol_test.go
@@ -50,7 +50,7 @@ func TestIntegrationAuthorize(t *testing.T) {
 	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
 	folderSvc := folderimpl.ProvideService(fStore, accesscontrolmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sql, featuremgmt.WithFeatures(),
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
 		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
diff --git a/pkg/services/annotations/annotationsimpl/annotations_test.go b/pkg/services/annotations/annotationsimpl/annotations_test.go
index 9f7fbe77164..b6b85e41aad 100644
--- a/pkg/services/annotations/annotationsimpl/annotations_test.go
+++ b/pkg/services/annotations/annotationsimpl/annotations_test.go
@@ -62,7 +62,7 @@ func TestIntegrationAnnotationListingWithRBAC(t *testing.T) {
 	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
 	folderSvc := folderimpl.ProvideService(fStore, accesscontrolmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sql, featuremgmt.WithFeatures(),
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
 		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
@@ -244,7 +244,7 @@ func TestIntegrationAnnotationListingWithInheritedRBAC(t *testing.T) {
 		fStore := folderimpl.ProvideStore(sql)
 		folderStore := folderimpl.ProvideDashboardFolderStore(sql)
 		folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore,
-			folderStore, sql, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+			folderStore, sql, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 		dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, features, accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
 			ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
 		require.NoError(t, err)
diff --git a/pkg/services/dashboards/database/database_folder_test.go b/pkg/services/dashboards/database/database_folder_test.go
index db185664ee4..fe0fc20be5c 100644
--- a/pkg/services/dashboards/database/database_folder_test.go
+++ b/pkg/services/dashboards/database/database_folder_test.go
@@ -300,7 +300,7 @@ func TestIntegrationDashboardInheritedFolderRBAC(t *testing.T) {
 		})
 
 		folderStore := folderimpl.ProvideStore(sqlStore)
-		folderSvc := folderimpl.ProvideService(folderStore, mock.New(), bus.ProvideBus(tracer), dashboardWriteStore, folderimpl.ProvideDashboardFolderStore(sqlStore), sqlStore, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		folderSvc := folderimpl.ProvideService(folderStore, mock.New(), bus.ProvideBus(tracer), dashboardWriteStore, folderimpl.ProvideDashboardFolderStore(sqlStore), sqlStore, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 		parentUID := ""
 		for i := 0; ; i++ {
diff --git a/pkg/services/dashboards/database/database_test.go b/pkg/services/dashboards/database/database_test.go
index 9628d111b56..60f3e45cfd1 100644
--- a/pkg/services/dashboards/database/database_test.go
+++ b/pkg/services/dashboards/database/database_test.go
@@ -891,7 +891,7 @@ func TestIntegrationFindDashboardsByTitle(t *testing.T) {
 	folderStore := folderimpl.ProvideDashboardFolderStore(sqlStore)
 	fStore := folderimpl.ProvideStore(sqlStore)
 	folderServiceWithFlagOn := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore,
-		folderStore, sqlStore, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		folderStore, sqlStore, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	user := &user.SignedInUser{
 		OrgID: 1,
@@ -1010,7 +1010,7 @@ func TestIntegrationFindDashboardsByFolder(t *testing.T) {
 	fStore := folderimpl.ProvideStore(sqlStore)
 
 	folderServiceWithFlagOn := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore,
-		folderStore, sqlStore, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		folderStore, sqlStore, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	user := &user.SignedInUser{
 		OrgID: 1,
diff --git a/pkg/services/dashboards/service/dashboard_service.go b/pkg/services/dashboards/service/dashboard_service.go
index 692d6d54383..b02b0e5d6bd 100644
--- a/pkg/services/dashboards/service/dashboard_service.go
+++ b/pkg/services/dashboards/service/dashboard_service.go
@@ -372,13 +372,15 @@ func (dr *DashboardServiceImpl) BuildSaveDashboardCommand(ctx context.Context, d
 
 	// Validate folder
 	if dash.FolderUID != "" {
-		folder, err := dr.folderStore.GetFolderByUID(ctx, dash.OrgID, dash.FolderUID)
-		if err != nil {
-			return nil, err
+		if !dr.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+			folder, err := dr.folderStore.GetFolderByUID(ctx, dash.OrgID, dash.FolderUID)
+			if err != nil {
+				return nil, err
+			}
+			metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Dashboard).Inc()
+			// nolint:staticcheck
+			dash.FolderID = folder.ID
 		}
-		metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Dashboard).Inc()
-		// nolint:staticcheck
-		dash.FolderID = folder.ID
 	} else if dash.FolderID != 0 { // nolint:staticcheck
 		metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Dashboard).Inc()
 		// nolint:staticcheck
diff --git a/pkg/services/dashboards/service/zanzana_integration_test.go b/pkg/services/dashboards/service/zanzana_integration_test.go
index bedd2fe4ffc..8e9b85fe02e 100644
--- a/pkg/services/dashboards/service/zanzana_integration_test.go
+++ b/pkg/services/dashboards/service/zanzana_integration_test.go
@@ -101,6 +101,7 @@ func TestIntegrationDashboardServiceZanzana(t *testing.T) {
 			db,
 			featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
 			supportbundlestest.NewFakeBundleService(),
+			cfg,
 			nil,
 			tracing.InitializeTracerForTest(),
 		)
diff --git a/pkg/services/featuremgmt/registry.go b/pkg/services/featuremgmt/registry.go
index 95130d80dd8..5fd9f61794d 100644
--- a/pkg/services/featuremgmt/registry.go
+++ b/pkg/services/featuremgmt/registry.go
@@ -714,6 +714,12 @@ var (
 			Stage:       FeatureStageExperimental,
 			Owner:       grafanaSearchAndStorageSquad,
 		},
+		{
+			Name:        "kubernetesFoldersServiceV2",
+			Description: "Use the Folders Service V2, and route Folder Service requests to k8s",
+			Stage:       FeatureStageExperimental,
+			Owner:       grafanaSearchAndStorageSquad,
+		},
 		{
 			Name:        "grafanaAPIServerTestingWithExperimentalAPIs",
 			Description: "Facilitate integration testing of experimental APIs",
diff --git a/pkg/services/featuremgmt/toggles_gen.csv b/pkg/services/featuremgmt/toggles_gen.csv
index 8b5f0c8d11f..c414b28d25a 100644
--- a/pkg/services/featuremgmt/toggles_gen.csv
+++ b/pkg/services/featuremgmt/toggles_gen.csv
@@ -94,6 +94,7 @@ kubernetesDashboards,experimental,@grafana/grafana-app-platform-squad,false,fals
 kubernetesCliDashboards,experimental,@grafana/grafana-app-platform-squad,false,false,false
 kubernetesRestore,experimental,@grafana/grafana-app-platform-squad,false,false,false
 kubernetesFolders,experimental,@grafana/search-and-storage,false,false,false
+kubernetesFoldersServiceV2,experimental,@grafana/search-and-storage,false,false,false
 grafanaAPIServerTestingWithExperimentalAPIs,experimental,@grafana/search-and-storage,false,false,false
 datasourceQueryTypes,experimental,@grafana/grafana-app-platform-squad,false,true,false
 queryService,experimental,@grafana/grafana-app-platform-squad,false,true,false
diff --git a/pkg/services/featuremgmt/toggles_gen.go b/pkg/services/featuremgmt/toggles_gen.go
index 473d0603c4a..8ff9b539d28 100644
--- a/pkg/services/featuremgmt/toggles_gen.go
+++ b/pkg/services/featuremgmt/toggles_gen.go
@@ -387,6 +387,10 @@ const (
 	// Use the kubernetes API in the frontend for folders, and route /api/folders requests to k8s
 	FlagKubernetesFolders = "kubernetesFolders"
 
+	// FlagKubernetesFoldersServiceV2
+	// Use the Folders Service V2, and route Folder Service requests to k8s
+	FlagKubernetesFoldersServiceV2 = "kubernetesFoldersServiceV2"
+
 	// FlagGrafanaAPIServerTestingWithExperimentalAPIs
 	// Facilitate integration testing of experimental APIs
 	FlagGrafanaAPIServerTestingWithExperimentalAPIs = "grafanaAPIServerTestingWithExperimentalAPIs"
diff --git a/pkg/services/featuremgmt/toggles_gen.json b/pkg/services/featuremgmt/toggles_gen.json
index 49fe6f2c7ce..a5704c0ffa0 100644
--- a/pkg/services/featuremgmt/toggles_gen.json
+++ b/pkg/services/featuremgmt/toggles_gen.json
@@ -2081,6 +2081,18 @@
         "codeowner": "@grafana/search-and-storage"
       }
     },
+    {
+      "metadata": {
+        "name": "kubernetesFoldersServiceV2",
+        "resourceVersion": "1735336477446",
+        "creationTimestamp": "2024-12-27T21:54:37Z"
+      },
+      "spec": {
+        "description": "Use the Folders Service V2, and route Folder Service requests to k8s",
+        "stage": "experimental",
+        "codeowner": "@grafana/search-and-storage"
+      }
+    },
     {
       "metadata": {
         "name": "kubernetesPlaylists",
diff --git a/pkg/services/folder/folderimpl/folder.go b/pkg/services/folder/folderimpl/folder.go
index 4e7037a8074..091e8c83e9a 100644
--- a/pkg/services/folder/folderimpl/folder.go
+++ b/pkg/services/folder/folderimpl/folder.go
@@ -18,12 +18,14 @@ import (
 	"golang.org/x/exp/slices"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/events"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/metrics"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -34,6 +36,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/store/entity"
 	"github.com/grafana/grafana/pkg/services/supportbundles"
 	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util"
 )
 
@@ -41,12 +44,14 @@ const FULLPATH_SEPARATOR = "/"
 
 type Service struct {
 	store                folder.Store
+	unifiedStore         folder.Store
 	db                   db.DB
 	log                  *slog.Logger
 	dashboardStore       dashboards.Store
 	dashboardFolderStore folder.FolderStore
 	features             featuremgmt.FeatureToggles
 	accessControl        accesscontrol.AccessControl
+	k8sclient            folderK8sHandler
 	// bus is currently used to publish event in case of folder full path change.
 	// For example when a folder is moved to another folder or when a folder is renamed.
 	bus bus.Bus
@@ -66,14 +71,24 @@ func ProvideService(
 	db db.DB, // DB for the (new) nested folder store
 	features featuremgmt.FeatureToggles,
 	supportBundles supportbundles.Service,
+	cfg *setting.Cfg,
 	r prometheus.Registerer,
 	tracer tracing.Tracer,
 ) *Service {
+	k8sHandler := &foldk8sHandler{
+		gvr:        v0alpha1.FolderResourceInfo.GroupVersionResource(),
+		namespacer: request.GetNamespaceMapper(cfg),
+		cfg:        cfg,
+	}
+
+	unifiedStore := ProvideUnifiedStore(cfg)
+
 	srv := &Service{
 		log:                  slog.Default().With("logger", "folder-service"),
 		dashboardStore:       dashboardStore,
 		dashboardFolderStore: folderStore,
 		store:                store,
+		unifiedStore:         unifiedStore,
 		features:             features,
 		accessControl:        ac,
 		bus:                  bus,
@@ -81,6 +96,7 @@ func ProvideService(
 		registry:             make(map[string]folder.RegistryService),
 		metrics:              newFoldersMetrics(r),
 		tracer:               tracer,
+		k8sclient:            k8sHandler,
 	}
 	srv.DBMigration(db)
 
@@ -138,6 +154,13 @@ func (s *Service) DBMigration(db db.DB) {
 }
 
 func (s *Service) GetFolders(ctx context.Context, q folder.GetFoldersQuery) ([]*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.getFoldersFromApiServer(ctx, q)
+	}
+	return s.GetFoldersLegacy(ctx, q)
+}
+
+func (s *Service) GetFoldersLegacy(ctx context.Context, q folder.GetFoldersQuery) ([]*folder.Folder, error) {
 	if q.SignedInUser == nil {
 		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
 	}
@@ -190,6 +213,13 @@ func (s *Service) GetFolders(ctx context.Context, q folder.GetFoldersQuery) ([]*
 }
 
 func (s *Service) Get(ctx context.Context, q *folder.GetFolderQuery) (*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.getFromApiServer(ctx, q)
+	}
+	return s.GetLegacy(ctx, q)
+}
+
+func (s *Service) GetLegacy(ctx context.Context, q *folder.GetFolderQuery) (*folder.Folder, error) {
 	if q.SignedInUser == nil {
 		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
 	}
@@ -278,13 +308,13 @@ func (s *Service) Get(ctx context.Context, q *folder.GetFolderQuery) (*folder.Fo
 	}
 
 	if s.features.IsEnabled(ctx, featuremgmt.FlagKubernetesFolders) {
-		f, err = s.setFullpath(ctx, f, q.SignedInUser)
+		f, err = s.setFullpath(ctx, f, q.SignedInUser, true)
 	}
 
 	return f, err
 }
 
-func (s *Service) setFullpath(ctx context.Context, f *folder.Folder, user identity.Requester) (*folder.Folder, error) {
+func (s *Service) setFullpath(ctx context.Context, f *folder.Folder, user identity.Requester, forceLegacy bool) (*folder.Folder, error) {
 	// #TODO is some kind of intermediate conversion required as is the case with user id where
 	// it gets parsed using UserIdentifier(). Also is there some kind of validation taking place as
 	// part of the parsing?
@@ -297,10 +327,19 @@ func (s *Service) setFullpath(ctx context.Context, f *folder.Folder, user identi
 
 	// Fetch the parent since the permissions for fetching the newly created folder
 	// are not yet present for the user--this requires a call to ClearUserPermissionCache
-	parents, err := s.GetParents(ctx, folder.GetParentsQuery{
-		UID:   f.UID,
-		OrgID: f.OrgID,
-	})
+	var parents []*folder.Folder
+	var err error
+	if forceLegacy {
+		parents, err = s.GetParentsLegacy(ctx, folder.GetParentsQuery{
+			UID:   f.UID,
+			OrgID: f.OrgID,
+		})
+	} else {
+		parents, err = s.GetParents(ctx, folder.GetParentsQuery{
+			UID:   f.UID,
+			OrgID: f.OrgID,
+		})
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -319,6 +358,13 @@ func (s *Service) setFullpath(ctx context.Context, f *folder.Folder, user identi
 }
 
 func (s *Service) GetChildren(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.getChildrenFromApiServer(ctx, q)
+	}
+	return s.GetChildrenLegacy(ctx, q)
+}
+
+func (s *Service) GetChildrenLegacy(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
 	defer func(t time.Time) {
 		parent := q.UID
 		if q.UID != folder.SharedWithMeFolderUID {
@@ -332,7 +378,7 @@ func (s *Service) GetChildren(ctx context.Context, q *folder.GetChildrenQuery) (
 	}
 
 	if s.features.IsEnabled(ctx, featuremgmt.FlagNestedFolders) && q.UID == folder.SharedWithMeFolderUID {
-		return s.GetSharedWithMe(ctx, q)
+		return s.GetSharedWithMe(ctx, q, true)
 	}
 
 	if q.UID == "" {
@@ -460,14 +506,19 @@ func (s *Service) getRootFolders(ctx context.Context, q *folder.GetChildrenQuery
 }
 
 // GetSharedWithMe returns folders available to user, which cannot be accessed from the root folders
-func (s *Service) GetSharedWithMe(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+func (s *Service) GetSharedWithMe(ctx context.Context, q *folder.GetChildrenQuery, forceLegacy bool) ([]*folder.Folder, error) {
 	start := time.Now()
-	availableNonRootFolders, err := s.getAvailableNonRootFolders(ctx, q)
+	availableNonRootFolders, err := s.getAvailableNonRootFolders(ctx, q, forceLegacy)
 	if err != nil {
 		s.metrics.sharedWithMeFetchFoldersRequestsDuration.WithLabelValues("failure").Observe(time.Since(start).Seconds())
 		return nil, folder.ErrInternal.Errorf("failed to fetch subfolders to which the user has explicit access: %w", err)
 	}
-	rootFolders, err := s.GetChildren(ctx, &folder.GetChildrenQuery{UID: "", OrgID: q.OrgID, SignedInUser: q.SignedInUser, Permission: q.Permission})
+	var rootFolders []*folder.Folder
+	if forceLegacy {
+		rootFolders, err = s.GetChildrenLegacy(ctx, &folder.GetChildrenQuery{UID: "", OrgID: q.OrgID, SignedInUser: q.SignedInUser, Permission: q.Permission})
+	} else {
+		rootFolders, err = s.GetChildren(ctx, &folder.GetChildrenQuery{UID: "", OrgID: q.OrgID, SignedInUser: q.SignedInUser, Permission: q.Permission})
+	}
 	if err != nil {
 		s.metrics.sharedWithMeFetchFoldersRequestsDuration.WithLabelValues("failure").Observe(time.Since(start).Seconds())
 		return nil, folder.ErrInternal.Errorf("failed to fetch root folders to which the user has access: %w", err)
@@ -478,7 +529,7 @@ func (s *Service) GetSharedWithMe(ctx context.Context, q *folder.GetChildrenQuer
 	return availableNonRootFolders, nil
 }
 
-func (s *Service) getAvailableNonRootFolders(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+func (s *Service) getAvailableNonRootFolders(ctx context.Context, q *folder.GetChildrenQuery, forceLegacy bool) ([]*folder.Folder, error) {
 	permissions := q.SignedInUser.GetPermissions()
 	var folderPermissions []string
 	if q.Permission == dashboardaccess.PERMISSION_EDIT {
@@ -507,13 +558,25 @@ func (s *Service) getAvailableNonRootFolders(ctx context.Context, q *folder.GetC
 		return nonRootFolders, nil
 	}
 
-	dashFolders, err := s.GetFolders(ctx, folder.GetFoldersQuery{
-		UIDs:             folderUids,
-		OrgID:            q.OrgID,
-		SignedInUser:     q.SignedInUser,
-		OrderByTitle:     true,
-		WithFullpathUIDs: true,
-	})
+	var dashFolders []*folder.Folder
+	var err error
+	if forceLegacy {
+		dashFolders, err = s.GetFoldersLegacy(ctx, folder.GetFoldersQuery{
+			UIDs:             folderUids,
+			OrgID:            q.OrgID,
+			SignedInUser:     q.SignedInUser,
+			OrderByTitle:     true,
+			WithFullpathUIDs: true,
+		})
+	} else {
+		dashFolders, err = s.GetFolders(ctx, folder.GetFoldersQuery{
+			UIDs:             folderUids,
+			OrgID:            q.OrgID,
+			SignedInUser:     q.SignedInUser,
+			OrderByTitle:     true,
+			WithFullpathUIDs: true,
+		})
+	}
 	if err != nil {
 		return nil, folder.ErrInternal.Errorf("failed to fetch subfolders: %w", err)
 	}
@@ -565,6 +628,13 @@ func (s *Service) deduplicateAvailableFolders(ctx context.Context, folders []*fo
 }
 
 func (s *Service) GetParents(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.getParentsFromApiServer(ctx, q)
+	}
+	return s.GetParentsLegacy(ctx, q)
+}
+
+func (s *Service) GetParentsLegacy(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
 	if !s.features.IsEnabled(ctx, featuremgmt.FlagNestedFolders) || q.UID == accesscontrol.GeneralFolderUID {
 		return nil, nil
 	}
@@ -591,6 +661,13 @@ func (s *Service) getFolderByTitle(ctx context.Context, orgID int64, title strin
 }
 
 func (s *Service) Create(ctx context.Context, cmd *folder.CreateFolderCommand) (*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.createOnApiServer(ctx, cmd)
+	}
+	return s.CreateLegacy(ctx, cmd)
+}
+
+func (s *Service) CreateLegacy(ctx context.Context, cmd *folder.CreateFolderCommand) (*folder.Folder, error) {
 	if cmd.SignedInUser == nil || cmd.SignedInUser.IsNil() {
 		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
 	}
@@ -700,13 +777,23 @@ func (s *Service) Create(ctx context.Context, cmd *folder.CreateFolderCommand) (
 	}
 
 	if s.features.IsEnabled(ctx, featuremgmt.FlagKubernetesFolders) {
-		f, err = s.setFullpath(ctx, f, user)
+		f, err = s.setFullpath(ctx, f, user, true)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return f, nil
 }
 
 func (s *Service) Update(ctx context.Context, cmd *folder.UpdateFolderCommand) (*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.updateOnApiServer(ctx, cmd)
+	}
+	return s.UpdateLegacy(ctx, cmd)
+}
+
+func (s *Service) UpdateLegacy(ctx context.Context, cmd *folder.UpdateFolderCommand) (*folder.Folder, error) {
 	ctx, span := s.tracer.Start(ctx, "folder.Update")
 	defer span.End()
 
@@ -839,6 +926,13 @@ func prepareForUpdate(dashFolder *dashboards.Dashboard, orgId int64, userId int6
 }
 
 func (s *Service) Delete(ctx context.Context, cmd *folder.DeleteFolderCommand) error {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.deleteFromApiServer(ctx, cmd)
+	}
+	return s.DeleteLegacy(ctx, cmd)
+}
+
+func (s *Service) DeleteLegacy(ctx context.Context, cmd *folder.DeleteFolderCommand) error {
 	if cmd.SignedInUser == nil {
 		return folder.ErrBadRequest.Errorf("missing signed in user")
 	}
@@ -922,6 +1016,13 @@ func (s *Service) legacyDelete(ctx context.Context, cmd *folder.DeleteFolderComm
 }
 
 func (s *Service) Move(ctx context.Context, cmd *folder.MoveFolderCommand) (*folder.Folder, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.moveOnApiServer(ctx, cmd)
+	}
+	return s.MoveLegacy(ctx, cmd)
+}
+
+func (s *Service) MoveLegacy(ctx context.Context, cmd *folder.MoveFolderCommand) (*folder.Folder, error) {
 	ctx, span := s.tracer.Start(ctx, "folder.Move")
 	defer span.End()
 
@@ -1142,6 +1243,14 @@ func (s *Service) nestedFolderDelete(ctx context.Context, cmd *folder.DeleteFold
 }
 
 func (s *Service) GetDescendantCounts(ctx context.Context, q *folder.GetDescendantCountsQuery) (folder.DescendantCounts, error) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesFoldersServiceV2) {
+		return s.getDescendantCountsFromApiServer(ctx, q)
+	}
+
+	return s.GetDescendantCountsLegacy(ctx, q)
+}
+
+func (s *Service) GetDescendantCountsLegacy(ctx context.Context, q *folder.GetDescendantCountsQuery) (folder.DescendantCounts, error) {
 	if q.SignedInUser == nil {
 		return nil, folder.ErrBadRequest.Errorf("missing signed-in user")
 	}
diff --git a/pkg/services/folder/folderimpl/folder_test.go b/pkg/services/folder/folderimpl/folder_test.go
index 132247791c3..f3c00291b26 100644
--- a/pkg/services/folder/folderimpl/folder_test.go
+++ b/pkg/services/folder/folderimpl/folder_test.go
@@ -62,10 +62,10 @@ func TestIntegrationProvideFolderService(t *testing.T) {
 	}
 	t.Run("should register scope resolvers", func(t *testing.T) {
 		ac := acmock.New()
-		db, _ := db.InitTestDBWithCfg(t)
+		db, cfg := db.InitTestDBWithCfg(t)
 		store := ProvideStore(db)
 		ProvideService(store, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), nil, nil, db,
-			featuremgmt.WithFeatures(), supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+			featuremgmt.WithFeatures(), supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 		require.Len(t, ac.Calls.RegisterAttributeScopeResolver, 2)
 	})
diff --git a/pkg/services/folder/folderimpl/folder_unifiedstorage.go b/pkg/services/folder/folderimpl/folder_unifiedstorage.go
new file mode 100644
index 00000000000..d8f9a5b8b76
--- /dev/null
+++ b/pkg/services/folder/folderimpl/folder_unifiedstorage.go
@@ -0,0 +1,702 @@
+package folderimpl
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+	"golang.org/x/exp/slices"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/events"
+	"github.com/grafana/grafana/pkg/infra/metrics"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/guardian"
+	"github.com/grafana/grafana/pkg/services/store/entity"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/util"
+)
+
+// interface to allow for testing
+type folderK8sHandler interface {
+	getClient(ctx context.Context, orgID int64) (dynamic.ResourceInterface, bool)
+	getNamespace(orgID int64) string
+}
+
+var _ folderK8sHandler = (*foldk8sHandler)(nil)
+
+type foldk8sHandler struct {
+	cfg        *setting.Cfg
+	namespacer request.NamespaceMapper
+	gvr        schema.GroupVersionResource
+}
+
+func (s *Service) getFoldersFromApiServer(ctx context.Context, q folder.GetFoldersQuery) ([]*folder.Folder, error) {
+	if q.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	qry := folder.NewGetFoldersQuery(q)
+	permissions := q.SignedInUser.GetPermissions()
+	folderPermissions := permissions[dashboards.ActionFoldersRead]
+	qry.AncestorUIDs = make([]string, 0, len(folderPermissions))
+	if len(folderPermissions) == 0 && !q.SignedInUser.GetIsGrafanaAdmin() {
+		return nil, nil
+	}
+	for _, p := range folderPermissions {
+		if p == dashboards.ScopeFoldersAll {
+			// no need to query for folders with permissions
+			// the user has permission to access all folders
+			qry.AncestorUIDs = nil
+			break
+		}
+		if folderUid, found := strings.CutPrefix(p, dashboards.ScopeFoldersPrefix); found {
+			if !slices.Contains(qry.AncestorUIDs, folderUid) {
+				qry.AncestorUIDs = append(qry.AncestorUIDs, folderUid)
+			}
+		}
+	}
+
+	var dashFolders []*folder.Folder
+	var err error
+
+	ctx = identity.WithRequester(ctx, q.SignedInUser)
+	dashFolders, err = s.unifiedStore.GetFolders(ctx, qry)
+	if err != nil {
+		return nil, folder.ErrInternal.Errorf("failed to fetch subfolders: %w", err)
+	}
+
+	return dashFolders, nil
+}
+
+func (s *Service) getFromApiServer(ctx context.Context, q *folder.GetFolderQuery) (*folder.Folder, error) {
+	if q.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	if q.UID != nil && *q.UID == accesscontrol.GeneralFolderUID {
+		return folder.RootFolder, nil
+	}
+
+	if q.UID != nil && *q.UID == folder.SharedWithMeFolderUID {
+		return folder.SharedWithMeFolder.WithURL(), nil
+	}
+
+	var dashFolder *folder.Folder
+	var err error
+	switch {
+	case q.UID != nil:
+		if *q.UID == "" {
+			return &folder.GeneralFolder, nil
+		}
+		dashFolder, err = s.unifiedStore.Get(ctx, *q)
+		if err != nil {
+			return nil, err
+		}
+	// nolint:staticcheck
+	case q.ID != nil:
+		// not implemented
+	case q.Title != nil:
+		// not implemented
+	default:
+		return nil, folder.ErrBadRequest.Errorf("either on of UID, ID, Title fields must be present")
+	}
+
+	if dashFolder.IsGeneral() {
+		return dashFolder, nil
+	}
+
+	// do not get guardian by the folder ID because it differs from the nested folder ID
+	// and the legacy folder ID has been associated with the permissions:
+	// use the folde UID instead that is the same for both
+	g, err := guardian.NewByFolder(ctx, dashFolder, dashFolder.OrgID, q.SignedInUser)
+	if err != nil {
+		return nil, err
+	}
+
+	if canView, err := g.CanView(); err != nil || !canView {
+		if err != nil {
+			return nil, toFolderError(err)
+		}
+		return nil, dashboards.ErrFolderAccessDenied
+	}
+
+	metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Folder).Inc()
+	// nolint:staticcheck
+	if q.ID != nil {
+		q.ID = nil
+		q.UID = &dashFolder.UID
+	}
+
+	f := dashFolder
+
+	// always expose the dashboard store sequential ID
+	metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Folder).Inc()
+	// nolint:staticcheck
+	f.ID = dashFolder.ID
+	f.Version = dashFolder.Version
+
+	f, err = s.setFullpath(ctx, f, q.SignedInUser, false)
+	if err != nil {
+		return nil, err
+	}
+
+	return f, err
+}
+
+func (s *Service) getChildrenFromApiServer(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+	defer func(t time.Time) {
+		parent := q.UID
+		if q.UID != folder.SharedWithMeFolderUID {
+			parent = "folder"
+		}
+		s.metrics.foldersGetChildrenRequestsDuration.WithLabelValues(parent).Observe(time.Since(t).Seconds())
+	}(time.Now())
+
+	if q.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	if q.UID == folder.SharedWithMeFolderUID {
+		return s.GetSharedWithMe(ctx, q, false)
+	}
+
+	if q.UID == "" {
+		return s.getRootFoldersFromApiServer(ctx, q)
+	}
+
+	var err error
+	// TODO: figure out what to do with Guardian
+	// we only need to check access to the folder
+	// if the parent is accessible then the subfolders are accessible as well (due to inheritance)
+	f := &folder.Folder{
+		UID: q.UID,
+	}
+	g, err := guardian.NewByFolder(ctx, f, q.OrgID, q.SignedInUser)
+	if err != nil {
+		return nil, err
+	}
+
+	guardianFunc := g.CanView
+	if q.Permission == dashboardaccess.PERMISSION_EDIT {
+		guardianFunc = g.CanEdit
+	}
+
+	hasAccess, err := guardianFunc()
+	if err != nil {
+		return nil, err
+	}
+	if !hasAccess {
+		return nil, dashboards.ErrFolderAccessDenied
+	}
+
+	children, err := s.unifiedStore.GetChildren(ctx, *q)
+	if err != nil {
+		return nil, err
+	}
+
+	return children, nil
+}
+
+func (s *Service) getRootFoldersFromApiServer(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+	permissions := q.SignedInUser.GetPermissions()
+	var folderPermissions []string
+	if q.Permission == dashboardaccess.PERMISSION_EDIT {
+		folderPermissions = permissions[dashboards.ActionFoldersWrite]
+	} else {
+		folderPermissions = permissions[dashboards.ActionFoldersRead]
+	}
+
+	if len(folderPermissions) == 0 && !q.SignedInUser.GetIsGrafanaAdmin() {
+		return nil, nil
+	}
+
+	q.FolderUIDs = make([]string, 0, len(folderPermissions))
+	for _, p := range folderPermissions {
+		if p == dashboards.ScopeFoldersAll {
+			// no need to query for folders with permissions
+			// the user has permission to access all folders
+			q.FolderUIDs = nil
+			break
+		}
+		if folderUid, found := strings.CutPrefix(p, dashboards.ScopeFoldersPrefix); found {
+			if !slices.Contains(q.FolderUIDs, folderUid) {
+				q.FolderUIDs = append(q.FolderUIDs, folderUid)
+			}
+		}
+	}
+
+	children, err := s.unifiedStore.GetChildren(ctx, *q)
+	if err != nil {
+		return nil, err
+	}
+
+	// add "shared with me" folder on the 1st page
+	if (q.Page == 0 || q.Page == 1) && len(q.FolderUIDs) != 0 {
+		children = append([]*folder.Folder{&folder.SharedWithMeFolder}, children...)
+	}
+
+	return children, nil
+}
+
+func (s *Service) getParentsFromApiServer(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
+	if q.UID == accesscontrol.GeneralFolderUID {
+		return nil, nil
+	}
+	if q.UID == folder.SharedWithMeFolderUID {
+		return []*folder.Folder{&folder.SharedWithMeFolder}, nil
+	}
+
+	return s.unifiedStore.GetParents(ctx, q)
+}
+
+func (s *Service) createOnApiServer(ctx context.Context, cmd *folder.CreateFolderCommand) (*folder.Folder, error) {
+	if cmd.SignedInUser == nil || cmd.SignedInUser.IsNil() {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	if cmd.ParentUID != "" {
+		// Check that the user is allowed to create a subfolder in this folder
+		parentUIDScope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.ParentUID)
+		legacyEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, parentUIDScope)
+		newEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersCreate, parentUIDScope)
+		evaluator := accesscontrol.EvalAny(legacyEvaluator, newEvaluator)
+		hasAccess, evalErr := s.accessControl.Evaluate(ctx, cmd.SignedInUser, evaluator)
+		if evalErr != nil {
+			return nil, evalErr
+		}
+		if !hasAccess {
+			return nil, dashboards.ErrFolderCreationAccessDenied.Errorf("user is missing the permission with action either folders:create or folders:write and scope %s or any of the parent folder scopes", parentUIDScope)
+		}
+	} else {
+		evaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersCreate, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID))
+		hasAccess, evalErr := s.accessControl.Evaluate(ctx, cmd.SignedInUser, evaluator)
+		if evalErr != nil {
+			return nil, evalErr
+		}
+		if !hasAccess {
+			return nil, dashboards.ErrFolderCreationAccessDenied.Errorf("user is missing the permission with action folders:create and scope folders:uid:general, which is required to create a folder under the root level")
+		}
+	}
+
+	if cmd.UID == folder.SharedWithMeFolderUID {
+		return nil, folder.ErrBadRequest.Errorf("cannot create folder with UID %s", folder.SharedWithMeFolderUID)
+	}
+
+	trimmedUID := strings.TrimSpace(cmd.UID)
+	if trimmedUID == accesscontrol.GeneralFolderUID {
+		return nil, dashboards.ErrFolderInvalidUID
+	}
+
+	user := cmd.SignedInUser
+
+	cmd = &folder.CreateFolderCommand{
+		// TODO: Today, if a UID isn't specified, the dashboard store
+		// generates a new UID. The new folder store will need to do this as
+		// well, but for now we take the UID from the newly created folder.
+		UID:          trimmedUID,
+		OrgID:        cmd.OrgID,
+		Title:        cmd.Title,
+		Description:  cmd.Description,
+		ParentUID:    cmd.ParentUID,
+		SignedInUser: cmd.SignedInUser,
+	}
+
+	f, err := s.unifiedStore.Create(ctx, *cmd)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err = s.setFullpath(ctx, f, user, false)
+	if err != nil {
+		return nil, err
+	}
+
+	return f, nil
+}
+
+func (s *Service) updateOnApiServer(ctx context.Context, cmd *folder.UpdateFolderCommand) (*folder.Folder, error) {
+	ctx, span := s.tracer.Start(ctx, "folder.Update")
+	defer span.End()
+
+	if cmd.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	if cmd.NewTitle != nil && *cmd.NewTitle != "" {
+		title := strings.TrimSpace(*cmd.NewTitle)
+		cmd.NewTitle = &title
+
+		if strings.EqualFold(*cmd.NewTitle, dashboards.RootFolderName) {
+			return nil, dashboards.ErrDashboardFolderNameExists
+		}
+	}
+
+	if !util.IsValidShortUID(cmd.UID) {
+		return nil, dashboards.ErrDashboardInvalidUid
+	} else if util.IsShortUIDTooLong(cmd.UID) {
+		return nil, dashboards.ErrDashboardUidTooLong
+	}
+
+	cmd.UID = strings.TrimSpace(cmd.UID)
+
+	if cmd.NewTitle != nil && *cmd.NewTitle == "" {
+		return nil, dashboards.ErrDashboardTitleEmpty
+	}
+
+	f := &folder.Folder{
+		UID: cmd.UID,
+	}
+	g, err := guardian.NewByFolder(ctx, f, cmd.OrgID, cmd.SignedInUser)
+	if err != nil {
+		return nil, err
+	}
+
+	if canSave, err := g.CanSave(); err != nil || !canSave {
+		if err != nil {
+			return nil, err
+		}
+		return nil, toFolderError(dashboards.ErrDashboardUpdateAccessDenied)
+	}
+
+	user := cmd.SignedInUser
+
+	foldr, err := s.unifiedStore.Update(ctx, folder.UpdateFolderCommand{
+		UID:            cmd.UID,
+		OrgID:          cmd.OrgID,
+		NewTitle:       cmd.NewTitle,
+		NewDescription: cmd.NewDescription,
+		SignedInUser:   user,
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if cmd.NewTitle != nil {
+		metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Folder).Inc()
+
+		if err := s.publishFolderFullPathUpdatedEventViaApiServer(ctx, foldr.Updated, cmd.OrgID, cmd.UID); err != nil {
+			return nil, err
+		}
+	}
+
+	// always expose the dashboard store sequential ID
+	metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Folder).Inc()
+
+	return foldr, nil
+}
+
+func (s *Service) deleteFromApiServer(ctx context.Context, cmd *folder.DeleteFolderCommand) error {
+	if cmd.SignedInUser == nil {
+		return folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+	if cmd.UID == "" {
+		return folder.ErrBadRequest.Errorf("missing UID")
+	}
+	if cmd.OrgID < 1 {
+		return folder.ErrBadRequest.Errorf("invalid orgID")
+	}
+
+	f := &folder.Folder{
+		UID: cmd.UID,
+	}
+	guard, err := guardian.NewByFolder(ctx, f, cmd.OrgID, cmd.SignedInUser)
+	if err != nil {
+		return err
+	}
+
+	if canSave, err := guard.CanDelete(); err != nil || !canSave {
+		if err != nil {
+			return toFolderError(err)
+		}
+		return dashboards.ErrFolderAccessDenied
+	}
+
+	descFolders, err := s.unifiedStore.GetDescendants(ctx, cmd.OrgID, cmd.UID)
+	if err != nil {
+		return err
+	}
+
+	folders := []string{cmd.UID}
+	for _, f := range descFolders {
+		folders = append(folders, f.UID)
+	}
+
+	if cmd.ForceDeleteRules {
+		if err := s.deleteChildrenInFolder(ctx, cmd.OrgID, folders, cmd.SignedInUser); err != nil {
+			return err
+		}
+	} else {
+		alertRuleSrv, ok := s.registry[entity.StandardKindAlertRule]
+		if !ok {
+			return folder.ErrInternal.Errorf("no alert rule service found in registry")
+		}
+		alertRulesInFolder, err := alertRuleSrv.CountInFolders(ctx, cmd.OrgID, folders, cmd.SignedInUser)
+		if err != nil {
+			s.log.Error("failed to count alert rules in folder", "error", err)
+			return err
+		}
+		if alertRulesInFolder > 0 {
+			return folder.ErrFolderNotEmpty.Errorf("folder contains %d alert rules", alertRulesInFolder)
+		}
+	}
+
+	err = s.unifiedStore.Delete(ctx, folders, cmd.OrgID)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *Service) moveOnApiServer(ctx context.Context, cmd *folder.MoveFolderCommand) (*folder.Folder, error) {
+	ctx, span := s.tracer.Start(ctx, "folder.Move")
+	defer span.End()
+
+	if cmd.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed in user")
+	}
+
+	// k6-specific check to prevent folder move for a k6-app folder and its children
+	if cmd.UID == accesscontrol.K6FolderUID {
+		return nil, folder.ErrBadRequest.Errorf("k6 project may not be moved")
+	}
+
+	f, err := s.unifiedStore.Get(ctx, folder.GetFolderQuery{
+		UID:          &cmd.UID,
+		OrgID:        cmd.OrgID,
+		SignedInUser: cmd.SignedInUser,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if f != nil && f.ParentUID == accesscontrol.K6FolderUID {
+		return nil, folder.ErrBadRequest.Errorf("k6 project may not be moved")
+	}
+
+	// Check that the user is allowed to move the folder to the destination folder
+	hasAccess, evalErr := s.canMoveViaApiServer(ctx, cmd)
+	if evalErr != nil {
+		return nil, evalErr
+	}
+	if !hasAccess {
+		return nil, dashboards.ErrFolderAccessDenied
+	}
+
+	// here we get the folder, we need to get the height of current folder
+	// and the depth of the new parent folder, the sum can't bypass 8
+	folderHeight, err := s.unifiedStore.GetHeight(ctx, cmd.UID, cmd.OrgID, &cmd.NewParentUID)
+	if err != nil {
+		return nil, err
+	}
+	parents, err := s.unifiedStore.GetParents(ctx, folder.GetParentsQuery{UID: cmd.NewParentUID, OrgID: cmd.OrgID})
+	if err != nil {
+		return nil, err
+	}
+
+	// height of the folder that is being moved + this current folder itself + depth of the NewParent folder should be less than or equal MaxNestedFolderDepth
+	if folderHeight+len(parents)+1 > folder.MaxNestedFolderDepth {
+		return nil, folder.ErrMaximumDepthReached.Errorf("failed to move folder")
+	}
+
+	for _, parent := range parents {
+		// if the current folder is already a parent of newparent, we should return error
+		if parent.UID == cmd.UID {
+			return nil, folder.ErrCircularReference.Errorf("failed to move folder")
+		}
+	}
+
+	f, err = s.unifiedStore.Update(ctx, folder.UpdateFolderCommand{
+		UID:          cmd.UID,
+		OrgID:        cmd.OrgID,
+		NewParentUID: &cmd.NewParentUID,
+		SignedInUser: cmd.SignedInUser,
+	})
+	if err != nil {
+		return nil, folder.ErrInternal.Errorf("failed to move folder: %w", err)
+	}
+
+	if err := s.publishFolderFullPathUpdatedEventViaApiServer(ctx, f.Updated, cmd.OrgID, cmd.UID); err != nil {
+		return nil, err
+	}
+
+	return f, nil
+}
+
+func (s *Service) publishFolderFullPathUpdatedEventViaApiServer(ctx context.Context, timestamp time.Time, orgID int64, folderUID string) error {
+	ctx, span := s.tracer.Start(ctx, "folder.publishFolderFullPathUpdatedEventViaApiServer")
+	defer span.End()
+
+	descFolders, err := s.unifiedStore.GetDescendants(ctx, orgID, folderUID)
+	if err != nil {
+		s.log.ErrorContext(ctx, "Failed to get descendants of the folder", "folderUID", folderUID, "orgID", orgID, "error", err)
+		return err
+	}
+
+	uids := make([]string, 0, len(descFolders)+1)
+	uids = append(uids, folderUID)
+	for _, f := range descFolders {
+		uids = append(uids, f.UID)
+	}
+	span.AddEvent("found folder descendants", trace.WithAttributes(
+		attribute.Int64("folders", int64(len(uids))),
+	))
+
+	if err := s.bus.Publish(ctx, &events.FolderFullPathUpdated{
+		Timestamp: timestamp,
+		UIDs:      uids,
+		OrgID:     orgID,
+	}); err != nil {
+		s.log.ErrorContext(ctx, "Failed to publish FolderFullPathUpdated event", "folderUID", folderUID, "orgID", orgID, "descendantsUIDs", uids, "error", err)
+		return err
+	}
+
+	return nil
+}
+
+func (s *Service) canMoveViaApiServer(ctx context.Context, cmd *folder.MoveFolderCommand) (bool, error) {
+	// Check that the user is allowed to move the folder to the destination folder
+	var evaluator accesscontrol.Evaluator
+	parentUID := cmd.NewParentUID
+	if parentUID != "" {
+		legacyEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.NewParentUID))
+		newEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersCreate, dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.NewParentUID))
+		evaluator = accesscontrol.EvalAny(legacyEvaluator, newEvaluator)
+	} else {
+		// Evaluate folder creation permission when moving folder to the root level
+		evaluator = accesscontrol.EvalPermission(dashboards.ActionFoldersCreate, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID))
+		parentUID = folder.GeneralFolderUID
+	}
+	if hasAccess, err := s.accessControl.Evaluate(ctx, cmd.SignedInUser, evaluator); err != nil {
+		return false, err
+	} else if !hasAccess {
+		return false, dashboards.ErrMoveAccessDenied.Errorf("user does not have permissions to move a folder to folder with UID %s", parentUID)
+	}
+
+	// Check that the user would not be elevating their permissions by moving a folder to the destination folder
+	// This is needed for plugins, as different folders can have different plugin configs
+	// We do this by checking that there are no permissions that user has on the destination parent folder but not on the source folder
+	// We also need to look at the folder tree for the destination folder, as folder permissions are inherited
+	newFolderAndParentUIDs, err := s.getFolderAndParentUIDScopesViaApiServer(ctx, parentUID, cmd.OrgID)
+	if err != nil {
+		return false, err
+	}
+
+	permissions := cmd.SignedInUser.GetPermissions()
+	var evaluators []accesscontrol.Evaluator
+	currentFolderScope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.UID)
+	for action, scopes := range permissions {
+		// Skip unexpanded action sets - they have no impact if action sets are not enabled
+		if !s.features.IsEnabled(ctx, featuremgmt.FlagAccessActionSets) {
+			if action == "folders:view" || action == "folders:edit" || action == "folders:admin" {
+				continue
+			}
+		}
+		for _, scope := range newFolderAndParentUIDs {
+			if slices.Contains(scopes, scope) {
+				evaluators = append(evaluators, accesscontrol.EvalPermission(action, currentFolderScope))
+				break
+			}
+		}
+	}
+
+	if hasAccess, err := s.accessControl.Evaluate(ctx, cmd.SignedInUser, accesscontrol.EvalAll(evaluators...)); err != nil {
+		return false, err
+	} else if !hasAccess {
+		return false, dashboards.ErrFolderAccessEscalation.Errorf("user cannot move a folder to another folder where they have higher permissions")
+	}
+	return true, nil
+}
+
+func (s *Service) getFolderAndParentUIDScopesViaApiServer(ctx context.Context, folderUID string, orgID int64) ([]string, error) {
+	folderAndParentUIDScopes := []string{dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID)}
+	if folderUID == folder.GeneralFolderUID {
+		return folderAndParentUIDScopes, nil
+	}
+	folderParents, err := s.unifiedStore.GetParents(ctx, folder.GetParentsQuery{UID: folderUID, OrgID: orgID})
+	if err != nil {
+		return nil, err
+	}
+	for _, newParent := range folderParents {
+		scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(newParent.UID)
+		folderAndParentUIDScopes = append(folderAndParentUIDScopes, scope)
+	}
+	return folderAndParentUIDScopes, nil
+}
+
+func (s *Service) getDescendantCountsFromApiServer(ctx context.Context, q *folder.GetDescendantCountsQuery) (folder.DescendantCounts, error) {
+	if q.SignedInUser == nil {
+		return nil, folder.ErrBadRequest.Errorf("missing signed-in user")
+	}
+	if q.UID == nil || *q.UID == "" {
+		return nil, folder.ErrBadRequest.Errorf("missing UID")
+	}
+	if q.OrgID < 1 {
+		return nil, folder.ErrBadRequest.Errorf("invalid orgID")
+	}
+
+	if s.features.IsEnabledGlobally(featuremgmt.FlagK8SFolderCounts) {
+		return s.unifiedStore.(*FolderUnifiedStoreImpl).CountFolderContent(ctx, q.OrgID, *q.UID)
+	}
+
+	folders := []string{*q.UID}
+	countsMap := make(folder.DescendantCounts, len(s.registry)+1)
+	descendantFolders, err := s.unifiedStore.GetDescendants(ctx, q.OrgID, *q.UID)
+	if err != nil {
+		s.log.ErrorContext(ctx, "failed to get descendant folders", "error", err)
+		return nil, err
+	}
+
+	for _, f := range descendantFolders {
+		folders = append(folders, f.UID)
+	}
+	countsMap[entity.StandardKindFolder] = int64(len(descendantFolders))
+
+	for _, v := range s.registry {
+		c, err := v.CountInFolders(ctx, q.OrgID, folders, q.SignedInUser)
+		if err != nil {
+			s.log.ErrorContext(ctx, "failed to count folder descendants", "error", err)
+			return nil, err
+		}
+		countsMap[v.Kind()] = c
+	}
+	return countsMap, nil
+}
+
+// -----------------------------------------------------------------------------------------
+// Folder k8s functions
+// -----------------------------------------------------------------------------------------
+
+func (fk8s *foldk8sHandler) getClient(ctx context.Context, orgID int64) (dynamic.ResourceInterface, bool) {
+	cfg := &rest.Config{
+		Host:    fk8s.cfg.AppURL,
+		APIPath: "/apis",
+		TLSClientConfig: rest.TLSClientConfig{
+			Insecure: true, // Skip TLS verification
+		},
+		Username: fk8s.cfg.AdminUser,
+		Password: fk8s.cfg.AdminPassword,
+	}
+
+	dyn, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return nil, false
+	}
+	return dyn.Resource(fk8s.gvr).Namespace(fk8s.getNamespace(orgID)), true
+}
+
+func (fk8s *foldk8sHandler) getNamespace(orgID int64) string {
+	return fk8s.namespacer(orgID)
+}
diff --git a/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go b/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
new file mode 100644
index 00000000000..8f757975d6c
--- /dev/null
+++ b/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
@@ -0,0 +1,414 @@
+package folderimpl
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
+	"github.com/grafana/grafana/pkg/bus"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/infra/log/logtest"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	internalfolders "github.com/grafana/grafana/pkg/registry/apis/folders"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
+	"github.com/grafana/grafana/pkg/services/authz/zanzana"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/guardian"
+	ngstore "github.com/grafana/grafana/pkg/services/ngalert/store"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
+	"github.com/grafana/grafana/pkg/services/user"
+)
+
+func TestIntegrationFolderServiceViaUnifiedStorage(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	m := map[string]v0alpha1.Folder{}
+
+	unifiedStorageFolder := &v0alpha1.Folder{}
+	unifiedStorageFolder.Kind = "folder"
+
+	fooFolder := &folder.Folder{
+		Title:        "Foo Folder",
+		OrgID:        orgID,
+		UID:          "foo",
+		URL:          "/dashboards/f/foo/foo-folder",
+		CreatedByUID: "user:1",
+		UpdatedByUID: "user:1",
+	}
+
+	updateFolder := &folder.Folder{
+		Title: "Folder",
+		OrgID: orgID,
+		UID:   "updatefolder",
+	}
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("DELETE /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/deletefolder", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+	})
+
+	mux.HandleFunc("GET /apis/folder.grafana.app/v0alpha1/namespaces/default/folders", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		l := &v0alpha1.FolderList{}
+		l.Kind = "Folder"
+		err := json.NewEncoder(w).Encode(l)
+		require.NoError(t, err)
+	})
+
+	mux.HandleFunc("GET /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/foo", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		namespacer := func(_ int64) string { return "1" }
+		result, err := internalfolders.LegacyFolderToUnstructured(fooFolder, namespacer)
+		require.NoError(t, err)
+
+		err = json.NewEncoder(w).Encode(result)
+		require.NoError(t, err)
+	})
+
+	mux.HandleFunc("GET /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/updatefolder", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		namespacer := func(_ int64) string { return "1" }
+		result, err := internalfolders.LegacyFolderToUnstructured(updateFolder, namespacer)
+		require.NoError(t, err)
+
+		err = json.NewEncoder(w).Encode(result)
+		require.NoError(t, err)
+	})
+
+	mux.HandleFunc("PUT /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/updatefolder", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		buf, err := io.ReadAll(req.Body)
+		require.NoError(t, err)
+
+		var foldr v0alpha1.Folder
+		err = json.Unmarshal(buf, &foldr)
+		require.NoError(t, err)
+
+		updateFolder.Title = foldr.Spec.Title
+
+		namespacer := func(_ int64) string { return "1" }
+		result, err := internalfolders.LegacyFolderToUnstructured(updateFolder, namespacer)
+		require.NoError(t, err)
+
+		err = json.NewEncoder(w).Encode(result)
+		require.NoError(t, err)
+	})
+
+	mux.HandleFunc("GET /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/ady4yobv315a8e", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		err := json.NewEncoder(w).Encode(unifiedStorageFolder)
+		require.NoError(t, err)
+	})
+	mux.HandleFunc("PUT /apis/folder.grafana.app/v0alpha1/namespaces/default/folders/ady4yobv315a8e", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		err := json.NewEncoder(w).Encode(unifiedStorageFolder)
+		require.NoError(t, err)
+	})
+	mux.HandleFunc("POST /apis/folder.grafana.app/v0alpha1/namespaces/default/folders", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		buf, err := io.ReadAll(req.Body)
+		require.NoError(t, err)
+
+		var folder v0alpha1.Folder
+		err = json.Unmarshal(buf, &folder)
+		require.NoError(t, err)
+
+		m[folder.Name] = folder
+
+		fmt.Printf("buf: %+v\n", folder)
+		folder.Kind = "Folder"
+		err = json.NewEncoder(w).Encode(folder)
+		require.NoError(t, err)
+	})
+
+	folderApiServerMock := httptest.NewServer(mux)
+	defer folderApiServerMock.Close()
+
+	origNewGuardian := guardian.New
+	t.Cleanup(func() {
+		guardian.New = origNewGuardian
+	})
+
+	db, cfg := sqlstore.InitTestDB(t)
+	cfg.AppURL = folderApiServerMock.URL
+
+	unifiedStore := ProvideUnifiedStore(cfg)
+
+	ctx := context.Background()
+	usr := &user.SignedInUser{UserID: 1, OrgID: 1, Permissions: map[int64]map[string][]string{
+		1: accesscontrol.GroupScopesByActionContext(
+			ctx,
+			[]accesscontrol.Permission{
+				{Action: dashboards.ActionFoldersCreate, Scope: dashboards.ScopeFoldersAll},
+				{Action: dashboards.ActionFoldersWrite, Scope: dashboards.ScopeFoldersAll},
+				{Action: accesscontrol.ActionAlertingRuleDelete, Scope: dashboards.ScopeFoldersAll},
+			}),
+	}}
+
+	alertingStore := ngstore.DBstore{
+		SQLStore:      db,
+		Cfg:           cfg.UnifiedAlerting,
+		Logger:        log.New("test-alerting-store"),
+		AccessControl: actest.FakeAccessControl{ExpectedEvaluate: true},
+	}
+
+	featuresArr := []any{
+		featuremgmt.FlagKubernetesFolders,
+		featuremgmt.FlagKubernetesFoldersServiceV2}
+	features := featuremgmt.WithFeatures(featuresArr...)
+
+	folderService := &Service{
+		log:          slog.New(logtest.NewTestHandler(t)).With("logger", "test-folder-service"),
+		unifiedStore: unifiedStore,
+		features:     features,
+		bus:          bus.ProvideBus(tracing.InitializeTracerForTest()),
+		// db:            db,
+		accessControl: acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+		registry:      make(map[string]folder.RegistryService),
+		metrics:       newFoldersMetrics(nil),
+		tracer:        tracing.InitializeTracerForTest(),
+	}
+
+	require.NoError(t, folderService.RegisterService(alertingStore))
+
+	t.Run("Folder service tests", func(t *testing.T) {
+		t.Run("Given user has no permissions", func(t *testing.T) {
+			origNewGuardian := guardian.New
+			guardian.MockDashboardGuardian(&guardian.FakeDashboardGuardian{})
+
+			ctx = identity.WithRequester(context.Background(), noPermUsr)
+
+			f := folder.NewFolder("Folder", "")
+			f.UID = "foo"
+
+			t.Run("When get folder by id should return access denied error", func(t *testing.T) {
+				_, err := folderService.Get(ctx, &folder.GetFolderQuery{
+					UID:          &f.UID,
+					OrgID:        orgID,
+					SignedInUser: noPermUsr,
+				})
+				require.Equal(t, dashboards.ErrFolderAccessDenied, err)
+			})
+
+			t.Run("When get folder by uid should return access denied error", func(t *testing.T) {
+				_, err := folderService.Get(ctx, &folder.GetFolderQuery{
+					UID:          &f.UID,
+					OrgID:        orgID,
+					SignedInUser: noPermUsr,
+				})
+				require.Equal(t, dashboards.ErrFolderAccessDenied, err)
+			})
+
+			t.Run("When creating folder should return access denied error", func(t *testing.T) {
+				_, err := folderService.Create(ctx, &folder.CreateFolderCommand{
+					OrgID:        orgID,
+					Title:        f.Title,
+					UID:          f.UID,
+					SignedInUser: noPermUsr,
+				})
+				require.Error(t, err)
+			})
+
+			title := "Folder-TEST"
+			t.Run("When updating folder should return access denied error", func(t *testing.T) {
+				_, err := folderService.Update(ctx, &folder.UpdateFolderCommand{
+					UID:          f.UID,
+					OrgID:        orgID,
+					NewTitle:     &title,
+					SignedInUser: noPermUsr,
+				})
+				require.Error(t, err)
+				require.Equal(t, dashboards.ErrFolderAccessDenied, err)
+			})
+
+			t.Run("When deleting folder by uid should return access denied error", func(t *testing.T) {
+				err := folderService.Delete(ctx, &folder.DeleteFolderCommand{
+					UID:              f.UID,
+					OrgID:            orgID,
+					ForceDeleteRules: false,
+					SignedInUser:     noPermUsr,
+				})
+				require.Error(t, err)
+				require.Equal(t, dashboards.ErrFolderAccessDenied, err)
+			})
+
+			t.Cleanup(func() {
+				guardian.New = origNewGuardian
+			})
+		})
+
+		t.Run("Given user has permission to save", func(t *testing.T) {
+			origNewGuardian := guardian.New
+			guardian.MockDashboardGuardian(&guardian.FakeDashboardGuardian{CanSaveValue: true, CanViewValue: true})
+
+			ctx = identity.WithRequester(context.Background(), usr)
+
+			f := &folder.Folder{
+				OrgID:        orgID,
+				Title:        "Test-Folder",
+				UID:          "testfolder",
+				URL:          "/dashboards/f/testfolder/test-folder",
+				CreatedByUID: "user:1",
+				UpdatedByUID: "user:1",
+			}
+
+			t.Run("When creating folder should not return access denied error", func(t *testing.T) {
+				actualFolder, err := folderService.Create(ctx, &folder.CreateFolderCommand{
+					OrgID:        orgID,
+					Title:        f.Title,
+					UID:          f.UID,
+					SignedInUser: usr,
+				})
+				require.NoError(t, err)
+				require.Equal(t, f, actualFolder)
+			})
+
+			t.Run("When creating folder should return error if uid is general", func(t *testing.T) {
+				_, err := folderService.Create(ctx, &folder.CreateFolderCommand{
+					OrgID:        orgID,
+					Title:        f.Title,
+					UID:          "general",
+					SignedInUser: usr,
+				})
+				require.ErrorIs(t, err, dashboards.ErrFolderInvalidUID)
+			})
+
+			t.Run("When updating folder should not return access denied error", func(t *testing.T) {
+				title := "TEST-Folder"
+				req := &folder.UpdateFolderCommand{
+					UID:          updateFolder.UID,
+					OrgID:        orgID,
+					NewTitle:     &title,
+					SignedInUser: usr,
+				}
+
+				reqResult, err := folderService.Update(ctx, req)
+				require.NoError(t, err)
+				require.Equal(t, title, reqResult.Title)
+			})
+
+			t.Run("When deleting folder by uid should not return access denied error - ForceDeleteRules true", func(t *testing.T) {
+				err := folderService.Delete(ctx, &folder.DeleteFolderCommand{
+					UID:              "deletefolder",
+					OrgID:            orgID,
+					ForceDeleteRules: true,
+					SignedInUser:     usr,
+				})
+				require.NoError(t, err)
+			})
+
+			t.Run("When deleting folder by uid should not return access denied error - ForceDeleteRules false", func(t *testing.T) {
+				err := folderService.Delete(ctx, &folder.DeleteFolderCommand{
+					UID:              "deletefolder",
+					OrgID:            orgID,
+					ForceDeleteRules: false,
+					SignedInUser:     usr,
+				})
+				require.NoError(t, err)
+			})
+
+			t.Run("When deleting folder by uid, expectedForceDeleteRules as false, and dashboard Restore turned on should not return access denied error", func(t *testing.T) {
+				folderService.features = featuremgmt.WithFeatures(append(featuresArr, featuremgmt.FlagDashboardRestore)...)
+
+				expectedForceDeleteRules := false
+				err := folderService.Delete(ctx, &folder.DeleteFolderCommand{
+					UID:              "deletefolder",
+					OrgID:            orgID,
+					ForceDeleteRules: expectedForceDeleteRules,
+					SignedInUser:     usr,
+				})
+				require.NoError(t, err)
+			})
+
+			t.Run("When deleting folder by uid, expectedForceDeleteRules as true, and dashboard Restore turned on should not return access denied error", func(t *testing.T) {
+				folderService.features = featuremgmt.WithFeatures(append(featuresArr, featuremgmt.FlagDashboardRestore)...)
+
+				expectedForceDeleteRules := true
+				err := folderService.Delete(ctx, &folder.DeleteFolderCommand{
+					UID:              "deletefolder",
+					OrgID:            orgID,
+					ForceDeleteRules: expectedForceDeleteRules,
+					SignedInUser:     usr,
+				})
+				require.NoError(t, err)
+			})
+
+			t.Cleanup(func() {
+				guardian.New = origNewGuardian
+			})
+		})
+
+		t.Run("Given user has permission to view", func(t *testing.T) {
+			origNewGuardian := guardian.New
+			guardian.MockDashboardGuardian(&guardian.FakeDashboardGuardian{CanViewValue: true})
+
+			t.Run("When get folder by uid should return folder", func(t *testing.T) {
+				actual, err := folderService.Get(ctx, &folder.GetFolderQuery{
+					UID:          &fooFolder.UID,
+					OrgID:        fooFolder.OrgID,
+					SignedInUser: usr,
+				})
+				require.Equal(t, fooFolder, actual)
+				require.NoError(t, err)
+			})
+
+			t.Run("When get folder by uid and uid is general should return the root folder object", func(t *testing.T) {
+				uid := accesscontrol.GeneralFolderUID
+				query := &folder.GetFolderQuery{
+					UID:          &uid,
+					OrgID:        1,
+					SignedInUser: usr,
+				}
+				actual, err := folderService.Get(ctx, query)
+				require.Equal(t, folder.RootFolder, actual)
+				require.NoError(t, err)
+			})
+
+			// TODO!!
+			/*
+				t.Run("When get folder by title should return folder", func(t *testing.T) {
+					expected := folder.NewFolder("TEST-"+util.GenerateShortUID(), "")
+
+					actual, err := service.getFolderByTitle(context.Background(), orgID, expected.Title, nil)
+					require.Equal(t, expected, actual)
+					require.NoError(t, err)
+				})
+			*/
+
+			t.Cleanup(func() {
+				guardian.New = origNewGuardian
+			})
+		})
+
+		t.Run("Returns root folder", func(t *testing.T) {
+			t.Run("When the folder UID is blank should return the root folder", func(t *testing.T) {
+				emptyString := ""
+				actual, err := folderService.Get(ctx, &folder.GetFolderQuery{
+					UID:          &emptyString,
+					OrgID:        1,
+					SignedInUser: usr,
+				})
+
+				require.NoError(t, err)
+				require.Equal(t, folder.GeneralFolder.UID, actual.UID)
+				require.Equal(t, folder.GeneralFolder.Title, actual.Title)
+			})
+		})
+	})
+}
diff --git a/pkg/services/folder/folderimpl/unifiedstore.go b/pkg/services/folder/folderimpl/unifiedstore.go
new file mode 100644
index 00000000000..55c1f5c462f
--- /dev/null
+++ b/pkg/services/folder/folderimpl/unifiedstore.go
@@ -0,0 +1,520 @@
+package folderimpl
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8sUser "k8s.io/apiserver/pkg/authentication/user"
+	k8sRequest "k8s.io/apiserver/pkg/endpoints/request"
+
+	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
+	"github.com/grafana/grafana/pkg/infra/log"
+	internalfolders "github.com/grafana/grafana/pkg/registry/apis/folders"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/util"
+)
+
+type FolderUnifiedStoreImpl struct {
+	log       log.Logger
+	k8sclient folderK8sHandler
+}
+
+// sqlStore implements the store interface.
+var _ folder.Store = (*FolderUnifiedStoreImpl)(nil)
+
+func ProvideUnifiedStore(cfg *setting.Cfg) *FolderUnifiedStoreImpl {
+	k8sHandler := &foldk8sHandler{
+		gvr:        v0alpha1.FolderResourceInfo.GroupVersionResource(),
+		namespacer: request.GetNamespaceMapper(cfg),
+		cfg:        cfg,
+	}
+
+	return &FolderUnifiedStoreImpl{
+		k8sclient: k8sHandler,
+		log:       log.New("folder-store"),
+	}
+}
+
+func (ss *FolderUnifiedStoreImpl) Create(ctx context.Context, cmd folder.CreateFolderCommand) (*folder.Folder, error) {
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, cmd.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	obj, err := internalfolders.LegacyCreateCommandToUnstructured(&cmd)
+	if err != nil {
+		return nil, err
+	}
+	out, err := client.Create(newCtx, obj, v1.CreateOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	folder, _ := internalfolders.UnstructuredToLegacyFolder(*out, cmd.SignedInUser.GetOrgID())
+	if err != nil {
+		return nil, err
+	}
+
+	return folder, err
+}
+
+func (ss *FolderUnifiedStoreImpl) Delete(ctx context.Context, UIDs []string, orgID int64) error {
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, orgID)
+	if !ok {
+		return nil
+	}
+
+	for _, uid := range UIDs {
+		err = client.Delete(newCtx, uid, v1.DeleteOptions{})
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (ss *FolderUnifiedStoreImpl) Update(ctx context.Context, cmd folder.UpdateFolderCommand) (*folder.Folder, error) {
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, cmd.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	obj, err := client.Get(ctx, cmd.UID, v1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	updated, err := internalfolders.LegacyUpdateCommandToUnstructured(obj, &cmd)
+	if err != nil {
+		return nil, err
+	}
+
+	out, err := client.Update(ctx, updated, v1.UpdateOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	folder, _ := internalfolders.UnstructuredToLegacyFolder(*out, cmd.SignedInUser.GetOrgID())
+	if err != nil {
+		return nil, err
+	}
+
+	return folder, err
+}
+
+// If WithFullpath is true it computes also the full path of a folder.
+// The full path is a string that contains the titles of all parent folders separated by a slash.
+// For example, if the folder structure is:
+//
+//	A
+//	└── B
+//	    └── C
+//
+// The full path of C is "A/B/C".
+// The full path of B is "A/B".
+// The full path of A is "A".
+// If a folder contains a slash in its title, it is escaped with a backslash.
+// For example, if the folder structure is:
+//
+//	A
+//	└── B/C
+//
+// The full path of C is "A/B\/C".
+func (ss *FolderUnifiedStoreImpl) Get(ctx context.Context, q folder.GetFolderQuery) (*folder.Folder, error) {
+	// create a new context - prevents issues when the request stems from the k8s api itself
+	// otherwise the context goes through the handlers twice and causes issues
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, q.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	out, err := client.Get(newCtx, *q.UID, v1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	dashFolder, _ := internalfolders.UnstructuredToLegacyFolder(*out, q.SignedInUser.GetOrgID())
+	return dashFolder, nil
+}
+
+func (ss *FolderUnifiedStoreImpl) GetParents(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
+	// create a new context - prevents issues when the request stems from the k8s api itself
+	// otherwise the context goes through the handlers twice and causes issues
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, q.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	hits := []*folder.Folder{}
+
+	parentUid := q.UID
+
+	for parentUid != "" {
+		out, err := client.Get(newCtx, parentUid, v1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+
+		folder, _ := internalfolders.UnstructuredToLegacyFolder(*out, q.OrgID)
+		if err != nil {
+			return nil, err
+		}
+
+		parentUid = folder.ParentUID
+		hits = append(hits, folder)
+	}
+
+	if len(hits) > 0 {
+		return util.Reverse(hits[1:]), nil
+	}
+
+	return hits, nil
+}
+
+func (ss *FolderUnifiedStoreImpl) GetChildren(ctx context.Context, q folder.GetChildrenQuery) ([]*folder.Folder, error) {
+	// create a new context - prevents issues when the request stems from the k8s api itself
+	// otherwise the context goes through the handlers twice and causes issues
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, q.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	out, err := client.List(newCtx, v1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	hits := make([]*folder.Folder, 0)
+	for _, item := range out.Items {
+		// convert item to legacy folder format
+		f, _ := internalfolders.UnstructuredToLegacyFolder(item, q.OrgID)
+		if f == nil {
+			return nil, fmt.Errorf("unable covert unstructured item to legacy folder")
+		}
+
+		// it we are at root level, skip subfolder
+		if q.UID == "" && f.ParentUID != "" {
+			continue // query filter
+		}
+		// if we are at a nested folder, then skip folders that don't belong to parentUid
+		if q.UID != "" && !strings.EqualFold(f.ParentUID, q.UID) {
+			continue
+		}
+
+		hits = append(hits, f)
+	}
+
+	return hits, nil
+}
+
+// TODO use a single query to get the height of a folder
+func (ss *FolderUnifiedStoreImpl) GetHeight(ctx context.Context, foldrUID string, orgID int64, parentUID *string) (int, error) {
+	height := -1
+	queue := []string{foldrUID}
+	for len(queue) > 0 && height <= folder.MaxNestedFolderDepth {
+		length := len(queue)
+		height++
+		for i := 0; i < length; i++ {
+			ele := queue[0]
+			queue = queue[1:]
+			if parentUID != nil && *parentUID == ele {
+				return 0, folder.ErrCircularReference
+			}
+			folders, err := ss.GetChildren(ctx, folder.GetChildrenQuery{UID: ele, OrgID: orgID})
+			if err != nil {
+				return 0, err
+			}
+			for _, f := range folders {
+				queue = append(queue, f.UID)
+			}
+		}
+	}
+	if height > folder.MaxNestedFolderDepth {
+		ss.log.Warn("folder height exceeds the maximum allowed depth, You might have a circular reference", "uid", foldrUID, "orgId", orgID, "maxDepth", folder.MaxNestedFolderDepth)
+	}
+	return height, nil
+}
+
+// GetFolders returns org folders by their UIDs.
+// If UIDs is empty, it returns all folders in the org.
+// If WithFullpath is true it computes also the full path of a folder.
+// The full path is a string that contains the titles of all parent folders separated by a slash.
+// For example, if the folder structure is:
+//
+//	A
+//	└── B
+//	    └── C
+//
+// The full path of C is "A/B/C".
+// The full path of B is "A/B".
+// The full path of A is "A".
+// If a folder contains a slash in its title, it is escaped with a backslash.
+// For example, if the folder structure is:
+//
+//	A
+//	└── B/C
+//
+// The full path of C is "A/B\/C".
+//
+// If FullpathUIDs is true it computes a string that contains the UIDs of all parent folders separated by slash.
+// For example, if the folder structure is:
+//
+//	A (uid: "uid1")
+//	└── B (uid: "uid2")
+//	    └── C (uid: "uid3")
+//
+// The full path UIDs of C is "uid1/uid2/uid3".
+// The full path UIDs of B is "uid1/uid2".
+// The full path UIDs of A is "uid1".
+func (ss *FolderUnifiedStoreImpl) GetFolders(ctx context.Context, q folder.GetFoldersFromStoreQuery) ([]*folder.Folder, error) {
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, q.OrgID)
+	if !ok {
+		return nil, nil
+	}
+
+	out, err := client.List(newCtx, v1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	m := map[string]*folder.Folder{}
+	for _, item := range out.Items {
+		// convert item to legacy folder format
+		f, _ := internalfolders.UnstructuredToLegacyFolder(item, q.SignedInUser.GetOrgID())
+		if f == nil {
+			return nil, fmt.Errorf("unable covert unstructured item to legacy folder")
+		}
+
+		m[f.UID] = f
+	}
+
+	hits := []*folder.Folder{}
+
+	if len(q.UIDs) > 0 {
+		//return only the specified q.UIDs
+		for _, uid := range q.UIDs {
+			f, ok := m[uid]
+			if ok {
+				hits = append(hits, f)
+			}
+		}
+
+		return hits, nil
+	}
+
+	/*
+		if len(q.AncestorUIDs) > 0 {
+			// TODO
+			//return all nodes under those ancestors, requires building a tree
+		}
+	*/
+
+	//return everything
+	for _, f := range m {
+		hits = append(hits, f)
+	}
+
+	return hits, nil
+}
+
+func (ss *FolderUnifiedStoreImpl) GetDescendants(ctx context.Context, orgID int64, ancestor_uid string) ([]*folder.Folder, error) {
+	// create a new context - prevents issues when the request stems from the k8s api itself
+	// otherwise the context goes through the handlers twice and causes issues
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, orgID)
+	if !ok {
+		return nil, nil
+	}
+
+	out, err := client.List(newCtx, v1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	nodes := map[string]*folder.Folder{}
+	for _, item := range out.Items {
+		// convert item to legacy folder format
+		f, _ := internalfolders.UnstructuredToLegacyFolder(item, orgID)
+		if f == nil {
+			return nil, fmt.Errorf("unable covert unstructured item to legacy folder")
+		}
+
+		nodes[f.UID] = f
+	}
+
+	tree := map[string]map[string]*folder.Folder{}
+
+	for uid, f := range nodes {
+		parentUID := f.ParentUID
+		if parentUID == "" {
+			parentUID = "general"
+		}
+
+		if tree[parentUID] == nil {
+			tree[parentUID] = map[string]*folder.Folder{}
+		}
+
+		tree[parentUID][uid] = f
+	}
+
+	descendantsMap := map[string]*folder.Folder{}
+	getDescendants(nodes, tree, ancestor_uid, descendantsMap)
+
+	descendants := []*folder.Folder{}
+	for _, f := range descendantsMap {
+		descendants = append(descendants, f)
+	}
+
+	return descendants, nil
+}
+
+func getDescendants(nodes map[string]*folder.Folder, tree map[string]map[string]*folder.Folder, ancestor_uid string, descendantsMap map[string]*folder.Folder) {
+	for uid, _ := range tree[ancestor_uid] {
+		descendantsMap[uid] = nodes[uid]
+		getDescendants(nodes, tree, uid, descendantsMap)
+	}
+}
+
+func (ss *FolderUnifiedStoreImpl) CountFolderContent(ctx context.Context, orgID int64, ancestor_uid string) (folder.DescendantCounts, error) {
+	// create a new context - prevents issues when the request stems from the k8s api itself
+	// otherwise the context goes through the handlers twice and causes issues
+	newCtx, cancel, err := ss.getK8sContext(ctx)
+	if err != nil {
+		return nil, err
+	} else if cancel != nil {
+		defer cancel()
+	}
+
+	client, ok := ss.k8sclient.getClient(newCtx, orgID)
+	if !ok {
+		return nil, nil
+	}
+
+	counts, err := client.Get(newCtx, ancestor_uid, v1.GetOptions{}, "counts")
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := toFolderLegacyCounts(counts)
+	return *res, err
+}
+
+func toFolderLegacyCounts(u *unstructured.Unstructured) (*folder.DescendantCounts, error) {
+	ds, err := v0alpha1.UnstructuredToDescendantCounts(u)
+	if err != nil {
+		return nil, err
+	}
+
+	var out = make(folder.DescendantCounts)
+	for _, v := range ds.Counts {
+		// if stats come from unified storage, we will use them
+		if v.Group != "sql-fallback" {
+			out[v.Resource] = v.Count
+			continue
+		}
+		// if stats are from single tenant DB and they are not in unified storage, we will use them
+		if _, ok := out[v.Resource]; !ok {
+			out[v.Resource] = v.Count
+		}
+	}
+	return &out, nil
+}
+
+func (ss *FolderUnifiedStoreImpl) getK8sContext(ctx context.Context) (context.Context, context.CancelFunc, error) {
+	requester, requesterErr := identity.GetRequester(ctx)
+	if requesterErr != nil {
+		return nil, nil, requesterErr
+	}
+
+	user, exists := k8sRequest.UserFrom(ctx)
+	if !exists {
+		// add in k8s user if not there yet
+		var ok bool
+		user, ok = requester.(k8sUser.Info)
+		if !ok {
+			return nil, nil, fmt.Errorf("could not convert user to k8s user")
+		}
+	}
+
+	newCtx := k8sRequest.WithUser(context.Background(), user)
+	newCtx = log.WithContextualAttributes(newCtx, log.FromContext(ctx))
+	// TODO: after GLSA token workflow is removed, make this return early
+	// and move the else below to be unconditional
+	if requesterErr == nil {
+		newCtxWithRequester := identity.WithRequester(newCtx, requester)
+		newCtx = newCtxWithRequester
+	}
+
+	// inherit the deadline from the original context, if it exists
+	deadline, ok := ctx.Deadline()
+	if ok {
+		var newCancel context.CancelFunc
+		newCtx, newCancel = context.WithTimeout(newCtx, time.Until(deadline))
+		return newCtx, newCancel, nil
+	}
+
+	return newCtx, nil, nil
+}
diff --git a/pkg/services/folder/foldertest/foldertest.go b/pkg/services/folder/foldertest/foldertest.go
index 7cfccb3b5c2..205d984d72b 100644
--- a/pkg/services/folder/foldertest/foldertest.go
+++ b/pkg/services/folder/foldertest/foldertest.go
@@ -22,27 +22,51 @@ var _ folder.Service = (*FakeService)(nil)
 func (s *FakeService) GetChildren(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
 	return s.ExpectedFolders, s.ExpectedError
 }
+func (s *FakeService) GetChildrenLegacy(ctx context.Context, q *folder.GetChildrenQuery) ([]*folder.Folder, error) {
+	return s.ExpectedFolders, s.ExpectedError
+}
 
 func (s *FakeService) GetParents(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
 	return s.ExpectedFolders, s.ExpectedError
 }
+func (s *FakeService) GetParentsLegacy(ctx context.Context, q folder.GetParentsQuery) ([]*folder.Folder, error) {
+	return s.ExpectedFolders, s.ExpectedError
+}
 
 func (s *FakeService) Create(ctx context.Context, cmd *folder.CreateFolderCommand) (*folder.Folder, error) {
 	return s.ExpectedFolder, s.ExpectedError
 }
+func (s *FakeService) CreateLegacy(ctx context.Context, cmd *folder.CreateFolderCommand) (*folder.Folder, error) {
+	return s.ExpectedFolder, s.ExpectedError
+}
+
 func (s *FakeService) Get(ctx context.Context, q *folder.GetFolderQuery) (*folder.Folder, error) {
 	return s.ExpectedFolder, s.ExpectedError
 }
+func (s *FakeService) GetLegacy(ctx context.Context, q *folder.GetFolderQuery) (*folder.Folder, error) {
+	return s.ExpectedFolder, s.ExpectedError
+}
+
 func (s *FakeService) Update(ctx context.Context, cmd *folder.UpdateFolderCommand) (*folder.Folder, error) {
 	return s.ExpectedFolder, s.ExpectedError
 }
+func (s *FakeService) UpdateLegacy(ctx context.Context, cmd *folder.UpdateFolderCommand) (*folder.Folder, error) {
+	return s.ExpectedFolder, s.ExpectedError
+}
+
 func (s *FakeService) Delete(ctx context.Context, cmd *folder.DeleteFolderCommand) error {
 	return s.ExpectedError
 }
+func (s *FakeService) DeleteLegacy(ctx context.Context, cmd *folder.DeleteFolderCommand) error {
+	return s.ExpectedError
+}
 
 func (s *FakeService) Move(ctx context.Context, cmd *folder.MoveFolderCommand) (*folder.Folder, error) {
 	return s.ExpectedFolder, s.ExpectedError
 }
+func (s *FakeService) MoveLegacy(ctx context.Context, cmd *folder.MoveFolderCommand) (*folder.Folder, error) {
+	return s.ExpectedFolder, s.ExpectedError
+}
 
 func (s *FakeService) RegisterService(service folder.RegistryService) error {
 	return s.ExpectedError
@@ -51,7 +75,13 @@ func (s *FakeService) RegisterService(service folder.RegistryService) error {
 func (s *FakeService) GetDescendantCounts(ctx context.Context, q *folder.GetDescendantCountsQuery) (folder.DescendantCounts, error) {
 	return s.ExpectedDescendantCounts, s.ExpectedError
 }
+func (s *FakeService) GetDescendantCountsLegacy(ctx context.Context, q *folder.GetDescendantCountsQuery) (folder.DescendantCounts, error) {
+	return s.ExpectedDescendantCounts, s.ExpectedError
+}
 
 func (s *FakeService) GetFolders(ctx context.Context, q folder.GetFoldersQuery) ([]*folder.Folder, error) {
 	return s.ExpectedFolders, s.ExpectedError
 }
+func (s *FakeService) GetFoldersLegacy(ctx context.Context, q folder.GetFoldersQuery) ([]*folder.Folder, error) {
+	return s.ExpectedFolders, s.ExpectedError
+}
diff --git a/pkg/services/folder/service.go b/pkg/services/folder/service.go
index 50a1bec3391..656bdeeb866 100644
--- a/pkg/services/folder/service.go
+++ b/pkg/services/folder/service.go
@@ -5,12 +5,10 @@ import (
 )
 
 type Service interface {
-	// GetChildren returns an array containing all child folders.
-	GetChildren(ctx context.Context, q *GetChildrenQuery) ([]*Folder, error)
-	// GetParents returns an array containing add parent folders if nested folders are enabled
-	// otherwise it returns an empty array
-	GetParents(ctx context.Context, q GetParentsQuery) ([]*Folder, error)
+	RegisterService(service RegistryService) error
+
 	Create(ctx context.Context, cmd *CreateFolderCommand) (*Folder, error)
+	CreateLegacy(ctx context.Context, cmd *CreateFolderCommand) (*Folder, error)
 
 	// GetFolder takes a GetFolderCommand and returns a folder matching the
 	// request. One of UID, ID or Title must be included. If multiple values
@@ -20,21 +18,39 @@ type Service interface {
 	// If ParentUID is not set then the folder will be fetched from the root level.
 	// If WithFullpath is true it computes also the full path of a folder.
 	Get(ctx context.Context, q *GetFolderQuery) (*Folder, error)
+	GetLegacy(ctx context.Context, q *GetFolderQuery) (*Folder, error)
 
 	// Update is used to update a folder's UID, Title and Description. To change
 	// a folder's parent folder, use Move.
 	Update(ctx context.Context, cmd *UpdateFolderCommand) (*Folder, error)
+	UpdateLegacy(ctx context.Context, cmd *UpdateFolderCommand) (*Folder, error)
+
 	Delete(ctx context.Context, cmd *DeleteFolderCommand) error
+	DeleteLegacy(ctx context.Context, cmd *DeleteFolderCommand) error
+
 	// Move changes a folder's parent folder to the requested new parent.
 	Move(ctx context.Context, cmd *MoveFolderCommand) (*Folder, error)
-	RegisterService(service RegistryService) error
+	MoveLegacy(ctx context.Context, cmd *MoveFolderCommand) (*Folder, error)
+
 	// GetFolders returns org folders that are accessible by the signed in user by their UIDs.
 	// If WithFullpath is true it computes also the full path of a folder.
 	// The full path is a string that contains the titles of all parent folders separated by a slash.
 	// If a folder contains a slash in its title, it is escaped with a backslash.
 	// If FullpathUIDs is true it computes a string that contains the UIDs of all parent folders separated by slash.
 	GetFolders(ctx context.Context, q GetFoldersQuery) ([]*Folder, error)
+	GetFoldersLegacy(ctx context.Context, q GetFoldersQuery) ([]*Folder, error)
+
+	// GetChildren returns an array containing all child folders.
+	GetChildren(ctx context.Context, q *GetChildrenQuery) ([]*Folder, error)
+	GetChildrenLegacy(ctx context.Context, q *GetChildrenQuery) ([]*Folder, error)
+
+	// GetParents returns an array containing add parent folders if nested folders are enabled
+	// otherwise it returns an empty array
+	GetParents(ctx context.Context, q GetParentsQuery) ([]*Folder, error)
+	GetParentsLegacy(ctx context.Context, q GetParentsQuery) ([]*Folder, error)
+
 	GetDescendantCounts(ctx context.Context, q *GetDescendantCountsQuery) (DescendantCounts, error)
+	GetDescendantCountsLegacy(ctx context.Context, q *GetDescendantCountsQuery) (DescendantCounts, error)
 }
 
 // FolderStore is a folder store.
diff --git a/pkg/services/libraryelements/libraryelements_test.go b/pkg/services/libraryelements/libraryelements_test.go
index 3e24e33df33..d9b9fb833f9 100644
--- a/pkg/services/libraryelements/libraryelements_test.go
+++ b/pkg/services/libraryelements/libraryelements_test.go
@@ -336,7 +336,7 @@ func createFolder(t *testing.T, sc scenarioContext, title string) *folder.Folder
 	folderStore := folderimpl.ProvideDashboardFolderStore(sc.sqlStore)
 	store := folderimpl.ProvideStore(sc.sqlStore)
 	s := folderimpl.ProvideService(store, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore, folderStore, sc.sqlStore,
-		features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	t.Logf("Creating folder with title and UID %q", title)
 	ctx := identity.WithRequester(context.Background(), &sc.user)
 	folder, err := s.Create(ctx, &folder.CreateFolderCommand{
@@ -473,7 +473,7 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
 		guardian.InitAccessControlGuardian(cfg, ac, dashService)
 		fStore := folderimpl.ProvideStore(sqlStore)
 		folderSrv := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracer), dashboardStore, folderStore, sqlStore,
-			features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+			features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 		service := LibraryElementService{
 			Cfg:           cfg,
 			features:      featuremgmt.WithFeatures(),
diff --git a/pkg/services/librarypanels/librarypanels_test.go b/pkg/services/librarypanels/librarypanels_test.go
index 7d75fe779fb..b911a31be4b 100644
--- a/pkg/services/librarypanels/librarypanels_test.go
+++ b/pkg/services/librarypanels/librarypanels_test.go
@@ -755,7 +755,7 @@ func createFolder(t *testing.T, sc scenarioContext, title string) *folder.Folder
 	folderStore := folderimpl.ProvideDashboardFolderStore(sc.sqlStore)
 	fStore := folderimpl.ProvideStore(sc.sqlStore)
 	s := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore, folderStore, sc.sqlStore,
-		features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	t.Logf("Creating folder with title and UID %q", title)
 	ctx := identity.WithRequester(context.Background(), sc.user)
@@ -840,7 +840,7 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
 		fStore := folderimpl.ProvideStore(sqlStore)
 
 		folderService := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore, folderStore, sqlStore,
-			features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+			features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 		elementService := libraryelements.ProvideService(cfg, sqlStore, routing.NewRouteRegister(), folderService, features, ac)
 		service := LibraryPanelService{
diff --git a/pkg/services/ngalert/api/api_provisioning_test.go b/pkg/services/ngalert/api/api_provisioning_test.go
index 689d1ee13fc..6246e6e0e6f 100644
--- a/pkg/services/ngalert/api/api_provisioning_test.go
+++ b/pkg/services/ngalert/api/api_provisioning_test.go
@@ -1920,7 +1920,7 @@ func createTestEnv(t *testing.T, testConfig string) testEnvironment {
 	folderStore := folderimpl.ProvideDashboardFolderStore(sqlStore)
 	fStore := folderimpl.ProvideStore(sqlStore)
 	folderService := folderimpl.ProvideService(fStore, actest.FakeAccessControl{ExpectedEvaluate: true}, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore, folderStore, sqlStore,
-		featuremgmt.WithFeatures(), supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		featuremgmt.WithFeatures(), supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	store := store.DBstore{
 		Logger:   log,
 		SQLStore: sqlStore,
diff --git a/pkg/services/ngalert/provisioning/alert_rules_test.go b/pkg/services/ngalert/provisioning/alert_rules_test.go
index 869f6cc3366..c626f854ba0 100644
--- a/pkg/services/ngalert/provisioning/alert_rules_test.go
+++ b/pkg/services/ngalert/provisioning/alert_rules_test.go
@@ -1604,7 +1604,7 @@ func TestProvisiongWithFullpath(t *testing.T) {
 	features := featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders)
 	fStore := folderimpl.ProvideStore(sqlStore)
 	folderService := folderimpl.ProvideService(fStore, ac, inProcBus, dashboardStore, folderStore, sqlStore,
-		features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	ruleService := createAlertRuleService(t, folderService)
 	var orgID int64 = 1
diff --git a/pkg/services/ngalert/testutil/testutil.go b/pkg/services/ngalert/testutil/testutil.go
index 977d2e12886..fd70d0563df 100644
--- a/pkg/services/ngalert/testutil/testutil.go
+++ b/pkg/services/ngalert/testutil/testutil.go
@@ -30,7 +30,7 @@ func SetupFolderService(tb testing.TB, cfg *setting.Cfg, db db.DB, dashboardStor
 	tb.Helper()
 	fStore := folderimpl.ProvideStore(db)
 	return folderimpl.ProvideService(fStore, ac, bus, dashboardStore, folderStore, db,
-		features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 }
 
 func SetupDashboardService(tb testing.TB, sqlStore db.DB, fs *folderimpl.DashboardFolderStoreImpl, cfg *setting.Cfg) (*dashboardservice.DashboardServiceImpl, dashboards.Store) {
diff --git a/pkg/services/publicdashboards/service/service_test.go b/pkg/services/publicdashboards/service/service_test.go
index df5ecc73d9b..dfccfc3aa29 100644
--- a/pkg/services/publicdashboards/service/service_test.go
+++ b/pkg/services/publicdashboards/service/service_test.go
@@ -1395,7 +1395,7 @@ func TestPublicDashboardServiceImpl_ListPublicDashboards(t *testing.T) {
 	fStore := folderimpl.ProvideStore(testDB)
 	folderPermissions := acmock.NewMockedPermissionsService()
 	folderStore := folderimpl.ProvideDashboardFolderStore(testDB)
-	folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore, folderStore, testDB, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+	folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore, folderStore, testDB, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	dashboardService, err := dashsvc.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), folderPermissions, &actest.FakePermissionsService{}, ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
diff --git a/pkg/services/quota/quotaimpl/quota_test.go b/pkg/services/quota/quotaimpl/quota_test.go
index cba4c326784..f7f84de157e 100644
--- a/pkg/services/quota/quotaimpl/quota_test.go
+++ b/pkg/services/quota/quotaimpl/quota_test.go
@@ -494,7 +494,7 @@ func setupEnv(t *testing.T, sqlStore db.DB, cfg *setting.Cfg, b bus.Bus, quotaSe
 	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
 	folderSvc := folderimpl.ProvideService(fStore, acmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sqlStore, featuremgmt.WithFeatures(),
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	_, err = dashService.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), acmock.NewMockedPermissionsService(), acmock.NewMockedPermissionsService(),
 		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil)
 
diff --git a/pkg/services/sqlstore/permissions/dashboard_test.go b/pkg/services/sqlstore/permissions/dashboard_test.go
index cfc939bfa86..f9de60e221d 100644
--- a/pkg/services/sqlstore/permissions/dashboard_test.go
+++ b/pkg/services/sqlstore/permissions/dashboard_test.go
@@ -823,7 +823,7 @@ func setupNestedTest(t *testing.T, usr *user.SignedInUser, perms []accesscontrol
 
 	fStore := folderimpl.ProvideStore(db)
 	folderSvc := folderimpl.ProvideService(fStore, actest.FakeAccessControl{ExpectedEvaluate: true}, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore,
-		folderimpl.ProvideDashboardFolderStore(db), db, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		folderimpl.ProvideDashboardFolderStore(db), db, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	// create parent folder
 	parent, err := folderSvc.Create(context.Background(), &folder.CreateFolderCommand{
diff --git a/pkg/services/sqlstore/permissions/dashboards_bench_test.go b/pkg/services/sqlstore/permissions/dashboards_bench_test.go
index 38d448d45b9..b58b4e5ab18 100644
--- a/pkg/services/sqlstore/permissions/dashboards_bench_test.go
+++ b/pkg/services/sqlstore/permissions/dashboards_bench_test.go
@@ -80,7 +80,7 @@ func setupBenchMark(b *testing.B, usr user.SignedInUser, features featuremgmt.Fe
 
 	fStore := folderimpl.ProvideStore(store)
 	folderSvc := folderimpl.ProvideService(fStore, mock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardWriteStore, folderimpl.ProvideDashboardFolderStore(store),
-		store, features, supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		store, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	origNewGuardian := guardian.New
 	guardian.MockDashboardGuardian(&guardian.FakeDashboardGuardian{CanViewValue: true, CanSaveValue: true})
diff --git a/pkg/storage/unified/apistore/go.sum b/pkg/storage/unified/apistore/go.sum
index 4dbbfe5ccce..6f8e0fb64a0 100644
--- a/pkg/storage/unified/apistore/go.sum
+++ b/pkg/storage/unified/apistore/go.sum
@@ -100,6 +100,8 @@ github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA4
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
+github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
 github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
 github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
@@ -559,6 +561,10 @@ github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 h1:fV6IgVtViXcYZ4VqTAMuVBTLuGA
 github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2/go.mod h1:Cbh94bfL5o6mUSaHFiOkx4r4CRKlo/DJLx4dPL8XrE0=
 github.com/grafana/grafana-plugin-sdk-go v0.261.0 h1:pGGpPbKRWZcLxwNATEiVDhILbYGYwlWOEXFLhmUkBMo=
 github.com/grafana/grafana-plugin-sdk-go v0.261.0/go.mod h1:QsLK0kAbmDXuX/QncFBTETPHCzw5g9hZnzqOPkoB3Yo=
+github.com/grafana/grafana/pkg/aggregator v0.0.0-20240813192817-1b0e6b5c09b2 h1:2H9x4q53pkfUGtSNYD1qSBpNnxrFgylof/TYADb5xMI=
+github.com/grafana/grafana/pkg/aggregator v0.0.0-20240813192817-1b0e6b5c09b2/go.mod h1:gBLBniiSUQvyt4LRrpIeysj8Many0DV+hdUKifRE0Ec=
+github.com/grafana/grafana/pkg/semconv v0.0.0-20240808213237-f4d2e064f435 h1:SNEeqY22DrGr5E9kGF1mKSqlOom14W9+b1u4XEGJowA=
+github.com/grafana/grafana/pkg/semconv v0.0.0-20240808213237-f4d2e064f435/go.mod h1:8cz+z0i57IjN6MYmu/zZQdCg9CQcsnEHbaJBBEf3KQo=
 github.com/grafana/otel-profiling-go v0.5.1 h1:stVPKAFZSa7eGiqbYuG25VcqYksR6iWvF3YH66t4qL8=
 github.com/grafana/otel-profiling-go v0.5.1/go.mod h1:ftN/t5A/4gQI19/8MoWurBEtC6gFw8Dns1sJZ9W4Tls=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8 h1:iwOtYXeeVSAeYefJNaxDytgjKtUuKQbJqgAIjlnicKg=
@@ -775,6 +781,8 @@ github.com/mithrandie/ternary v1.1.1 h1:k/joD6UGVYxHixYmSR8EGgDFNONBMqyD373xT4QR
 github.com/mithrandie/ternary v1.1.1/go.mod h1:0D9Ba3+09K2TdSZO7/bFCC0GjSXetCvYuYq0u8FY/1g=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -792,6 +800,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8m
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nakagami/firebirdsql v0.0.0-20190310045651-3c02a58cfed8/go.mod h1:86wM1zFnC6/uDBfZGNwB65O+pR2OFi5q/YQaEUid1qA=
 github.com/natefinch/wrap v0.2.0 h1:IXzc/pw5KqxJv55gV0lSOcKHYuEZPGbQrOOXr/bamRk=
 github.com/natefinch/wrap v0.2.0/go.mod h1:6gMHlAl12DwYEfKP3TkuykYUfLSEAvHw67itm4/KAS8=
@@ -1546,6 +1556,10 @@ k8s.io/component-base v0.32.0 h1:d6cWHZkCiiep41ObYQS6IcgzOUQUNpywm39KVYaUqzU=
 k8s.io/component-base v0.32.0/go.mod h1:JLG2W5TUxUu5uDyKiH2R/7NnxJo1HlPoRIIbVLkK5eM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kms v0.32.0 h1:jwOfunHIrcdYl5FRcA+uUKKtg6qiqoPCwmS2T3XTYL4=
+k8s.io/kms v0.32.0/go.mod h1:Bk2evz/Yvk0oVrvm4MvZbgq8BD34Ksxs2SRHn4/UiOM=
+k8s.io/kube-aggregator v0.32.0 h1:5ZyMW3QwAbmkasQrROcpa5we3et938DQuyUYHeXSPao=
+k8s.io/kube-aggregator v0.32.0/go.mod h1:6OKivf6Ypx44qu2v1ZUMrxH8kRp/8LKFKeJU72J18lU=
 k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
 k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
diff --git a/pkg/storage/unified/federated/stats_test.go b/pkg/storage/unified/federated/stats_test.go
index 79350c108f7..cc24573fae0 100644
--- a/pkg/storage/unified/federated/stats_test.go
+++ b/pkg/storage/unified/federated/stats_test.go
@@ -51,7 +51,7 @@ func TestDirectSQLStats(t *testing.T) {
 	fStore := folderimpl.ProvideStore(db)
 	folderSvc := folderimpl.ProvideService(fStore, actest.FakeAccessControl{ExpectedEvaluate: true}, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore,
 		folderimpl.ProvideDashboardFolderStore(db), db, featuremgmt.WithFeatures(),
-		supportbundlestest.NewFakeBundleService(), nil, tracing.InitializeTracerForTest())
+		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
 	// create parent folder
 
diff --git a/pkg/tests/apis/folder/folders_test.go b/pkg/tests/apis/folder/folders_test.go
index c1a0aab9046..b696918ff93 100644
--- a/pkg/tests/apis/folder/folders_test.go
+++ b/pkg/tests/apis/folder/folders_test.go
@@ -925,7 +925,6 @@ func TestFoldersCreateAPIEndpointK8S(t *testing.T) {
 	}
 
 	folderWithoutParentInput := "{ \"uid\": \"uid\", \"title\": \"Folder\"}"
-	folderWithoutUID := "{ \"title\": \"Folder without UID\"}"
 	folderWithTitleEmpty := "{ \"title\": \"\"}"
 	folderWithInvalidUid := "{ \"uid\": \"::::::::::::\", \"title\": \"Another folder\"}"
 	folderWithUIDTooLong := "{ \"uid\": \"asdfghjklqwertyuiopzxcvbnmasdfghjklqwertyuiopzxcvbnmasdfghjklqwertyuiopzxcvbnm\", \"title\": \"Third folder\"}"
@@ -964,17 +963,6 @@ func TestFoldersCreateAPIEndpointK8S(t *testing.T) {
 			expectedMessage: dashboards.ErrFolderAccessDenied.Error(),
 			permissions:     []resourcepermissions.SetResourcePermissionCommand{},
 		},
-		{
-			// #TODO This test case doesn't set up the conditions it describes. We should have created a folder with the same UID before
-			// creating a second one and failing to do so successfully.
-			description:  "folder creation fails given folder service error %s",
-			input:        folderWithoutUID,
-			expectedCode: http.StatusConflict,
-			// expectedMessage:        dashboards.ErrFolderWithSameUIDExists.Error(),
-			expectedFolderSvcError: dashboards.ErrFolderWithSameUIDExists,
-			createSecondRecord:     true,
-			permissions:            folderCreatePermission,
-		},
 		{
 			description:            "folder creation fails given folder service error %s",
 			input:                  folderWithTitleEmpty,

From 6883a4b294cccbd9fa8034dc82bb857af7d4aed2 Mon Sep 17 00:00:00 2001
From: Matthew Jacobson <matthew.jacobson@grafana.com>
Date: Mon, 13 Jan 2025 18:23:45 -0500
Subject: [PATCH 12/24] Alerting: Regenerate swagger spec (#98914)

---
 pkg/services/ngalert/api/tooling/api.json  | 65 +++++++++++----------
 pkg/services/ngalert/api/tooling/post.json | 66 ++++++++++++----------
 pkg/services/ngalert/api/tooling/spec.json | 66 ++++++++++++----------
 public/api-merged.json                     | 59 ++++++++++---------
 public/openapi3.json                       | 59 ++++++++++---------
 5 files changed, 168 insertions(+), 147 deletions(-)

diff --git a/pkg/services/ngalert/api/tooling/api.json b/pkg/services/ngalert/api/tooling/api.json
index 965cee8114f..b28835c9327 100644
--- a/pkg/services/ngalert/api/tooling/api.json
+++ b/pkg/services/ngalert/api/tooling/api.json
@@ -165,6 +165,9 @@
   },
   "AlertRuleEditorSettings": {
    "properties": {
+    "simplified_notifications_section": {
+     "type": "boolean"
+    },
     "simplified_query_and_expressions_section": {
      "type": "boolean"
     }
@@ -755,7 +758,7 @@
      "type": "string"
     },
     "ErrorSource": {
-     "$ref": "#/definitions/ErrorSource"
+     "$ref": "#/definitions/Source"
     },
     "Frames": {
      "$ref": "#/definitions/Frames"
@@ -895,23 +898,23 @@
     "type": {
      "enum": [
       "alertmanager",
-      " dingding",
-      " discord",
-      " email",
-      " googlechat",
-      " kafka",
-      " line",
-      " opsgenie",
-      " pagerduty",
-      " pushover",
-      " sensugo",
-      " slack",
-      " teams",
-      " telegram",
-      " threema",
-      " victorops",
-      " webhook",
-      " wecom"
+      "dingding",
+      "discord",
+      "email",
+      "googlechat",
+      "kafka",
+      "line",
+      "opsgenie",
+      "pagerduty",
+      "pushover",
+      "sensugo",
+      "slack",
+      "teams",
+      "telegram",
+      "threema",
+      "victorops",
+      "webhook",
+      "wecom"
      ],
      "example": "webhook",
      "type": "string"
@@ -965,10 +968,6 @@
    },
    "type": "object"
   },
-  "ErrorSource": {
-   "description": "ErrorSource type defines the source of the error",
-   "type": "string"
-  },
   "ErrorType": {
    "title": "ErrorType models the different API error types.",
    "type": "string"
@@ -3606,6 +3605,9 @@
   },
   "RuleDiscovery": {
    "properties": {
+    "groupNextToken": {
+     "type": "string"
+    },
     "groups": {
      "items": {
       "$ref": "#/definitions/RuleGroup"
@@ -3975,6 +3977,10 @@
   "SmtpNotEnabled": {
    "$ref": "#/definitions/ResponseDetails"
   },
+  "Source": {
+   "title": "Source type defines the status source.",
+   "type": "string"
+  },
   "Span": {
    "properties": {
     "Length": {
@@ -4803,6 +4809,7 @@
    "type": "object"
   },
   "gettableAlerts": {
+   "description": "GettableAlerts gettable alerts",
    "items": {
     "$ref": "#/definitions/gettableAlert",
     "type": "object"
@@ -6240,7 +6247,7 @@
       }
      }
     },
-    "summary": "Get all notification templates.",
+    "summary": "Get all notification template groups.",
     "tags": [
      "provisioning"
     ]
@@ -6251,7 +6258,7 @@
     "operationId": "RouteDeleteTemplate",
     "parameters": [
      {
-      "description": "Template name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -6275,7 +6282,7 @@
       }
      }
     },
-    "summary": "Delete a template.",
+    "summary": "Delete a notification template group.",
     "tags": [
      "provisioning"
     ]
@@ -6284,7 +6291,7 @@
     "operationId": "RouteGetTemplate",
     "parameters": [
      {
-      "description": "Template Name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -6305,7 +6312,7 @@
       }
      }
     },
-    "summary": "Get a notification template.",
+    "summary": "Get a notification template group.",
     "tags": [
      "provisioning"
     ]
@@ -6317,7 +6324,7 @@
     "operationId": "RoutePutTemplate",
     "parameters": [
      {
-      "description": "Template Name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -6356,7 +6363,7 @@
       }
      }
     },
-    "summary": "Updates an existing notification template.",
+    "summary": "Updates an existing notification template group.",
     "tags": [
      "provisioning"
     ]
diff --git a/pkg/services/ngalert/api/tooling/post.json b/pkg/services/ngalert/api/tooling/post.json
index eae46145ba8..f23b4673ecb 100644
--- a/pkg/services/ngalert/api/tooling/post.json
+++ b/pkg/services/ngalert/api/tooling/post.json
@@ -165,6 +165,9 @@
   },
   "AlertRuleEditorSettings": {
    "properties": {
+    "simplified_notifications_section": {
+     "type": "boolean"
+    },
     "simplified_query_and_expressions_section": {
      "type": "boolean"
     }
@@ -755,7 +758,7 @@
      "type": "string"
     },
     "ErrorSource": {
-     "$ref": "#/definitions/ErrorSource"
+     "$ref": "#/definitions/Source"
     },
     "Frames": {
      "$ref": "#/definitions/Frames"
@@ -895,23 +898,23 @@
     "type": {
      "enum": [
       "alertmanager",
-      " dingding",
-      " discord",
-      " email",
-      " googlechat",
-      " kafka",
-      " line",
-      " opsgenie",
-      " pagerduty",
-      " pushover",
-      " sensugo",
-      " slack",
-      " teams",
-      " telegram",
-      " threema",
-      " victorops",
-      " webhook",
-      " wecom"
+      "dingding",
+      "discord",
+      "email",
+      "googlechat",
+      "kafka",
+      "line",
+      "opsgenie",
+      "pagerduty",
+      "pushover",
+      "sensugo",
+      "slack",
+      "teams",
+      "telegram",
+      "threema",
+      "victorops",
+      "webhook",
+      "wecom"
      ],
      "example": "webhook",
      "type": "string"
@@ -965,10 +968,6 @@
    },
    "type": "object"
   },
-  "ErrorSource": {
-   "description": "ErrorSource type defines the source of the error",
-   "type": "string"
-  },
   "ErrorType": {
    "title": "ErrorType models the different API error types.",
    "type": "string"
@@ -3606,6 +3605,9 @@
   },
   "RuleDiscovery": {
    "properties": {
+    "groupNextToken": {
+     "type": "string"
+    },
     "groups": {
      "items": {
       "$ref": "#/definitions/RuleGroup"
@@ -3975,6 +3977,10 @@
   "SmtpNotEnabled": {
    "$ref": "#/definitions/ResponseDetails"
   },
+  "Source": {
+   "title": "Source type defines the status source.",
+   "type": "string"
+  },
   "Span": {
    "properties": {
     "Length": {
@@ -4802,7 +4808,6 @@
    "type": "object"
   },
   "gettableAlerts": {
-   "description": "GettableAlerts gettable alerts",
    "items": {
     "$ref": "#/definitions/gettableAlert",
     "type": "object"
@@ -4927,7 +4932,6 @@
    "type": "object"
   },
   "gettableSilences": {
-   "description": "GettableSilences gettable silences",
    "items": {
     "$ref": "#/definitions/gettableSilence",
     "type": "object"
@@ -8452,7 +8456,7 @@
       }
      }
     },
-    "summary": "Get all notification templates.",
+    "summary": "Get all notification template groups.",
     "tags": [
      "provisioning"
     ]
@@ -8463,7 +8467,7 @@
     "operationId": "RouteDeleteTemplate",
     "parameters": [
      {
-      "description": "Template name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -8487,7 +8491,7 @@
       }
      }
     },
-    "summary": "Delete a template.",
+    "summary": "Delete a notification template group.",
     "tags": [
      "provisioning"
     ]
@@ -8496,7 +8500,7 @@
     "operationId": "RouteGetTemplate",
     "parameters": [
      {
-      "description": "Template Name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -8517,7 +8521,7 @@
       }
      }
     },
-    "summary": "Get a notification template.",
+    "summary": "Get a notification template group.",
     "tags": [
      "provisioning"
     ]
@@ -8529,7 +8533,7 @@
     "operationId": "RoutePutTemplate",
     "parameters": [
      {
-      "description": "Template Name",
+      "description": "Template group name",
       "in": "path",
       "name": "name",
       "required": true,
@@ -8568,7 +8572,7 @@
       }
      }
     },
-    "summary": "Updates an existing notification template.",
+    "summary": "Updates an existing notification template group.",
     "tags": [
      "provisioning"
     ]
diff --git a/pkg/services/ngalert/api/tooling/spec.json b/pkg/services/ngalert/api/tooling/spec.json
index 95716ea1899..a3ac020c228 100644
--- a/pkg/services/ngalert/api/tooling/spec.json
+++ b/pkg/services/ngalert/api/tooling/spec.json
@@ -3306,7 +3306,7 @@
           "provisioning",
           "stable"
         ],
-        "summary": "Get all notification templates.",
+        "summary": "Get all notification template groups.",
         "operationId": "RouteGetTemplates",
         "responses": {
           "200": {
@@ -3324,12 +3324,12 @@
           "provisioning",
           "stable"
         ],
-        "summary": "Get a notification template.",
+        "summary": "Get a notification template group.",
         "operationId": "RouteGetTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template Name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -3358,12 +3358,12 @@
           "provisioning",
           "stable"
         ],
-        "summary": "Updates an existing notification template.",
+        "summary": "Updates an existing notification template group.",
         "operationId": "RoutePutTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template Name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -3407,12 +3407,12 @@
           "provisioning",
           "stable"
         ],
-        "summary": "Delete a template.",
+        "summary": "Delete a notification template group.",
         "operationId": "RouteDeleteTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -3797,6 +3797,9 @@
     "AlertRuleEditorSettings": {
       "type": "object",
       "properties": {
+        "simplified_notifications_section": {
+          "type": "boolean"
+        },
         "simplified_query_and_expressions_section": {
           "type": "boolean"
         }
@@ -4388,7 +4391,7 @@
           "type": "string"
         },
         "ErrorSource": {
-          "$ref": "#/definitions/ErrorSource"
+          "$ref": "#/definitions/Source"
         },
         "Frames": {
           "$ref": "#/definitions/Frames"
@@ -4533,23 +4536,23 @@
           "type": "string",
           "enum": [
             "alertmanager",
-            " dingding",
-            " discord",
-            " email",
-            " googlechat",
-            " kafka",
-            " line",
-            " opsgenie",
-            " pagerduty",
-            " pushover",
-            " sensugo",
-            " slack",
-            " teams",
-            " telegram",
-            " threema",
-            " victorops",
-            " webhook",
-            " wecom"
+            "dingding",
+            "discord",
+            "email",
+            "googlechat",
+            "kafka",
+            "line",
+            "opsgenie",
+            "pagerduty",
+            "pushover",
+            "sensugo",
+            "slack",
+            "teams",
+            "telegram",
+            "threema",
+            "victorops",
+            "webhook",
+            "wecom"
           ],
           "example": "webhook"
         },
@@ -4597,10 +4600,6 @@
         }
       }
     },
-    "ErrorSource": {
-      "description": "ErrorSource type defines the source of the error",
-      "type": "string"
-    },
     "ErrorType": {
       "type": "string",
       "title": "ErrorType models the different API error types."
@@ -7243,6 +7242,9 @@
         "groups"
       ],
       "properties": {
+        "groupNextToken": {
+          "type": "string"
+        },
         "groups": {
           "type": "array",
           "items": {
@@ -7608,6 +7610,10 @@
     "SmtpNotEnabled": {
       "$ref": "#/definitions/ResponseDetails"
     },
+    "Source": {
+      "type": "string",
+      "title": "Source type defines the status source."
+    },
     "Span": {
       "type": "object",
       "title": "A Span defines a continuous sequence of buckets.",
@@ -8435,7 +8441,6 @@
       }
     },
     "gettableAlerts": {
-      "description": "GettableAlerts gettable alerts",
       "type": "array",
       "items": {
         "type": "object",
@@ -8560,7 +8565,6 @@
       }
     },
     "gettableSilences": {
-      "description": "GettableSilences gettable silences",
       "type": "array",
       "items": {
         "type": "object",
diff --git a/public/api-merged.json b/public/api-merged.json
index 3076a55b586..79758d8f542 100644
--- a/public/api-merged.json
+++ b/public/api-merged.json
@@ -11783,7 +11783,7 @@
         "tags": [
           "provisioning"
         ],
-        "summary": "Get all notification templates.",
+        "summary": "Get all notification template groups.",
         "operationId": "RouteGetTemplates",
         "responses": {
           "200": {
@@ -11800,12 +11800,12 @@
         "tags": [
           "provisioning"
         ],
-        "summary": "Get a notification template.",
+        "summary": "Get a notification template group.",
         "operationId": "RouteGetTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template Name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -11833,12 +11833,12 @@
         "tags": [
           "provisioning"
         ],
-        "summary": "Updates an existing notification template.",
+        "summary": "Updates an existing notification template group.",
         "operationId": "RoutePutTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template Name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -11881,12 +11881,12 @@
         "tags": [
           "provisioning"
         ],
-        "summary": "Delete a template.",
+        "summary": "Delete a notification template group.",
         "operationId": "RouteDeleteTemplate",
         "parameters": [
           {
             "type": "string",
-            "description": "Template name",
+            "description": "Template group name",
             "name": "name",
             "in": "path",
             "required": true
@@ -12588,6 +12588,9 @@
     "AlertRuleEditorSettings": {
       "type": "object",
       "properties": {
+        "simplified_notifications_section": {
+          "type": "boolean"
+        },
         "simplified_query_and_expressions_section": {
           "type": "boolean"
         }
@@ -15067,23 +15070,23 @@
           "type": "string",
           "enum": [
             "alertmanager",
-            " dingding",
-            " discord",
-            " email",
-            " googlechat",
-            " kafka",
-            " line",
-            " opsgenie",
-            " pagerduty",
-            " pushover",
-            " sensugo",
-            " slack",
-            " teams",
-            " telegram",
-            " threema",
-            " victorops",
-            " webhook",
-            " wecom"
+            "dingding",
+            "discord",
+            "email",
+            "googlechat",
+            "kafka",
+            "line",
+            "opsgenie",
+            "pagerduty",
+            "pushover",
+            "sensugo",
+            "slack",
+            "teams",
+            "telegram",
+            "threema",
+            "victorops",
+            "webhook",
+            "wecom"
           ],
           "example": "webhook"
         },
@@ -15151,10 +15154,6 @@
         }
       }
     },
-    "ErrorSource": {
-      "description": "ErrorSource type defines the source of the error",
-      "type": "string"
-    },
     "ErrorType": {
       "type": "string",
       "title": "ErrorType models the different API error types."
@@ -19857,6 +19856,9 @@
         "groups"
       ],
       "properties": {
+        "groupNextToken": {
+          "type": "string"
+        },
         "groups": {
           "type": "array",
           "items": {
@@ -22645,6 +22647,7 @@
       }
     },
     "gettableAlerts": {
+      "description": "GettableAlerts gettable alerts",
       "type": "array",
       "items": {
         "type": "object",
diff --git a/public/openapi3.json b/public/openapi3.json
index e4e814258b9..fe2da223144 100644
--- a/public/openapi3.json
+++ b/public/openapi3.json
@@ -2662,6 +2662,9 @@
       },
       "AlertRuleEditorSettings": {
         "properties": {
+          "simplified_notifications_section": {
+            "type": "boolean"
+          },
           "simplified_query_and_expressions_section": {
             "type": "boolean"
           }
@@ -5136,23 +5139,23 @@
           "type": {
             "enum": [
               "alertmanager",
-              " dingding",
-              " discord",
-              " email",
-              " googlechat",
-              " kafka",
-              " line",
-              " opsgenie",
-              " pagerduty",
-              " pushover",
-              " sensugo",
-              " slack",
-              " teams",
-              " telegram",
-              " threema",
-              " victorops",
-              " webhook",
-              " wecom"
+              "dingding",
+              "discord",
+              "email",
+              "googlechat",
+              "kafka",
+              "line",
+              "opsgenie",
+              "pagerduty",
+              "pushover",
+              "sensugo",
+              "slack",
+              "teams",
+              "telegram",
+              "threema",
+              "victorops",
+              "webhook",
+              "wecom"
             ],
             "example": "webhook",
             "type": "string"
@@ -5226,10 +5229,6 @@
         ],
         "type": "object"
       },
-      "ErrorSource": {
-        "description": "ErrorSource type defines the source of the error",
-        "type": "string"
-      },
       "ErrorType": {
         "title": "ErrorType models the different API error types.",
         "type": "string"
@@ -9928,6 +9927,9 @@
       },
       "RuleDiscovery": {
         "properties": {
+          "groupNextToken": {
+            "type": "string"
+          },
           "groups": {
             "items": {
               "$ref": "#/components/schemas/RuleGroup"
@@ -12718,6 +12720,7 @@
         "type": "object"
       },
       "gettableAlerts": {
+        "description": "GettableAlerts gettable alerts",
         "items": {
           "$ref": "#/components/schemas/gettableAlert"
         },
@@ -26239,7 +26242,7 @@
             "description": "NotificationTemplates"
           }
         },
-        "summary": "Get all notification templates.",
+        "summary": "Get all notification template groups.",
         "tags": [
           "provisioning"
         ]
@@ -26250,7 +26253,7 @@
         "operationId": "RouteDeleteTemplate",
         "parameters": [
           {
-            "description": "Template name",
+            "description": "Template group name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -26282,7 +26285,7 @@
             "description": "PublicError"
           }
         },
-        "summary": "Delete a template.",
+        "summary": "Delete a notification template group.",
         "tags": [
           "provisioning"
         ]
@@ -26291,7 +26294,7 @@
         "operationId": "RouteGetTemplate",
         "parameters": [
           {
-            "description": "Template Name",
+            "description": "Template group name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -26322,7 +26325,7 @@
             "description": "PublicError"
           }
         },
-        "summary": "Get a notification template.",
+        "summary": "Get a notification template group.",
         "tags": [
           "provisioning"
         ]
@@ -26331,7 +26334,7 @@
         "operationId": "RoutePutTemplate",
         "parameters": [
           {
-            "description": "Template Name",
+            "description": "Template group name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -26389,7 +26392,7 @@
             "description": "PublicError"
           }
         },
-        "summary": "Updates an existing notification template.",
+        "summary": "Updates an existing notification template group.",
         "tags": [
           "provisioning"
         ]

From fd4718df333e17d0816e145630d7f49dbae3f68a Mon Sep 17 00:00:00 2001
From: Brendan O'Handley <brendan.ohandley@grafana.com>
Date: Mon, 13 Jan 2025 18:42:18 -0600
Subject: [PATCH 13/24] Explore metrics: Consolidate filters with the OTel
 experience (#98371)

* sort otel resources to top of adhoc filters

* add bool in datatrail

* add function to find non promoted otel resources

* add additional super filter variable

* hide filters var and keep otel filters var hidden

* add nonpromoted resources to state, update otel or var filters when super filter is updated

* update comments

* update plan

* Allow deployment environment values from both metrics and target_info

* Remove usage of dep env var in getting resources

* update code comments for clarity

* Remove dep env variable, autoselect dep env in otelmetricvar and allow updating of vals in otelmetricvar

* Fix bug that conflicts with local storage useOtelExperience check

* expose metadata to show data source is loaded to prevent otel race conditions

* remove filtering check on target_info in the itel join query

* update plan with extra issues

* refactor update and reset functions for otel experience

* use non promoted resources as the standardization check

* sort the resources in filters var if using otel experience

* add test for sorting resources with otelmetricsvar

* update tests for otel experience in datatrail.test

* update tests for otel utils

* update otel api tests

* update trail store tests to remove dep env var

* run prettier

* remove unused imports

* add tests, distinguish on start and when the initial otel check is done, update comments

* Fix bug when adding multiple otel resources

* fix when adding filter from breakdown

* add migration for dep env var

* update migration function and write tests

* prettier

* Update dep env migration to handle bookmarks

* fix trailstore tests for reintroducing the dep env var

* refactor default env function, we only need the value

* remove redundant check

* move otel functions to utils and update and add tests

* prettier

* cleanup

* fix migration for fromStart

* update tests for migration

* use join and use push

* fix flow with state

* Fix flow in update OTel function

* update tests for flow fixes

* fix toggle OTel bugs

* report when dep env has been migrated and delete dep env filters to not migrate it again

* Clear out dep env after migration

* run prettier

* improve non promoted attribute function

* remove unused functions

* prettier

* default otel experience to off

* report when otel experience is used

* report when otel is turned on and off

* report otel filters changed

* prettier

* keep default otel off, respect the local storage, but if loading with otel vars from url or bookmark we can turn it on

* Add new badge

* fix metric scene breakdown add filter bug around non promoted labels on a metric that are different than non promoted labels for all metrics

* prettier

* make i18n-extract

* prettier for translations

* change button name to "Filter"

* Update public/app/features/trails/Breakdown/AddToFiltersGraphAction.tsx

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Update public/app/features/trails/DataTrail.tsx

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Update public/app/features/trails/migrations/otelDeploymentEnvironment.ts

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Update public/app/features/trails/DataTrail.tsx

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Update public/app/features/trails/otel/api.ts

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Update public/app/features/trails/otel/util.ts

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>

* Add more padding for pill where capital letter gets to close to the left border and looks off.

* clear up comments

---------

Co-authored-by: Nick Richmond <5732000+NWRichmond@users.noreply.github.com>
---
 .../Breakdown/AddToFiltersGraphAction.tsx     |  25 +-
 public/app/features/trails/DataTrail.test.tsx | 115 ++--
 public/app/features/trails/DataTrail.tsx      | 476 ++++++----------
 .../app/features/trails/DataTrailsHistory.tsx |   1 +
 public/app/features/trails/DataTrailsHome.tsx |   2 +-
 .../trails/MetricSelect/MetricSelectScene.tsx |  62 ++-
 .../trails/TrailStore/TrailStore.test.ts      |  15 +-
 .../trails/helpers/MetricDatasourceHelper.ts  |  12 +-
 public/app/features/trails/interactions.ts    |  13 +-
 .../otelDeploymentEnvironment.test.ts         | 129 +++++
 .../migrations/otelDeploymentEnvironment.ts   | 111 ++++
 public/app/features/trails/otel/api.test.ts   |  38 +-
 public/app/features/trails/otel/api.ts        | 158 +++---
 public/app/features/trails/otel/util.ts       | 386 +++++++++++--
 public/app/features/trails/otel/utils.test.ts | 525 ++++++++++++++----
 public/app/features/trails/shared.ts          |   3 +
 public/app/features/trails/utils.test.ts      |  21 +
 public/app/features/trails/utils.ts           |  28 +-
 public/locales/en-US/grafana.json             |   1 +
 public/locales/pseudo-LOCALE/grafana.json     |   1 +
 20 files changed, 1486 insertions(+), 636 deletions(-)
 create mode 100644 public/app/features/trails/migrations/otelDeploymentEnvironment.test.ts
 create mode 100644 public/app/features/trails/migrations/otelDeploymentEnvironment.ts

diff --git a/public/app/features/trails/Breakdown/AddToFiltersGraphAction.tsx b/public/app/features/trails/Breakdown/AddToFiltersGraphAction.tsx
index b4b53e80ae8..faf7ef9542b 100644
--- a/public/app/features/trails/Breakdown/AddToFiltersGraphAction.tsx
+++ b/public/app/features/trails/Breakdown/AddToFiltersGraphAction.tsx
@@ -9,7 +9,7 @@ import {
 import { Button } from '@grafana/ui';
 
 import { reportExploreMetrics } from '../interactions';
-import { VAR_OTEL_GROUP_LEFT, VAR_OTEL_RESOURCES } from '../shared';
+import { VAR_OTEL_AND_METRIC_FILTERS, VAR_OTEL_GROUP_LEFT, VAR_OTEL_RESOURCES } from '../shared';
 import { getTrailFor } from '../utils';
 
 export interface AddToFiltersGraphActionState extends SceneObjectState {
@@ -38,7 +38,6 @@ export class AddToFiltersGraphAction extends SceneObjectBase<AddToFiltersGraphAc
       operator: '=',
       value: labels[labelName],
     };
-
     // add to either label filters or otel resource filters
     if (
       allAttributes &&
@@ -46,12 +45,30 @@ export class AddToFiltersGraphAction extends SceneObjectBase<AddToFiltersGraphAc
       // if the label chosen is a resource attribute, add it to the otel resource variable
       allAttributes?.split(',').includes(labelName)
     ) {
+      // This is different than the first non-promoted labels on data trail. In data trail we look at all labels
+      // for all metrics. In breakdown, we look at one metric.
+      //
+      // The metric may not have the label promoted so we have to compare not the non-promoted
+      // label collection we use in the parent datatrail, but instead have to look at `VAR_OTEL_GROUP_LEFT`
+      // which are a collection of labels from `target_info` that have not been promoted to the metric.
+      //
+      // These metric-specific non-promoted labels are retrieved in the function `getFilteredResourceAttributes`.
+      // These attributes on the metric that has been selected.
+      trail.setState({ addingLabelFromBreakdown: true });
       // add to OTel resource var filters
       const otelResourcesVar = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, trail);
-      if (!(otelResourcesVar instanceof AdHocFiltersVariable)) {
+      const otelAndMetricsResourcesVar = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+      if (
+        !(
+          otelResourcesVar instanceof AdHocFiltersVariable && otelAndMetricsResourcesVar instanceof AdHocFiltersVariable
+        )
+      ) {
         return;
       }
-      otelResourcesVar.setState({ filters: [...variable.state.filters, filter] });
+
+      otelResourcesVar.setState({ filters: [...otelResourcesVar.state.filters, filter] });
+      otelAndMetricsResourcesVar.setState({ filters: [...otelAndMetricsResourcesVar.state.filters, filter] });
+      trail.setState({ addingLabelFromBreakdown: false });
     } else {
       // add to regular var filters
       trail.addFilterWithoutReportingInteraction(filter);
diff --git a/public/app/features/trails/DataTrail.test.tsx b/public/app/features/trails/DataTrail.test.tsx
index ce5b53fcdf2..4d0d0af86c4 100644
--- a/public/app/features/trails/DataTrail.test.tsx
+++ b/public/app/features/trails/DataTrail.test.tsx
@@ -1,6 +1,6 @@
 import { VariableHide } from '@grafana/data';
 import { locationService, setDataSourceSrv } from '@grafana/runtime';
-import { AdHocFiltersVariable, ConstantVariable, CustomVariable, sceneGraph } from '@grafana/scenes';
+import { AdHocFiltersVariable, ConstantVariable, sceneGraph } from '@grafana/scenes';
 import { DataSourceType } from 'app/features/alerting/unified/utils/datasource';
 
 import { MockDataSourceSrv, mockDataSource } from '../alerting/unified/mocks';
@@ -12,7 +12,7 @@ import { MetricSelectScene } from './MetricSelect/MetricSelectScene';
 import {
   MetricSelectedEvent,
   VAR_FILTERS,
-  VAR_OTEL_DEPLOYMENT_ENV,
+  VAR_OTEL_AND_METRIC_FILTERS,
   VAR_OTEL_GROUP_LEFT,
   VAR_OTEL_JOIN_QUERY,
   VAR_OTEL_RESOURCES,
@@ -20,7 +20,6 @@ import {
 
 jest.mock('./otel/api', () => ({
   totalOtelResources: jest.fn(() => ({ job: 'oteldemo', instance: 'instance' })),
-  getDeploymentEnvironments: jest.fn(() => ['production', 'staging']),
   isOtelStandardization: jest.fn(() => true),
 }));
 
@@ -481,15 +480,18 @@ describe('DataTrail', () => {
 
   describe('OTel resources attributes', () => {
     let trail: DataTrail;
+
+    // selecting a non promoted resource from VAR_OTEL_AND_METRICS will automatically update the otel resources var
+    const nonPromotedOtelResources = ['deployment_environment'];
     const preTrailUrl =
       '/trail?from=now-1h&to=now&var-ds=edwxqcebl0cg0c&var-deployment_environment=oteldemo01&var-otel_resources=k8s_cluster_name%7C%3D%7Cappo11ydev01&var-filters=&refresh=&metricPrefix=all&metricSearch=http&actionView=breakdown&var-groupby=$__all&metric=http_client_duration_milliseconds_bucket';
 
-    function getOtelDepEnvVar(trail: DataTrail) {
-      const variable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, trail);
-      if (variable instanceof CustomVariable) {
+    function getOtelAndMetricsVar(trail: DataTrail) {
+      const variable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+      if (variable instanceof AdHocFiltersVariable) {
         return variable;
       }
-      throw new Error('getDepEnvVar failed');
+      throw new Error('getOtelAndMetricsVar failed');
     }
 
     function getOtelJoinQueryVar(trail: DataTrail) {
@@ -497,7 +499,7 @@ describe('DataTrail', () => {
       if (variable instanceof ConstantVariable) {
         return variable;
       }
-      throw new Error('getDepEnvVar failed');
+      throw new Error('getOtelJoinQueryVar failed');
     }
 
     function getOtelResourcesVar(trail: DataTrail) {
@@ -513,26 +515,34 @@ describe('DataTrail', () => {
       if (variable instanceof ConstantVariable) {
         return variable;
       }
-      throw new Error('getOtelResourcesVar failed');
+      throw new Error('getOtelGroupLeftVar failed');
+    }
+
+    function getFilterVar() {
+      const variable = sceneGraph.lookupVariable(VAR_FILTERS, trail);
+      if (variable instanceof AdHocFiltersVariable) {
+        return variable;
+      }
+      throw new Error('getFilterVar failed');
     }
 
     beforeEach(() => {
-      trail = new DataTrail({});
+      trail = new DataTrail({
+        nonPromotedOtelResources,
+        // before checking, things should be hidden
+        initialOtelCheckComplete: false,
+      });
       locationService.push(preTrailUrl);
       activateFullSceneTree(trail);
-      getOtelResourcesVar(trail).setState({ filters: [{ key: 'service_name', operator: '=', value: 'adservice' }] });
-      getOtelDepEnvVar(trail).changeValueTo('production');
       getOtelGroupLeftVar(trail).setState({ value: 'attribute1,attribute2' });
     });
-
-    it('should start with hidden dep env variable', () => {
-      const depEnvVarHide = getOtelDepEnvVar(trail).state.hide;
-      expect(depEnvVarHide).toBe(VariableHide.hideVariable);
-    });
-
-    it('should start with hidden otel resources variable', () => {
-      const resourcesVarHide = getOtelResourcesVar(trail).state.hide;
-      expect(resourcesVarHide).toBe(VariableHide.hideVariable);
+    // default otel experience to off
+    it('clicking start button should start with OTel off and showing var filters', () => {
+      trail.setState({ startButtonClicked: true });
+      const otelResourcesHide = getOtelResourcesVar(trail).state.hide;
+      const varFiltersHide = getFilterVar().state.hide;
+      expect(otelResourcesHide).toBe(VariableHide.hideVariable);
+      expect(varFiltersHide).toBe(VariableHide.hideLabel);
     });
 
     it('should start with hidden otel join query variable', () => {
@@ -540,25 +550,54 @@ describe('DataTrail', () => {
       expect(joinQueryVarHide).toBe(VariableHide.hideVariable);
     });
 
-    it('should add history step for when updating the otel resource variable', () => {
-      expect(trail.state.history.state.steps[2].type).toBe('resource');
-    });
-
-    it('Should have otel resource attribute selected as "service_name=adservice"', () => {
-      expect(getOtelResourcesVar(trail).state.filters[0].key).toBe('service_name');
-      expect(getOtelResourcesVar(trail).state.filters[0].value).toBe('adservice');
-    });
-
-    it('Should have deployment environment selected as "production"', () => {
-      expect(getOtelDepEnvVar(trail).getValue()).toBe('production');
-    });
-
-    it('should add history step for when updating the dep env variable', () => {
-      expect(trail.state.history.state.steps[3].type).toBe('dep_env');
-    });
-
     it('should have a group left variable for resource attributes', () => {
       expect(getOtelGroupLeftVar(trail).state.value).toBe('attribute1,attribute2');
     });
+
+    describe('resetting the OTel experience', () => {
+      it('should display with hideLabel var filters and hide VAR_OTEL_AND_METRIC_FILTERS when resetting otel experience', () => {
+        trail.resetOtelExperience();
+        expect(getFilterVar().state.hide).toBe(VariableHide.hideLabel);
+        expect(getOtelAndMetricsVar(trail).state.hide).toBe(VariableHide.hideVariable);
+      });
+
+      // it should preserve var filters when it resets
+    });
+
+    describe('when otel is on the subscription to Otel and metrics var should update other variables', () => {
+      beforeEach(() => {
+        trail.setState({ initialOtelCheckComplete: true, useOtelExperience: true });
+      });
+
+      it('should automatically update the otel resources var when a non promoted resource has been selected from VAR_OTEL_AND_METRICS', () => {
+        getOtelAndMetricsVar(trail).setState({
+          filters: [{ key: 'deployment_environment', operator: '=', value: 'production' }],
+        });
+
+        const otelResourcesVar = getOtelResourcesVar(trail);
+        const otelResourcesFilter = otelResourcesVar.state.filters[0];
+        expect(otelResourcesFilter.key).toBe('deployment_environment');
+        expect(otelResourcesFilter.value).toBe('production');
+      });
+
+      it('should add history step of type "resource" when adding a non promoted otel resource', () => {
+        getOtelAndMetricsVar(trail).setState({
+          filters: [{ key: 'deployment_environment', operator: '=', value: 'production' }],
+        });
+        expect(trail.state.history.state.steps[2].type).toBe('resource');
+      });
+
+      it('should automatically update the var filters when a promoted resource has been selected from VAR_OTEL_AND_METRICS', () => {
+        getOtelAndMetricsVar(trail).setState({ filters: [{ key: 'promoted', operator: '=', value: 'resource' }] });
+        const varFilters = getFilterVar().state.filters[0];
+        expect(varFilters.key).toBe('promoted');
+        expect(varFilters.value).toBe('resource');
+      });
+
+      it('should add history step of type "filters" when adding a non promoted otel resource', () => {
+        getOtelAndMetricsVar(trail).setState({ filters: [{ key: 'promoted', operator: '=', value: 'resource' }] });
+        expect(trail.state.history.state.steps[2].type).toBe('filters');
+      });
+    });
   });
 });
diff --git a/public/app/features/trails/DataTrail.tsx b/public/app/features/trails/DataTrail.tsx
index 6e98e2514e1..f9f6d0bee19 100644
--- a/public/app/features/trails/DataTrail.tsx
+++ b/public/app/features/trails/DataTrail.tsx
@@ -1,15 +1,7 @@
 import { css } from '@emotion/css';
-import { useEffect } from 'react';
+import { useEffect, useRef } from 'react';
 
-import {
-  AdHocVariableFilter,
-  GetTagResponse,
-  GrafanaTheme2,
-  MetricFindValue,
-  RawTimeRange,
-  urlUtil,
-  VariableHide,
-} from '@grafana/data';
+import { AdHocVariableFilter, GrafanaTheme2, RawTimeRange, urlUtil, VariableHide } from '@grafana/data';
 import { PromQuery } from '@grafana/prometheus';
 import { locationService, useChromeHeaderHeight } from '@grafana/runtime';
 import {
@@ -48,17 +40,11 @@ import { MetricSelectScene } from './MetricSelect/MetricSelectScene';
 import { MetricsHeader } from './MetricsHeader';
 import { getTrailStore } from './TrailStore/TrailStore';
 import { MetricDatasourceHelper } from './helpers/MetricDatasourceHelper';
-import { reportChangeInLabelFilters } from './interactions';
-import { getDeploymentEnvironments, TARGET_INFO_FILTER, totalOtelResources } from './otel/api';
-import { OtelResourcesObject, OtelTargetType } from './otel/types';
-import {
-  getOtelJoinQuery,
-  getOtelResourcesObject,
-  getProdOrDefaultOption,
-  sortResources,
-  updateOtelJoinWithGroupLeft,
-} from './otel/util';
-import { getOtelExperienceToggleState } from './services/store';
+import { reportChangeInLabelFilters, reportExploreMetrics } from './interactions';
+import { migrateOtelDeploymentEnvironment } from './migrations/otelDeploymentEnvironment';
+import { getDeploymentEnvironments, getNonPromotedOtelResources, totalOtelResources } from './otel/api';
+import { OtelTargetType } from './otel/types';
+import { manageOtelAndMetricFilters, updateOtelData, updateOtelJoinWithGroupLeft } from './otel/util';
 import {
   getVariablesWithOtelJoinQueryConstant,
   MetricSelectedEvent,
@@ -67,6 +53,7 @@ import {
   VAR_DATASOURCE_EXPR,
   VAR_FILTERS,
   VAR_MISSING_OTEL_TARGETS,
+  VAR_OTEL_AND_METRIC_FILTERS,
   VAR_OTEL_DEPLOYMENT_ENV,
   VAR_OTEL_GROUP_LEFT,
   VAR_OTEL_JOIN_QUERY,
@@ -92,6 +79,13 @@ export interface DataTrailState extends SceneObjectState {
   otelTargets?: OtelTargetType; // all the targets with job and instance regex, job=~"<job-v>|<job-v>"", instance=~"<instance-v>|<instance-v>"
   otelJoinQuery?: string;
   isStandardOtel?: boolean;
+  nonPromotedOtelResources?: string[];
+  initialOtelCheckComplete?: boolean; // updated after the first otel check
+  startButtonClicked?: boolean; // from original landing page
+  afterFirstOtelCheck?: boolean; // when starting there is always a DS var change from variable dependency
+  resettingOtel?: boolean; // when switching OTel off from the switch
+  isUpdatingOtel?: boolean;
+  addingLabelFromBreakdown?: boolean; // do not use the otel and metrics var subscription when adding label from the breakdown
 
   // moved into settings
   showPreviews?: boolean;
@@ -133,6 +127,9 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
   }
 
   public _onActivate() {
+    const urlParams = urlUtil.getUrlSearchParams();
+    migrateOtelDeploymentEnvironment(this, urlParams);
+
     if (!this.state.topScene) {
       this.setState({ topScene: getTopSceneFor(this.state.metric) });
     }
@@ -151,6 +148,41 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
       );
     }
 
+    // This is for OTel consolidation filters
+    // whenever the otel and metric filter is updated,
+    // we need to add that filter to the correct otel resource var or var filter
+    // so the filter can be interpolated in the query correctly
+    const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, this);
+    const otelFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, this);
+    if (
+      otelAndMetricsFiltersVariable instanceof AdHocFiltersVariable &&
+      otelFiltersVariable instanceof AdHocFiltersVariable &&
+      filtersVariable instanceof AdHocFiltersVariable
+    ) {
+      this._subs.add(
+        otelAndMetricsFiltersVariable?.subscribeToState((newState, prevState) => {
+          // identify the added, updated or removed variables and update the correct filter,
+          // either the otel resource or the var filter
+          // do not update on switching on otel experience or the initial check
+          // do not update when selecting a label from metric scene breakdown
+          if (
+            this.state.useOtelExperience &&
+            this.state.initialOtelCheckComplete &&
+            !this.state.addingLabelFromBreakdown
+          ) {
+            const nonPromotedOtelResources = this.state.nonPromotedOtelResources ?? [];
+            manageOtelAndMetricFilters(
+              newState.filters,
+              prevState.filters,
+              nonPromotedOtelResources,
+              otelFiltersVariable,
+              filtersVariable
+            );
+          }
+        })
+      );
+    }
+
     // Save the current trail as a recent (if the browser closes or reloads) if user selects a metric OR applies filters to metric select view
     const saveRecentTrail = () => {
       const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, this);
@@ -170,39 +202,30 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
   }
 
   protected _variableDependency = new VariableDependencyConfig(this, {
-    variableNames: [VAR_DATASOURCE, VAR_OTEL_RESOURCES, VAR_OTEL_DEPLOYMENT_ENV, VAR_OTEL_JOIN_QUERY],
+    variableNames: [VAR_DATASOURCE, VAR_OTEL_RESOURCES, VAR_OTEL_JOIN_QUERY, VAR_OTEL_AND_METRIC_FILTERS],
     onReferencedVariableValueChanged: async (variable: SceneVariable) => {
       const { name } = variable.state;
 
       if (name === VAR_DATASOURCE) {
         this.datasourceHelper.reset();
 
+        if (this.state.afterFirstOtelCheck) {
+          // we need a new check for OTel
+          this.setState({ initialOtelCheckComplete: false });
+          // clear out the OTel filters, do not clear out var filters
+          this.resetOtelExperience();
+        }
         // fresh check for otel experience
         this.checkDataSourceForOTelResources();
       }
 
       // update otel variables when changed
-      if (this.state.useOtelExperience && (name === VAR_OTEL_DEPLOYMENT_ENV || name === VAR_OTEL_RESOURCES)) {
+      if (this.state.useOtelExperience && name === VAR_OTEL_RESOURCES && this.state.initialOtelCheckComplete) {
         // for state and variables
         const timeRange: RawTimeRange | undefined = this.state.$timeRange?.state;
         const datasourceUid = sceneGraph.interpolate(this, VAR_DATASOURCE_EXPR);
-        const otelDepEnvVariable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, this);
-        const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, this);
-        const otelJoinQueryVariable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, this);
-
-        if (
-          timeRange &&
-          otelResourcesVariable instanceof AdHocFiltersVariable &&
-          otelJoinQueryVariable instanceof ConstantVariable &&
-          otelDepEnvVariable instanceof CustomVariable
-        ) {
-          this.updateOtelData(
-            datasourceUid,
-            timeRange,
-            otelDepEnvVariable,
-            otelResourcesVariable,
-            otelJoinQueryVariable
-          );
+        if (timeRange) {
+          updateOtelData(this, datasourceUid, timeRange);
         }
       }
     },
@@ -215,14 +238,20 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
    */
   public addFilterWithoutReportingInteraction(filter: AdHocVariableFilter) {
     const variable = sceneGraph.lookupVariable('filters', this);
-    if (!(variable instanceof AdHocFiltersVariable)) {
+    const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, this);
+    if (
+      !(variable instanceof AdHocFiltersVariable) ||
+      !(otelAndMetricsFiltersVariable instanceof AdHocFiltersVariable)
+    ) {
       return;
     }
 
     this._addingFilterWithoutReportingInteraction = true;
-
-    variable.setState({ filters: [...variable.state.filters, filter] });
-
+    if (this.state.useOtelExperience) {
+      otelAndMetricsFiltersVariable.setState({ filters: [...otelAndMetricsFiltersVariable.state.filters, filter] });
+    } else {
+      variable.setState({ filters: [...variable.state.filters, filter] });
+    }
     this._addingFilterWithoutReportingInteraction = false;
   }
 
@@ -320,7 +349,7 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
    * Check that the data source is standard for OTEL
    * Show a warning if not
    * Update the following variables:
-   * deployment_environment (first filter), otelResources (filters), otelJoinQuery (used in the query)
+   * otelResources (filters), otelJoinQuery (used in the query)
    * Enable the otel experience
    *
    * @returns
@@ -333,267 +362,102 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
     const timeRange: RawTimeRange | undefined = trail.state.$timeRange?.state;
 
     if (timeRange) {
-      const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, this);
-      const otelDepEnvVariable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, this);
-      const otelJoinQueryVariable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, this);
-      const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, this);
-
       const datasourceUid = sceneGraph.interpolate(trail, VAR_DATASOURCE_EXPR);
-
       const otelTargets = await totalOtelResources(datasourceUid, timeRange);
       const deploymentEnvironments = await getDeploymentEnvironments(datasourceUid, timeRange, getSelectedScopes());
       const hasOtelResources = otelTargets.jobs.length > 0 && otelTargets.instances.length > 0;
+      // loading from the url with otel resources selected will result in turning on OTel experience
+      const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, this);
+      let previouslyUsedOtelResources = false;
+      if (otelResourcesVariable instanceof AdHocFiltersVariable) {
+        previouslyUsedOtelResources = otelResourcesVariable.state.filters.length > 0;
+      }
+
+      // Future refactor: non promoted resources could be the full check
+      //   - remove hasOtelResources
+      //   - remove deployment environments as a check
+      const nonPromotedOtelResources = await getNonPromotedOtelResources(datasourceUid, timeRange);
+
+      // This is the function that will turn on OTel for the entire app.
+      // The conditions to use this function are
+      // 1. must be an otel data source
+      // 2. Do not turn it on if the start button was clicked
+      // 3. Url or bookmark has previous otel filters
+      // 4. We are restting OTel with the toggle switch
       if (
-        otelResourcesVariable instanceof AdHocFiltersVariable &&
-        otelDepEnvVariable instanceof CustomVariable &&
-        otelJoinQueryVariable instanceof ConstantVariable &&
-        filtersVariable instanceof AdHocFiltersVariable
+        hasOtelResources &&
+        nonPromotedOtelResources && // it is an otel data source
+        !this.state.startButtonClicked && // we are not starting from the start button
+        (previouslyUsedOtelResources || this.state.resettingOtel) // there are otel filters or we are restting
       ) {
         // HERE WE START THE OTEL EXPERIENCE ENGINE
         // 1. Set deployment variable values
         // 2. update all other variables and state
-        if (hasOtelResources && deploymentEnvironments.length > 0) {
-          // apply VAR FILTERS manually
-          // otherwise they will appear anywhere the query contains {} characters
-          filtersVariable.setState({
-            addFilterButtonText: 'Select metric attributes',
-            label: 'Select metric attribute',
-          });
-
-          // 1. set deployment variable values
-          let varQuery = '';
-          const options = deploymentEnvironments.map((env) => {
-            varQuery += env + ',';
-            return { value: env, label: env };
-          });
-          // We have to have a default value because custom variable requires it
-          // we choose one default value to help filter metrics
-          // The work flow for OTel begins with users selecting a deployment environment
-          // default to production
-          let defaultDepEnv = getProdOrDefaultOption(options) ?? '';
-          // On starting the explore metrics workflow, the custom variable has no value
-          // Even if there is state, the value is always ''
-          // The only reference to state values are in the text
-          const otelDepEnvValue = otelDepEnvVariable.state.text;
-
-          // TypeScript issue: VariableValue is either a string or array but does not have any string or array methods on it to check that it is empty
-          const notInitialvalue = otelDepEnvValue !== '' && otelDepEnvValue.toLocaleString() !== '';
-
-          const depEnvInitialValue = notInitialvalue ? otelDepEnvValue : defaultDepEnv;
-
-          otelDepEnvVariable?.setState({
-            value: depEnvInitialValue,
-            options: options,
-            hide: VariableHide.dontHide,
-          });
-
-          this.updateOtelData(
-            datasourceUid,
-            timeRange,
-            otelDepEnvVariable,
-            otelResourcesVariable,
-            otelJoinQueryVariable,
-            deploymentEnvironments,
-            hasOtelResources
-          );
-        } else {
-          // reset filters to apply auto, anywhere there are {} characters
-          this.resetOtelExperience(
-            otelResourcesVariable,
-            otelDepEnvVariable,
-            otelJoinQueryVariable,
-            filtersVariable,
-            hasOtelResources,
-            deploymentEnvironments
-          );
-        }
+        updateOtelData(
+          this,
+          datasourceUid,
+          timeRange,
+          deploymentEnvironments,
+          hasOtelResources,
+          nonPromotedOtelResources
+        );
+      } else {
+        this.resetOtelExperience(hasOtelResources, nonPromotedOtelResources);
       }
     }
   }
 
-  /**
-   *  This function is used to update state and otel variables.
-   *
-   *  1. Set the otelResources adhoc tagKey and tagValues filter functions
-   *  2. Get the otel join query for state and variable
-   *  3. Update state with the following
-   *    - otel join query
-   *    - otelTargets used to filter metrics
-   *  For initialization we also update the following
-   *    - has otel resources flag
-   *    - isStandardOtel flag (for enabliing the otel experience toggle)
-   *    - and useOtelExperience
-   *
-   * This function is called on start and when variables change.
-   * On start will provide the deploymentEnvironments and hasOtelResources parameters.
-   * In the variable change case, we will not provide these parameters. It is assumed that the
-   * data source has been checked for otel resources and standardization and the otel variables are enabled at this point.
-   * @param datasourceUid
-   * @param timeRange
-   * @param otelDepEnvVariable
-   * @param otelResourcesVariable
-   * @param otelJoinQueryVariable
-   * @param deploymentEnvironments
-   * @param hasOtelResources
-   */
-  async updateOtelData(
-    datasourceUid: string,
-    timeRange: RawTimeRange,
-    otelDepEnvVariable: CustomVariable,
-    otelResourcesVariable: AdHocFiltersVariable,
-    otelJoinQueryVariable: ConstantVariable,
-    deploymentEnvironments?: string[],
-    hasOtelResources?: boolean
-  ) {
-    // 1. Set the otelResources adhoc tagKey and tagValues filter functions
-    // get the labels for otel resources
-    // collection of filters for the otel resource variable
-    // filter label names and label values
-    // the first filter is {__name__="target_info"}
-    let filters: AdHocVariableFilter[] = [TARGET_INFO_FILTER];
+  resetOtelExperience(hasOtelResources?: boolean, nonPromotedResources?: string[]) {
+    const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, this);
+    const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, this);
+    const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, this);
+    const otelJoinQueryVariable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, this);
 
-    // always start with the deployment environment
-    const depEnvValue = '' + otelDepEnvVariable?.getValue();
-
-    if (depEnvValue) {
-      // update the operator if more than one
-      const op = depEnvValue.includes(',') ? '=~' : '=';
-      // the second filter is deployment_environment
-      const filter = {
-        key: 'deployment_environment',
-        value: depEnvValue.split(',').join('|'),
-        operator: op,
-      };
-
-      filters.push(filter);
+    if (
+      !(
+        otelResourcesVariable instanceof AdHocFiltersVariable &&
+        filtersVariable instanceof AdHocFiltersVariable &&
+        otelAndMetricsFiltersVariable instanceof AdHocFiltersVariable &&
+        otelJoinQueryVariable instanceof ConstantVariable
+      )
+    ) {
+      return;
     }
-    // next we check the otel resources adhoc variable for filters
-    const values = otelResourcesVariable.getValue();
 
-    if (values && otelResourcesVariable.state.filters.length > 0) {
-      filters = filters.concat(otelResourcesVariable.state.filters);
-    }
-    // the datasourceHelper will give us access to the
-    // Prometheus functions getTagKeys and getTagValues
-    // because we can access the ds
-    const datasourceHelper = this.datasourceHelper;
-    // now we reset the override tagKeys and tagValues functions of the adhoc variable
-    otelResourcesVariable.setState({
-      getTagKeysProvider: async (
-        variable: AdHocFiltersVariable,
-        currentKey: string | null
-      ): Promise<{
-        replace?: boolean;
-        values: GetTagResponse | MetricFindValue[];
-      }> => {
-        // apply filters here
-        // we're passing the queries so we get the labels that adhere to the queries
-        // we're also passing the scopes so we get the labels that adhere to the scopes filters
-        let values = await datasourceHelper.getTagKeys({
-          filters,
-          scopes: getSelectedScopes(),
-          queries: this.getQueries(),
-        });
-        values = sortResources(values, filters.map((f) => f.key).concat(currentKey ?? ''));
-        return { replace: true, values };
-      },
-      getTagValuesProvider: async (
-        variable: AdHocFiltersVariable,
-        filter: AdHocVariableFilter
-      ): Promise<{
-        replace?: boolean;
-        values: GetTagResponse | MetricFindValue[];
-      }> => {
-        // apply filters here
-        // remove current selected filter if refiltering
-        filters = filters.filter((f) => f.key !== filter.key);
-        // we're passing the queries so we get the label values that adhere to the queries
-        // we're also passing the scopes so we get the label values that adhere to the scopes filters
-        const values = await datasourceHelper.getTagValues({
-          key: filter.key,
-          filters,
-          scopes: getSelectedScopes(),
-          queries: this.getQueries(),
-        });
-        return { replace: true, values };
-      },
-      hide: VariableHide.hideLabel,
-    });
-
-    // 2. Get the otel join query for state and variable
-    // Because we need to define the deployment environment variable
-    // we also need to update the otel join query state and variable
-    const resourcesObject: OtelResourcesObject = getOtelResourcesObject(this);
-    const otelJoinQuery = getOtelJoinQuery(resourcesObject);
-
-    // update the otel join query variable too
-    otelJoinQueryVariable.setState({ value: otelJoinQuery });
-
-    // 3. Update state with the following
-    // - otel join query
-    // - otelTargets used to filter metrics
-    // now we can filter target_info targets by deployment_environment="somevalue"
-    // and use these new targets to reduce the metrics
-    // for initialization we also update the following
-    // - has otel resources flag
-    // - and default to useOtelExperience
-    const otelTargets = await totalOtelResources(datasourceUid, timeRange, resourcesObject.filters);
-
-    // we pass in deploymentEnvironments and hasOtelResources on start
-    if (hasOtelResources && deploymentEnvironments) {
-      const isEnabledInLocalStorage = getOtelExperienceToggleState();
-      this.setState({
-        otelTargets,
-        otelJoinQuery,
-        hasOtelResources,
-        isStandardOtel: deploymentEnvironments.length > 0,
-        useOtelExperience: isEnabledInLocalStorage,
-      });
-    } else {
-      // we are updating on variable changes
-      this.setState({
-        otelTargets,
-        otelJoinQuery,
-      });
-    }
-  }
-
-  resetOtelExperience(
-    otelResourcesVariable: AdHocFiltersVariable,
-    otelDepEnvVariable: CustomVariable,
-    otelJoinQueryVariable: ConstantVariable,
-    filtersVariable: AdHocFiltersVariable,
-    hasOtelResources?: boolean,
-    deploymentEnvironments?: string[]
-  ) {
-    // reset filters to apply auto, anywhere there are {} characters
+    // show the var filters normally
     filtersVariable.setState({
       addFilterButtonText: 'Add label',
       label: 'Select label',
+      hide: VariableHide.hideLabel,
+    });
+    // Resetting the otel experience filters means clearing both the otel resources var and the otelMetricsVar
+    // hide the super otel and metric filter and reset it
+    otelAndMetricsFiltersVariable.setState({
+      filters: [],
+      hide: VariableHide.hideVariable,
     });
 
     // if there are no resources reset the otel variables and otel state
     // or if not standard
     otelResourcesVariable.setState({
+      filters: [],
       defaultKeys: [],
       hide: VariableHide.hideVariable,
     });
 
-    otelDepEnvVariable.setState({
-      value: '',
-      hide: VariableHide.hideVariable,
-    });
-
     otelJoinQueryVariable.setState({ value: '' });
 
-    // full reset when a data source fails the check
-    if (hasOtelResources && deploymentEnvironments) {
+    // potential full reset when a data source fails the check or is the initial check with turning off
+    if (hasOtelResources && nonPromotedResources) {
       this.setState({
         hasOtelResources,
-        isStandardOtel: deploymentEnvironments.length > 0,
+        isStandardOtel: nonPromotedResources.length > 0,
         useOtelExperience: false,
         otelTargets: { jobs: [], instances: [] },
         otelJoinQuery: '',
+        afterFirstOtelCheck: true,
+        initialOtelCheckComplete: true,
+        isUpdatingOtel: false,
       });
     } else {
       // partial reset when a user turns off the otel experience
@@ -601,6 +465,9 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
         otelTargets: { jobs: [], instances: [] },
         otelJoinQuery: '',
         useOtelExperience: false,
+        afterFirstOtelCheck: true,
+        initialOtelCheckComplete: true,
+        isUpdatingOtel: false,
       });
     }
   }
@@ -629,22 +496,13 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
     const showHeaderForFirstTimeUsers = getTrailStore().recent.length < 2;
 
     useEffect(() => {
-      // check if the otel experience has been enabled
-      if (!useOtelExperience) {
-        // if the experience has been turned off, reset the otel variables
-        const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, model);
-        const otelDepEnvVariable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, model);
-        const otelJoinQueryVariable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, model);
-        const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, model);
+      if (model.state.addingLabelFromBreakdown) {
+        return;
+      }
 
-        if (
-          otelResourcesVariable instanceof AdHocFiltersVariable &&
-          otelDepEnvVariable instanceof CustomVariable &&
-          otelJoinQueryVariable instanceof ConstantVariable &&
-          filtersVariable instanceof AdHocFiltersVariable
-        ) {
-          model.resetOtelExperience(otelResourcesVariable, otelDepEnvVariable, otelJoinQueryVariable, filtersVariable);
-        }
+      if (!useOtelExperience && model.state.afterFirstOtelCheck) {
+        // if the experience has been turned off, reset the otel variables
+        model.resetOtelExperience();
       } else {
         // if experience is enabled, check standardization and update the otel variables
         model.checkDataSourceForOTelResources();
@@ -653,9 +511,18 @@ export class DataTrail extends SceneObjectBase<DataTrailState> implements SceneO
 
     useEffect(() => {
       const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, model);
+      const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, model);
+      const limitedFilterVariable = useOtelExperience ? otelAndMetricsFiltersVariable : filtersVariable;
       const datasourceHelper = model.datasourceHelper;
-      limitAdhocProviders(model, filtersVariable, datasourceHelper);
-    }, [model]);
+      limitAdhocProviders(model, limitedFilterVariable, datasourceHelper);
+    }, [model, useOtelExperience]);
+
+    const reportOtelExperience = useRef(false);
+    // only report otel experience once
+    if (useOtelExperience && !reportOtelExperience.current) {
+      reportExploreMetrics('otel_experience_used', {});
+      reportOtelExperience.current = true;
+    }
 
     return (
       <div className={styles.container}>
@@ -702,14 +569,6 @@ function getVariableSet(
         value: initialDS,
         pluginId: 'prometheus',
       }),
-      new CustomVariable({
-        name: VAR_OTEL_DEPLOYMENT_ENV,
-        label: 'Deployment environment',
-        hide: VariableHide.hideVariable,
-        value: undefined,
-        placeholder: 'Select',
-        isMulti: true,
-      }),
       new AdHocFiltersVariable({
         name: VAR_OTEL_RESOURCES,
         label: 'Select resource attributes',
@@ -724,6 +583,7 @@ function getVariableSet(
         name: VAR_FILTERS,
         addFilterButtonText: 'Add label',
         datasource: trailDS,
+        // default to use var filters and have otel off
         hide: VariableHide.hideLabel,
         layout: 'vertical',
         filters: initialFilters ?? [],
@@ -743,6 +603,30 @@ function getVariableSet(
         hide: VariableHide.hideVariable,
         value: false,
       }),
+      new AdHocFiltersVariable({
+        name: VAR_OTEL_AND_METRIC_FILTERS,
+        addFilterButtonText: 'Filter',
+        datasource: trailDS,
+        hide: VariableHide.hideVariable,
+        layout: 'vertical',
+        filters: initialFilters ?? [],
+        baseFilters: getBaseFiltersForMetric(metric),
+        applyMode: 'manual',
+        // since we only support prometheus datasources, this is always true
+        supportsMultiValueOperators: true,
+        // skipUrlSync: true
+      }),
+      // Legacy variable needed for bookmarking which is necessary because
+      // url sync method does not handle multiple dep env values
+      // Remove this when the rudderstack event "deployment_environment_migrated" tapers off
+      new CustomVariable({
+        name: VAR_OTEL_DEPLOYMENT_ENV,
+        label: 'Deployment environment',
+        hide: VariableHide.hideVariable,
+        value: undefined,
+        placeholder: 'Select',
+        isMulti: true,
+      }),
     ],
   });
 }
diff --git a/public/app/features/trails/DataTrailsHistory.tsx b/public/app/features/trails/DataTrailsHistory.tsx
index aa66384eb4f..bfd7af07344 100644
--- a/public/app/features/trails/DataTrailsHistory.tsx
+++ b/public/app/features/trails/DataTrailsHistory.tsx
@@ -127,6 +127,7 @@ export class DataTrailHistory extends SceneObjectBase<DataTrailsHistoryState> {
         this.setState({ filtersApplied });
       }
 
+      // TEST THE MIGRATION OF REMOVING THE VAR_OTEL_DEPLOYMENT_ENV
       if (evt.payload.state.name === VAR_OTEL_DEPLOYMENT_ENV) {
         const otelDepEnvs = this.state.otelDepEnvs;
         const urlState = sceneUtils.getUrlState(trail);
diff --git a/public/app/features/trails/DataTrailsHome.tsx b/public/app/features/trails/DataTrailsHome.tsx
index c0c4d6d5995..4d21a05239c 100644
--- a/public/app/features/trails/DataTrailsHome.tsx
+++ b/public/app/features/trails/DataTrailsHome.tsx
@@ -25,7 +25,7 @@ export class DataTrailsHome extends SceneObjectBase<DataTrailsHomeState> {
 
   public onNewMetricsTrail = () => {
     const app = getAppFor(this);
-    const trail = newMetricsTrail(getDatasourceForNewTrail());
+    const trail = newMetricsTrail(getDatasourceForNewTrail(), true);
     reportExploreMetrics('exploration_started', { cause: 'new_clicked' });
     app.goToUrlForTrail(trail);
   };
diff --git a/public/app/features/trails/MetricSelect/MetricSelectScene.tsx b/public/app/features/trails/MetricSelect/MetricSelectScene.tsx
index edaf14c9533..1eb1deacf45 100644
--- a/public/app/features/trails/MetricSelect/MetricSelectScene.tsx
+++ b/public/app/features/trails/MetricSelect/MetricSelectScene.tsx
@@ -25,7 +25,7 @@ import {
   SceneVariableSet,
   VariableDependencyConfig,
 } from '@grafana/scenes';
-import { Alert, Field, Icon, IconButton, InlineSwitch, Input, Select, Tooltip, useStyles2 } from '@grafana/ui';
+import { Alert, Badge, Field, Icon, IconButton, InlineSwitch, Input, Select, Tooltip, useStyles2 } from '@grafana/ui';
 import { Trans } from 'app/core/internationalization';
 import { getSelectedScopes } from 'app/features/scopes';
 
@@ -486,9 +486,19 @@ export class MetricSelectScene extends SceneObjectBase<MetricSelectSceneState> i
   public onToggleOtelExperience = () => {
     const trail = getTrailFor(this);
     const useOtelExperience = trail.state.useOtelExperience;
-
+    // set the startButtonClicked to null as we have gone past the owrkflow this is needed for
+    let startButtonClicked = false;
+    let resettingOtel = true;
+    if (useOtelExperience) {
+      reportExploreMetrics('otel_experience_toggled', { value: 'off' });
+      // if turning off OTel
+      resettingOtel = false;
+      trail.resetOtelExperience();
+    } else {
+      reportExploreMetrics('otel_experience_toggled', { value: 'on' });
+    }
     setOtelExperienceToggleState(!useOtelExperience);
-    trail.setState({ useOtelExperience: !useOtelExperience });
+    trail.setState({ useOtelExperience: !useOtelExperience, resettingOtel, startButtonClicked });
   };
 
   public static Component = ({ model }: SceneComponentProps<MetricSelectScene>) => {
@@ -564,19 +574,28 @@ export class MetricSelectScene extends SceneObjectBase<MetricSelectSceneState> i
           {hasOtelResources && (
             <Field
               label={
-                <div className={styles.displayOptionTooltip}>
-                  <Trans i18nKey="trails.metric-select.filter-by">Filter by</Trans>
-                  <IconButton
-                    name={'info-circle'}
-                    size="sm"
-                    variant={'secondary'}
-                    tooltip={
-                      <Trans i18nKey="trails.metric-select.otel-switch">
-                        This switch enables filtering by OTel resources for OTel native data sources.
-                      </Trans>
-                    }
-                  />
-                </div>
+                <>
+                  <div className={styles.displayOptionTooltip}>
+                    <Trans i18nKey="trails.metric-select.filter-by">Filter by</Trans>
+                    <IconButton
+                      name={'info-circle'}
+                      size="sm"
+                      variant={'secondary'}
+                      tooltip={
+                        <Trans i18nKey="trails.metric-select.otel-switch">
+                          This switch enables filtering by OTel resources for OTel native data sources.
+                        </Trans>
+                      }
+                    />
+                    <div>
+                      <Badge
+                        text={<Trans i18nKey="trails.metric-select.new-badge">New</Trans>}
+                        color={'blue'}
+                        className={styles.badgeStyle}
+                      ></Badge>
+                    </div>
+                  </div>
+                </>
               }
               className={styles.displayOption}
             >
@@ -668,6 +687,17 @@ function getStyles(theme: GrafanaTheme2) {
     warningIcon: css({
       color: theme.colors.warning.main,
     }),
+    badgeStyle: css({
+      display: 'flex',
+      height: '1rem',
+      padding: '0rem 0.25rem 0 0.30rem',
+      alignItems: 'center',
+      borderRadius: theme.shape.radius.pill,
+      border: `1px solid ${theme.colors.info.text}`,
+      background: theme.colors.info.transparent,
+      marginTop: '4px',
+      marginLeft: '-3px',
+    }),
   };
 }
 
diff --git a/public/app/features/trails/TrailStore/TrailStore.test.ts b/public/app/features/trails/TrailStore/TrailStore.test.ts
index c018a19ba52..ba41d6c6014 100644
--- a/public/app/features/trails/TrailStore/TrailStore.test.ts
+++ b/public/app/features/trails/TrailStore/TrailStore.test.ts
@@ -510,9 +510,10 @@ describe('TrailStore', () => {
               to: 'now',
               timezone,
               'var-ds': 'prom-mock',
-              'var-deployment_environment': ['undefined'],
               'var-otel_resources': [''],
               'var-filters': [],
+              'var-otel_and_metric_filters': [''],
+              'var-deployment_environment': [''],
               refresh: '',
             },
             type: 'time',
@@ -716,9 +717,10 @@ describe('TrailStore', () => {
                   to: 'now',
                   timezone,
                   'var-ds': 'prom-mock',
-                  'var-deployment_environment': ['undefined'],
                   'var-otel_resources': [''],
                   'var-filters': [],
+                  'var-otel_and_metric_filters': [''],
+                  'var-deployment_environment': [''],
                   refresh: '',
                 },
                 type: 'start',
@@ -730,9 +732,10 @@ describe('TrailStore', () => {
                   to: 'now',
                   timezone,
                   'var-ds': 'prom-mock',
-                  'var-deployment_environment': ['undefined'],
                   'var-otel_resources': [''],
                   'var-filters': [],
+                  'var-otel_and_metric_filters': [''],
+                  'var-deployment_environment': [''],
                   refresh: '',
                 },
                 type: 'time',
@@ -744,9 +747,10 @@ describe('TrailStore', () => {
                   to: 'now',
                   timezone,
                   'var-ds': 'prom-mock',
-                  'var-deployment_environment': ['undefined'],
                   'var-otel_resources': [''],
                   'var-filters': [],
+                  'var-otel_and_metric_filters': [''],
+                  'var-deployment_environment': [''],
                   refresh: '',
                 },
                 type: 'metric',
@@ -766,9 +770,10 @@ describe('TrailStore', () => {
               to: 'now',
               timezone,
               'var-ds': 'prom-mock',
-              'var-deployment_environment': ['undefined'],
               'var-otel_resources': [''],
               'var-filters': [],
+              'var-otel_and_metric_filters': [''],
+              'var-deployment_environment': [''],
               refresh: '',
             },
             type: 'time',
diff --git a/public/app/features/trails/helpers/MetricDatasourceHelper.ts b/public/app/features/trails/helpers/MetricDatasourceHelper.ts
index c1e25cfbaed..d9b84d76b82 100644
--- a/public/app/features/trails/helpers/MetricDatasourceHelper.ts
+++ b/public/app/features/trails/helpers/MetricDatasourceHelper.ts
@@ -34,7 +34,7 @@ export class MetricDatasourceHelper {
     return ds;
   }
 
-  private _metricsMetadata?: Promise<PromMetricsMetadata | undefined>;
+  _metricsMetadata?: Promise<PromMetricsMetadata | undefined>;
 
   private async _getMetricsMetadata() {
     const ds = await this.getDatasource();
@@ -62,10 +62,7 @@ export class MetricDatasourceHelper {
   }
 
   /**
-   * Used for filtering label names for OTel resources to add custom match filters
-   * - target_info metric
-   * - deployment_environment label
-   * - all other OTel filters
+   * Used for additional filtering for adhoc vars labels in Explore metrics.
    * @param options
    * @returns
    */
@@ -81,10 +78,7 @@ export class MetricDatasourceHelper {
   }
 
   /**
-   * Used for filtering label values for OTel resources to add custom match filters
-   * - target_info metric
-   * - deployment_environment label
-   * - all other OTel filters
+   * Used for additional filtering for adhoc vars label values in Explore metrics.
    * @param options
    * @returns
    */
diff --git a/public/app/features/trails/interactions.ts b/public/app/features/trails/interactions.ts
index 181b321dfc7..968742feb35 100644
--- a/public/app/features/trails/interactions.ts
+++ b/public/app/features/trails/interactions.ts
@@ -25,6 +25,7 @@ type Interactions = {
     label: string;
     action: 'added' | 'removed' | 'changed';
     cause: 'breakdown' | 'adhoc_filter';
+    otel_resource_attribute?: boolean;
   };
   // User changed the breakdown layout
   breakdown_layout_changed: { layout: BreakdownLayoutType };
@@ -126,6 +127,11 @@ type Interactions = {
   missing_otel_labels_by_truncating_job_and_instance: {
     metric?: string;
   },
+  deployment_environment_migrated: {},
+  otel_experience_used: {},
+  otel_experience_toggled: {
+    value: ('on'| 'off')
+  }
 };
 
 const PREFIX = 'grafana_explore_metrics_';
@@ -135,7 +141,11 @@ export function reportExploreMetrics<E extends keyof Interactions, P extends Int
 }
 
 /** Detect the single change in filters and report the event, assuming it came from manipulating the adhoc filter */
-export function reportChangeInLabelFilters(newFilters: AdHocVariableFilter[], oldFilters: AdHocVariableFilter[]) {
+export function reportChangeInLabelFilters(
+  newFilters: AdHocVariableFilter[],
+  oldFilters: AdHocVariableFilter[],
+  otel?: boolean
+) {
   if (newFilters.length === oldFilters.length) {
     for (const oldFilter of oldFilters) {
       for (const newFilter of newFilters) {
@@ -145,6 +155,7 @@ export function reportChangeInLabelFilters(newFilters: AdHocVariableFilter[], ol
               label: oldFilter.key,
               action: 'changed',
               cause: 'adhoc_filter',
+              otel_resource_attribute: otel ?? false,
             });
           }
         }
diff --git a/public/app/features/trails/migrations/otelDeploymentEnvironment.test.ts b/public/app/features/trails/migrations/otelDeploymentEnvironment.test.ts
new file mode 100644
index 00000000000..1cee80d9529
--- /dev/null
+++ b/public/app/features/trails/migrations/otelDeploymentEnvironment.test.ts
@@ -0,0 +1,129 @@
+import { AdHocVariableFilter, UrlQueryMap, UrlQueryValue } from '@grafana/data';
+import { AdHocFiltersVariable, CustomVariable, sceneGraph } from '@grafana/scenes';
+
+import { DataTrail } from '../DataTrail';
+import { VAR_OTEL_AND_METRIC_FILTERS, VAR_OTEL_DEPLOYMENT_ENV } from '../shared';
+
+import { migrateOtelDeploymentEnvironment, migrateAdHocFilters } from './otelDeploymentEnvironment';
+
+describe('migrate old dep env var to otel and metrics var', () => {
+  describe('migrateOtelDeploymentEnvironment', () => {
+    let trail = {} as DataTrail;
+    beforeEach(() => {
+      trail = new DataTrail({
+        useOtelExperience: true,
+      });
+    });
+    it('should not be called if var-otel_and_metric_filters is present with label', () => {
+      // this variable being present indicates it has already been migrated
+      const urlParams: UrlQueryMap = {
+        'var-otel_and_metric_filters': ['key|=|value'],
+      };
+
+      migrateOtelDeploymentEnvironment(trail, urlParams);
+
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+
+      expect(otelMetricsVar.state.filters).toEqual([]);
+    });
+
+    it('should not be called if starting a new trail', () => {
+      // new trails do not need to be migrated
+      trail.setState({ startButtonClicked: true });
+
+      const urlParams: UrlQueryMap = {
+        'var-otel_and_metric_filters': [''],
+      };
+
+      migrateOtelDeploymentEnvironment(trail, urlParams);
+
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+
+      expect(otelMetricsVar.state.filters).toEqual([]);
+    });
+
+    it('should not migrate if var-deployment_environment is not present', () => {
+      const urlParams: UrlQueryMap = {};
+
+      migrateOtelDeploymentEnvironment(trail, urlParams);
+
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+
+      expect(otelMetricsVar.state.filters).toEqual([]);
+    });
+
+    it('should migrate deployment environment and set filters correctly', () => {
+      const urlParams: UrlQueryMap = {
+        'var-deployment_environment': ['env1', 'env2'],
+        'var-otel_resources': ['otelResource|=|value'],
+        'var-filters': ['metricFilter|=|value'],
+      };
+
+      migrateOtelDeploymentEnvironment(trail, urlParams);
+
+      const expectedFilters = [
+        {
+          key: 'deployment_environment',
+          operator: '=~',
+          value: 'env1|env2',
+        },
+        {
+          key: 'otelResource',
+          operator: '=',
+          value: 'value',
+        },
+        {
+          key: 'metricFilter',
+          operator: '=',
+          value: 'value',
+        },
+        // Add expected otelFilters and metricFilters here
+      ];
+
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+      expect(otelMetricsVar.state.filters).toEqual(expectedFilters);
+      // should clear out the dep env var
+      const depEnvVar = getDepEnvVar(trail);
+      expect(depEnvVar.state.value).toBe('');
+    });
+  });
+
+  describe('migrateAdHocFilters', () => {
+    it('should return empty array when urlFilter is not present', () => {
+      const urlFilter: UrlQueryValue = null;
+      const filters: AdHocVariableFilter[] = [];
+      migrateAdHocFilters(urlFilter, filters);
+      expect(filters).toEqual([]);
+    });
+
+    it('should return filters when urlFilter is present', () => {
+      const urlFilter: UrlQueryValue = ['someKey|=|someValue'];
+      const filters: AdHocVariableFilter[] = [];
+      migrateAdHocFilters(urlFilter, filters);
+      const expected = [
+        {
+          key: 'someKey',
+          operator: '=',
+          value: 'someValue',
+        },
+      ];
+      expect(filters).toEqual(expected);
+    });
+  });
+
+  function getOtelAndMetricsVar(trail: DataTrail) {
+    const variable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+    if (variable instanceof AdHocFiltersVariable) {
+      return variable;
+    }
+    throw new Error('getOtelAndMetricsVar failed');
+  }
+
+  function getDepEnvVar(trail: DataTrail) {
+    const variable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, trail);
+    if (variable instanceof CustomVariable) {
+      return variable;
+    }
+    throw new Error('getDepVar failed');
+  }
+});
diff --git a/public/app/features/trails/migrations/otelDeploymentEnvironment.ts b/public/app/features/trails/migrations/otelDeploymentEnvironment.ts
new file mode 100644
index 00000000000..969c95bf662
--- /dev/null
+++ b/public/app/features/trails/migrations/otelDeploymentEnvironment.ts
@@ -0,0 +1,111 @@
+import { AdHocVariableFilter, UrlQueryValue, UrlQueryMap } from '@grafana/data';
+import { sceneGraph, AdHocFiltersVariable, CustomVariable } from '@grafana/scenes';
+
+import { DataTrail } from '../DataTrail';
+import { reportExploreMetrics } from '../interactions';
+import { VAR_OTEL_AND_METRIC_FILTERS, VAR_OTEL_DEPLOYMENT_ENV } from '../shared';
+
+/**
+ * Migration for the otel deployment environment variable.
+ * When the deployment environment is present in the url, "var-deployment_environment",
+ * it is migrated to the new variable "var-otel_and_metric_filters."
+ *
+ * We check if the otel resources vars are also present in the url, "var-otel_resources"
+ * and if the metric filters are present in the url, "var-filters".
+ *
+ * Once all the variables are migrated to "var-otel_and_metric_filters", the rest is handled in trail.updateOtelData.
+ *
+ * @param trail
+ * @returns
+ */
+export function migrateOtelDeploymentEnvironment(trail: DataTrail, urlParams: UrlQueryMap) {
+  const deploymentEnv = urlParams['var-deployment_environment'];
+  // does not need to be migrated
+  const otelMetricsVar = urlParams['var-otel_and_metric_filters'];
+
+  // this check is if it has already been migrated
+  if (
+    otelMetricsVar &&
+    Array.isArray(otelMetricsVar) &&
+    otelMetricsVar.length > 0 &&
+    (trail.state.startButtonClicked || otelMetricsVar[0] !== '')
+  ) {
+    return;
+  }
+  // if there is no dep env, does not need to be migrated
+  if (!deploymentEnv) {
+    return;
+  }
+
+  let filters: AdHocVariableFilter[] = [];
+  // if there is a deployment environment, we must also migrate the otel resources to the new variable
+  const otelResources = urlParams['var-otel_resources'];
+  const metricVarfilters = urlParams['var-filters'];
+  if (
+    Array.isArray(deploymentEnv) &&
+    deploymentEnv.length > 0 &&
+    deploymentEnv[0] !== '' &&
+    deploymentEnv.every((r) => r && typeof r === 'string')
+  ) {
+    // all the values are strings because they are prometheus labels
+    // so we can safely cast them to strings
+    const stringDepEnv = deploymentEnv.map((r) => r.toString());
+    const value = stringDepEnv.join('|');
+
+    filters.push({
+      key: 'deployment_environment',
+      operator: deploymentEnv.length > 1 ? '=~' : '=',
+      value,
+    });
+  }
+
+  // mutate the filters and add to them if we need to
+  migrateAdHocFilters(otelResources, filters);
+  migrateAdHocFilters(metricVarfilters, filters);
+
+  const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+  const deploymentEnvironmentVariable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, trail);
+
+  if (
+    !(
+      otelAndMetricsFiltersVariable instanceof AdHocFiltersVariable &&
+      deploymentEnvironmentVariable instanceof CustomVariable
+    )
+  ) {
+    return;
+  }
+
+  otelAndMetricsFiltersVariable.setState({
+    filters,
+  });
+  // clear the deployment environment to not migrate it again
+  reportExploreMetrics('deployment_environment_migrated', {});
+  deploymentEnvironmentVariable.setState({
+    value: '',
+  });
+}
+
+export function migrateAdHocFilters(urlFilter: UrlQueryValue, filters: AdHocVariableFilter[]) {
+  if (
+    !(
+      urlFilter && // is present
+      Array.isArray(urlFilter) && // is an array
+      urlFilter.length > 0 && // has values
+      urlFilter[0] !== '' && // empty vars can contain ''
+      urlFilter.every((r) => r && typeof r === 'string') // vars are of any type but ours are all strings
+    )
+  ) {
+    return filters;
+  }
+
+  urlFilter.forEach((filter) => {
+    const parts = filter.toString().split('|');
+    filters.push({
+      key: parts[0].toString(),
+      operator: parts[1].toString(),
+      value: parts[2].toString(),
+    });
+  });
+
+  return filters;
+}
diff --git a/public/app/features/trails/otel/api.test.ts b/public/app/features/trails/otel/api.test.ts
index b5469478c5a..97e5f4a01ae 100644
--- a/public/app/features/trails/otel/api.test.ts
+++ b/public/app/features/trails/otel/api.test.ts
@@ -1,13 +1,7 @@
 import { RawTimeRange } from '@grafana/data';
 import { BackendSrvRequest } from '@grafana/runtime';
 
-import {
-  getOtelResources,
-  totalOtelResources,
-  isOtelStandardization,
-  getDeploymentEnvironments,
-  getFilteredResourceAttributes,
-} from './api';
+import { totalOtelResources, getDeploymentEnvironments, getFilteredResourceAttributes } from './api';
 
 jest.mock('./util', () => ({
   ...jest.requireActual('./util'),
@@ -37,9 +31,7 @@ jest.mock('@grafana/runtime', () => ({
         options?: Partial<BackendSrvRequest>
       ) => {
         // explore-metrics-otel-resources
-        if (requestId === 'explore-metrics-otel-resources') {
-          return Promise.resolve({ data: ['job', 'instance', 'deployment_environment'] });
-        } else if (
+        if (
           requestId === 'explore-metrics-otel-check-total-count(target_info{}) by (job, instance)' ||
           requestId === 'explore-metrics-otel-check-total-count(metric) by (job, instance)'
         ) {
@@ -51,12 +43,6 @@ jest.mock('@grafana/runtime', () => ({
               ],
             },
           });
-        } else if (requestId === 'explore-metrics-otel-check-standard') {
-          return Promise.resolve({
-            data: {
-              result: [{ metric: { job: 'job1', instance: 'instance1' } }],
-            },
-          });
         } else if (requestId === 'explore-metrics-otel-resources-deployment-env') {
           return Promise.resolve({ data: ['env1', 'env2'] });
         } else if (
@@ -89,14 +75,6 @@ describe('OTEL API', () => {
     jest.clearAllMocks();
   });
 
-  describe('getOtelResources', () => {
-    it('should fetch and filter OTEL resources', async () => {
-      const resources = await getOtelResources(dataSourceUid, timeRange);
-
-      expect(resources).toEqual(['job', 'instance']);
-    });
-  });
-
   describe('totalOtelResources', () => {
     it('should fetch total OTEL resources', async () => {
       const result = await totalOtelResources(dataSourceUid, timeRange);
@@ -108,18 +86,6 @@ describe('OTEL API', () => {
     });
   });
 
-  describe('isOtelStandardization', () => {
-    // keeping for reference because standardization for OTel by series on target_info for job&instance is not consistent
-    // There is a bug currently where there is stale data in Prometheus resulting in duplicate series for job&instance at random times
-    // When this is resolved, we can check for standardization again
-    xit('should check if OTEL standardization is met when there are no duplicate series on target_info for job&instance', async () => {
-      // will return duplicates, see mock above
-      const isStandard = await isOtelStandardization(dataSourceUid, timeRange);
-
-      expect(isStandard).toBe(false);
-    });
-  });
-
   describe('getDeploymentEnvironments', () => {
     it('should fetch deployment environments', async () => {
       const environments = await getDeploymentEnvironments(dataSourceUid, timeRange, []);
diff --git a/public/app/features/trails/otel/api.ts b/public/app/features/trails/otel/api.ts
index b1c1b8a09f8..3399b0f7fe9 100644
--- a/public/app/features/trails/otel/api.ts
+++ b/public/app/features/trails/otel/api.ts
@@ -7,7 +7,7 @@ import { callSuggestionsApi } from '../utils';
 import { OtelResponse, LabelResponse, OtelTargetType } from './types';
 import { limitOtelMatchTerms, sortResources } from './util';
 
-const OTEL_RESOURCE_EXCLUDED_FILTERS = ['__name__', 'deployment_environment']; // name is handled by metric search metrics bar
+const OTEL_RESOURCE_EXCLUDED_FILTERS = ['__name__']; // name is handled by metric search metrics bar
 /**
  * Function used to test for OTEL
  * When filters are added, we can also get a list of otel targets used to reduce the metric list
@@ -18,41 +18,14 @@ const metricOtelJobInstanceQuery = (metric: string) => `count(${metric}) by (job
 export const TARGET_INFO_FILTER = { key: '__name__', value: 'target_info', operator: '=' };
 
 /**
- * Query the DS for target_info matching job and instance.
- * Parse the results to get label filters.
- * @param dataSourceUid
- * @param timeRange
- * @param excludedFilters
- * @param matchFilters
- * @returns OtelResourcesType[], labels for the query result requesting matching job and instance on target_info metric
- */
-export async function getOtelResources(
-  dataSourceUid: string,
-  timeRange: RawTimeRange,
-  excludedFilters?: string[],
-  matchFilters?: string
-): Promise<string[]> {
-  const allExcludedFilters = (excludedFilters ?? []).concat(OTEL_RESOURCE_EXCLUDED_FILTERS);
-
-  const start = getPrometheusTime(timeRange.from, false);
-  const end = getPrometheusTime(timeRange.to, true);
-
-  const url = `/api/datasources/uid/${dataSourceUid}/resources/api/v1/labels`;
-  const params: Record<string, string | number> = {
-    start,
-    end,
-    'match[]': `{__name__="target_info"${matchFilters ? `,${matchFilters}` : ''}}`,
-  };
-
-  const response = await getBackendSrv().get<LabelResponse>(url, params, 'explore-metrics-otel-resources');
-
-  // exclude __name__ or deployment_environment or previously chosen filters
-  return response.data?.filter((resource) => !allExcludedFilters.includes(resource)).map((el: string) => el);
-}
-
-/**
- * Get the total amount of job/instance pairs on a metric.
- * Can be used for target_info.
+ * Get the total amount of job/instance for target_info or for a metric.
+ *
+ * If used for target_info, this is the metric preview scene with many panels and
+ * the job/instance pairs will be used to filter the metric list.
+ *
+ * If used for a metric, this is the metric preview scene with a single panel and
+ * the job/instance pairs will be used to identify otel resource attributes for the metric
+ * and distinguish between resource attributes and promoted attributes.
  *
  * @param dataSourceUid
  * @param timeRange
@@ -105,37 +78,9 @@ export async function totalOtelResources(
   };
 }
 
-/**
- * Look for duplicated series in target_info metric by job and instance labels
- * If each job&instance combo is unique, the data source is otel standardized.
- * If there is a count by job&instance on target_info greater than one,
- * the data source is not standardized
- *
- * @param dataSourceUid
- * @param timeRange
- * @returns
- */
-export async function isOtelStandardization(dataSourceUid: string, timeRange: RawTimeRange): Promise<boolean> {
-  const url = `/api/datasources/uid/${dataSourceUid}/resources/api/v1/query`;
-
-  const start = getPrometheusTime(timeRange.from, false);
-  const end = getPrometheusTime(timeRange.to, true);
-
-  const paramsTargets: Record<string, string | number> = {
-    start,
-    end,
-    // any data source with duplicated series will have a count > 1
-    query: `${otelTargetInfoQuery()} > 1`,
-  };
-
-  const response = await getBackendSrv().get<OtelResponse>(url, paramsTargets, 'explore-metrics-otel-check-standard');
-
-  // the response should be not greater than zero if it is standard
-  return !(response.data.result.length > 0);
-}
-
 /**
  * Query the DS for deployment environment label values.
+ * The deployment environment can be either on target_info or promoted to metrics.
  *
  * @param dataSourceUid
  * @param timeRange
@@ -172,7 +117,8 @@ export async function getDeploymentEnvironmentsWithoutScopes(
   const params: Record<string, string | number> = {
     start,
     end,
-    'match[]': '{__name__="target_info"}',
+    // we are ok if deployment_environment has been promoted to metrics so we don't need the match
+    // 'match[]': '{__name__="target_info"}',
   };
 
   const response = await getBackendSrv().get<LabelResponse>(
@@ -181,7 +127,7 @@ export async function getDeploymentEnvironmentsWithoutScopes(
     'explore-metrics-otel-resources-deployment-env'
   );
 
-  // exclude __name__ or deployment_environment or previously chosen filters
+  // exclude __name__ or previously chosen filters
   return response.data;
 }
 
@@ -203,17 +149,19 @@ export async function getDeploymentEnvironmentsWithScopes(
     timeRange,
     scopes,
     [
-      {
-        key: '__name__',
-        operator: '=',
-        value: 'target_info',
-      },
+      // we are ok if deployment_environment has been promoted to metrics so we don't need the match
+      // 'match[]': '{__name__="target_info"}',
+      // {
+      //   key: '__name__',
+      //   operator: '=',
+      //   value: 'target_info',
+      // },
     ],
     'deployment_environment',
     undefined,
     'explore-metrics-otel-resources-deployment-env'
   );
-  // exclude __name__ or deployment_environment or previously chosen filters
+  // exclude __name__ or previously chosen filters
   return response.data.data;
 }
 
@@ -221,11 +169,16 @@ export async function getDeploymentEnvironmentsWithScopes(
  * For OTel, get the resource attributes for a metric.
  * Handle filtering on both OTel resources as well as metric labels.
  *
+ * 1. Does not include resources promoted to metrics
+ * 2. Does not include __name__ or previously chosen filters
+ * 3. Sorts the resources, surfacing the blessedlist on top
+ * 4. Identifies if missing targets if the job/instance list is too long for the label values endpoint request
+ *
  * @param datasourceUid
  * @param timeRange
  * @param metric
  * @param excludedFilters
- * @returns
+ * @returns attributes: string[], missingOtelTargets: boolean
  */
 export async function getFilteredResourceAttributes(
   datasourceUid: string,
@@ -295,7 +248,7 @@ export async function getFilteredResourceAttributes(
   // first filters out metric labels from the resource attributes
   const firstFilter = targetInfoAttributes.filter((resource) => !metricLabels.includes(resource));
 
-  // exclude __name__ or deployment_environment or previously chosen filters
+  // exclude __name__ or previously chosen filters
   const secondFilter = firstFilter
     .filter((resource) => !allExcludedFilters.includes(resource))
     .map((el) => ({ text: el }));
@@ -307,3 +260,58 @@ export async function getFilteredResourceAttributes(
 
   return { attributes: resourceAttributes, missingOtelTargets: metricMatchTerms.missingOtelTargets };
 }
+
+/**
+ * This function gets otel resources that only exist in target_info and
+ * do not exist on metrics as promoted labels.
+ *
+ * This is used when selecting a label from the list that includes both otel resources and metric labels.
+ * This list helps identify that a selected lbel/resource must be stored in VAR_OTEL_RESOURCES or VAR_FILTERS to be interpolated correctly in the queries.
+ */
+export async function getNonPromotedOtelResources(datasourceUid: string, timeRange: RawTimeRange) {
+  const start = getPrometheusTime(timeRange.from, false);
+  const end = getPrometheusTime(timeRange.to, true);
+  // The URL for the labels endpoint
+  const url = `/api/datasources/uid/${datasourceUid}/resources/api/v1/labels`;
+  // GET TARGET_INFO LABELS
+  const targetInfoParams: Record<string, string | number> = {
+    start,
+    end,
+    'match[]': `{__name__="target_info"}`,
+  };
+
+  // these are the resource attributes that come from target_info,
+  // filtered by the metric job and instance
+  const targetInfoResponse = getBackendSrv().get<LabelResponse>(
+    url,
+    targetInfoParams,
+    `explore-metrics-all-otel-resources-on-target_info`
+  );
+
+  // all labels in all metrics
+  const metricParams: Record<string, string | number> = {
+    start,
+    end,
+    'match[]': `{name!="",__name__!~"target_info"}`,
+  };
+
+  // Get the metric labels but exclude any labels found on target_info.
+  // We prioritize metric attributes over resource attributes.
+  // If a label is present in both metric and target_info, we exclude it from the resource attributes.
+  // This prevents errors in the join query.
+  const metricResponse = await getBackendSrv().get<LabelResponse>(
+    url,
+    metricParams,
+    `explore-metrics-all-metric-labels-not-otel-resource-attributes`
+  );
+  const promResponses = await Promise.all([targetInfoResponse, metricResponse]);
+  // otel resource attributes
+  const targetInfoLabels = promResponses[0].data ?? [];
+  // the metric labels here
+  const metricLabels = new Set(promResponses[1].data ?? []);
+
+  // get all the resource attributes that are not present on metrics (have been promoted to metrics)
+  const nonPromotedResources = targetInfoLabels.filter((item) => !metricLabels.has(item));
+
+  return nonPromotedResources;
+}
diff --git a/public/app/features/trails/otel/util.ts b/public/app/features/trails/otel/util.ts
index c8633e2df95..d5c2c0b9886 100644
--- a/public/app/features/trails/otel/util.ts
+++ b/public/app/features/trails/otel/util.ts
@@ -1,19 +1,21 @@
-import { MetricFindValue } from '@grafana/data';
+import { AdHocVariableFilter, MetricFindValue, RawTimeRange, VariableHide } from '@grafana/data';
 import { config } from '@grafana/runtime';
-import { AdHocFiltersVariable, ConstantVariable, CustomVariable, sceneGraph, SceneObject } from '@grafana/scenes';
+import { AdHocFiltersVariable, ConstantVariable, sceneGraph, SceneObject } from '@grafana/scenes';
 
 import { DataTrail } from '../DataTrail';
+import { reportChangeInLabelFilters } from '../interactions';
+import { getOtelExperienceToggleState } from '../services/store';
 import {
   VAR_DATASOURCE_EXPR,
   VAR_FILTERS,
   VAR_MISSING_OTEL_TARGETS,
-  VAR_OTEL_DEPLOYMENT_ENV,
+  VAR_OTEL_AND_METRIC_FILTERS,
   VAR_OTEL_GROUP_LEFT,
   VAR_OTEL_JOIN_QUERY,
   VAR_OTEL_RESOURCES,
 } from '../shared';
 
-import { getFilteredResourceAttributes } from './api';
+import { getFilteredResourceAttributes, totalOtelResources } from './api';
 import { OtelResourcesObject } from './types';
 
 export const blessedList = (): Record<string, number> => {
@@ -81,10 +83,9 @@ export function getOtelJoinQuery(otelResourcesObject: OtelResourcesObject, scene
   }
 
   let otelResourcesJoinQuery = '';
-  if (otelResourcesObject.filters && otelResourcesObject.labels) {
-    // add support for otel data sources that are not standardized, i.e., have non unique target_info series by job, instance
-    otelResourcesJoinQuery = `* on (job, instance) group_left(${groupLeft}) topk by (job, instance) (1, target_info{${otelResourcesObject.filters}})`;
-  }
+  // add support for otel data sources that are not standardized, i.e., have non unique target_info series by job, instance
+  // target_info does not have to be filtered by deployment environment
+  otelResourcesJoinQuery = `* on (job, instance) group_left(${groupLeft}) topk by (job, instance) (1, target_info{${otelResourcesObject.filters}})`;
 
   return otelResourcesJoinQuery;
 }
@@ -98,34 +99,14 @@ export function getOtelJoinQuery(otelResourcesObject: OtelResourcesObject, scene
  */
 export function getOtelResourcesObject(scene: SceneObject, firstQueryVal?: string): OtelResourcesObject {
   const otelResources = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, scene);
-  // add deployment env to otel resource filters
-  const otelDepEnv = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, scene);
-
   let otelResourcesObject = { labels: '', filters: '' };
 
-  if (otelResources instanceof AdHocFiltersVariable && otelDepEnv instanceof CustomVariable) {
+  if (otelResources instanceof AdHocFiltersVariable) {
     // get the collection of adhoc filters
     const otelFilters = otelResources.state.filters;
 
-    // get the value for deployment_environment variable
-    let otelDepEnvValue = String(otelDepEnv.getValue());
-    // check if there are multiple environments
-    const isMulti = otelDepEnvValue.includes(',');
-    // start with the default label filters for deployment_environment
-    let op = '=';
-    let val = firstQueryVal ? firstQueryVal : otelDepEnvValue;
-    // update the filters if multiple deployment environments selected
-    if (isMulti) {
-      op = '=~';
-      val = val.split(',').join('|');
-    }
-
-    // start with the deployment environment
-    let allFilters = `deployment_environment${op}"${val}"`;
-    if (config.featureToggles.prometheusSpecialCharsInLabelValues) {
-      allFilters = `deployment_environment${op}'${val}'`;
-    }
-    let allLabels = 'deployment_environment';
+    let allFilters = '';
+    let allLabels = '';
 
     // add the other OTEL resource filters
     for (let i = 0; i < otelFilters?.length; i++) {
@@ -133,16 +114,20 @@ export function getOtelResourcesObject(scene: SceneObject, firstQueryVal?: strin
       const op = otelFilters[i].operator;
       const labelValue = otelFilters[i].value;
 
+      if (i > 0) {
+        allFilters += ',';
+      }
+
       if (config.featureToggles.prometheusSpecialCharsInLabelValues) {
-        allFilters += `,${labelName}${op}'${labelValue}'`;
+        allFilters += `${labelName}${op}'${labelValue}'`;
       } else {
-        allFilters += `,${labelName}${op}"${labelValue}"`;
+        allFilters += `${labelName}${op}"${labelValue}"`;
       }
 
       const addLabelToGroupLeft = labelName !== 'job' && labelName !== 'instance';
 
       if (addLabelToGroupLeft) {
-        allLabels += `,${labelName}`;
+        allLabels += `${labelName}`;
       }
     }
 
@@ -262,7 +247,8 @@ export async function updateOtelJoinWithGroupLeft(trail: DataTrail, metric: stri
     return;
   }
   // Remove the group left
-  if (!metric) {
+  // if the metric is target_info, it already has all resource attributes
+  if (!metric || metric === 'target_info') {
     // if the metric is not present, that means we are in the metric select scene
     // and that should have no group left because it may interfere with queries.
     otelGroupLeft.setState({ value: '' });
@@ -271,10 +257,6 @@ export async function updateOtelJoinWithGroupLeft(trail: DataTrail, metric: stri
     otelJoinQueryVariable.setState({ value: otelJoinQuery });
     return;
   }
-  // if the metric is target_info, it already has all resource attributes
-  if (metric === 'target_info') {
-    return;
-  }
 
   // Add the group left
   const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, trail);
@@ -312,16 +294,334 @@ export async function updateOtelJoinWithGroupLeft(trail: DataTrail, metric: stri
 }
 
 /**
- * Returns the option value that is like 'prod'.
+ * Returns the environment that is like 'prod'.
  * If there are no options, returns null.
  *
  * @param options
  * @returns
  */
-export function getProdOrDefaultOption(options: Array<{ value: string; label: string }>): string | null {
-  if (options.length === 0) {
+export function getProdOrDefaultEnv(envs: string[]): string | null {
+  if (envs.length === 0) {
     return null;
   }
 
-  return options.find((option) => option.value.toLowerCase().indexOf('prod') > -1)?.value ?? options[0].value;
+  return envs.find((env) => env.toLowerCase().indexOf('prod') > -1) ?? envs[0];
+}
+
+/**
+ *  This function is used to update state and otel variables.
+ *
+ *  1. Set the otelResources adhoc tagKey and tagValues filter functions
+ *  2. Get the otel join query for state and variable
+ *  3. Update state with the following
+ *    - otel join query
+ *    - otelTargets used to filter metrics
+ *  For initialization we also update the following
+ *    - has otel resources flag
+ *    - isStandardOtel flag (for enabliing the otel experience toggle)
+ *    - and useOtelExperience
+ *
+ * This function is called on start and when variables change.
+ * On start will provide the deploymentEnvironments and hasOtelResources parameters.
+ * In the variable change case, we will not provide these parameters. It is assumed that the
+ * data source has been checked for otel resources and standardization and the otel variables are enabled at this point.
+ * @param datasourceUid
+ * @param timeRange
+ * @param deploymentEnvironments
+ * @param hasOtelResources
+ * @param nonPromotedOtelResources
+ * @param fromDataSourceChanged
+ */
+export async function updateOtelData(
+  trail: DataTrail,
+  datasourceUid: string,
+  timeRange: RawTimeRange,
+  deploymentEnvironments?: string[],
+  hasOtelResources?: boolean,
+  nonPromotedOtelResources?: string[]
+) {
+  // currently need isUpdatingOtel check for variable race conditions and state changes
+  // future refactor project
+  //  - checkDataSourceForOTelResources for state changes
+  //  - otel resources var for variable dependency listeners
+  if (trail.state.isUpdatingOtel) {
+    return;
+  }
+  trail.setState({ isUpdatingOtel: true });
+
+  const otelResourcesVariable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, trail);
+  const filtersVariable = sceneGraph.lookupVariable(VAR_FILTERS, trail);
+  const otelAndMetricsFiltersVariable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+  const otelJoinQueryVariable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, trail);
+  const initialOtelCheckComplete = trail.state.initialOtelCheckComplete;
+  const resettingOtel = trail.state.resettingOtel;
+
+  if (
+    !(
+      otelResourcesVariable instanceof AdHocFiltersVariable &&
+      filtersVariable instanceof AdHocFiltersVariable &&
+      otelAndMetricsFiltersVariable instanceof AdHocFiltersVariable &&
+      otelJoinQueryVariable instanceof ConstantVariable
+    )
+  ) {
+    return;
+  }
+  // Set deployment environment variable as a new otel & metric filter.
+  // We choose one default value at the beginning of the OTel experience.
+  // This is because the work flow for OTel begins with users selecting a deployment environment
+  // default to production.
+  let defaultDepEnv = getProdOrDefaultEnv(deploymentEnvironments ?? []) ?? '';
+
+  const isEnabledInLocalStorage = getOtelExperienceToggleState();
+
+  // We respect that if users have it turned off in local storage we keep it off unless the toggle is switched
+  if (!isEnabledInLocalStorage) {
+    trail.resetOtelExperience(hasOtelResources, nonPromotedOtelResources);
+  } else {
+    // 1. Cases of how to add filters to the otelmetricsvar
+    //  -- when we set these on instantiation, we need to check that we are not double setting them
+    // 1.0. legacy, check url values for dep env and otel resources and migrate to otelmetricvar
+    //  -- do not duplicate
+    // 1.1. NONE If the otel metrics var has no filters, set the default value
+    // 1.2. VAR_FILTERS If the var filters has filters, add to otemetricsvar
+    //  -- do not duplicate when adding to otelmtricsvar
+    // 1.3. OTEL_FILTERS If the otel resources var has filters, add to otelmetricsvar
+    //  -- do not duplicate when adding to otelmtricsvar
+
+    // 1. switching data source
+    // the previous var filters are not reset so even if they don't apply to the new data source we want to keep them
+    // 2. on load with url values, check isInitial CheckComplete
+    // Set otelmetrics var, distinguish if these are var filters or otel resources, then place in correct filter
+    let prevVarFilters = resettingOtel ? filtersVariable.state.filters : [];
+    // only look at url values for otelmetricsvar if the initial check is NOT YET complete
+    const urlOtelAndMetricsFilters =
+      initialOtelCheckComplete && !resettingOtel ? [] : otelAndMetricsFiltersVariable.state.filters;
+    // url vars should override the deployment environment variable
+    const urlVarsObject = checkLabelPromotion(urlOtelAndMetricsFilters, nonPromotedOtelResources);
+    const urlOtelResources = initialOtelCheckComplete ? [] : urlVarsObject.nonPromoted;
+    const urlVarFilters = initialOtelCheckComplete ? [] : urlVarsObject.promoted;
+
+    // set the vars if the following conditions
+    if (!initialOtelCheckComplete || resettingOtel) {
+      // if the default dep env value like 'prod' is missing OR
+      // if we are loading from the url and the default dep env is missing
+      // there are no prev deployment environments from url
+      const hasPreviousDepEnv = urlOtelAndMetricsFilters.filter((f) => f.key === 'deployment_environment').length > 0;
+      const doNotSetDepEvValue = defaultDepEnv === '' || hasPreviousDepEnv;
+      // we do not have to set the dep env value if the default is missing
+      const defaultDepEnvFilter = doNotSetDepEvValue
+        ? []
+        : [
+            {
+              key: 'deployment_environment',
+              value: defaultDepEnv,
+              operator: defaultDepEnv.includes(',') ? '=~' : '=',
+            },
+          ];
+
+      const notPromoted = nonPromotedOtelResources?.includes('deployment_environment');
+      // Next, the previous data source filters may include the default dep env but in the wrong filter
+      // i.e., dep env is not promoted to metrics but in the previous DS, it was, so it will exist in the VAR FILTERS
+      // and we will see a duplication in the OTELMETRICSVAR
+      // remove the duplication
+      prevVarFilters = notPromoted ? prevVarFilters.filter((f) => f.key !== 'deployment_environment') : prevVarFilters;
+
+      // previous var filters are handled but what about previous otel resources filters?
+      // need to add the prev otel resources to the otelmetricsvar filters
+      otelAndMetricsFiltersVariable?.setState({
+        filters: [...defaultDepEnvFilter, ...prevVarFilters, ...urlOtelAndMetricsFilters],
+        hide: VariableHide.hideLabel,
+      });
+
+      // update the otel resources if the dep env has not been promoted
+      const otelDepEnvFilters = notPromoted ? defaultDepEnvFilter : [];
+      const otelFilters = [...otelDepEnvFilters, ...urlOtelResources];
+      otelResourcesVariable.setState({
+        filters: otelFilters,
+        hide: VariableHide.hideVariable,
+      });
+
+      const isPromoted = !notPromoted;
+      // if the dep env IS PROMOTED
+      // we need to ask, does var filters already contain it?
+      // keep previous filters if they are there
+      // add the dep env to var filters if not present and isPromoted
+      const depEnvFromVarFilters = prevVarFilters.filter((f) => f.key === 'deployment_environment');
+
+      // if promoted and no dep env has been chosen yet, set the default
+      if (isPromoted && depEnvFromVarFilters.length === 0) {
+        prevVarFilters = [...prevVarFilters, ...defaultDepEnvFilter];
+      }
+
+      prevVarFilters = [...prevVarFilters, ...urlVarFilters];
+
+      filtersVariable.setState({
+        filters: prevVarFilters,
+        hide: VariableHide.hideVariable,
+      });
+    }
+  }
+  // 1. Get the otel join query for state and variable
+  // Because we need to define the deployment environment variable
+  // we also need to update the otel join query state and variable
+  const resourcesObject: OtelResourcesObject = getOtelResourcesObject(trail);
+  // THIS ASSUMES THAT WE ALWAYS HAVE DEPLOYMENT ENVIRONMENT!
+  // FIX THIS SO THAT WE HAVE SOME QUERY EVEN IF THERE ARE NO OTEL FILTERS
+  const otelJoinQuery = getOtelJoinQuery(resourcesObject);
+
+  // update the otel join query variable too
+  otelJoinQueryVariable.setState({ value: otelJoinQuery });
+
+  // 2. Update state with the following
+  // - otel join query
+  // - otelTargets used to filter metrics
+  // now we can filter target_info targets by deployment_environment="somevalue"
+  // and use these new targets to reduce the metrics
+  // for initialization we also update the following
+  // - has otel resources flag
+  // - and default to useOtelExperience
+  const otelTargets = await totalOtelResources(datasourceUid, timeRange, resourcesObject.filters);
+
+  // we pass in deploymentEnvironments and hasOtelResources on start
+  // RETHINK We may be able to get rid of this check
+  // a non standard data source is more missing job and instance matchers
+  if (hasOtelResources && deploymentEnvironments && !initialOtelCheckComplete) {
+    trail.setState({
+      otelTargets,
+      otelJoinQuery,
+      hasOtelResources,
+      // Previously checking standardization for having deployment environments
+      // Now we check that there are target_info labels that are not promoted
+      isStandardOtel: (nonPromotedOtelResources ?? []).length > 0,
+      useOtelExperience: isEnabledInLocalStorage,
+      nonPromotedOtelResources,
+      initialOtelCheckComplete: true,
+      resettingOtel: false,
+      afterFirstOtelCheck: true,
+      isUpdatingOtel: false,
+    });
+  } else {
+    // we are updating on variable changes
+    trail.setState({
+      otelTargets,
+      otelJoinQuery,
+      resettingOtel: false,
+      afterFirstOtelCheck: true,
+      isUpdatingOtel: false,
+    });
+  }
+}
+
+function checkLabelPromotion(filters: AdHocVariableFilter[], nonPromotedOtelResources: string[] = []) {
+  const nonPromotedResources = new Set(nonPromotedOtelResources);
+  const nonPromoted = filters.filter((f) => nonPromotedResources.has(f.key));
+  const promoted = filters.filter((f) => !nonPromotedResources.has(f.key));
+
+  return {
+    nonPromoted,
+    promoted,
+  };
+}
+
+/**
+ * When a new filter is chosen from the consolidated filters, VAR_OTEL_AND_METRIC_FILTERS,
+ * we need to identify the following:
+ *
+ * 1. Is the filter a non-promoted otel resource or a metric filter?
+ * 2. Is the filter being added or removed?
+ *
+ * Once we know this, we can add the selected filter to either the
+ * VAR_OTEL_RESOURCES or VAR_FILTERS variable.
+ *
+ * When the correct variable is updated, the rest of the explore metrics behavior will remain the same.
+ *
+ * @param newStateFilters
+ * @param prevStateFilters
+ * @param nonPromotedOtelResources
+ * @param otelFiltersVariable
+ * @param filtersVariable
+ */
+export function manageOtelAndMetricFilters(
+  newStateFilters: AdHocVariableFilter[],
+  prevStateFilters: AdHocVariableFilter[],
+  nonPromotedOtelResources: string[],
+  otelFiltersVariable: AdHocFiltersVariable,
+  filtersVariable: AdHocFiltersVariable
+) {
+  // add filter
+  if (newStateFilters.length > prevStateFilters.length) {
+    const newFilter = newStateFilters[newStateFilters.length - 1];
+    // check that the filter is a non-promoted otel resource
+    if (nonPromotedOtelResources?.includes(newFilter.key)) {
+      // add to otel filters
+      otelFiltersVariable.setState({
+        filters: [...otelFiltersVariable.state.filters, newFilter],
+      });
+      reportChangeInLabelFilters(newStateFilters, prevStateFilters, true);
+    } else {
+      // add to metric filters
+      filtersVariable.setState({
+        filters: [...filtersVariable.state.filters, newFilter],
+      });
+    }
+    return;
+  }
+  // remove filter
+  if (newStateFilters.length < prevStateFilters.length) {
+    // get the removed filter
+    const removedFilter = prevStateFilters.filter((f) => !newStateFilters.includes(f))[0];
+    if (nonPromotedOtelResources?.includes(removedFilter.key)) {
+      // remove from otel filters
+      otelFiltersVariable.setState({
+        filters: otelFiltersVariable.state.filters.filter((f) => f.key !== removedFilter.key),
+      });
+      reportChangeInLabelFilters(newStateFilters, prevStateFilters, true);
+    } else {
+      // remove from metric filters
+      filtersVariable.setState({
+        filters: filtersVariable.state.filters.filter((f) => f.key !== removedFilter.key),
+      });
+    }
+    return;
+  }
+  // a filter has been changed
+  let updatedFilter: AdHocVariableFilter[] = [];
+  if (
+    newStateFilters.length === prevStateFilters.length &&
+    newStateFilters.some((filter, i) => {
+      const newKey = filter.key;
+      const newValue = filter.value;
+      const isUpdatedFilter = prevStateFilters[i].key === newKey && prevStateFilters[i].value !== newValue;
+      if (isUpdatedFilter) {
+        updatedFilter.push(filter);
+      }
+      return isUpdatedFilter;
+    })
+  ) {
+    // check if the filter is a non-promoted otel resource
+    if (nonPromotedOtelResources?.includes(updatedFilter[0].key)) {
+      // add to otel filters
+      otelFiltersVariable.setState({
+        // replace the updated filter
+        filters: otelFiltersVariable.state.filters.map((f) => {
+          if (f.key === updatedFilter[0].key) {
+            return updatedFilter[0];
+          }
+          return f;
+        }),
+      });
+      reportChangeInLabelFilters(newStateFilters, prevStateFilters, true);
+    } else {
+      // add to metric filters
+      filtersVariable.setState({
+        // replace the updated filter
+        filters: filtersVariable.state.filters.map((f) => {
+          if (f.key === updatedFilter[0].key) {
+            return updatedFilter[0];
+          }
+          return f;
+        }),
+      });
+    }
+  }
 }
diff --git a/public/app/features/trails/otel/utils.test.ts b/public/app/features/trails/otel/utils.test.ts
index 11d8657aa6b..572643831d7 100644
--- a/public/app/features/trails/otel/utils.test.ts
+++ b/public/app/features/trails/otel/utils.test.ts
@@ -1,12 +1,18 @@
-import { MetricFindValue } from '@grafana/data';
+import { AdHocVariableFilter, MetricFindValue } from '@grafana/data';
 import { locationService, setDataSourceSrv } from '@grafana/runtime';
-import { AdHocFiltersVariable, ConstantVariable, CustomVariable, sceneGraph } from '@grafana/scenes';
+import { AdHocFiltersVariable, ConstantVariable, sceneGraph } from '@grafana/scenes';
 import { mockDataSource, MockDataSourceSrv } from 'app/features/alerting/unified/mocks';
 import { DataSourceType } from 'app/features/alerting/unified/utils/datasource';
 import { activateFullSceneTree } from 'app/features/dashboard-scene/utils/test-utils';
 
 import { DataTrail } from '../DataTrail';
-import { VAR_OTEL_DEPLOYMENT_ENV, VAR_OTEL_GROUP_LEFT, VAR_OTEL_JOIN_QUERY, VAR_OTEL_RESOURCES } from '../shared';
+import {
+  VAR_FILTERS,
+  VAR_OTEL_AND_METRIC_FILTERS,
+  VAR_OTEL_GROUP_LEFT,
+  VAR_OTEL_JOIN_QUERY,
+  VAR_OTEL_RESOURCES,
+} from '../shared';
 
 import {
   sortResources,
@@ -14,7 +20,9 @@ import {
   blessedList,
   limitOtelMatchTerms,
   updateOtelJoinWithGroupLeft,
-  getProdOrDefaultOption,
+  getProdOrDefaultEnv,
+  updateOtelData,
+  manageOtelAndMetricFilters,
 } from './util';
 
 jest.mock('./api', () => ({
@@ -54,7 +62,7 @@ describe('getOtelJoinQuery', () => {
     );
   });
 
-  it('should return an empty string if filters or labels are missing', () => {
+  it('should return a join query if filters or labels are missing', () => {
     const otelResourcesObject = {
       filters: '',
       labels: '',
@@ -62,7 +70,7 @@ describe('getOtelJoinQuery', () => {
 
     const result = getOtelJoinQuery(otelResourcesObject);
 
-    expect(result).toBe('');
+    expect(result).toBe('* on (job, instance) group_left() topk by (job, instance) (1, target_info{})');
   });
 });
 
@@ -116,32 +124,6 @@ describe('sortResources', () => {
   });
 });
 
-describe('getOtelJoinQuery', () => {
-  it('should return the correct join query', () => {
-    const otelResourcesObject = {
-      filters: 'job="test-job",instance="test-instance"',
-      labels: 'deployment_environment,custom_label',
-    };
-
-    const result = getOtelJoinQuery(otelResourcesObject);
-
-    expect(result).toBe(
-      '* on (job, instance) group_left() topk by (job, instance) (1, target_info{job="test-job",instance="test-instance"})'
-    );
-  });
-
-  it('should return an empty string if filters or labels are missing', () => {
-    const otelResourcesObject = {
-      filters: '',
-      labels: '',
-    };
-
-    const result = getOtelJoinQuery(otelResourcesObject);
-
-    expect(result).toBe('');
-  });
-});
-
 describe('limitOtelMatchTerms', () => {
   it('should limit the OTel match terms if the total match term character count exceeds 2000', () => {
     // the initial match is 1980 characters
@@ -213,14 +195,6 @@ describe('updateOtelJoinWithGroupLeft', () => {
   const preTrailUrl =
     '/trail?from=now-1h&to=now&var-ds=edwxqcebl0cg0c&var-deployment_environment=oteldemo01&var-otel_resources=k8s_cluster_name%7C%3D%7Cappo11ydev01&var-filters=&refresh=&metricPrefix=all&metricSearch=http&actionView=breakdown&var-groupby=$__all&metric=http_client_duration_milliseconds_bucket';
 
-  function getOtelDepEnvVar(trail: DataTrail) {
-    const variable = sceneGraph.lookupVariable(VAR_OTEL_DEPLOYMENT_ENV, trail);
-    if (variable instanceof CustomVariable) {
-      return variable;
-    }
-    throw new Error('getDepEnvVar failed');
-  }
-
   function getOtelJoinQueryVar(trail: DataTrail) {
     const variable = sceneGraph.lookupVariable(VAR_OTEL_JOIN_QUERY, trail);
     if (variable instanceof ConstantVariable) {
@@ -229,6 +203,106 @@ describe('updateOtelJoinWithGroupLeft', () => {
     throw new Error('getDepEnvVar failed');
   }
 
+  beforeEach(() => {
+    jest.spyOn(DataTrail.prototype, 'checkDataSourceForOTelResources').mockImplementation(() => Promise.resolve());
+    setDataSourceSrv(
+      new MockDataSourceSrv({
+        prom: mockDataSource({
+          name: 'Prometheus',
+          type: DataSourceType.Prometheus,
+        }),
+      })
+    );
+    trail = new DataTrail({
+      useOtelExperience: true,
+      nonPromotedOtelResources: ['service_name'],
+    });
+    locationService.push(preTrailUrl);
+    activateFullSceneTree(trail);
+  });
+
+  it('should update OTel join query with the group left resource attributes', async () => {
+    await updateOtelJoinWithGroupLeft(trail, 'metric');
+    const otelJoinQueryVar = getOtelJoinQueryVar(trail);
+    // this will include the group left resource attributes
+    expect(otelJoinQueryVar.getValue()).toBe(
+      '* on (job, instance) group_left(resourceAttribute) topk by (job, instance) (1, target_info{})'
+    );
+  });
+
+  it('should not update OTel join query with the group left resource attributes when the metric is target_info', async () => {
+    await updateOtelJoinWithGroupLeft(trail, 'target_info');
+    const otelJoinQueryVar = getOtelJoinQueryVar(trail);
+    const emptyGroupLeftClause = 'group_left()';
+    const otelJoinQuery = otelJoinQueryVar.state.value;
+    if (typeof otelJoinQuery === 'string') {
+      expect(otelJoinQuery.includes(emptyGroupLeftClause)).toBe(true);
+    }
+  });
+});
+
+describe('getProdOrDefaultEnv', () => {
+  it('should return the value of the option containing "prod"', () => {
+    const options = ['test1', 'prod2', 'test3'];
+
+    expect(getProdOrDefaultEnv(options)).toBe('prod2');
+  });
+
+  it('should return the first option value if no option contains "prod"', () => {
+    const options = ['test1', 'test2', 'test3'];
+
+    expect(getProdOrDefaultEnv(options)).toBe('test1');
+  });
+
+  it('should handle case insensitivity', () => {
+    const options = ['test1', 'PROD2', 'test3'];
+
+    expect(getProdOrDefaultEnv(options)).toBe('PROD2');
+  });
+
+  it('should return null if the options array is empty', () => {
+    const options: string[] = [];
+    expect(getProdOrDefaultEnv(options)).toBeNull();
+  });
+
+  it('should return the first option value if the options array has one element', () => {
+    const options = ['test1'];
+    expect(getProdOrDefaultEnv(options)).toBe('test1');
+  });
+});
+
+describe('util functions that rely on trail and variable setup', () => {
+  beforeAll(() => {
+    jest.spyOn(DataTrail.prototype, 'checkDataSourceForOTelResources').mockImplementation(() => Promise.resolve());
+    setDataSourceSrv(
+      new MockDataSourceSrv({
+        prom: mockDataSource({
+          name: 'Prometheus',
+          type: DataSourceType.Prometheus,
+        }),
+      })
+    );
+  });
+
+  afterAll(() => {
+    jest.restoreAllMocks();
+  });
+
+  let trail: DataTrail;
+  const defaultTimeRange = { from: 'now-1h', to: 'now' };
+  // selecting a non promoted resource from VAR_OTEL_AND_METRICS will automatically update the otel resources var
+  const nonPromotedOtelResources = ['deployment_environment'];
+  const preTrailUrl =
+    '/trail?from=now-1h&to=now&var-ds=edwxqcebl0cg0c&var-deployment_environment=oteldemo01&var-otel_resources=k8s_cluster_name%7C%3D%7Cappo11ydev01&var-filters=&refresh=&metricPrefix=all&metricSearch=http&actionView=breakdown&var-groupby=$__all&metric=http_client_duration_milliseconds_bucket';
+
+  function getOtelAndMetricsVar(trail: DataTrail) {
+    const variable = sceneGraph.lookupVariable(VAR_OTEL_AND_METRIC_FILTERS, trail);
+    if (variable instanceof AdHocFiltersVariable) {
+      return variable;
+    }
+    throw new Error('getOtelAndMetricsVar failed');
+  }
+
   function getOtelResourcesVar(trail: DataTrail) {
     const variable = sceneGraph.lookupVariable(VAR_OTEL_RESOURCES, trail);
     if (variable instanceof AdHocFiltersVariable) {
@@ -242,79 +316,324 @@ describe('updateOtelJoinWithGroupLeft', () => {
     if (variable instanceof ConstantVariable) {
       return variable;
     }
-    throw new Error('getOtelResourcesVar failed');
+    throw new Error('getOtelGroupLeftVar failed');
+  }
+
+  function getFilterVar() {
+    const variable = sceneGraph.lookupVariable(VAR_FILTERS, trail);
+    if (variable instanceof AdHocFiltersVariable) {
+      return variable;
+    }
+    throw new Error('getFilterVar failed');
   }
 
   beforeEach(() => {
-    jest.spyOn(DataTrail.prototype, 'checkDataSourceForOTelResources').mockImplementation(() => Promise.resolve());
-    setDataSourceSrv(
-      new MockDataSourceSrv({
-        prom: mockDataSource({
-          name: 'Prometheus',
-          type: DataSourceType.Prometheus,
-        }),
-      })
-    );
-    trail = new DataTrail({});
+    trail = new DataTrail({
+      useOtelExperience: true,
+      nonPromotedOtelResources,
+    });
     locationService.push(preTrailUrl);
     activateFullSceneTree(trail);
-    getOtelResourcesVar(trail).setState({ filters: [{ key: 'service_name', operator: '=', value: 'adservice' }] });
-    getOtelDepEnvVar(trail).changeValueTo('production');
     getOtelGroupLeftVar(trail).setState({ value: 'attribute1,attribute2' });
   });
 
-  it('should update OTel join query with the group left resource attributes', async () => {
-    await updateOtelJoinWithGroupLeft(trail, 'metric');
-    const otelJoinQueryVar = getOtelJoinQueryVar(trail);
-    // this will include the group left resource attributes
-    expect(otelJoinQueryVar.getValue()).toBe(
-      '* on (job, instance) group_left(resourceAttribute) topk by (job, instance) (1, target_info{deployment_environment="production",service_name="adservice"})'
-    );
+  afterEach(() => {
+    trail.setState({ initialOtelCheckComplete: false });
+  });
+  describe('updateOtelData', () => {
+    it('should automatically add the deployment environment on loading a data trail from start', () => {
+      trail.setState({ startButtonClicked: true });
+      const autoSelectedDepEnvValue = 'production';
+      const deploymentEnvironments = [autoSelectedDepEnvValue];
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+      const otelMetricsKey = otelMetricsVar.state.filters[0].key;
+      const otelMetricsValue = otelMetricsVar.state.filters[0].value;
+
+      const otelResourcesVar = getOtelResourcesVar(trail);
+      const otelResourcesKey = otelResourcesVar.state.filters[0].key;
+      const otelResourcesValue = otelResourcesVar.state.filters[0].value;
+
+      expect(otelMetricsKey).toBe('deployment_environment');
+      expect(otelMetricsValue).toBe(autoSelectedDepEnvValue);
+
+      expect(otelResourcesKey).toBe('deployment_environment');
+      expect(otelResourcesValue).toBe(autoSelectedDepEnvValue);
+    });
+
+    it('should use the deployment environment from url when loading a trail and not automatically load it', () => {
+      const autoSelectedDeploymentEnvironmentValue = 'production';
+      const deploymentEnvironments = [autoSelectedDeploymentEnvironmentValue];
+      // the url loads the deployment environment into otelmetricsvar
+      const prevUrlDepEnvValue = 'from_url';
+      getOtelAndMetricsVar(trail).setState({
+        filters: [{ key: 'deployment_environment', operator: '=', value: prevUrlDepEnvValue }],
+      });
+
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+      const otelMetricsKey = otelMetricsVar.state.filters[0].key;
+      const otelMetricsValue = otelMetricsVar.state.filters[0].value;
+
+      const otelResourcesVar = getOtelResourcesVar(trail);
+      const otelResourcesKey = otelResourcesVar.state.filters[0].key;
+      const otelResourcesValue = otelResourcesVar.state.filters[0].value;
+
+      expect(otelMetricsKey).toBe('deployment_environment');
+      expect(otelMetricsValue).toBe(prevUrlDepEnvValue);
+
+      expect(otelResourcesKey).toBe('deployment_environment');
+      expect(otelResourcesValue).toBe(prevUrlDepEnvValue);
+    });
+
+    it('should load all filters based on the url for VAR_OTEL_AND_METRICS_FILTERS on initial load', () => {
+      const nonPromotedOtelResources = ['deployment_environment', 'resource'];
+      const depEnvFilter = { key: 'deployment_environment', operator: '=', value: 'from_url' };
+      const otelResourceFilter = { key: 'resource', operator: '=', value: 'resource' };
+      const promotedFilter = { key: 'promoted', operator: '=', value: 'promoted' };
+      const metricFilter = { key: 'metric', operator: '=', value: 'metric' };
+
+      getOtelAndMetricsVar(trail).setState({
+        filters: [depEnvFilter, otelResourceFilter, promotedFilter, metricFilter],
+      });
+
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        ['production'],
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+      const otelResourcesVar = getOtelResourcesVar(trail);
+      const varFilters = getFilterVar();
+
+      // otelmetrics var will contain all three
+      expect(otelMetricsVar.state.filters).toEqual([depEnvFilter, otelResourceFilter, promotedFilter, metricFilter]);
+      // otel resources will contain only non promoted
+      expect(otelResourcesVar.state.filters).toEqual([depEnvFilter, otelResourceFilter]);
+      // var filters will contain promoted and metric labels
+      expect(varFilters.state.filters).toEqual([promotedFilter, metricFilter]);
+    });
+
+    it('should not automatically add the deployment environment on loading a data trail when there are no deployment environments in the data source', () => {
+      // no dep env values found in the data source
+      const deploymentEnvironments: string[] = [];
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+
+      const otelResourcesVar = getOtelResourcesVar(trail);
+
+      expect(otelMetricsVar.state.filters.length).toBe(0);
+      expect(otelResourcesVar.state.filters.length).toBe(0);
+    });
+
+    it('should not automatically add the deployment environment on loading a data trail when loading from url and no dep env are present in the filters', () => {
+      // not from start
+      // no dep env values found in the data source
+      const deploymentEnvironments: string[] = [];
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+      const otelMetricsVar = getOtelAndMetricsVar(trail);
+
+      const otelResourcesVar = getOtelResourcesVar(trail);
+
+      expect(otelMetricsVar.state.filters.length).toBe(0);
+      expect(otelResourcesVar.state.filters.length).toBe(0);
+    });
+
+    it('should add the deployment environment to var filters if it has been promoted from start', () => {
+      trail.setState({ startButtonClicked: true });
+      // the deployment environment has been promoted to a metric label
+      const deploymentEnvironments = ['production'];
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        [] //nonPromotedOtelResources
+      );
+      const varFilters = getFilterVar().state.filters[0];
+      expect(varFilters.key).toBe('deployment_environment');
+      expect(varFilters.value).toBe('production');
+    });
+
+    it('should preserve var filters when switching a data source but not initial load', () => {
+      trail.setState({ initialOtelCheckComplete: true });
+      const deploymentEnvironments = ['production'];
+      getFilterVar().setState({ filters: [{ key: 'zone', operator: '=', value: 'a' }] });
+      updateOtelData(
+        trail,
+        'datasourceUid',
+        defaultTimeRange,
+        deploymentEnvironments,
+        true, // hasOtelResources
+        nonPromotedOtelResources
+      );
+      const varFilters = getFilterVar().state.filters[0];
+      expect(varFilters.key).toBe('zone');
+      expect(varFilters.value).toBe('a');
+    });
   });
 
-  it('should not update OTel join query with the group left resource attributes when the metric is target_info', async () => {
-    await updateOtelJoinWithGroupLeft(trail, 'target_info');
-    const otelJoinQueryVar = getOtelJoinQueryVar(trail);
+  describe('manageOtelAndMetricFilters', () => {
+    it('should add a new filter to otel filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [{ key: 'otel_key', value: 'value', operator: '=' }];
+      const prevStateFilters: AdHocVariableFilter[] = [];
 
-    expect(otelJoinQueryVar.getValue()).toBe('');
-  });
-});
-
-describe('getProdOrDefaultOption', () => {
-  it('should return the value of the option containing "prod"', () => {
-    const options = [
-      { value: 'test1', label: 'Test 1' },
-      { value: 'prod2', label: 'Prod 2' },
-      { value: 'test3', label: 'Test 3' },
-    ];
-    expect(getProdOrDefaultOption(options)).toBe('prod2');
-  });
-
-  it('should return the first option value if no option contains "prod"', () => {
-    const options = [
-      { value: 'test1', label: 'Test 1' },
-      { value: 'test2', label: 'Test 2' },
-      { value: 'test3', label: 'Test 3' },
-    ];
-    expect(getProdOrDefaultOption(options)).toBe('test1');
-  });
-
-  it('should handle case insensitivity', () => {
-    const options = [
-      { value: 'test1', label: 'Test 1' },
-      { value: 'PROD2', label: 'Prod 2' },
-      { value: 'test3', label: 'Test 3' },
-    ];
-    expect(getProdOrDefaultOption(options)).toBe('PROD2');
-  });
-
-  it('should return null if the options array is empty', () => {
-    const options: Array<{ value: string; label: string }> = [];
-    expect(getProdOrDefaultOption(options)).toBeNull();
-  });
-
-  it('should return the first option value if the options array has one element', () => {
-    const options = [{ value: 'test1', label: 'Test 1' }];
-    expect(getProdOrDefaultOption(options)).toBe('test1');
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+
+      const filtersVariable = getFilterVar();
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(otelFiltersVariable.state.filters).toEqual(newStateFilters);
+    });
+
+    it('should add a new filter to metric filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [{ key: 'metric_key', value: 'value', operator: '=' }];
+      const prevStateFilters: AdHocVariableFilter[] = [];
+
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+
+      const filtersVariable = getFilterVar();
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(filtersVariable.state.filters).toEqual(newStateFilters);
+    });
+
+    it('should remove a filter from otel filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [];
+      const prevStateFilters: AdHocVariableFilter[] = [{ key: 'otel_key', value: 'value', operator: '=' }];
+
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+
+      const filtersVariable = getFilterVar();
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(otelFiltersVariable.state.filters).toEqual(newStateFilters);
+    });
+
+    it('should remove a filter from metric filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [];
+      const prevStateFilters: AdHocVariableFilter[] = [{ key: 'metric_key', value: 'value', operator: '=' }];
+
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+
+      const filtersVariable = getFilterVar();
+      filtersVariable.setState({ filters: [{ key: 'metric_key', value: 'value', operator: '=' }] });
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(filtersVariable.state.filters).toEqual(newStateFilters);
+    });
+
+    it('should update a filter in otel filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [{ key: 'otel_key', value: 'new_value', operator: '=' }];
+      const prevStateFilters: AdHocVariableFilter[] = [{ key: 'otel_key', value: 'old_value', operator: '=' }];
+
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+      otelFiltersVariable.setState({ filters: [{ key: 'otel_key', value: 'old_value', operator: '=' }] });
+
+      const filtersVariable = getFilterVar();
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(otelFiltersVariable.state.filters).toEqual(newStateFilters);
+    });
+
+    it('should update a filter in metric filters when VAR_OTEL_AND_METRIC_FILTERS is updated', () => {
+      const newStateFilters: AdHocVariableFilter[] = [{ key: 'metric_key', value: 'new_value', operator: '=' }];
+      const prevStateFilters: AdHocVariableFilter[] = [{ key: 'metric_key', value: 'old_value', operator: '=' }];
+
+      const nonPromotedOtelResources = ['otel_key'];
+
+      const otelFiltersVariable = getOtelResourcesVar(trail);
+
+      const filtersVariable = getFilterVar();
+      filtersVariable.setState({ filters: [{ key: 'metric_key', value: 'old_value', operator: '=' }] });
+
+      manageOtelAndMetricFilters(
+        newStateFilters,
+        prevStateFilters,
+        nonPromotedOtelResources,
+        otelFiltersVariable,
+        filtersVariable
+      );
+
+      expect(filtersVariable.state.filters).toEqual(newStateFilters);
+    });
   });
 });
diff --git a/public/app/features/trails/shared.ts b/public/app/features/trails/shared.ts
index aab8bc4c736..41820ce0239 100644
--- a/public/app/features/trails/shared.ts
+++ b/public/app/features/trails/shared.ts
@@ -36,6 +36,9 @@ export const VAR_OTEL_GROUP_LEFT = 'otel_group_left';
 export const VAR_OTEL_GROUP_LEFT_EXPR = '${otel_group_left}';
 export const VAR_MISSING_OTEL_TARGETS = 'missing_otel_targets';
 export const VAR_MISSING_OTEL_TARGETS_EXPR = '${missing_otel_targets}';
+// for consolidating otel and metric filters into one adhoc filter set
+export const VAR_OTEL_AND_METRIC_FILTERS = 'otel_and_metric_filters';
+export const VAR_OTEL_AND_METRIC_FILTERS_EXPR = '${otel_and_metric_filters}';
 
 export const LOGS_METRIC = '$__logs__';
 export const KEY_SQR_METRIC_VIZ_QUERY = 'sqr-metric-viz-query';
diff --git a/public/app/features/trails/utils.test.ts b/public/app/features/trails/utils.test.ts
index f4cab00bc54..04b15995982 100644
--- a/public/app/features/trails/utils.test.ts
+++ b/public/app/features/trails/utils.test.ts
@@ -5,6 +5,8 @@ import { getDatasourceSrv } from '../plugins/datasource_srv';
 import { DataTrail } from './DataTrail';
 import { getTrailStore } from './TrailStore/TrailStore';
 import { MetricDatasourceHelper } from './helpers/MetricDatasourceHelper';
+import { sortResources } from './otel/util';
+import { VAR_OTEL_AND_METRIC_FILTERS } from './shared';
 import { getDatasourceForNewTrail, limitAdhocProviders } from './utils';
 
 jest.mock('./TrailStore/TrailStore', () => ({
@@ -15,8 +17,13 @@ jest.mock('../plugins/datasource_srv', () => ({
   getDatasourceSrv: jest.fn(),
 }));
 
+jest.mock('./otel/util', () => ({
+  sortResources: jest.fn(),
+}));
+
 describe('limitAdhocProviders', () => {
   let filtersVariable: AdHocFiltersVariable;
+  let otelAndMetricsVariable: AdHocFiltersVariable;
   let datasourceHelper: MetricDatasourceHelper;
   let dataTrail: DataTrail;
 
@@ -31,6 +38,12 @@ describe('limitAdhocProviders', () => {
       type: 'adhoc',
     });
 
+    otelAndMetricsVariable = new AdHocFiltersVariable({
+      name: VAR_OTEL_AND_METRIC_FILTERS,
+      label: 'Test Variable',
+      type: 'adhoc',
+    });
+
     datasourceHelper = {
       getTagKeys: jest.fn().mockResolvedValue(Array(20000).fill({ text: 'key' })),
       getTagValues: jest.fn().mockResolvedValue(Array(20000).fill({ text: 'value' })),
@@ -70,6 +83,14 @@ describe('limitAdhocProviders', () => {
       expect(result.replace).toBe(true);
     }
   });
+
+  it('should call sort resources and sort the promoted otel resources list if using the otel and metrics filter', async () => {
+    limitAdhocProviders(dataTrail, otelAndMetricsVariable, datasourceHelper);
+    if (otelAndMetricsVariable instanceof AdHocFiltersVariable && otelAndMetricsVariable.state.getTagKeysProvider) {
+      await otelAndMetricsVariable.state.getTagKeysProvider(otelAndMetricsVariable, null);
+    }
+    expect(sortResources).toHaveBeenCalled();
+  });
 });
 
 describe('getDatasourceForNewTrail', () => {
diff --git a/public/app/features/trails/utils.ts b/public/app/features/trails/utils.ts
index c96e5099f41..abacfb7a5a6 100644
--- a/public/app/features/trails/utils.ts
+++ b/public/app/features/trails/utils.ts
@@ -32,7 +32,8 @@ import { DataTrailSettings } from './DataTrailSettings';
 import { MetricScene } from './MetricScene';
 import { getTrailStore } from './TrailStore/TrailStore';
 import { MetricDatasourceHelper } from './helpers/MetricDatasourceHelper';
-import { LOGS_METRIC, TRAILS_ROUTE, VAR_DATASOURCE_EXPR } from './shared';
+import { sortResources } from './otel/util';
+import { LOGS_METRIC, TRAILS_ROUTE, VAR_DATASOURCE_EXPR, VAR_OTEL_AND_METRIC_FILTERS } from './shared';
 
 export function getTrailFor(model: SceneObject): DataTrail {
   return sceneGraph.getAncestor(model, DataTrail);
@@ -42,11 +43,12 @@ export function getTrailSettings(model: SceneObject): DataTrailSettings {
   return sceneGraph.getAncestor(model, DataTrail).state.settings;
 }
 
-export function newMetricsTrail(initialDS?: string): DataTrail {
+export function newMetricsTrail(initialDS?: string, startButtonClicked?: boolean): DataTrail {
   return new DataTrail({
     initialDS,
     $timeRange: new SceneTimeRange({ from: 'now-1h', to: 'now' }),
     embedded: false,
+    startButtonClicked,
   });
 }
 
@@ -145,19 +147,19 @@ const MAX_ADHOC_VARIABLE_OPTIONS = 10000;
  * This function still uses these functions from inside the data source helper.
  *
  * @param dataTrail
- * @param filtersVariable
+ * @param limitedFilterVariable Depending on otel experience flag, either filtersVar or otelAndMetricsVar
  * @param datasourceHelper
  */
 export function limitAdhocProviders(
   dataTrail: DataTrail,
-  filtersVariable: SceneVariable<SceneVariableState> | null,
+  limitedFilterVariable: SceneVariable<SceneVariableState> | null,
   datasourceHelper: MetricDatasourceHelper
 ) {
-  if (!(filtersVariable instanceof AdHocFiltersVariable)) {
+  if (!(limitedFilterVariable instanceof AdHocFiltersVariable)) {
     return;
   }
 
-  filtersVariable.setState({
+  limitedFilterVariable.setState({
     getTagKeysProvider: async (
       variable: AdHocFiltersVariable,
       currentKey: string | null
@@ -170,7 +172,7 @@ export function limitAdhocProviders(
       // to use in the query to filter the response
       // using filters, e.g. {previously_selected_label:"value"},
       // as the series match[] parameter in Prometheus labels endpoint
-      const filters = filtersVariable.state.filters;
+      const filters = limitedFilterVariable.state.filters;
       // call getTagKeys and truncate the response
       // we're passing the queries so we get the labels that adhere to the queries
       // we're also passing the scopes so we get the labels that adhere to the scopes filters
@@ -187,7 +189,15 @@ export function limitAdhocProviders(
         opts.queries = [];
       }
 
-      const values = (await datasourceHelper.getTagKeys(opts)).slice(0, MAX_ADHOC_VARIABLE_OPTIONS);
+      let values = (await datasourceHelper.getTagKeys(opts)).slice(0, MAX_ADHOC_VARIABLE_OPTIONS);
+
+      // sort the values for otel resources at the top
+      if (limitedFilterVariable.state.name === VAR_OTEL_AND_METRIC_FILTERS) {
+        values = sortResources(
+          values,
+          filters.map((f) => f.key)
+        );
+      }
       // use replace: true to override the default lookup in adhoc filter variable
       return { replace: true, values };
     },
@@ -203,7 +213,7 @@ export function limitAdhocProviders(
       // to use in the query to filter the response
       // using filters, e.g. {previously_selected_label:"value"},
       // as the series match[] parameter in Prometheus label values endpoint
-      const filtersValues = filtersVariable.state.filters;
+      const filtersValues = limitedFilterVariable.state.filters;
       // remove current selected filter if updating a chosen filter
       const filters = filtersValues.filter((f) => f.key !== filter.key);
       // call getTagValues and truncate the response
diff --git a/public/locales/en-US/grafana.json b/public/locales/en-US/grafana.json
index d4ecfb90224..7645b538e9b 100644
--- a/public/locales/en-US/grafana.json
+++ b/public/locales/en-US/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "Filter by",
+      "new-badge": "New",
       "otel-switch": "This switch enables filtering by OTel resources for OTel native data sources."
     },
     "recent-metrics": {
diff --git a/public/locales/pseudo-LOCALE/grafana.json b/public/locales/pseudo-LOCALE/grafana.json
index 340bd89b16d..7df520bca8f 100644
--- a/public/locales/pseudo-LOCALE/grafana.json
+++ b/public/locales/pseudo-LOCALE/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "Fįľŧęř þy",
+      "new-badge": "Ńęŵ",
       "otel-switch": "Ŧĥįş şŵįŧčĥ ęʼnäþľęş ƒįľŧęřįʼnģ þy ØŦęľ řęşőūřčęş ƒőř ØŦęľ ʼnäŧįvę đäŧä şőūřčęş."
     },
     "recent-metrics": {

From 8054b30d5d469d536974ab64e1bd830858b03373 Mon Sep 17 00:00:00 2001
From: "grafana-pr-automation[bot]"
 <140550294+grafana-pr-automation[bot]@users.noreply.github.com>
Date: Tue, 14 Jan 2025 07:35:24 +0200
Subject: [PATCH 14/24] I18n: Download translations from Crowdin (#98921)

New Crowdin translations by GitHub Action

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 public/locales/de-DE/grafana.json   | 1 +
 public/locales/es-ES/grafana.json   | 1 +
 public/locales/fr-FR/grafana.json   | 1 +
 public/locales/pt-BR/grafana.json   | 1 +
 public/locales/zh-Hans/grafana.json | 1 +
 5 files changed, 5 insertions(+)

diff --git a/public/locales/de-DE/grafana.json b/public/locales/de-DE/grafana.json
index 11850d1322a..46fe1314938 100644
--- a/public/locales/de-DE/grafana.json
+++ b/public/locales/de-DE/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "",
+      "new-badge": "",
       "otel-switch": ""
     },
     "recent-metrics": {
diff --git a/public/locales/es-ES/grafana.json b/public/locales/es-ES/grafana.json
index dd1be065f18..f324380f834 100644
--- a/public/locales/es-ES/grafana.json
+++ b/public/locales/es-ES/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "",
+      "new-badge": "",
       "otel-switch": ""
     },
     "recent-metrics": {
diff --git a/public/locales/fr-FR/grafana.json b/public/locales/fr-FR/grafana.json
index a59e147018e..2ea9883ffe1 100644
--- a/public/locales/fr-FR/grafana.json
+++ b/public/locales/fr-FR/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "",
+      "new-badge": "",
       "otel-switch": ""
     },
     "recent-metrics": {
diff --git a/public/locales/pt-BR/grafana.json b/public/locales/pt-BR/grafana.json
index 3c6d16eb1f4..5e0b7cdc2d4 100644
--- a/public/locales/pt-BR/grafana.json
+++ b/public/locales/pt-BR/grafana.json
@@ -3320,6 +3320,7 @@
     },
     "metric-select": {
       "filter-by": "",
+      "new-badge": "",
       "otel-switch": ""
     },
     "recent-metrics": {
diff --git a/public/locales/zh-Hans/grafana.json b/public/locales/zh-Hans/grafana.json
index 2eb9552cb6d..c5cba66ace2 100644
--- a/public/locales/zh-Hans/grafana.json
+++ b/public/locales/zh-Hans/grafana.json
@@ -3306,6 +3306,7 @@
     },
     "metric-select": {
       "filter-by": "",
+      "new-badge": "",
       "otel-switch": ""
     },
     "recent-metrics": {

From 05ea05d64e269ae8a8fa7fa176caf783a78cae55 Mon Sep 17 00:00:00 2001
From: Mariell Hoversholm <mariell.hoversholm@grafana.com>
Date: Tue, 14 Jan 2025 09:28:44 +0100
Subject: [PATCH 15/24] Chore: Bump Go to 1.23.4 (#98853)

* Chore: Bump Go to 1.23.4

This is done in preparation of updating the App SDK library we import, as it has bumped its Go version to 1.23.4 as well.

* Chore: make update-workspace
---
 .drone.yml                          | 210 ++++++++++++++--------------
 Makefile                            |   2 +-
 apps/alerting/notifications/go.mod  |   2 +-
 go.mod                              |   2 +-
 go.work                             |   2 +-
 pkg/storage/unified/apistore/go.mod |   2 +-
 pkg/storage/unified/resource/go.mod |   2 +-
 scripts/drone/variables.star        |   2 +-
 8 files changed, 112 insertions(+), 112 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 516e31ade06..4190807e50a 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -25,7 +25,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build verify-drone
@@ -75,7 +75,7 @@ steps:
   - go install github.com/bazelbuild/buildtools/buildifier@latest
   - buildifier --lint=warn -mode=check -r .
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: lint-starlark
 trigger:
   event:
@@ -427,7 +427,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -436,21 +436,21 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - apk add --update build-base shared-mime-info shared-mime-info-lang
   - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend
 - commands:
   - apk add --update build-base
@@ -459,7 +459,7 @@ steps:
     | grep -o '\(.*\)/' | sort -u)
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend-integration
 trigger:
   event:
@@ -513,7 +513,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - echo $(/usr/bin/github-app-external-token) > /github-app/token
@@ -558,16 +558,16 @@ steps:
   - apk add --update make
   - make gen-go
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-modfile
 - commands:
   - apk add --update make
   - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-openapi-spec
 trigger:
   event:
@@ -643,7 +643,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -653,7 +653,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -662,7 +662,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - yarn install --immutable || yarn install --immutable
@@ -698,7 +698,7 @@ steps:
   - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
     -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
     -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
-    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.1 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.4 --yarn-cache=$$YARN_CACHE_FOLDER
     --build-id=$$DRONE_BUILD_NUMBER --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3
     --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{
     .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD
@@ -1096,7 +1096,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - echo $DRONE_RUNNER_NAME
@@ -1110,7 +1110,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -1119,14 +1119,14 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - dockerize -wait tcp://postgres:5432 -timeout 120s
@@ -1147,7 +1147,7 @@ steps:
     GRAFANA_TEST_DB: postgres
     PGPASSWORD: grafanatest
     POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: postgres-integration-tests
 - commands:
   - dockerize -wait tcp://mysql80:3306 -timeout 120s
@@ -1168,7 +1168,7 @@ steps:
   environment:
     GRAFANA_TEST_DB: mysql
     MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: mysql-8.0-integration-tests
 - commands:
   - dockerize -wait tcp://redis:6379 -timeout 120s
@@ -1184,7 +1184,7 @@ steps:
   - wait-for-redis
   environment:
     REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: redis-integration-tests
 - commands:
   - dockerize -wait tcp://memcached:11211 -timeout 120s
@@ -1200,7 +1200,7 @@ steps:
   - wait-for-memcached
   environment:
     MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: memcached-integration-tests
 - commands:
   - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@@ -1216,7 +1216,7 @@ steps:
   environment:
     AM_TENANT_ID: test
     AM_URL: http://mimir_backend:8080
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: remote-alertmanager-integration-tests
 trigger:
   event:
@@ -1303,7 +1303,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 trigger:
   event:
@@ -1424,7 +1424,7 @@ steps:
     && return 1; fi
   depends_on:
   - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: swagger-gen
 trigger:
   event:
@@ -1529,7 +1529,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1540,7 +1540,7 @@ steps:
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on:
   - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -1550,14 +1550,14 @@ steps:
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on:
   - clone-enterprise
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - apk add --update build-base
@@ -1565,7 +1565,7 @@ steps:
   - go test -v -run=^$ -benchmem -timeout=1h -count=8 -bench=. ${GO_PACKAGES}
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: sqlite-benchmark-integration-tests
 - commands:
   - apk add --update build-base
@@ -1577,7 +1577,7 @@ steps:
     GRAFANA_TEST_DB: postgres
     PGPASSWORD: grafanatest
     POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: postgres-benchmark-integration-tests
 - commands:
   - apk add --update build-base
@@ -1588,7 +1588,7 @@ steps:
   environment:
     GRAFANA_TEST_DB: mysql
     MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: mysql-8.0-benchmark-integration-tests
 trigger:
   event:
@@ -1665,7 +1665,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 trigger:
   branch: main
@@ -1838,7 +1838,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -1847,21 +1847,21 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - apk add --update build-base shared-mime-info shared-mime-info-lang
   - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend
 - commands:
   - apk add --update build-base
@@ -1870,7 +1870,7 @@ steps:
     | grep -o '\(.*\)/' | sort -u)
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend-integration
 trigger:
   branch: main
@@ -1915,22 +1915,22 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - apk add --update make
   - make gen-go
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-modfile
 - commands:
   - apk add --update make
   - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-openapi-spec
 - commands:
   - ./bin/build verify-drone
@@ -2062,7 +2062,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -2072,7 +2072,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -2081,7 +2081,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - yarn install --immutable || yarn install --immutable
@@ -2116,7 +2116,7 @@ steps:
   - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64
     -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
     -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
-    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.1 --yarn-cache=$$YARN_CACHE_FOLDER
+    -a docker:grafana:linux/arm/v7:ubuntu --go-version=1.23.4 --yarn-cache=$$YARN_CACHE_FOLDER
     --build-id=$$DRONE_BUILD_NUMBER --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3
     --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{
     .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD
@@ -2591,7 +2591,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - echo $DRONE_RUNNER_NAME
@@ -2605,7 +2605,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -2614,14 +2614,14 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - dockerize -wait tcp://postgres:5432 -timeout 120s
@@ -2642,7 +2642,7 @@ steps:
     GRAFANA_TEST_DB: postgres
     PGPASSWORD: grafanatest
     POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: postgres-integration-tests
 - commands:
   - dockerize -wait tcp://mysql80:3306 -timeout 120s
@@ -2663,7 +2663,7 @@ steps:
   environment:
     GRAFANA_TEST_DB: mysql
     MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: mysql-8.0-integration-tests
 - commands:
   - dockerize -wait tcp://redis:6379 -timeout 120s
@@ -2679,7 +2679,7 @@ steps:
   - wait-for-redis
   environment:
     REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: redis-integration-tests
 - commands:
   - dockerize -wait tcp://memcached:11211 -timeout 120s
@@ -2695,7 +2695,7 @@ steps:
   - wait-for-memcached
   environment:
     MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: memcached-integration-tests
 - commands:
   - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@@ -2711,7 +2711,7 @@ steps:
   environment:
     AM_TENANT_ID: test
     AM_URL: http://mimir_backend:8080
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: remote-alertmanager-integration-tests
 trigger:
   branch: main
@@ -2970,7 +2970,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -2979,21 +2979,21 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - apk add --update build-base shared-mime-info shared-mime-info-lang
   - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend
 - commands:
   - apk add --update build-base
@@ -3002,7 +3002,7 @@ steps:
     | grep -o '\(.*\)/' | sort -u)
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend-integration
 trigger:
   branch:
@@ -3045,22 +3045,22 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - apk add --update make
   - make gen-go
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - go run scripts/modowners/modowners.go check go.mod
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-modfile
 - commands:
   - apk add --update make
   - make swagger-validate
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: validate-openapi-spec
 trigger:
   branch:
@@ -3139,7 +3139,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - echo $DRONE_RUNNER_NAME
@@ -3153,7 +3153,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -3162,14 +3162,14 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - dockerize -wait tcp://postgres:5432 -timeout 120s
@@ -3190,7 +3190,7 @@ steps:
     GRAFANA_TEST_DB: postgres
     PGPASSWORD: grafanatest
     POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: postgres-integration-tests
 - commands:
   - dockerize -wait tcp://mysql80:3306 -timeout 120s
@@ -3211,7 +3211,7 @@ steps:
   environment:
     GRAFANA_TEST_DB: mysql
     MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: mysql-8.0-integration-tests
 - commands:
   - dockerize -wait tcp://redis:6379 -timeout 120s
@@ -3227,7 +3227,7 @@ steps:
   - wait-for-redis
   environment:
     REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: redis-integration-tests
 - commands:
   - dockerize -wait tcp://memcached:11211 -timeout 120s
@@ -3243,7 +3243,7 @@ steps:
   - wait-for-memcached
   environment:
     MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: memcached-integration-tests
 - commands:
   - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@@ -3259,7 +3259,7 @@ steps:
   environment:
     AM_TENANT_ID: test
     AM_URL: http://mimir_backend:8080
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: remote-alertmanager-integration-tests
 trigger:
   branch:
@@ -3359,7 +3359,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build artifacts docker fetch --edition oss
@@ -3491,7 +3491,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build artifacts docker fetch --edition oss
@@ -3632,7 +3632,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build artifacts packages --artifacts-editions=oss --tag $${DRONE_TAG} --src-bucket
@@ -3724,7 +3724,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - yarn install --immutable || yarn install --immutable
@@ -3824,7 +3824,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - depends_on:
   - compile-build-cmd
@@ -3921,7 +3921,7 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build publish grafana-com --edition oss ${DRONE_TAG}
@@ -3983,7 +3983,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4058,7 +4058,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4115,13 +4115,13 @@ steps:
   depends_on: []
   environment:
     CGO_ENABLED: 0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: compile-build-cmd
 - commands:
   - ./bin/build whatsnew-checker
   depends_on:
   - compile-build-cmd
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: whats-new-checker
 trigger:
   event:
@@ -4220,7 +4220,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4371,7 +4371,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -4380,21 +4380,21 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - apk add --update build-base shared-mime-info shared-mime-info-lang
   - go list -f '{{.Dir}}/...' -m  | xargs go test -short -covermode=atomic -timeout=5m
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend
 - commands:
   - apk add --update build-base
@@ -4403,7 +4403,7 @@ steps:
     | grep -o '\(.*\)/' | sort -u)
   depends_on:
   - wire-install
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: test-backend-integration
 trigger:
   cron:
@@ -4457,7 +4457,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4601,7 +4601,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4708,7 +4708,7 @@ steps:
   - export GITHUB_TOKEN=$(cat /github-app/token)
   - 'dagger run --silent /src/grafana-build artifacts -a $${ARTIFACTS} --grafana-ref=$${GRAFANA_REF}
     --enterprise-ref=$${ENTERPRISE_REF} --grafana-repo=$${GRAFANA_REPO} --version=$${VERSION} '
-  - --go-version=1.23.1
+  - --go-version=1.23.4
   depends_on:
   - github-app-generate-token
   environment:
@@ -4729,7 +4729,7 @@ steps:
       from_secret: grafana_api_key
     GCP_KEY_BASE64:
       from_secret: gcp_key_base64
-    GO_VERSION: 1.23.1
+    GO_VERSION: 1.23.4
     GPG_PASSPHRASE:
       from_secret: packages_gpg_passphrase
     GPG_PRIVATE_KEY:
@@ -4863,7 +4863,7 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-cue
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-cue
 - commands:
   - '# It is required that generated jsonnet is committed and in sync with its inputs.'
@@ -4872,14 +4872,14 @@ steps:
   - apk add --update make
   - CODEGEN_VERIFY=1 make gen-jsonnet
   depends_on: []
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: verify-gen-jsonnet
 - commands:
   - apk add --update make
   - make gen-go
   depends_on:
   - verify-gen-cue
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: wire-install
 - commands:
   - dockerize -wait tcp://postgres:5432 -timeout 120s
@@ -4900,7 +4900,7 @@ steps:
     GRAFANA_TEST_DB: postgres
     PGPASSWORD: grafanatest
     POSTGRES_HOST: postgres
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: postgres-integration-tests
 - commands:
   - dockerize -wait tcp://mysql80:3306 -timeout 120s
@@ -4921,7 +4921,7 @@ steps:
   environment:
     GRAFANA_TEST_DB: mysql
     MYSQL_HOST: mysql80
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: mysql-8.0-integration-tests
 - commands:
   - dockerize -wait tcp://redis:6379 -timeout 120s
@@ -4937,7 +4937,7 @@ steps:
   - wait-for-redis
   environment:
     REDIS_URL: redis://redis:6379/0
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: redis-integration-tests
 - commands:
   - dockerize -wait tcp://memcached:11211 -timeout 120s
@@ -4953,7 +4953,7 @@ steps:
   - wait-for-memcached
   environment:
     MEMCACHED_HOSTS: memcached:11211
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: memcached-integration-tests
 - commands:
   - dockerize -wait tcp://mimir_backend:8080 -timeout 120s
@@ -4969,7 +4969,7 @@ steps:
   environment:
     AM_TENANT_ID: test
     AM_URL: http://mimir_backend:8080
-  image: golang:1.23.1-alpine
+  image: golang:1.23.4-alpine
   name: remote-alertmanager-integration-tests
 trigger:
   event:
@@ -5272,7 +5272,7 @@ steps:
 - commands:
   - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:27-cli
   - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine/git:2.40.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.23.1-alpine
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.23.4-alpine
   - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:22.11.0-alpine
   - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:22-bookworm
   - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0
@@ -5310,7 +5310,7 @@ steps:
 - commands:
   - trivy --exit-code 1 --severity HIGH,CRITICAL docker:27-cli
   - trivy --exit-code 1 --severity HIGH,CRITICAL alpine/git:2.40.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.23.1-alpine
+  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.23.4-alpine
   - trivy --exit-code 1 --severity HIGH,CRITICAL node:22.11.0-alpine
   - trivy --exit-code 1 --severity HIGH,CRITICAL node:22-bookworm
   - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0
@@ -5579,6 +5579,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 9f0a6d29cd6f5e368fb6d63f26ab213d668ac099e3b8e653dbf4b074e7ef0a1a
+hmac: bdf4cd3767ad13e5a8d7221731676e8ee1991dae0da9ae2cee92087d5c660ece
 
 ...
diff --git a/Makefile b/Makefile
index 424c2a6c231..88657f0cf77 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ WIRE_TAGS = "oss"
 include .bingo/Variables.mk
 
 GO = go
-GO_VERSION = 1.23.1
+GO_VERSION = 1.23.4
 GO_LINT_FILES ?= $(shell ./scripts/go-workspace/golangci-lint-includes.sh)
 GO_TEST_FILES ?= $(shell ./scripts/go-workspace/test-includes.sh)
 SH_FILES ?= $(shell find ./scripts -name *.sh)
diff --git a/apps/alerting/notifications/go.mod b/apps/alerting/notifications/go.mod
index 25ea30979b6..1b6cc345dd7 100644
--- a/apps/alerting/notifications/go.mod
+++ b/apps/alerting/notifications/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/grafana/apps/alerting/notifications
 
-go 1.23.1
+go 1.23.4
 
 replace github.com/grafana/grafana => ../../..
 
diff --git a/go.mod b/go.mod
index 70876ec2cc9..14ca0f3616a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/grafana
 
-go 1.23.1
+go 1.23.4
 
 require (
 	buf.build/gen/go/parca-dev/parca/connectrpc/go v1.17.0-20240902100956-02fd72488966.1 // @grafana/observability-traces-and-profiling
diff --git a/go.work b/go.work
index a2026119223..78c561488f2 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.23.1
+go 1.23.4
 
 // The `skip:golangci-lint` comment tag is used to exclude the package from the `golangci-lint` GitHub Action.
 // The module at the root of the repo (`.`) is excluded because ./pkg/... is included manually in the `golangci-lint` configuration.
diff --git a/pkg/storage/unified/apistore/go.mod b/pkg/storage/unified/apistore/go.mod
index 53a64c6a9a7..c0f249a8706 100644
--- a/pkg/storage/unified/apistore/go.mod
+++ b/pkg/storage/unified/apistore/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/grafana/pkg/storage/unified/apistore
 
-go 1.23.1
+go 1.23.4
 
 replace (
 	github.com/grafana/grafana => ../../../..
diff --git a/pkg/storage/unified/resource/go.mod b/pkg/storage/unified/resource/go.mod
index 192b0ab2be1..223028ebbf3 100644
--- a/pkg/storage/unified/resource/go.mod
+++ b/pkg/storage/unified/resource/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/grafana/pkg/storage/unified/resource
 
-go 1.23.1
+go 1.23.4
 
 replace (
 	github.com/grafana/grafana => ../../../..
diff --git a/scripts/drone/variables.star b/scripts/drone/variables.star
index bd9536ee040..ec9e803a101 100644
--- a/scripts/drone/variables.star
+++ b/scripts/drone/variables.star
@@ -3,7 +3,7 @@ global variables
 """
 
 grabpl_version = "v3.1.1"
-golang_version = "1.23.1"
+golang_version = "1.23.4"
 
 # nodejs_version should match what's in ".nvmrc", but without the v prefix.
 nodejs_version = "22.11.0"

From 9b34a56d7cb393a2931a030cc52d822267497f08 Mon Sep 17 00:00:00 2001
From: Ieva <ieva.vasiljeva@grafana.com>
Date: Tue, 14 Jan 2025 08:33:42 +0000
Subject: [PATCH 16/24] AuthZ service: Take action sets into account when
 checking folder create permissions (#98751)

take action sets into account when checking folder create permissions
---
 pkg/services/authz/rbac/service.go                 | 14 +++++++++++---
 pkg/services/authz/rbac/store/models.go            |  1 +
 pkg/services/authz/rbac/store/permission_query.sql | 10 ++++++++--
 pkg/services/authz/rbac/store/sql_test.go          | 10 ++++++++++
 pkg/services/authz/rbac/store/store.go             |  2 +-
 .../mysql--permission_query-With_action_sets.sql   |  8 ++++++++
 .../mysql--permission_query-admin_user.sql         |  6 ++++--
 .../mysql--permission_query-anonymous_user.sql     |  6 ++++--
 .../mysql--permission_query-user_with_teams.sql    |  6 ++++--
 .../mysql--permission_query-viewer_user.sql        |  6 ++++--
 ...postgres--permission_query-With_action_sets.sql |  8 ++++++++
 .../postgres--permission_query-admin_user.sql      |  6 ++++--
 .../postgres--permission_query-anonymous_user.sql  |  6 ++++--
 .../postgres--permission_query-user_with_teams.sql |  6 ++++--
 .../postgres--permission_query-viewer_user.sql     |  6 ++++--
 .../sqlite--permission_query-With_action_sets.sql  |  8 ++++++++
 .../sqlite--permission_query-admin_user.sql        |  6 ++++--
 .../sqlite--permission_query-anonymous_user.sql    |  6 ++++--
 .../sqlite--permission_query-user_with_teams.sql   |  6 ++++--
 .../sqlite--permission_query-viewer_user.sql       |  6 ++++--
 20 files changed, 103 insertions(+), 30 deletions(-)
 create mode 100755 pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
 create mode 100755 pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
 create mode 100755 pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql

diff --git a/pkg/services/authz/rbac/service.go b/pkg/services/authz/rbac/service.go
index f6b8b5c2fe5..8834b3e1da9 100644
--- a/pkg/services/authz/rbac/service.go
+++ b/pkg/services/authz/rbac/service.go
@@ -241,8 +241,15 @@ func (s *Service) getUserPermissions(ctx context.Context, ns claims.NamespaceInf
 	ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.getUserPermissions")
 	defer span.End()
 
+	// When checking folder creation permissions, also check edit and admin action sets for folder, as the scoped folder create actions aren't stored in the DB separately
+	var actionSets []string
+	if action == "folders:create" {
+		actionSets = append(actionSets, "folders:edit")
+		actionSets = append(actionSets, "folders:admin")
+	}
+
 	if idType == claims.TypeAnonymous {
-		return s.getAnonymousPermissions(ctx, ns, action)
+		return s.getAnonymousPermissions(ctx, ns, action, actionSets)
 	}
 
 	userIdentifiers, err := s.GetUserIdentifiers(ctx, ns, userID)
@@ -269,6 +276,7 @@ func (s *Service) getUserPermissions(ctx context.Context, ns claims.NamespaceInf
 		userPermQuery := store.PermissionsQuery{
 			UserID:        userIdentifiers.ID,
 			Action:        action,
+			ActionSets:    actionSets,
 			TeamIDs:       teamIDs,
 			Role:          basicRoles.Role,
 			IsServerAdmin: basicRoles.IsAdmin,
@@ -293,7 +301,7 @@ func (s *Service) getUserPermissions(ctx context.Context, ns claims.NamespaceInf
 	return res.(map[string]bool), nil
 }
 
-func (s *Service) getAnonymousPermissions(ctx context.Context, ns claims.NamespaceInfo, action string) (map[string]bool, error) {
+func (s *Service) getAnonymousPermissions(ctx context.Context, ns claims.NamespaceInfo, action string, actionSets []string) (map[string]bool, error) {
 	ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.getAnonymousPermissions")
 	defer span.End()
 
@@ -303,7 +311,7 @@ func (s *Service) getAnonymousPermissions(ctx context.Context, ns claims.Namespa
 	}
 
 	res, err, _ := s.sf.Do(anonPermKey+"_getAnonymousPermissions", func() (interface{}, error) {
-		permissions, err := s.store.GetUserPermissions(ctx, ns, store.PermissionsQuery{Action: action, Role: "Viewer"})
+		permissions, err := s.store.GetUserPermissions(ctx, ns, store.PermissionsQuery{Action: action, ActionSets: actionSets, Role: "Viewer"})
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/services/authz/rbac/store/models.go b/pkg/services/authz/rbac/store/models.go
index bee9cb5540b..5df60d261a7 100644
--- a/pkg/services/authz/rbac/store/models.go
+++ b/pkg/services/authz/rbac/store/models.go
@@ -14,6 +14,7 @@ type PermissionsQuery struct {
 	OrgID         int64
 	UserID        int64
 	Action        string
+	ActionSets    []string
 	TeamIDs       []int64
 	Role          string
 	IsServerAdmin bool
diff --git a/pkg/services/authz/rbac/store/permission_query.sql b/pkg/services/authz/rbac/store/permission_query.sql
index 10e466f8074..dfa82390541 100644
--- a/pkg/services/authz/rbac/store/permission_query.sql
+++ b/pkg/services/authz/rbac/store/permission_query.sql
@@ -1,5 +1,11 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
-WHERE p.action = {{ .Arg .Query.Action }} AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
+WHERE
+  {{ if .Query.ActionSets }}
+  p.action IN ({{ .ArgList .Query.ActionSets }}, {{ .Arg .Query.Action }})
+  {{ else }}
+  p.action = {{ .Arg .Query.Action }}
+  {{ end }}
+AND p.role_id IN (
   SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
     {{ if .Query.IsServerAdmin }}
    OR (br.role = 'Grafana Admin')
diff --git a/pkg/services/authz/rbac/store/sql_test.go b/pkg/services/authz/rbac/store/sql_test.go
index 37aca917d10..c3d9afd1f0e 100644
--- a/pkg/services/authz/rbac/store/sql_test.go
+++ b/pkg/services/authz/rbac/store/sql_test.go
@@ -105,6 +105,16 @@ func TestIdentityQueries(t *testing.T) {
 						Role:   "Viewer",
 					}),
 				},
+				{
+					Name: "With_action_sets",
+					Data: getPermissions(&PermissionsQuery{
+						UserID:     1,
+						OrgID:      1,
+						Action:     "folders:create",
+						ActionSets: []string{"folders:edit", "folders:admin"},
+						Role:       "Viewer",
+					}),
+				},
 			},
 			sqlFolders: {
 				{
diff --git a/pkg/services/authz/rbac/store/store.go b/pkg/services/authz/rbac/store/store.go
index 3e61c62f775..510619c2d39 100644
--- a/pkg/services/authz/rbac/store/store.go
+++ b/pkg/services/authz/rbac/store/store.go
@@ -60,7 +60,7 @@ func (s *StoreImpl) GetUserPermissions(ctx context.Context, ns claims.NamespaceI
 	var perms []accesscontrol.Permission
 	for res.Next() {
 		var perm accesscontrol.Permission
-		if err := res.Scan(&perm.Action, &perm.Kind, &perm.Attribute, &perm.Identifier, &perm.Scope); err != nil {
+		if err := res.Scan(&perm.Kind, &perm.Attribute, &perm.Identifier, &perm.Scope); err != nil {
 			return nil, err
 		}
 		perms = append(perms, perm)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
new file mode 100755
index 00000000000..0393be57d3f
--- /dev/null
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
@@ -0,0 +1,8 @@
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+WHERE
+  p.action IN ('folders:edit', 'folders:admin', 'folders:create')
+AND p.role_id IN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+    UNION
+  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
index a38590186d0..ba9f7064c91 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
    OR (br.role = 'Grafana Admin')
     UNION
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
index c0a0434e9fc..99959aeef2d 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
@@ -1,4 +1,6 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
 )
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
index 09c374c4000..d47a6b8226d 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
index 0bf68123439..15f8dde3169 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
new file mode 100755
index 00000000000..8c35badfb31
--- /dev/null
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
@@ -0,0 +1,8 @@
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action IN ('folders:edit', 'folders:admin', 'folders:create')
+AND p.role_id IN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+    UNION
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
index 3e4ac0a954c..c78b0cbd2aa 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
    OR (br.role = 'Grafana Admin')
     UNION
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
index d8a4944a45f..20544064211 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
@@ -1,4 +1,6 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
 )
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
index d7b8ea9ed0d..ae269975c83 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
index 71e2412fbc1..3a78a730602 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
new file mode 100755
index 00000000000..8c35badfb31
--- /dev/null
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
@@ -0,0 +1,8 @@
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action IN ('folders:edit', 'folders:admin', 'folders:create')
+AND p.role_id IN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+    UNION
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
index 3e4ac0a954c..c78b0cbd2aa 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
    OR (br.role = 'Grafana Admin')
     UNION
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
index d8a4944a45f..20544064211 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
@@ -1,4 +1,6 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
 )
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
index d7b8ea9ed0d..ae269975c83 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
index 71e2412fbc1..3a78a730602 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
@@ -1,5 +1,7 @@
-SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
-WHERE p.action = 'folders:read' AND p.role_id IN (
+SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+WHERE
+  p.action = 'folders:read'
+AND p.role_id IN (
   SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
     UNION
   SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)

From 29a8fbd89848693602af2ba8c60e193720f9bdc9 Mon Sep 17 00:00:00 2001
From: Alex Rosenfeld <alexrosenfeld10@gmail.com>
Date: Tue, 14 Jan 2025 03:35:54 -0500
Subject: [PATCH 17/24] Panel inspect: Fix file names of data download included
 uninterpolated variable names. (#98832)

* use panel title for dataName instead of panel.getDisplayTitle()

* Interpolate variables in panel title for downloads in scenes

---------

Co-authored-by: oscarkilhed <oscar.kilhed@grafana.com>
---
 public/app/features/dashboard-scene/inspect/InspectDataTab.tsx  | 2 +-
 .../features/dashboard/components/Inspector/InspectContent.tsx  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/public/app/features/dashboard-scene/inspect/InspectDataTab.tsx b/public/app/features/dashboard-scene/inspect/InspectDataTab.tsx
index 9b6805153b4..24d6a003306 100644
--- a/public/app/features/dashboard-scene/inspect/InspectDataTab.tsx
+++ b/public/app/features/dashboard-scene/inspect/InspectDataTab.tsx
@@ -62,7 +62,7 @@ export class InspectDataTab extends SceneObjectBase<InspectDataTabState> {
         hasTransformations={hasTransformations(dataProvider)}
         timeZone={timeRange.getTimeZone()}
         panelPluginId={panel.state.pluginId}
-        dataName={panel.state.title}
+        dataName={sceneGraph.interpolate(panel, panel.state.title)}
         fieldConfig={panel.state.fieldConfig}
         onOptionsChange={model.onOptionsChange}
       />
diff --git a/public/app/features/dashboard/components/Inspector/InspectContent.tsx b/public/app/features/dashboard/components/Inspector/InspectContent.tsx
index 7dfc6c7d54e..dc28685e098 100644
--- a/public/app/features/dashboard/components/Inspector/InspectContent.tsx
+++ b/public/app/features/dashboard/components/Inspector/InspectContent.tsx
@@ -94,7 +94,7 @@ export const InspectContent = ({
     >
       {activeTab === InspectTab.Data && (
         <InspectDataTab
-          dataName={panel.getDisplayTitle()}
+          dataName={panelTitle}
           panelPluginId={panel.type}
           fieldConfig={panel.fieldConfig}
           hasTransformations={Boolean(panel.transformations?.length)}

From 4c86de267816d0a70eb0405b0db93cc7af41b211 Mon Sep 17 00:00:00 2001
From: Gabriel MABILLE <gamab@users.noreply.github.com>
Date: Tue, 14 Jan 2025 09:42:17 +0100
Subject: [PATCH 18/24] Chore: Update authlib (#98870)

* Chore: Update authlib

* AccessChecker -> AccessClient
---
 go.mod                              | 2 +-
 go.sum                              | 4 ++--
 go.work.sum                         | 3 +++
 pkg/apimachinery/go.mod             | 2 +-
 pkg/apimachinery/go.sum             | 4 ++--
 pkg/services/authz/client.go        | 8 ++++----
 pkg/storage/unified/apistore/go.mod | 2 +-
 pkg/storage/unified/apistore/go.sum | 4 ++--
 pkg/storage/unified/resource/go.mod | 2 +-
 pkg/storage/unified/resource/go.sum | 4 ++--
 10 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/go.mod b/go.mod
index 14ca0f3616a..fc775d26665 100644
--- a/go.mod
+++ b/go.mod
@@ -65,7 +65,7 @@ require (
 	github.com/gorilla/mux v1.8.1 // @grafana/grafana-backend-group
 	github.com/gorilla/websocket v1.5.3 // @grafana/grafana-app-platform-squad
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // @grafana/alerting-backend
-	github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f // @grafana/identity-access-team
+	github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 // @grafana/identity-access-team
 	github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 // @grafana/identity-access-team
 	github.com/grafana/dataplane/examples v0.0.1 // @grafana/observability-metrics
 	github.com/grafana/dataplane/sdata v0.0.9 // @grafana/observability-metrics
diff --git a/go.sum b/go.sum
index f6c88982f6f..f725276a745 100644
--- a/go.sum
+++ b/go.sum
@@ -1491,8 +1491,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 h1:dSA0aOMzNnpBmYcmwv2OT5Is4kE7rubdSxo9GZSePAY=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968/go.mod h1:QsnoKX/iYZxA4Cv+H+wC7uxutBD8qi8ZW5UJvD2TYmU=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f h1:BcgUTu26JtOudfpQ8LoLpZNV2CdMEyhLUZweCUgETZw=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 h1:MSRBiQrSJZ+iowjU4Tgtq8+uC5/cs9XdtUdSWCNHrNE=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
 github.com/grafana/dataplane/examples v0.0.1 h1:K9M5glueWyLoL4//H+EtTQq16lXuHLmOhb6DjSCahzA=
diff --git a/go.work.sum b/go.work.sum
index 2b6d5972528..2b2e097cc4e 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -1755,6 +1755,7 @@ github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJr
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hamba/avro/v2 v2.27.0 h1:IAM4lQ0VzUIKBuo4qlAiLKfqALSrFC+zi1iseTtbBKU=
@@ -2630,6 +2631,7 @@ google.golang.org/genproto/googleapis/api v0.0.0-20240311132316-a219d84964c2/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20240415180920-8c6c420018be/go.mod h1:dvdCTIoAGbkWbcIKBniID56/7XHTt6WfxXNMxuziJ+w=
 google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6/go.mod h1:10yRODfgim2/T8csjQsMPgZOMvtytXKTDRzH6HRGzRw=
 google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157/go.mod h1:99sLkeliLXfdj2J75X3Ho+rrVCaJze0uwN7zDDkjPVU=
+google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117/go.mod h1:OimBR/bc1wPO9iV4NC2bpyjy3VnAwZh5EBPQdtaE5oo=
 google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4/go.mod h1:px9SlOOZBg1wM1zdnr8jEL4CNGUBZ+ZKYtNPApNQc4c=
 google.golang.org/genproto/googleapis/api v0.0.0-20240711142825-46eb208f015d/go.mod h1:mw8MG/Qz5wfgYr6VqVCiZcHe/GJEfI+oGGDCohaVgB0=
 google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
@@ -2689,6 +2691,7 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240415180920-8c6c420018be/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240429193739-8cf5692501f6/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240711142825-46eb208f015d/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240722135656-d784300faade/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
diff --git a/pkg/apimachinery/go.mod b/pkg/apimachinery/go.mod
index 092c89abaab..99cbcffc242 100644
--- a/pkg/apimachinery/go.mod
+++ b/pkg/apimachinery/go.mod
@@ -3,7 +3,7 @@ module github.com/grafana/grafana/pkg/apimachinery
 go 1.23.1
 
 require (
-	github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f // @grafana/identity-access-team
+	github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 // @grafana/identity-access-team
 	github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 // @grafana/identity-access-team
 	github.com/stretchr/testify v1.10.0
 	k8s.io/apimachinery v0.32.0
diff --git a/pkg/apimachinery/go.sum b/pkg/apimachinery/go.sum
index 26af7a46237..4c7b9b81572 100644
--- a/pkg/apimachinery/go.sum
+++ b/pkg/apimachinery/go.sum
@@ -32,8 +32,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f h1:BcgUTu26JtOudfpQ8LoLpZNV2CdMEyhLUZweCUgETZw=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 h1:MSRBiQrSJZ+iowjU4Tgtq8+uC5/cs9XdtUdSWCNHrNE=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
diff --git a/pkg/services/authz/client.go b/pkg/services/authz/client.go
index 0b8a35a053e..ccb88d4a399 100644
--- a/pkg/services/authz/client.go
+++ b/pkg/services/authz/client.go
@@ -28,7 +28,7 @@ import (
 const authzServiceAudience = "authzService"
 
 type Client interface {
-	authzlib.AccessChecker
+	authzlib.AccessClient
 }
 
 // ProvideAuthZClient provides an AuthZ client and creates the AuthZ service.
@@ -92,7 +92,7 @@ func ProvideStandaloneAuthZClient(
 	return newCloudLegacyClient(authCfg, tracer)
 }
 
-func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzlib.AccessChecker, error) {
+func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzlib.AccessClient, error) {
 	// For in-proc use-case authorize add fake service claims - it should be able to access every namespace, as there is only one
 	staticAuth := func(ctx context.Context) (context.Context, error) {
 		ctx = claims.WithClaims(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
@@ -121,7 +121,7 @@ func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzli
 	)
 }
 
-func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessChecker, error) {
+func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
 	// This client interceptor is a noop, as we don't send an access token
 	clientConfig := authnlib.GrpcClientConfig{}
 	clientInterceptor, err := authnlib.NewGrpcClientInterceptor(
@@ -151,7 +151,7 @@ func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessCh
 	return client, nil
 }
 
-func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessChecker, error) {
+func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
 	grpcClientConfig := authnlib.GrpcClientConfig{
 		TokenClientConfig: &authnlib.TokenExchangeConfig{
 			Token:            authCfg.token,
diff --git a/pkg/storage/unified/apistore/go.mod b/pkg/storage/unified/apistore/go.mod
index c0f249a8706..2aadfed0fda 100644
--- a/pkg/storage/unified/apistore/go.mod
+++ b/pkg/storage/unified/apistore/go.mod
@@ -170,7 +170,7 @@ require (
 	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // indirect
-	github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f // indirect
+	github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040 // indirect
 	github.com/grafana/grafana-aws-sdk v0.31.5 // indirect
diff --git a/pkg/storage/unified/apistore/go.sum b/pkg/storage/unified/apistore/go.sum
index 6f8e0fb64a0..5c74ef8d68e 100644
--- a/pkg/storage/unified/apistore/go.sum
+++ b/pkg/storage/unified/apistore/go.sum
@@ -545,8 +545,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 h1:dSA0aOMzNnpBmYcmwv2OT5Is4kE7rubdSxo9GZSePAY=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968/go.mod h1:QsnoKX/iYZxA4Cv+H+wC7uxutBD8qi8ZW5UJvD2TYmU=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f h1:BcgUTu26JtOudfpQ8LoLpZNV2CdMEyhLUZweCUgETZw=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 h1:MSRBiQrSJZ+iowjU4Tgtq8+uC5/cs9XdtUdSWCNHrNE=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
 github.com/grafana/dataplane/examples v0.0.1 h1:K9M5glueWyLoL4//H+EtTQq16lXuHLmOhb6DjSCahzA=
diff --git a/pkg/storage/unified/resource/go.mod b/pkg/storage/unified/resource/go.mod
index 223028ebbf3..30dacf1bed3 100644
--- a/pkg/storage/unified/resource/go.mod
+++ b/pkg/storage/unified/resource/go.mod
@@ -11,7 +11,7 @@ replace (
 require (
 	github.com/fullstorydev/grpchan v1.1.1
 	github.com/google/uuid v1.6.0
-	github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f
+	github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884
 	github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335
 	github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040
 	github.com/grafana/grafana v0.0.0-00010101000000-000000000000
diff --git a/pkg/storage/unified/resource/go.sum b/pkg/storage/unified/resource/go.sum
index 442003fff6b..9a6c58f32e1 100644
--- a/pkg/storage/unified/resource/go.sum
+++ b/pkg/storage/unified/resource/go.sum
@@ -400,8 +400,8 @@ github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 h1:dSA0aOMzNnpBmYcmwv2OT5Is4kE7rubdSxo9GZSePAY=
 github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968/go.mod h1:QsnoKX/iYZxA4Cv+H+wC7uxutBD8qi8ZW5UJvD2TYmU=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f h1:BcgUTu26JtOudfpQ8LoLpZNV2CdMEyhLUZweCUgETZw=
-github.com/grafana/authlib v0.0.0-20250107102310-3edeb9fc9d5f/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 h1:MSRBiQrSJZ+iowjU4Tgtq8+uC5/cs9XdtUdSWCNHrNE=
+github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
 github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
 github.com/grafana/dataplane/sdata v0.0.9 h1:AGL1LZnCUG4MnQtnWpBPbQ8ZpptaZs14w6kE/MWfg7s=

From 7480c9eb544e45b2cd6ef5a396c503f5c7dc9286 Mon Sep 17 00:00:00 2001
From: Giuseppe Guerra <giuseppe.guerra@grafana.com>
Date: Tue, 14 Jan 2025 09:51:01 +0100
Subject: [PATCH 19/24] Plugins: Disable SRI checks for filesystem plugins
 (#98673)

* Plugins: Disable SRI checks for filesystem plugins

* Plugins: Disable SRI checks for filesystem plugins

* Update tests

* Lint

* Check for cdn enabled rather than just plugin class

* ops

* Update tests

* lint
---
 .../pluginassets/pluginassets.go              |  9 ++
 .../pluginassets/pluginassets_test.go         | 83 +++++++++++++------
 2 files changed, 68 insertions(+), 24 deletions(-)

diff --git a/pkg/services/pluginsintegration/pluginassets/pluginassets.go b/pkg/services/pluginsintegration/pluginassets/pluginassets.go
index 3184a4ec772..cecf8ea78dc 100644
--- a/pkg/services/pluginsintegration/pluginassets/pluginassets.go
+++ b/pkg/services/pluginsintegration/pluginassets/pluginassets.go
@@ -102,6 +102,7 @@ func (s *Service) ModuleHash(ctx context.Context, p pluginstore.Plugin) string {
 }
 
 // moduleHash is the underlying function for ModuleHash. See its documentation for more information.
+// If the plugin is not a CDN plugin, the function will return an empty string.
 // It will read the module hash from the MANIFEST.txt in the [[plugins.FS]] of the provided plugin.
 // If childFSBase is provided, the function will try to get the hash from MANIFEST.txt for the provided children's
 // module.js file, rather than for the provided plugin.
@@ -137,6 +138,14 @@ func (s *Service) moduleHash(ctx context.Context, p pluginstore.Plugin, childFSB
 		return s.moduleHash(ctx, parent, childFSBase)
 	}
 
+	// Only CDN plugins are supported for SRI checks.
+	// CDN plugins have the version as part of the URL, which acts as a cache-buster.
+	// Needed due to: https://github.com/grafana/plugin-tools/pull/1426
+	// FS plugins build before this change will have SRI mismatch issues.
+	if !s.cdnEnabled(p.ID, p.Class) {
+		return "", nil
+	}
+
 	manifest, err := s.signature.ReadPluginManifestFromFS(ctx, p.FS)
 	if err != nil {
 		return "", fmt.Errorf("read plugin manifest: %w", err)
diff --git a/pkg/services/pluginsintegration/pluginassets/pluginassets_test.go b/pkg/services/pluginsintegration/pluginassets/pluginassets_test.go
index 371a116f86c..a747e7e4e89 100644
--- a/pkg/services/pluginsintegration/pluginassets/pluginassets_test.go
+++ b/pkg/services/pluginsintegration/pluginassets/pluginassets_test.go
@@ -2,6 +2,7 @@ package pluginassets
 
 import (
 	"context"
+	"fmt"
 	"path/filepath"
 	"testing"
 
@@ -74,10 +75,7 @@ func TestService_Calculate(t *testing.T) {
 				CreatePluginVersionCfgKey: incompatVersion,
 				// NOTE: cdn key is not set
 			}),
-			plugin: newPlugin(pluginID, withAngular(false), func(p pluginstore.Plugin) pluginstore.Plugin {
-				p.Class = plugins.ClassExternal
-				return p
-			}),
+			plugin:   newPlugin(pluginID, withAngular(false), withClass(plugins.ClassExternal)),
 			expected: plugins.LoadingStrategyScript,
 		},
 		{
@@ -121,10 +119,7 @@ func TestService_Calculate(t *testing.T) {
 				"cdn":                     "true",
 				CreatePluginVersionCfgKey: incompatVersion,
 			}),
-			plugin: newPlugin(pluginID, withAngular(false), func(p pluginstore.Plugin) pluginstore.Plugin {
-				p.Class = plugins.ClassExternal
-				return p
-			}),
+			plugin:   newPlugin(pluginID, withAngular(false), withClass(plugins.ClassExternal)),
 			expected: plugins.LoadingStrategyFetch,
 		},
 		{
@@ -149,10 +144,7 @@ func TestService_Calculate(t *testing.T) {
 			pluginSettings: newPluginSettings(pluginID, map[string]string{
 				CreatePluginVersionCfgKey: incompatVersion,
 			}),
-			plugin: newPlugin(pluginID, withAngular(false), func(p pluginstore.Plugin) pluginstore.Plugin {
-				p.Class = plugins.ClassCDN
-				return p
-			}),
+			plugin:   newPlugin(pluginID, withAngular(false), withClass(plugins.ClassCDN)),
 			expected: plugins.LoadingStrategyFetch,
 		},
 		{
@@ -187,10 +179,16 @@ func TestService_ModuleHash(t *testing.T) {
 		parentPluginID = "grafana-test-app"
 	)
 	for _, tc := range []struct {
-		name          string
-		features      *config.Features
-		store         []pluginstore.Plugin
-		plugin        pluginstore.Plugin
+		name     string
+		features *config.Features
+		store    []pluginstore.Plugin
+
+		// Can be used to configure plugin's class
+		// cdn class = loaded from CDN with no files on disk
+		// external class = files on disk but served from CDN only if cdn=true
+		plugin pluginstore.Plugin
+
+		// When true, set cdn=true in config
 		cdn           bool
 		expModuleHash string
 	}{
@@ -202,18 +200,28 @@ func TestService_ModuleHash(t *testing.T) {
 			expModuleHash: "",
 		},
 		{
-			name: "feature flag on with cdn on should return module hash",
 			plugin: newPlugin(
 				pluginID,
 				withSignatureStatus(plugins.SignatureStatusValid),
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid"))),
+				withClass(plugins.ClassCDN),
+			),
+			cdn:           true,
+			features:      &config.Features{SriChecksEnabled: true},
+			expModuleHash: newSRIHash(t, "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"),
+		},
+		{
+			plugin: newPlugin(
+				pluginID,
+				withSignatureStatus(plugins.SignatureStatusValid),
+				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid"))),
+				withClass(plugins.ClassExternal),
 			),
 			cdn:           true,
 			features:      &config.Features{SriChecksEnabled: true},
 			expModuleHash: newSRIHash(t, "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"),
 		},
 		{
-			name: "feature flag on with cdn off should return module hash",
 			plugin: newPlugin(
 				pluginID,
 				withSignatureStatus(plugins.SignatureStatusValid),
@@ -221,21 +229,20 @@ func TestService_ModuleHash(t *testing.T) {
 			),
 			cdn:           false,
 			features:      &config.Features{SriChecksEnabled: true},
-			expModuleHash: newSRIHash(t, "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"),
+			expModuleHash: "",
 		},
 		{
-			name: "feature flag off with cdn on should not return module hash",
 			plugin: newPlugin(
 				pluginID,
 				withSignatureStatus(plugins.SignatureStatusValid),
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid"))),
+				withClass(plugins.ClassCDN),
 			),
 			cdn:           true,
 			features:      &config.Features{SriChecksEnabled: false},
 			expModuleHash: "",
 		},
 		{
-			name: "feature flag off with cdn off should not return module hash",
 			plugin: newPlugin(
 				pluginID,
 				withSignatureStatus(plugins.SignatureStatusValid),
@@ -254,6 +261,7 @@ func TestService_ModuleHash(t *testing.T) {
 					parentPluginID,
 					withSignatureStatus(plugins.SignatureStatusValid),
 					withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested"))),
+					withClass(plugins.ClassCDN),
 				),
 			},
 			plugin: newPlugin(
@@ -261,8 +269,9 @@ func TestService_ModuleHash(t *testing.T) {
 				withSignatureStatus(plugins.SignatureStatusValid),
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested", "datasource"))),
 				withParent(parentPluginID),
+				withClass(plugins.ClassCDN),
 			),
-			cdn:           false,
+			cdn:           true,
 			features:      &config.Features{SriChecksEnabled: true},
 			expModuleHash: newSRIHash(t, "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711"),
 		},
@@ -275,6 +284,7 @@ func TestService_ModuleHash(t *testing.T) {
 					parentPluginID,
 					withSignatureStatus(plugins.SignatureStatusValid),
 					withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested"))),
+					withClass(plugins.ClassCDN),
 				),
 			},
 			plugin: newPlugin(
@@ -282,8 +292,9 @@ func TestService_ModuleHash(t *testing.T) {
 				withSignatureStatus(plugins.SignatureStatusValid),
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested", "panels", "one"))),
 				withParent(parentPluginID),
+				withClass(plugins.ClassCDN),
 			),
-			cdn:           false,
+			cdn:           true,
 			features:      &config.Features{SriChecksEnabled: true},
 			expModuleHash: newSRIHash(t, "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f"),
 		},
@@ -297,12 +308,14 @@ func TestService_ModuleHash(t *testing.T) {
 					"grand-parent-app",
 					withSignatureStatus(plugins.SignatureStatusValid),
 					withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested"))),
+					withClass(plugins.ClassCDN),
 				),
 				newPlugin(
 					"parent-datasource",
 					withSignatureStatus(plugins.SignatureStatusValid),
 					withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested", "datasource"))),
 					withParent("grand-parent-app"),
+					withClass(plugins.ClassCDN),
 				),
 			},
 			plugin: newPlugin(
@@ -310,8 +323,9 @@ func TestService_ModuleHash(t *testing.T) {
 				withSignatureStatus(plugins.SignatureStatusValid),
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested", "datasource", "panels", "one"))),
 				withParent("parent-datasource"),
+				withClass(plugins.ClassCDN),
 			),
-			cdn:           false,
+			cdn:           true,
 			features:      &config.Features{SriChecksEnabled: true},
 			expModuleHash: newSRIHash(t, "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f"),
 		},
@@ -351,12 +365,24 @@ func TestService_ModuleHash(t *testing.T) {
 			expModuleHash: "",
 		},
 	} {
+		if tc.name == "" {
+			var expS string
+			if tc.expModuleHash == "" {
+				expS = "should not return module hash"
+			} else {
+				expS = "should return module hash"
+			}
+			tc.name = fmt.Sprintf("feature=%v, cdn_config=%v, class=%v %s", tc.features.SriChecksEnabled, tc.cdn, tc.plugin.Class, expS)
+		}
+
 		t.Run(tc.name, func(t *testing.T) {
 			var pluginSettings setting.PluginSettings
 			if tc.cdn {
 				pluginSettings = newPluginSettings(pluginID, map[string]string{
 					"cdn": "true",
 				})
+			} else {
+				require.NotEqual(t, plugins.ClassCDN, tc.plugin.Class, "plugin should not have the CDN class because CDN is disabled")
 			}
 			features := tc.features
 			if features == nil {
@@ -413,6 +439,7 @@ func TestService_ModuleHash_Cache(t *testing.T) {
 			withInfo(plugins.Info{Version: "1.0.0"}),
 			withSignatureStatus(plugins.SignatureStatusValid),
 			withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid"))),
+			withClass(plugins.ClassCDN),
 		)
 		k := svc.moduleHashCacheKey(pV1)
 
@@ -434,6 +461,7 @@ func TestService_ModuleHash_Cache(t *testing.T) {
 				withSignatureStatus(plugins.SignatureStatusValid),
 				// different fs for different hash
 				withFS(plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested"))),
+				withClass(plugins.ClassCDN),
 			)
 			mhV2 := svc.ModuleHash(context.Background(), pV2)
 			require.NotEqual(t, mhV2, mhV1, "different version should have different hash")
@@ -522,6 +550,13 @@ func withParent(parentID string) func(p pluginstore.Plugin) pluginstore.Plugin {
 	}
 }
 
+func withClass(class plugins.Class) func(p pluginstore.Plugin) pluginstore.Plugin {
+	return func(p pluginstore.Plugin) pluginstore.Plugin {
+		p.Class = class
+		return p
+	}
+}
+
 func newCfg(ps setting.PluginSettings) *config.PluginManagementCfg {
 	return &config.PluginManagementCfg{
 		PluginSettings: ps,

From cbb688e910432fdb9bbcdd6e804424af89950e44 Mon Sep 17 00:00:00 2001
From: Alexander Zobnin <alexanderzobnin@gmail.com>
Date: Tue, 14 Jan 2025 10:26:15 +0100
Subject: [PATCH 20/24] Zanzana: Remove usage from legacy access control
 (#98883)

* Zanzana: Remove usage from legacy access control

* remove unused

* remove zanzana client from services where it's not used

* remove unused metrics

* fix linter
---
 pkg/api/annotations_test.go                   |   3 +-
 pkg/api/common_test.go                        |   5 +-
 pkg/api/dashboard_snapshot_test.go            |   3 +-
 pkg/api/dashboard_test.go                     |  13 +-
 pkg/api/datasources_test.go                   |   7 +-
 pkg/api/folder_bench_test.go                  |   6 +-
 pkg/api/pluginproxy/ds_proxy_test.go          |   8 +-
 pkg/api/pluginproxy/pluginproxy_test.go       |  10 +-
 pkg/api/plugins_test.go                       |   8 +-
 pkg/api/user_test.go                          |   8 +-
 .../usagestats/service/usage_stats_test.go    |   3 +-
 pkg/login/social/socialimpl/service_test.go   |   5 +-
 pkg/registry/apis/folders/register_test.go    |  24 +-
 pkg/registry/apis/iam/common/common_test.go   |   3 +-
 .../accesscontrol/acimpl/accesscontrol.go     | 129 +--------
 .../acimpl/accesscontrol_test.go              |   3 +-
 pkg/services/accesscontrol/acimpl/metrics.go  |  53 ----
 .../accesscontrol/authorize_in_org_test.go    |   4 +-
 pkg/services/accesscontrol/authorizer_test.go |   4 +-
 pkg/services/accesscontrol/middleware_test.go |   5 +-
 .../ossaccesscontrol/testutil/testutil.go     |   2 +-
 .../resourcepermissions/service_test.go       |   5 +-
 .../accesscontrol/accesscontrol_test.go       |   5 +-
 .../annotationsimpl/annotations_test.go       |   9 +-
 .../correlations/correlationstest/fake.go     |   3 +-
 .../dashboards/database/database_test.go      |   5 +-
 .../dashboards/service/dashboard_service.go   |  15 +-
 .../dashboard_service_integration_test.go     |   6 -
 pkg/services/dashboards/service/zanzana.go    | 255 ------------------
 .../service/zanzana_integration_test.go       | 155 -----------
 .../service/service_test.go                   |   3 +-
 pkg/services/folder/folderimpl/folder_test.go |  50 ++--
 .../folderimpl/folder_unifiedstorage_test.go  |   3 +-
 .../guardian/accesscontrol_guardian_test.go   |   3 +-
 pkg/services/ldap/api/service_test.go         |   3 +-
 .../libraryelements/libraryelements_test.go   |  13 +-
 .../librarypanels/librarypanels_test.go       |   5 +-
 pkg/services/live/live_test.go                |   3 +-
 .../navtree/navtreeimpl/applinks_test.go      |   3 +-
 .../ngalert/accesscontrol/rules_test.go       |   3 +-
 .../ngalert/api/api_alertmanager_test.go      |   5 +-
 .../ngalert/api/api_prometheus_test.go        |   7 +-
 pkg/services/ngalert/api/api_ruler_test.go    |   3 +-
 .../ngalert/notifier/receiver_svc_test.go     |   5 +-
 .../provisioning/contactpoints_test.go        |   3 +-
 pkg/services/ngalert/testutil/testutil.go     |   3 +-
 .../publicdashboards/api/common_test.go       |   3 +-
 .../publicdashboards/api/query_test.go        |   3 +-
 .../publicdashboards/service/service_test.go  |   3 +-
 pkg/services/quota/quotaimpl/quota_test.go    |   5 +-
 pkg/services/serviceaccounts/api/api_test.go  |   3 +-
 pkg/services/ssosettings/api/api_test.go      |   3 +-
 .../ssosettingsimpl/service_test.go           |   3 +-
 .../team/teamapi/team_members_test.go         |   5 +-
 .../notifications/receivers/receiver_test.go  |   7 +-
 .../routingtree/routing_tree_test.go          |   3 +-
 .../templategroup/templates_group_test.go     |   5 +-
 .../timeinterval/timeinterval_test.go         |   7 +-
 58 files changed, 139 insertions(+), 790 deletions(-)
 delete mode 100644 pkg/services/accesscontrol/acimpl/metrics.go
 delete mode 100644 pkg/services/dashboards/service/zanzana.go
 delete mode 100644 pkg/services/dashboards/service/zanzana_integration_test.go

diff --git a/pkg/api/annotations_test.go b/pkg/api/annotations_test.go
index 12eea783e5d..977f3307ca1 100644
--- a/pkg/api/annotations_test.go
+++ b/pkg/api/annotations_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/annotations"
 	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder"
@@ -402,7 +401,7 @@ func TestAPI_Annotations(t *testing.T) {
 				folderDB.On("GetFolderByID", mock.Anything, mock.Anything, mock.Anything).Return(&folder.Folder{UID: folderUID, ID: 1}, nil)
 				hs.DashboardService = dashService
 				hs.folderService = folderService
-				hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+				hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 				hs.AccessControl.RegisterScopeAttributeResolver(AnnotationTypeScopeResolver(hs.annotationsRepo, hs.Features, dashService, folderService))
 				hs.AccessControl.RegisterScopeAttributeResolver(dashboards.NewDashboardIDScopeResolver(folderDB, dashService, folderService))
 			})
diff --git a/pkg/api/common_test.go b/pkg/api/common_test.go
index 6d0dc92df4a..4ea428b2a1b 100644
--- a/pkg/api/common_test.go
+++ b/pkg/api/common_test.go
@@ -27,7 +27,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/auth/authtest"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/contexthandler"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	dashver "github.com/grafana/grafana/pkg/services/dashboardversion"
@@ -271,7 +270,7 @@ func setupSimpleHTTPServer(features featuremgmt.FeatureToggles) *HTTPServer {
 		Cfg:             cfg,
 		Features:        features,
 		License:         &licensing.OSSLicensingService{},
-		AccessControl:   acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl:   acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		annotationsRepo: annotationstest.NewFakeAnnotationsRepo(),
 		authInfoService: &authinfotest.FakeService{
 			ExpectedLabels: map[int64]string{int64(1): login.GetAuthProviderLabel(login.LDAPAuthModule)},
@@ -314,7 +313,7 @@ func SetupAPITestServer(t *testing.T, opts ...APITestServerOption) *webtest.Serv
 	}
 
 	if hs.AccessControl == nil {
-		hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+		hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	}
 
 	hs.registerRoutes()
diff --git a/pkg/api/dashboard_snapshot_test.go b/pkg/api/dashboard_snapshot_test.go
index 0f49dc935a4..2f27909020e 100644
--- a/pkg/api/dashboard_snapshot_test.go
+++ b/pkg/api/dashboard_snapshot_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/db/dbtest"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboardsnapshots"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -40,7 +39,7 @@ func TestHTTPServer_DeleteDashboardSnapshot(t *testing.T) {
 
 			hs.DashboardService = svc
 
-			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			guardian.InitAccessControlGuardian(hs.Cfg, hs.AccessControl, hs.DashboardService)
 		})
 	}
diff --git a/pkg/api/dashboard_test.go b/pkg/api/dashboard_test.go
index 45965caa319..ad0d6643c65 100644
--- a/pkg/api/dashboard_test.go
+++ b/pkg/api/dashboard_test.go
@@ -30,7 +30,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
 	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
@@ -131,7 +130,7 @@ func newTestLive(t *testing.T, store db.DB) *live.GrafanaLive {
 		nil,
 		&usagestats.UsageStatsMock{T: t},
 		nil,
-		features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), &dashboards.FakeDashboardService{}, annotationstest.NewFakeAnnotationsRepo(), nil)
+		features, acimpl.ProvideAccessControl(features), &dashboards.FakeDashboardService{}, annotationstest.NewFakeAnnotationsRepo(), nil)
 	require.NoError(t, err)
 	return gLive
 }
@@ -148,7 +147,7 @@ func TestHTTPServer_GetDashboard_AccessControl(t *testing.T) {
 			hs.DashboardService = dashSvc
 
 			hs.Cfg = setting.NewCfg()
-			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			hs.starService = startest.NewStarServiceFake()
 			hs.dashboardProvisioningService = mockDashboardProvisioningService{}
 
@@ -267,7 +266,7 @@ func TestHTTPServer_DeleteDashboardByUID_AccessControl(t *testing.T) {
 			hs.DashboardService = dashSvc
 
 			hs.Cfg = setting.NewCfg()
-			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			hs.starService = startest.NewStarServiceFake()
 
 			hs.LibraryPanelService = &mockLibraryPanelService{}
@@ -323,7 +322,7 @@ func TestHTTPServer_GetDashboardVersions_AccessControl(t *testing.T) {
 			hs.DashboardService = dashSvc
 
 			hs.Cfg = setting.NewCfg()
-			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			hs.starService = startest.NewStarServiceFake()
 
 			hs.dashboardVersionService = &dashvertest.FakeDashboardVersionService{
@@ -838,14 +837,14 @@ func getDashboardShouldReturn200WithConfig(t *testing.T, sc *scenarioContext, pr
 	if dashboardService == nil {
 		dashboardService, err = service.ProvideDashboardServiceImpl(
 			cfg, dashboardStore, folderStore, features, folderPermissions, dashboardPermissions,
-			ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+			ac, folderSvc, fStore, nil, nil, nil, nil, quotaService, nil,
 		)
 		require.NoError(t, err)
 	}
 
 	dashboardProvisioningService, err := service.ProvideDashboardServiceImpl(
 		cfg, dashboardStore, folderStore, features, folderPermissions, dashboardPermissions,
-		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+		ac, folderSvc, fStore, nil, nil, nil, nil, quotaService, nil,
 	)
 	require.NoError(t, err)
 
diff --git a/pkg/api/datasources_test.go b/pkg/api/datasources_test.go
index 70190bf2a00..10a8237d1b3 100644
--- a/pkg/api/datasources_test.go
+++ b/pkg/api/datasources_test.go
@@ -19,7 +19,6 @@ import (
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/datasources/guardian"
@@ -116,7 +115,7 @@ func TestAddDataSource_URLWithoutProtocol(t *testing.T) {
 			expectedDatasource: &datasources.DataSource{},
 		},
 		Cfg:                  setting.NewCfg(),
-		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		accesscontrolService: actest.FakeService{},
 	}
 
@@ -287,7 +286,7 @@ func TestUpdateDataSource_URLWithoutProtocol(t *testing.T) {
 			expectedDatasource: &datasources.DataSource{},
 		},
 		Cfg:                  setting.NewCfg(),
-		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		accesscontrolService: actest.FakeService{},
 	}
 
@@ -320,7 +319,7 @@ func TestUpdateDataSourceByID_DataSourceNameExists(t *testing.T) {
 			},
 		},
 		Cfg:                  setting.NewCfg(),
-		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		accesscontrolService: actest.FakeService{},
 		Live:                 newTestLive(t, nil),
 	}
diff --git a/pkg/api/folder_bench_test.go b/pkg/api/folder_bench_test.go
index cb0d7fe8672..d8ed6e33237 100644
--- a/pkg/api/folder_bench_test.go
+++ b/pkg/api/folder_bench_test.go
@@ -456,7 +456,7 @@ func setupServer(b testing.TB, sc benchScenario, features featuremgmt.FeatureTog
 
 	folderStore := folderimpl.ProvideDashboardFolderStore(sc.db)
 
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	cfg := setting.NewCfg()
 	actionSets := resourcepermissions.NewActionSetService(features)
 	fStore := folderimpl.ProvideStore(sc.db)
@@ -477,7 +477,7 @@ func setupServer(b testing.TB, sc benchScenario, features featuremgmt.FeatureTog
 	dashboardSvc, err := dashboardservice.ProvideDashboardServiceImpl(
 		sc.cfg, dashStore, folderStore,
 		features, folderPermissions, dashboardPermissions, ac,
-		folderServiceWithFlagOn, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaSrv, nil,
+		folderServiceWithFlagOn, fStore, nil, nil, nil, nil, quotaSrv, nil,
 	)
 	require.NoError(b, err)
 
@@ -495,7 +495,7 @@ func setupServer(b testing.TB, sc benchScenario, features featuremgmt.FeatureTog
 		DashboardService: dashboardSvc,
 	}
 
-	hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	guardian.InitAccessControlGuardian(hs.Cfg, hs.AccessControl, hs.DashboardService)
 
 	m.Get("/api/folders", hs.GetFolders)
diff --git a/pkg/api/pluginproxy/ds_proxy_test.go b/pkg/api/pluginproxy/ds_proxy_test.go
index 5c02a119116..a2b70b8aa2a 100644
--- a/pkg/api/pluginproxy/ds_proxy_test.go
+++ b/pkg/api/pluginproxy/ds_proxy_test.go
@@ -20,6 +20,7 @@ import (
 	"golang.org/x/oauth2"
 
 	"github.com/grafana/authlib/claims"
+
 	"github.com/grafana/grafana/pkg/api/datasource"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/components/simplejson"
@@ -33,7 +34,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	"github.com/grafana/grafana/pkg/services/auth"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/contexthandler/ctxkey"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/datasources"
@@ -917,7 +917,7 @@ func getDatasourceProxiedRequest(t *testing.T, ctx *contextmodel.ReqContext, cfg
 	secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
 	features := featuremgmt.WithFeatures()
 	quotaService := quotatest.New(false, nil)
-	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features),
 		&actest.FakePermissionsService{}, quotaService, &pluginstore.FakePluginStore{}, &pluginfakes.FakePluginClient{},
 		plugincontext.ProvideBaseService(cfg, pluginconfig.NewFakePluginRequestConfigProvider()))
 	require.NoError(t, err)
@@ -1039,7 +1039,7 @@ func runDatasourceAuthTest(t *testing.T, secretsService secrets.Service, secrets
 	var routes []*plugins.Route
 	features := featuremgmt.WithFeatures()
 	quotaService := quotatest.New(false, nil)
-	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features),
 		&actest.FakePermissionsService{}, quotaService, &pluginstore.FakePluginStore{}, &pluginfakes.FakePluginClient{},
 		plugincontext.ProvideBaseService(cfg, pluginconfig.NewFakePluginRequestConfigProvider()))
 	require.NoError(t, err)
@@ -1095,7 +1095,7 @@ func setupDSProxyTest(t *testing.T, ctx *contextmodel.ReqContext, ds *datasource
 	secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
 	secretsStore := secretskvs.NewSQLSecretsKVStore(dbtest.NewFakeDB(), secretsService, log.NewNopLogger())
 	features := featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall)
-	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+	dsService, err := datasourceservice.ProvideService(nil, secretsService, secretsStore, cfg, features, acimpl.ProvideAccessControl(features),
 		&actest.FakePermissionsService{}, quotatest.New(false, nil), &pluginstore.FakePluginStore{}, &pluginfakes.FakePluginClient{},
 		plugincontext.ProvideBaseService(cfg, pluginconfig.NewFakePluginRequestConfigProvider()))
 	require.NoError(t, err)
diff --git a/pkg/api/pluginproxy/pluginproxy_test.go b/pkg/api/pluginproxy/pluginproxy_test.go
index c1a8523f942..a4ab9a6e6cd 100644
--- a/pkg/api/pluginproxy/pluginproxy_test.go
+++ b/pkg/api/pluginproxy/pluginproxy_test.go
@@ -13,10 +13,10 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/authlib/claims"
+
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/org"
@@ -267,7 +267,7 @@ func TestPluginProxy(t *testing.T) {
 			SecureJSONData: map[string][]byte{},
 		}
 		cfg := &setting.Cfg{}
-		proxy, err := NewPluginProxy(ps, routes, ctx, "", cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), featuremgmt.WithFeatures())
+		proxy, err := NewPluginProxy(ps, routes, ctx, "", cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), featuremgmt.WithFeatures())
 		require.NoError(t, err)
 		proxy.HandleRequest()
 
@@ -423,7 +423,7 @@ func TestPluginProxyRoutes(t *testing.T) {
 				SecureJSONData: map[string][]byte{},
 			}
 			cfg := &setting.Cfg{}
-			proxy, err := NewPluginProxy(ps, testRoutes, ctx, tc.proxyPath, cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), featuremgmt.WithFeatures(tc.withFeatures...))
+			proxy, err := NewPluginProxy(ps, testRoutes, ctx, tc.proxyPath, cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), featuremgmt.WithFeatures(tc.withFeatures...))
 			require.NoError(t, err)
 			proxy.HandleRequest()
 
@@ -557,7 +557,7 @@ func TestPluginProxyRoutesAccessControl(t *testing.T) {
 				SecureJSONData: map[string][]byte{},
 			}
 			cfg := &setting.Cfg{}
-			proxy, err := NewPluginProxy(ps, testRoutes, ctx, tc.proxyPath, cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall))
+			proxy, err := NewPluginProxy(ps, testRoutes, ctx, tc.proxyPath, cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall))
 			require.NoError(t, err)
 			proxy.HandleRequest()
 
@@ -588,7 +588,7 @@ func getPluginProxiedRequest(t *testing.T, ps *pluginsettings.DTO, secretsServic
 			ReqRole: org.RoleEditor,
 		}
 	}
-	proxy, err := NewPluginProxy(ps, []*plugins.Route{}, ctx, "", cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), featuremgmt.WithFeatures())
+	proxy, err := NewPluginProxy(ps, []*plugins.Route{}, ctx, "", cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{}, acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), featuremgmt.WithFeatures())
 	require.NoError(t, err)
 
 	req, err := http.NewRequest(http.MethodGet, "/api/plugin-proxy/grafana-simple-app/api/v4/alerts", nil)
diff --git a/pkg/api/plugins_test.go b/pkg/api/plugins_test.go
index 639dd12f174..5dd1ab5aa67 100644
--- a/pkg/api/plugins_test.go
+++ b/pkg/api/plugins_test.go
@@ -12,13 +12,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana/pkg/plugins/auth"
 	"github.com/prometheus/client_golang/prometheus"
 	dto "github.com/prometheus/client_model/go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana/pkg/plugins/auth"
+
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/log/logtest"
@@ -36,7 +37,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/org"
@@ -759,7 +759,7 @@ func TestHTTPServer_hasPluginRequestedPermissions(t *testing.T) {
 			}
 			hs.log = logger
 			hs.accesscontrolService = actest.FakeService{}
-			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 			expectedIdentity := &authn.Identity{
 				OrgID:       tt.orgID,
diff --git a/pkg/api/user_test.go b/pkg/api/user_test.go
index 3ecf9f752d9..557af60259a 100644
--- a/pkg/api/user_test.go
+++ b/pkg/api/user_test.go
@@ -10,12 +10,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/grafana/grafana/pkg/services/authn"
-	"github.com/grafana/grafana/pkg/services/authn/authntest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 
+	"github.com/grafana/grafana/pkg/services/authn"
+	"github.com/grafana/grafana/pkg/services/authn/authntest"
+
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
@@ -30,7 +31,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
 	"github.com/grafana/grafana/pkg/services/auth/idtest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/login"
@@ -63,7 +63,7 @@ func TestUserAPIEndpoint_userLoggedIn(t *testing.T) {
 	hs := &HTTPServer{
 		Cfg:           settings,
 		SQLStore:      sqlStore,
-		AccessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 	}
 
 	mockResult := user.SearchUserQueryResult{
diff --git a/pkg/infra/usagestats/service/usage_stats_test.go b/pkg/infra/usagestats/service/usage_stats_test.go
index c405c681329..2667144d5a4 100644
--- a/pkg/infra/usagestats/service/usage_stats_test.go
+++ b/pkg/infra/usagestats/service/usage_stats_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/infra/usagestats"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/supportbundles/supportbundlestest"
 	"github.com/grafana/grafana/pkg/setting"
@@ -248,7 +247,7 @@ func createService(t *testing.T, sqlStore db.DB, withDB bool) *UsageStats {
 		kvstore.ProvideService(sqlStore),
 		routing.NewRouteRegister(),
 		tracing.InitializeTracerForTest(),
-		acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		supportbundlestest.NewFakeBundleService(),
 	)
 
diff --git a/pkg/login/social/socialimpl/service_test.go b/pkg/login/social/socialimpl/service_test.go
index 766fd501fea..ad9617bc15b 100644
--- a/pkg/login/social/socialimpl/service_test.go
+++ b/pkg/login/social/socialimpl/service_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/grafana/grafana/pkg/login/social"
 	"github.com/grafana/grafana/pkg/login/social/connectors"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/licensing"
 	secretsfake "github.com/grafana/grafana/pkg/services/secrets/fakes"
@@ -68,7 +67,7 @@ func TestSocialService_ProvideService(t *testing.T) {
 	cfg.Raw = iniFile
 
 	secrets := secretsfake.NewMockService(t)
-	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	sqlStore := db.InitTestDB(t)
 
 	ssoSettingsSvc := ssosettingsimpl.ProvideService(
@@ -180,7 +179,7 @@ func TestSocialService_ProvideService_GrafanaComGrafanaNet(t *testing.T) {
 
 	cfg := setting.NewCfg()
 	secrets := secretsfake.NewMockService(t)
-	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	sqlStore := db.InitTestDB(t)
 
 	ssoSettingsSvc := ssosettingsimpl.ProvideService(
diff --git a/pkg/registry/apis/folders/register_test.go b/pkg/registry/apis/folders/register_test.go
index 6d9211cfa26..4f1aae986f7 100644
--- a/pkg/registry/apis/folders/register_test.go
+++ b/pkg/registry/apis/folders/register_test.go
@@ -4,24 +4,24 @@ import (
 	"context"
 	"testing"
 
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
 
 func TestFolderAPIBuilder_getAuthorizerFunc(t *testing.T) {
@@ -194,7 +194,7 @@ func TestFolderAPIBuilder_getAuthorizerFunc(t *testing.T) {
 		features:      nil,
 		namespacer:    func(_ int64) string { return "123" },
 		folderSvc:     foldertest.NewFakeService(),
-		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 	}
 
 	for _, tt := range tests {
@@ -299,7 +299,7 @@ func TestFolderAPIBuilder_Validate_Create(t *testing.T) {
 		namespacer:    func(_ int64) string { return "123" },
 		folderSvc:     foldertest.NewFakeService(),
 		storage:       us,
-		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 	}
 
 	for _, tt := range tests {
@@ -384,7 +384,7 @@ func TestFolderAPIBuilder_Validate_Delete(t *testing.T) {
 				namespacer:    func(_ int64) string { return "123" },
 				folderSvc:     foldertest.NewFakeService(),
 				storage:       us,
-				accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+				accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 				searcher:      sm,
 			}
 
@@ -550,7 +550,7 @@ func TestFolderAPIBuilder_Validate_Update(t *testing.T) {
 				namespacer:    func(_ int64) string { return "123" },
 				folderSvc:     foldertest.NewFakeService(),
 				storage:       us,
-				accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+				accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 				searcher:      sm,
 			}
 
@@ -646,7 +646,7 @@ func TestFolderAPIBuilder_Mutate_Create(t *testing.T) {
 		namespacer:    func(_ int64) string { return "123" },
 		folderSvc:     foldertest.NewFakeService(),
 		storage:       us,
-		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 		searcher:      sm,
 	}
 	for _, tt := range tests {
@@ -753,7 +753,7 @@ func TestFolderAPIBuilder_Mutate_Update(t *testing.T) {
 		namespacer:    func(_ int64) string { return "123" },
 		folderSvc:     foldertest.NewFakeService(),
 		storage:       us,
-		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders"), zanzana.NewNoopClient()),
+		accessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures("nestedFolders")),
 		searcher:      sm,
 	}
 	for _, tt := range tests {
diff --git a/pkg/registry/apis/iam/common/common_test.go b/pkg/registry/apis/iam/common/common_test.go
index c07c2cb63f9..df0b6e7910f 100644
--- a/pkg/registry/apis/iam/common/common_test.go
+++ b/pkg/registry/apis/iam/common/common_test.go
@@ -11,7 +11,6 @@ import (
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 )
 
@@ -24,7 +23,7 @@ func (i item) AuthID() string {
 }
 
 func TestList(t *testing.T) {
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	t.Run("should allow all items if no access client is passed", func(t *testing.T) {
 		ctx := newContext("stacks-1", newIdent())
diff --git a/pkg/services/accesscontrol/acimpl/accesscontrol.go b/pkg/services/accesscontrol/acimpl/accesscontrol.go
index effccef7653..01e6bf3385e 100644
--- a/pkg/services/accesscontrol/acimpl/accesscontrol.go
+++ b/pkg/services/accesscontrol/acimpl/accesscontrol.go
@@ -3,7 +3,6 @@ package acimpl
 import (
 	"context"
 	"errors"
-	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
@@ -12,54 +11,37 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/metrics"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 )
 
-var (
-	errAccessNotImplemented = errors.New("access control not implemented for resource")
-	tracer                  = otel.Tracer("github.com/grafana/grafana/pkg/services/accesscontrol/acimpl")
-)
+var tracer = otel.Tracer("github.com/grafana/grafana/pkg/services/accesscontrol/acimpl")
 
 var _ accesscontrol.AccessControl = new(AccessControl)
 
-func ProvideAccessControl(features featuremgmt.FeatureToggles, zclient zanzana.Client) *AccessControl {
+func ProvideAccessControl(features featuremgmt.FeatureToggles) *AccessControl {
 	logger := log.New("accesscontrol")
 
-	var m *acMetrics
-	if features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
-		m = initMetrics()
-	}
-
 	return &AccessControl{
 		features,
 		logger,
 		accesscontrol.NewResolvers(logger),
-		zclient,
-		m,
 	}
 }
 
 func ProvideAccessControlTest() *AccessControl {
-	return ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	return ProvideAccessControl(featuremgmt.WithFeatures())
 }
 
 type AccessControl struct {
 	features  featuremgmt.FeatureToggles
 	log       log.Logger
 	resolvers accesscontrol.Resolvers
-	zclient   zanzana.Client
-	metrics   *acMetrics
 }
 
 func (a *AccessControl) Evaluate(ctx context.Context, user identity.Requester, evaluator accesscontrol.Evaluator) (bool, error) {
 	ctx, span := tracer.Start(ctx, "accesscontrol.acimpl.Evaluate")
 	defer span.End()
 
-	if a.features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
-		return a.evaluateCompare(ctx, user, evaluator)
-	}
-
 	return a.evaluate(ctx, user, evaluator)
 }
 
@@ -104,109 +86,6 @@ func (a *AccessControl) evaluate(ctx context.Context, user identity.Requester, e
 	return resolvedEvaluator.Evaluate(permissions), nil
 }
 
-func (a *AccessControl) evaluateZanzana(ctx context.Context, user identity.Requester, evaluator accesscontrol.Evaluator) (bool, error) {
-	ctx, span := tracer.Start(ctx, "accesscontrol.acimpl.evaluateZanzana")
-	defer span.End()
-
-	eval, err := evaluator.MutateScopes(ctx, a.resolvers.GetScopeAttributeMutator(user.GetOrgID()))
-	if err != nil {
-		if !errors.Is(err, accesscontrol.ErrResolverNotFound) {
-			return false, err
-		}
-		eval = evaluator
-	}
-
-	return eval.EvaluateCustom(func(action string, scopes ...string) (bool, error) {
-		// FIXME: handle action with no scopes
-		if len(scopes) == 0 {
-			return false, nil
-		}
-
-		resourceScope := scopes[0]
-		kind, _, identifier := accesscontrol.SplitScope(resourceScope)
-
-		// Parent folder always returned by scope resolver as a second value
-		var parentFolder string
-		if len(scopes) > 1 {
-			_, _, parentFolder = accesscontrol.SplitScope(scopes[1])
-		}
-
-		req, ok := zanzana.TranslateToCheckRequest(user.GetNamespace(), action, kind, parentFolder, identifier)
-		if !ok {
-			// unsupported translation
-			return false, errAccessNotImplemented
-		}
-
-		a.log.Debug("evaluating zanzana", "user", user.GetUID(), "namespace", req.Namespace, "verb", req.Verb, "resource", req.Resource, "name", req.Name)
-		res, err := a.zclient.Check(ctx, user, *req)
-
-		if err != nil {
-			return false, err
-		}
-
-		return res.Allowed, nil
-	})
-}
-
-type evalResult struct {
-	runner   string
-	decision bool
-	err      error
-	duration time.Duration
-}
-
-// evaluateCompare run RBAC and zanzana checks in parallel and then compare result
-func (a *AccessControl) evaluateCompare(ctx context.Context, user identity.Requester, evaluator accesscontrol.Evaluator) (bool, error) {
-	ctx, span := tracer.Start(ctx, "accesscontrol.acimpl.evaluateCompare")
-	defer span.End()
-
-	res := make(chan evalResult, 2)
-	go func() {
-		timer := prometheus.NewTimer(a.metrics.mAccessEngineEvaluationsSeconds.WithLabelValues("zanzana"))
-		defer timer.ObserveDuration()
-		start := time.Now()
-
-		hasAccess, err := a.evaluateZanzana(ctx, user, evaluator)
-		res <- evalResult{"zanzana", hasAccess, err, time.Since(start)}
-	}()
-
-	go func() {
-		timer := prometheus.NewTimer(a.metrics.mAccessEngineEvaluationsSeconds.WithLabelValues("grafana"))
-		defer timer.ObserveDuration()
-		start := time.Now()
-
-		hasAccess, err := a.evaluate(ctx, user, evaluator)
-		res <- evalResult{"grafana", hasAccess, err, time.Since(start)}
-	}()
-	first, second := <-res, <-res
-	close(res)
-
-	if second.runner == "grafana" {
-		first, second = second, first
-	}
-
-	if !errors.Is(second.err, errAccessNotImplemented) {
-		if second.err != nil {
-			a.log.Error("zanzana evaluation failed", "error", second.err)
-		} else if first.decision != second.decision {
-			a.metrics.mZanzanaEvaluationStatusTotal.WithLabelValues("error").Inc()
-			a.log.Warn(
-				"zanzana evaluation result does not match grafana",
-				"grafana_decision", first.decision,
-				"zanana_decision", second.decision,
-				"grafana_ms", first.duration,
-				"zanzana_ms", second.duration,
-				"eval", evaluator.GoString(),
-			)
-		} else {
-			a.metrics.mZanzanaEvaluationStatusTotal.WithLabelValues("success").Inc()
-			a.log.Debug("zanzana evaluation is correct", "grafana_ms", first.duration, "zanzana_ms", second.duration)
-		}
-	}
-
-	return first.decision, first.err
-}
-
 func (a *AccessControl) RegisterScopeAttributeResolver(prefix string, resolver accesscontrol.ScopeAttributeResolver) {
 	a.resolvers.AddScopeAttributeResolver(prefix, resolver)
 }
@@ -215,8 +94,6 @@ func (a *AccessControl) WithoutResolvers() accesscontrol.AccessControl {
 	return &AccessControl{
 		features:  a.features,
 		log:       a.log,
-		zclient:   a.zclient,
-		metrics:   a.metrics,
 		resolvers: accesscontrol.NewResolvers(a.log),
 	}
 }
diff --git a/pkg/services/accesscontrol/acimpl/accesscontrol_test.go b/pkg/services/accesscontrol/acimpl/accesscontrol_test.go
index 22f2e5d4858..9bc60141a14 100644
--- a/pkg/services/accesscontrol/acimpl/accesscontrol_test.go
+++ b/pkg/services/accesscontrol/acimpl/accesscontrol_test.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/user"
 )
@@ -66,7 +65,7 @@ func TestAccessControl_Evaluate(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets), zanzana.NewNoopClient())
+			ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets))
 
 			if tt.scopeResolver != nil {
 				ac.RegisterScopeAttributeResolver(tt.resolverPrefix, tt.scopeResolver)
diff --git a/pkg/services/accesscontrol/acimpl/metrics.go b/pkg/services/accesscontrol/acimpl/metrics.go
deleted file mode 100644
index 253f1160f1a..00000000000
--- a/pkg/services/accesscontrol/acimpl/metrics.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package acimpl
-
-import (
-	"sync"
-
-	"github.com/prometheus/client_golang/prometheus"
-
-	"github.com/grafana/grafana/pkg/infra/metrics/metricutil"
-)
-
-const (
-	metricsSubSystem = "authz"
-	metricsNamespace = "grafana"
-)
-
-type acMetrics struct {
-	// mAccessEngineEvaluationsSeconds is a summary for evaluating access for a specific engine (RBAC and zanzana)
-	mAccessEngineEvaluationsSeconds *prometheus.HistogramVec
-	// mZanzanaEvaluationStatusTotal is a metric for zanzana evaluation status
-	mZanzanaEvaluationStatusTotal *prometheus.CounterVec
-}
-
-var once sync.Once
-
-// TODO: use prometheus.Registerer
-func initMetrics() *acMetrics {
-	m := &acMetrics{}
-	once.Do(func() {
-		m.mAccessEngineEvaluationsSeconds = prometheus.NewHistogramVec(prometheus.HistogramOpts{
-			Name:      "engine_evaluations_seconds",
-			Help:      "Histogram for evaluation time for the specific access control engine (RBAC and zanzana).",
-			Namespace: metricsNamespace,
-			Subsystem: metricsSubSystem,
-			Buckets:   prometheus.ExponentialBuckets(0.00001, 4, 10),
-		},
-			[]string{"engine"},
-		)
-
-		m.mZanzanaEvaluationStatusTotal = metricutil.NewCounterVecStartingAtZero(
-			prometheus.CounterOpts{
-				Name:      "zanzana_evaluation_status_total",
-				Help:      "evaluation status (success or error) for zanzana",
-				Namespace: metricsNamespace,
-				Subsystem: metricsSubSystem,
-			}, []string{"status"}, map[string][]string{"status": {"success", "error"}})
-
-		prometheus.MustRegister(
-			m.mAccessEngineEvaluationsSeconds,
-			m.mZanzanaEvaluationStatusTotal,
-		)
-	})
-	return m
-}
diff --git a/pkg/services/accesscontrol/authorize_in_org_test.go b/pkg/services/accesscontrol/authorize_in_org_test.go
index 8eb3082e1cc..6839f4c3902 100644
--- a/pkg/services/accesscontrol/authorize_in_org_test.go
+++ b/pkg/services/accesscontrol/authorize_in_org_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/grafana/authlib/claims"
+
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/team"
@@ -24,7 +24,7 @@ import (
 )
 
 func TestAuthorizeInOrgMiddleware(t *testing.T) {
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	// Define test cases
 	testCases := []struct {
diff --git a/pkg/services/accesscontrol/authorizer_test.go b/pkg/services/accesscontrol/authorizer_test.go
index 1a4ddf21b76..742a81088a8 100644
--- a/pkg/services/accesscontrol/authorizer_test.go
+++ b/pkg/services/accesscontrol/authorizer_test.go
@@ -7,15 +7,15 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/grafana/authlib/authz"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 )
 
 func TestLegacyAccessClient_Check(t *testing.T) {
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	t.Run("should reject when when no configuration for resource exist", func(t *testing.T) {
 		a := accesscontrol.NewLegacyAccessClient(ac)
diff --git a/pkg/services/accesscontrol/middleware_test.go b/pkg/services/accesscontrol/middleware_test.go
index afdb8ef5063..6374f165a5c 100644
--- a/pkg/services/accesscontrol/middleware_test.go
+++ b/pkg/services/accesscontrol/middleware_test.go
@@ -10,7 +10,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/contexthandler/ctxkey"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -26,7 +25,7 @@ type middlewareTestCase struct {
 }
 
 func TestMiddleware(t *testing.T) {
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	tests := []middlewareTestCase{
 		{
@@ -82,7 +81,7 @@ func TestMiddleware_forceLogin(t *testing.T) {
 		{url: "/endpoint"},
 	}
 
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	for _, tc := range tests {
 		t.Run(tc.url, func(t *testing.T) {
diff --git a/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go b/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
index 062bd27b535..0600c6b6cf4 100644
--- a/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
+++ b/pkg/services/accesscontrol/ossaccesscontrol/testutil/testutil.go
@@ -37,7 +37,7 @@ func ProvideFolderPermissions(
 	license := licensingtest.NewFakeLicensing()
 	license.On("FeatureEnabled", "accesscontrol.enforcement").Return(true).Maybe()
 
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	quotaService := quotatest.New(false, nil)
 	dashboardStore, err := database.ProvideDashboardStore(sqlStore, cfg, features, tagimpl.ProvideService(sqlStore))
diff --git a/pkg/services/accesscontrol/resourcepermissions/service_test.go b/pkg/services/accesscontrol/resourcepermissions/service_test.go
index 94ead810dd7..29d534cf218 100644
--- a/pkg/services/accesscontrol/resourcepermissions/service_test.go
+++ b/pkg/services/accesscontrol/resourcepermissions/service_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/licensing/licensingtest"
 	"github.com/grafana/grafana/pkg/services/org/orgimpl"
@@ -291,7 +290,7 @@ func TestService_RegisterActionSets(t *testing.T) {
 			if tt.actionSetsEnabled {
 				features = featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets)
 			}
-			ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+			ac := acimpl.ProvideAccessControl(features)
 			actionSets := NewActionSetService(features)
 			_, err := New(
 				setting.NewCfg(), tt.options, features, routing.NewRouteRegister(), licensingtest.NewFakeLicensing(),
@@ -509,7 +508,7 @@ func setupTestEnvironment(t *testing.T, ops Options) (*Service, user.Service, te
 	license.On("FeatureEnabled", "accesscontrol.enforcement").Return(true).Maybe()
 	acService := &actest.FakeService{}
 	features := featuremgmt.WithFeatures()
-	ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(features)
 	service, err := New(
 		cfg, ops, features, routing.NewRouteRegister(), license,
 		ac, acService, sql, teamSvc, userSvc, NewActionSetService(features),
diff --git a/pkg/services/annotations/accesscontrol/accesscontrol_test.go b/pkg/services/annotations/accesscontrol/accesscontrol_test.go
index ec6b7d5a0dc..37b3f5e9b93 100644
--- a/pkg/services/annotations/accesscontrol/accesscontrol_test.go
+++ b/pkg/services/annotations/accesscontrol/accesscontrol_test.go
@@ -16,7 +16,6 @@ import (
 	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
 	"github.com/grafana/grafana/pkg/services/annotations"
 	"github.com/grafana/grafana/pkg/services/annotations/testutil"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashboardsservice "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -47,12 +46,12 @@ func TestIntegrationAuthorize(t *testing.T) {
 	fStore := folderimpl.ProvideStore(sql)
 	dashStore, err := database.ProvideDashboardStore(sql, cfg, featuremgmt.WithFeatures(), tagimpl.ProvideService(sql))
 	require.NoError(t, err)
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	folderSvc := folderimpl.ProvideService(fStore, accesscontrolmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sql, featuremgmt.WithFeatures(),
 		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
-		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
+		ac, folderSvc, fStore, nil, nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
 
 	u := &user.SignedInUser{
diff --git a/pkg/services/annotations/annotationsimpl/annotations_test.go b/pkg/services/annotations/annotationsimpl/annotations_test.go
index b6b85e41aad..005eefb8184 100644
--- a/pkg/services/annotations/annotationsimpl/annotations_test.go
+++ b/pkg/services/annotations/annotationsimpl/annotations_test.go
@@ -19,7 +19,6 @@ import (
 	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
 	"github.com/grafana/grafana/pkg/services/annotations"
 	"github.com/grafana/grafana/pkg/services/annotations/testutil"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashboardsservice "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -59,12 +58,12 @@ func TestIntegrationAnnotationListingWithRBAC(t *testing.T) {
 	fStore := folderimpl.ProvideStore(sql)
 	dashStore, err := database.ProvideDashboardStore(sql, cfg, featuremgmt.WithFeatures(), tagimpl.ProvideService(sql))
 	require.NoError(t, err)
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	folderSvc := folderimpl.ProvideService(fStore, accesscontrolmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sql, featuremgmt.WithFeatures(),
 		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
-		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
+		ac, folderSvc, fStore, nil, nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
 
 	repo := ProvideService(sql, cfg, features, tagService, tracing.InitializeTracerForTest(), ruleStore, dashSvc)
@@ -240,13 +239,13 @@ func TestIntegrationAnnotationListingWithInheritedRBAC(t *testing.T) {
 			guardian.New = origNewGuardian
 		})
 
-		ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+		ac := acimpl.ProvideAccessControl(features)
 		fStore := folderimpl.ProvideStore(sql)
 		folderStore := folderimpl.ProvideDashboardFolderStore(sql)
 		folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore,
 			folderStore, sql, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 		dashSvc, err := dashboardsservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, features, accesscontrolmock.NewMockedPermissionsService(), accesscontrolmock.NewMockedPermissionsService(),
-			ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
+			ac, folderSvc, fStore, nil, nil, nil, nil, quotatest.New(false, nil), nil)
 		require.NoError(t, err)
 
 		cfg.AnnotationMaximumTagsLength = 60
diff --git a/pkg/services/correlations/correlationstest/fake.go b/pkg/services/correlations/correlationstest/fake.go
index f5f134bf51b..6263f9db41f 100644
--- a/pkg/services/correlations/correlationstest/fake.go
+++ b/pkg/services/correlations/correlationstest/fake.go
@@ -5,7 +5,6 @@ import (
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/correlations"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	fakeDatasources "github.com/grafana/grafana/pkg/services/datasources/fakes"
@@ -21,6 +20,6 @@ func New(db db.DB, cfg *setting.Cfg, bus bus.Bus) *correlations.CorrelationsServ
 		},
 	}
 
-	correlationsSvc, _ := correlations.ProvideService(db, routing.NewRouteRegister(), ds, acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), bus, quotatest.New(false, nil), cfg)
+	correlationsSvc, _ := correlations.ProvideService(db, routing.NewRouteRegister(), ds, acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), bus, quotatest.New(false, nil), cfg)
 	return correlationsSvc
 }
diff --git a/pkg/services/dashboards/database/database_test.go b/pkg/services/dashboards/database/database_test.go
index 60f3e45cfd1..d54dd4066cc 100644
--- a/pkg/services/dashboards/database/database_test.go
+++ b/pkg/services/dashboards/database/database_test.go
@@ -16,7 +16,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder"
@@ -887,7 +886,7 @@ func TestIntegrationFindDashboardsByTitle(t *testing.T) {
 	orgID := int64(1)
 	insertTestDashboard(t, dashboardStore, "dashboard under general", orgID, 0, "", false)
 
-	ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(features)
 	folderStore := folderimpl.ProvideDashboardFolderStore(sqlStore)
 	fStore := folderimpl.ProvideStore(sqlStore)
 	folderServiceWithFlagOn := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashboardStore,
@@ -1005,7 +1004,7 @@ func TestIntegrationFindDashboardsByFolder(t *testing.T) {
 	orgID := int64(1)
 	insertTestDashboard(t, dashboardStore, "dashboard under general", orgID, 0, "", false)
 
-	ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(features)
 	folderStore := folderimpl.ProvideDashboardFolderStore(sqlStore)
 	fStore := folderimpl.ProvideStore(sqlStore)
 
diff --git a/pkg/services/dashboards/service/dashboard_service.go b/pkg/services/dashboards/service/dashboard_service.go
index b02b0e5d6bd..2881db09436 100644
--- a/pkg/services/dashboards/service/dashboard_service.go
+++ b/pkg/services/dashboards/service/dashboard_service.go
@@ -26,6 +26,7 @@ import (
 	"k8s.io/client-go/dynamic"
 
 	"github.com/grafana/authlib/claims"
+
 	"github.com/grafana/grafana-plugin-sdk-go/backend/gtime"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
@@ -37,7 +38,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/apiserver"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
 	"github.com/grafana/grafana/pkg/services/datasources"
@@ -83,7 +83,6 @@ type DashboardServiceImpl struct {
 	folderPermissions    accesscontrol.FolderPermissionsService
 	dashboardPermissions accesscontrol.DashboardPermissionsService
 	ac                   accesscontrol.AccessControl
-	zclient              zanzana.Client
 	k8sclient            dashboardK8sHandler
 	metrics              *dashboardsMetrics
 }
@@ -109,7 +108,7 @@ func ProvideDashboardServiceImpl(
 	cfg *setting.Cfg, dashboardStore dashboards.Store, folderStore folder.FolderStore,
 	features featuremgmt.FeatureToggles, folderPermissionsService accesscontrol.FolderPermissionsService,
 	dashboardPermissionsService accesscontrol.DashboardPermissionsService, ac accesscontrol.AccessControl,
-	folderSvc folder.Service, fStore folder.Store, r prometheus.Registerer, zclient zanzana.Client,
+	folderSvc folder.Service, fStore folder.Store, r prometheus.Registerer,
 	restConfigProvider apiserver.RestConfigProvider, userService user.Service, unified resource.ResourceClient,
 	quotaService quota.Service, orgService org.Service,
 ) (*DashboardServiceImpl, error) {
@@ -128,7 +127,6 @@ func ProvideDashboardServiceImpl(
 		folderPermissions:    folderPermissionsService,
 		dashboardPermissions: dashboardPermissionsService,
 		ac:                   ac,
-		zclient:              zclient,
 		folderStore:          folderStore,
 		folderService:        folderSvc,
 		orgService:           orgService,
@@ -1214,19 +1212,12 @@ func (dr *DashboardServiceImpl) SearchDashboards(ctx context.Context, query *das
 	ctx, span := tracer.Start(ctx, "dashboards.service.SearchDashboards")
 	defer span.End()
 
-	var res []dashboards.DashboardSearchProjection
-	var err error
-	if dr.features.IsEnabled(ctx, featuremgmt.FlagZanzana) {
-		res, err = dr.FindDashboardsZanzana(ctx, query)
-	} else {
-		res, err = dr.FindDashboards(ctx, query)
-	}
+	res, err := dr.FindDashboards(ctx, query)
 	if err != nil {
 		return nil, err
 	}
 
 	hits := makeQueryResult(query, res)
-
 	return hits, nil
 }
 
diff --git a/pkg/services/dashboards/service/dashboard_service_integration_test.go b/pkg/services/dashboards/service/dashboard_service_integration_test.go
index 3dcbc7bef32..89c3babe8f9 100644
--- a/pkg/services/dashboards/service/dashboard_service_integration_test.go
+++ b/pkg/services/dashboards/service/dashboard_service_integration_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -884,7 +883,6 @@ func permissionScenario(t *testing.T, desc string, canSave bool, fn permissionSc
 			foldertest.NewFakeService(),
 			folder.NewFakeStore(),
 			nil,
-			zanzana.NewNoopClient(),
 			nil,
 			nil,
 			nil,
@@ -956,7 +954,6 @@ func callSaveWithResult(t *testing.T, cmd dashboards.SaveDashboardCommand, sqlSt
 		foldertest.NewFakeService(),
 		folder.NewFakeStore(),
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
@@ -987,7 +984,6 @@ func callSaveWithError(t *testing.T, cmd dashboards.SaveDashboardCommand, sqlSto
 		foldertest.NewFakeService(),
 		folder.NewFakeStore(),
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
@@ -1037,7 +1033,6 @@ func saveTestDashboard(t *testing.T, title string, orgID int64, folderUID string
 		foldertest.NewFakeService(),
 		folder.NewFakeStore(),
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
@@ -1094,7 +1089,6 @@ func saveTestFolder(t *testing.T, title string, orgID int64, sqlStore db.DB) *da
 		foldertest.NewFakeService(),
 		folder.NewFakeStore(),
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
diff --git a/pkg/services/dashboards/service/zanzana.go b/pkg/services/dashboards/service/zanzana.go
deleted file mode 100644
index 2bd40601c7f..00000000000
--- a/pkg/services/dashboards/service/zanzana.go
+++ /dev/null
@@ -1,255 +0,0 @@
-package service
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-
-	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
-	"github.com/grafana/grafana/pkg/services/dashboards"
-)
-
-const (
-	defaultQueryLimit = 1000
-	// If search query string shorter than this value, then "List, then check" strategy will be used
-	listQueryLengthThreshold = 8
-	// If query limit set to value higher than this value, then "List, then check" strategy will be used
-	listQueryLimitThreshold = 50
-)
-
-type searchResult struct {
-	runner   string
-	result   []dashboards.DashboardSearchProjection
-	err      error
-	duration time.Duration
-}
-
-func (dr *DashboardServiceImpl) FindDashboardsZanzana(ctx context.Context, query *dashboards.FindPersistedDashboardsQuery) ([]dashboards.DashboardSearchProjection, error) {
-	if dr.cfg.Zanzana.ZanzanaOnlyEvaluation {
-		return dr.findDashboardsZanzanaOnly(ctx, *query)
-	}
-	return dr.findDashboardsZanzanaCompare(ctx, *query)
-}
-
-func (dr *DashboardServiceImpl) findDashboardsZanzanaOnly(ctx context.Context, query dashboards.FindPersistedDashboardsQuery) ([]dashboards.DashboardSearchProjection, error) {
-	timer := prometheus.NewTimer(dr.metrics.searchRequestsDuration.WithLabelValues("zanzana"))
-	defer timer.ObserveDuration()
-
-	return dr.findDashboardsZanzana(ctx, query)
-}
-
-func (dr *DashboardServiceImpl) findDashboardsZanzanaCompare(ctx context.Context, query dashboards.FindPersistedDashboardsQuery) ([]dashboards.DashboardSearchProjection, error) {
-	result := make(chan searchResult, 2)
-
-	go func() {
-		timer := prometheus.NewTimer(dr.metrics.searchRequestsDuration.WithLabelValues("zanzana"))
-		defer timer.ObserveDuration()
-		start := time.Now()
-
-		queryZanzana := query
-		res, err := dr.findDashboardsZanzana(ctx, queryZanzana)
-		result <- searchResult{"zanzana", res, err, time.Since(start)}
-	}()
-
-	go func() {
-		timer := prometheus.NewTimer(dr.metrics.searchRequestsDuration.WithLabelValues("grafana"))
-		defer timer.ObserveDuration()
-		start := time.Now()
-
-		res, err := dr.FindDashboards(ctx, &query)
-		result <- searchResult{"grafana", res, err, time.Since(start)}
-	}()
-
-	first, second := <-result, <-result
-	close(result)
-
-	if second.runner == "grafana" {
-		first, second = second, first
-	}
-
-	if second.err != nil {
-		dr.log.Error("zanzana search failed", "error", second.err)
-		dr.metrics.searchRequestStatusTotal.WithLabelValues("error").Inc()
-	} else if len(first.result) != len(second.result) {
-		dr.metrics.searchRequestStatusTotal.WithLabelValues("error").Inc()
-		dr.log.Warn(
-			"zanzana search result does not match grafana",
-			"grafana_result_len", len(first.result),
-			"zanana_result_len", len(second.result),
-			"grafana_duration", first.duration,
-			"zanzana_duration", second.duration,
-		)
-	} else {
-		dr.metrics.searchRequestStatusTotal.WithLabelValues("success").Inc()
-		dr.log.Debug("zanzana search is correct", "result_len", len(first.result), "grafana_duration", first.duration, "zanzana_duration", second.duration)
-	}
-
-	return first.result, first.err
-}
-
-type checkDashboardsFn func(context.Context, dashboards.FindPersistedDashboardsQuery, []dashboards.DashboardSearchProjection, int64) ([]dashboards.DashboardSearchProjection, error)
-
-func (dr *DashboardServiceImpl) findDashboardsZanzana(ctx context.Context, query dashboards.FindPersistedDashboardsQuery) ([]dashboards.DashboardSearchProjection, error) {
-	if len(query.Title) <= listQueryLengthThreshold || query.Limit > listQueryLimitThreshold {
-		checkCompileFn, err := dr.getCheckCompileFn(ctx, query)
-		if err != nil {
-			return nil, err
-		}
-		return dr.findDashboardsZanzanaGeneric(ctx, query, checkCompileFn)
-	}
-
-	return dr.findDashboardsZanzanaGeneric(ctx, query, dr.checkDashboardsBatch)
-}
-
-// findDashboardsZanzanaGeneric runs search query in the database and then check if resultls
-// available to user by calling provided checkFn function. It could be check-based or compile (list) - based.
-func (dr *DashboardServiceImpl) findDashboardsZanzanaGeneric(ctx context.Context, query dashboards.FindPersistedDashboardsQuery, checkFn checkDashboardsFn) ([]dashboards.DashboardSearchProjection, error) {
-	ctx, span := tracer.Start(ctx, "dashboards.service.findDashboardsZanzanaCheck")
-	defer span.End()
-
-	result := make([]dashboards.DashboardSearchProjection, 0, query.Limit)
-
-	query.SkipAccessControlFilter = true
-	// Remember initial query limit
-	limit := query.Limit
-	// Set limit to default to prevent pagination issues
-	query.Limit = defaultQueryLimit
-	if query.Page == 0 {
-		query.Page = 1
-	}
-
-	for len(result) < int(limit) {
-		findRes, err := dr.FindDashboards(ctx, &query)
-		if err != nil {
-			return nil, err
-		}
-
-		remains := limit - int64(len(result))
-		res, err := checkFn(ctx, query, findRes, remains)
-		if err != nil {
-			return nil, err
-		}
-
-		result = append(result, res...)
-		query.Page++
-
-		// Stop when last page reached
-		if len(findRes) < defaultQueryLimit {
-			break
-		}
-	}
-
-	return result, nil
-}
-
-func (dr *DashboardServiceImpl) checkDashboardsBatch(ctx context.Context, query dashboards.FindPersistedDashboardsQuery, searchRes []dashboards.DashboardSearchProjection, remains int64) ([]dashboards.DashboardSearchProjection, error) {
-	ctx, span := tracer.Start(ctx, "dashboards.service.checkDashboardsBatch")
-	defer span.End()
-
-	if len(searchRes) == 0 {
-		return nil, nil
-	}
-
-	batchReqItems := make([]*authzextv1.BatchCheckItem, 0, len(searchRes))
-
-	for _, d := range searchRes {
-		// FIXME: support different access levels
-		kind := zanzana.KindDashboards
-		action := dashboards.ActionDashboardsRead
-		if d.IsFolder {
-			kind = zanzana.KindFolders
-			action = dashboards.ActionFoldersRead
-		}
-
-		checkReq, ok := zanzana.TranslateToCheckRequest("", action, kind, d.FolderUID, d.UID)
-		if !ok {
-			continue
-		}
-
-		batchReqItems = append(batchReqItems, &authzextv1.BatchCheckItem{
-			Verb:        checkReq.Verb,
-			Group:       checkReq.Group,
-			Resource:    checkReq.Resource,
-			Name:        checkReq.Name,
-			Folder:      checkReq.Folder,
-			Subresource: checkReq.Subresource,
-		})
-	}
-
-	batchReq := authzextv1.BatchCheckRequest{
-		Namespace: query.SignedInUser.GetNamespace(),
-		Subject:   query.SignedInUser.GetUID(),
-		Items:     batchReqItems,
-	}
-
-	res, err := dr.zclient.BatchCheck(ctx, &batchReq)
-	if err != nil {
-		return nil, err
-	}
-
-	result := make([]dashboards.DashboardSearchProjection, 0)
-	for _, d := range searchRes {
-		if len(result) >= int(remains) {
-			break
-		}
-
-		kind := zanzana.KindDashboards
-		if d.IsFolder {
-			kind = zanzana.KindFolders
-		}
-		groupResource := zanzana.TranslateToGroupResource(kind)
-		if group, ok := res.Groups[groupResource]; ok {
-			if allowed := group.Items[d.UID]; allowed {
-				result = append(result, d)
-			}
-		}
-	}
-
-	return result, nil
-}
-
-func (dr *DashboardServiceImpl) getCheckCompileFn(ctx context.Context, query dashboards.FindPersistedDashboardsQuery) (checkDashboardsFn, error) {
-	// List available folders
-	namespace := query.SignedInUser.GetNamespace()
-	req, ok := zanzana.TranslateToListRequest(namespace, dashboards.ActionFoldersRead, zanzana.KindFolders)
-	if !ok {
-		return nil, errors.New("resource type not supported")
-	}
-	folderChecker, err := dr.zclient.Compile(ctx, query.SignedInUser, *req)
-	if err != nil {
-		return nil, err
-	}
-
-	// List available dashboards
-	req, ok = zanzana.TranslateToListRequest(namespace, dashboards.ActionDashboardsRead, zanzana.KindDashboards)
-	if !ok {
-		return nil, errors.New("resource type not supported")
-	}
-	dashboardChecker, err := dr.zclient.Compile(ctx, query.SignedInUser, *req)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(_ context.Context, _ dashboards.FindPersistedDashboardsQuery, searchRes []dashboards.DashboardSearchProjection, remains int64) ([]dashboards.DashboardSearchProjection, error) {
-		result := make([]dashboards.DashboardSearchProjection, 0)
-		for _, d := range searchRes {
-			if len(result) >= int(remains) {
-				break
-			}
-			allowed := false
-			if d.IsFolder {
-				allowed = folderChecker(namespace, d.UID, d.FolderUID)
-			} else {
-				allowed = dashboardChecker(namespace, d.UID, d.FolderUID)
-			}
-			if allowed {
-				result = append(result, d)
-			}
-		}
-
-		return result, nil
-	}, nil
-}
diff --git a/pkg/services/dashboards/service/zanzana_integration_test.go b/pkg/services/dashboards/service/zanzana_integration_test.go
deleted file mode 100644
index 8e9b85fe02e..00000000000
--- a/pkg/services/dashboards/service/zanzana_integration_test.go
+++ /dev/null
@@ -1,155 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/grafana/grafana/pkg/bus"
-	"github.com/grafana/grafana/pkg/infra/db"
-	"github.com/grafana/grafana/pkg/infra/serverlock"
-	"github.com/grafana/grafana/pkg/infra/tracing"
-	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/accesscontrol/dualwrite"
-	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz"
-	"github.com/grafana/grafana/pkg/services/dashboards"
-	"github.com/grafana/grafana/pkg/services/dashboards/database"
-	"github.com/grafana/grafana/pkg/services/featuremgmt"
-	"github.com/grafana/grafana/pkg/services/folder/folderimpl"
-	"github.com/grafana/grafana/pkg/services/folder/foldertest"
-	"github.com/grafana/grafana/pkg/services/guardian"
-	"github.com/grafana/grafana/pkg/services/quota/quotatest"
-	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
-	"github.com/grafana/grafana/pkg/services/supportbundles/supportbundlestest"
-	"github.com/grafana/grafana/pkg/services/tag/tagimpl"
-	"github.com/grafana/grafana/pkg/services/user"
-	"github.com/grafana/grafana/pkg/setting"
-)
-
-func TestIntegrationDashboardServiceZanzana(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	t.Run("Zanzana enabled", func(t *testing.T) {
-		features := featuremgmt.WithFeatures(featuremgmt.FlagZanzana)
-		db, cfg := db.InitTestDBWithCfg(t)
-
-		// Hack to skip these tests on mysql 5.7
-		if db.GetDialect().DriverName() == migrator.MySQL {
-			if supported, err := db.RecursiveQueriesAreSupported(); !supported || err != nil {
-				t.Skip("skipping integration test")
-			}
-		}
-
-		// Enable zanzana and run in embedded mode (part of grafana server)
-		cfg.Zanzana.ZanzanaOnlyEvaluation = true
-		cfg.Zanzana.Mode = setting.ZanzanaModeEmbedded
-		cfg.Zanzana.ConcurrentChecks = 10
-
-		_, err := cfg.Raw.Section("rbac").NewKey("resources_with_managed_permissions_on_creation", "dashboard, folder")
-		require.NoError(t, err)
-
-		quotaService := quotatest.New(false, nil)
-		tagService := tagimpl.ProvideService(db)
-		folderStore := folderimpl.ProvideDashboardFolderStore(db)
-		fStore := folderimpl.ProvideStore(db)
-		dashboardStore, err := database.ProvideDashboardStore(db, cfg, features, tagService)
-		require.NoError(t, err)
-
-		zclient, err := authz.ProvideZanzana(cfg, db, features)
-		require.NoError(t, err)
-		ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zclient)
-
-		service, err := ProvideDashboardServiceImpl(
-			cfg, dashboardStore, folderStore,
-			featuremgmt.WithFeatures(),
-			accesscontrolmock.NewMockedPermissionsService(),
-			accesscontrolmock.NewMockedPermissionsService(),
-			ac,
-			foldertest.NewFakeService(),
-			fStore,
-			nil,
-			zclient,
-			nil,
-			nil,
-			nil,
-			quotaService,
-			nil,
-		)
-		require.NoError(t, err)
-
-		guardianMock := &guardian.FakeDashboardGuardian{
-			CanSaveValue: true,
-		}
-		guardian.MockDashboardGuardian(guardianMock)
-
-		createDashboards(t, service, 100, "test-a")
-		createDashboards(t, service, 100, "test-b")
-
-		folderImplStore := folderimpl.ProvideStore(db)
-		folderService := folderimpl.ProvideService(
-			folderImplStore,
-			ac,
-			bus.ProvideBus(tracing.InitializeTracerForTest()),
-			dashboardStore,
-			folderStore,
-			db,
-			featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
-			supportbundlestest.NewFakeBundleService(),
-			cfg,
-			nil,
-			tracing.InitializeTracerForTest(),
-		)
-
-		// Sync Grafana DB with zanzana (migrate data)
-		tracer := tracing.InitializeTracerForTest()
-		lock := serverlock.ProvideService(db, tracer)
-		zanzanaSyncronizer := dualwrite.NewZanzanaReconciler(cfg, zclient, db, lock, folderService)
-		err = zanzanaSyncronizer.ReconcileSync(context.Background())
-		require.NoError(t, err)
-
-		query := &dashboards.FindPersistedDashboardsQuery{
-			Title: "test-a",
-			Limit: 1000,
-			SignedInUser: &user.SignedInUser{
-				OrgID:     1,
-				UserID:    1,
-				UserUID:   "test1",
-				Namespace: "default",
-			},
-		}
-		res, err := service.FindDashboardsZanzana(context.Background(), query)
-
-		require.NoError(t, err)
-		assert.Equal(t, 0, len(res))
-	})
-}
-
-func createDashboard(t *testing.T, service dashboards.DashboardService, uid, title string) {
-	dto := &dashboards.SaveDashboardDTO{
-		OrgID: 1,
-		// User:  user,
-		User: &user.SignedInUser{
-			OrgID:  1,
-			UserID: 1,
-		},
-	}
-	dto.Dashboard = dashboards.NewDashboard(title)
-	dto.Dashboard.SetUID(uid)
-
-	_, err := service.SaveDashboard(context.Background(), dto, false)
-	require.NoError(t, err)
-}
-
-func createDashboards(t *testing.T, service dashboards.DashboardService, number int, prefix string) {
-	for i := 0; i < number; i++ {
-		title := fmt.Sprintf("%s-%d", prefix, i)
-		uid := fmt.Sprintf("dash-%s", title)
-		createDashboard(t, service, uid, title)
-	}
-}
diff --git a/pkg/services/dashboardsnapshots/service/service_test.go b/pkg/services/dashboardsnapshots/service/service_test.go
index 9844d2e4067..1e391a58ed9 100644
--- a/pkg/services/dashboardsnapshots/service/service_test.go
+++ b/pkg/services/dashboardsnapshots/service/service_test.go
@@ -12,7 +12,6 @@ import (
 	dashboardsnapshot "github.com/grafana/grafana/pkg/apis/dashboardsnapshot/v0alpha1"
 	"github.com/grafana/grafana/pkg/infra/db"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	dashdb "github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashsvc "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -101,7 +100,7 @@ func TestValidateDashboardExists(t *testing.T) {
 	feats := featuremgmt.WithFeatures()
 	dashboardStore, err := dashdb.ProvideDashboardStore(sqlStore, cfg, feats, tagimpl.ProvideService(sqlStore))
 	require.NoError(t, err)
-	dashSvc, err := dashsvc.ProvideDashboardServiceImpl(cfg, dashboardStore, folderimpl.ProvideDashboardFolderStore(sqlStore), feats, nil, nil, acmock.New(), foldertest.NewFakeService(), folder.NewFakeStore(), nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
+	dashSvc, err := dashsvc.ProvideDashboardServiceImpl(cfg, dashboardStore, folderimpl.ProvideDashboardFolderStore(sqlStore), feats, nil, nil, acmock.New(), foldertest.NewFakeService(), folder.NewFakeStore(), nil, nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
 	s := ProvideService(dsStore, secretsService, dashSvc)
 	ctx := context.Background()
diff --git a/pkg/services/folder/folderimpl/folder_test.go b/pkg/services/folder/folderimpl/folder_test.go
index f3c00291b26..fa16db4487a 100644
--- a/pkg/services/folder/folderimpl/folder_test.go
+++ b/pkg/services/folder/folderimpl/folder_test.go
@@ -27,7 +27,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
@@ -99,7 +98,7 @@ func TestIntegrationFolderService(t *testing.T) {
 			features:             features,
 			bus:                  bus.ProvideBus(tracing.InitializeTracerForTest()),
 			db:                   db,
-			accessControl:        acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+			accessControl:        acimpl.ProvideAccessControl(features),
 			metrics:              newFoldersMetrics(nil),
 			registry:             make(map[string]folder.RegistryService),
 			tracer:               tracing.InitializeTracerForTest(),
@@ -430,7 +429,7 @@ func TestIntegrationNestedFolderService(t *testing.T) {
 	nestedFolderStore := ProvideStore(db)
 
 	b := bus.ProvideBus(tracing.InitializeTracerForTest())
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	serviceWithFlagOn := &Service{
 		log:                  slog.New(logtest.NewTestHandler(t)).With("logger", "test-folder-service"),
@@ -487,7 +486,7 @@ func TestIntegrationNestedFolderService(t *testing.T) {
 				CanEditValue: true,
 			})
 
-			dashSrv, err := dashboardservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuresFlagOn, folderPermissions, dashboardPermissions, ac, serviceWithFlagOn, nestedFolderStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil)
+			dashSrv, err := dashboardservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuresFlagOn, folderPermissions, dashboardPermissions, ac, serviceWithFlagOn, nestedFolderStore, nil, nil, nil, nil, quotaService, nil)
 			require.NoError(t, err)
 
 			alertStore, err := ngstore.ProvideDBStore(cfg, featuresFlagOn, db, serviceWithFlagOn, dashSrv, ac, b)
@@ -569,7 +568,7 @@ func TestIntegrationNestedFolderService(t *testing.T) {
 			})
 
 			dashSrv, err := dashboardservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuresFlagOff,
-				folderPermissions, dashboardPermissions, ac, serviceWithFlagOff, nestedFolderStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil)
+				folderPermissions, dashboardPermissions, ac, serviceWithFlagOff, nestedFolderStore, nil, nil, nil, nil, quotaService, nil)
 			require.NoError(t, err)
 
 			alertStore, err := ngstore.ProvideDBStore(cfg, featuresFlagOff, db, serviceWithFlagOff, dashSrv, ac, b)
@@ -714,7 +713,7 @@ func TestIntegrationNestedFolderService(t *testing.T) {
 				tc.service.dashboardStore = dashStore
 				tc.service.store = nestedFolderStore
 
-				dashSrv, err := dashboardservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, tc.featuresFlag, folderPermissions, dashboardPermissions, ac, tc.service, tc.service.store, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil)
+				dashSrv, err := dashboardservice.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, tc.featuresFlag, folderPermissions, dashboardPermissions, ac, tc.service, tc.service.store, nil, nil, nil, nil, quotaService, nil)
 				require.NoError(t, err)
 				alertStore, err := ngstore.ProvideDBStore(cfg, tc.featuresFlag, db, tc.service, dashSrv, ac, b)
 				require.NoError(t, err)
@@ -809,7 +808,7 @@ func TestNestedFolderServiceFeatureToggle(t *testing.T) {
 		dashboardStore:       &dashStore,
 		dashboardFolderStore: dashboardFolderStore,
 		features:             featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
-		accessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		accessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		metrics:              newFoldersMetrics(nil),
 		tracer:               tracing.InitializeTracerForTest(),
 	}
@@ -846,7 +845,7 @@ func TestFolderServiceDualWrite(t *testing.T) {
 		dashboardStore:       dashStore,
 		dashboardFolderStore: dashboardFolderStore,
 		features:             featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
-		accessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		accessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		metrics:              newFoldersMetrics(nil),
 		tracer:               tracing.InitializeTracerForTest(),
 		bus:                  bus.ProvideBus(tracing.InitializeTracerForTest()),
@@ -911,7 +910,7 @@ func TestNestedFolderService(t *testing.T) {
 			features := featuremgmt.WithFeatures()
 
 			db, _ := sqlstore.InitTestDB(t)
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), db)
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), db)
 
 			tempUser := &user.SignedInUser{UserID: 1, OrgID: orgID, Permissions: map[int64]map[string][]string{}}
 			tempUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersCreate: {dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID)}}
@@ -952,7 +951,7 @@ func TestNestedFolderService(t *testing.T) {
 			tempUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersCreate: {dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID)}}
 
 			db, _ := sqlstore.InitTestDB(t)
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), db)
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), db)
 			_, err := folderSvc.Create(context.Background(), &folder.CreateFolderCommand{
 				OrgID:        orgID,
 				Title:        dash.Title,
@@ -982,7 +981,7 @@ func TestNestedFolderService(t *testing.T) {
 			tempUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersWrite: {dashboards.ScopeFoldersProvider.GetResourceScopeUID("subfolder_uid")}}
 
 			db, _ := sqlstore.InitTestDB(t)
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), db)
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), db)
 			_, err := folderSvc.Create(context.Background(), &folder.CreateFolderCommand{
 				OrgID:        orgID,
 				Title:        "some_folder",
@@ -1012,7 +1011,7 @@ func TestNestedFolderService(t *testing.T) {
 			dashStore.On("SaveDashboard", mock.Anything, mock.AnythingOfType("dashboards.SaveDashboardCommand")).Return(&dashboards.Dashboard{}, nil)
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, nil, nil, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, nil, nil, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Create(context.Background(), &folder.CreateFolderCommand{
 				OrgID:        orgID,
 				Title:        dash.Title,
@@ -1048,7 +1047,7 @@ func TestNestedFolderService(t *testing.T) {
 			nestedFolderStore := folder.NewFakeStore()
 			db, _ := sqlstore.InitTestDB(t)
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), db)
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), db)
 			_, err := folderSvc.Create(context.Background(), &folder.CreateFolderCommand{
 				OrgID:        orgID,
 				Title:        dash.Title,
@@ -1197,7 +1196,7 @@ func TestNestedFolderService(t *testing.T) {
 			nestedFolderUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersWrite: {dashboards.ScopeFoldersProvider.GetResourceScopeUID("wrong_uid")}}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: "myFolder", NewParentUID: "newFolder", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.ErrorIs(t, err, dashboards.ErrMoveAccessDenied)
 		})
@@ -1220,7 +1219,7 @@ func TestNestedFolderService(t *testing.T) {
 			}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: "myFolder", NewParentUID: "newFolder", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.NoError(t, err)
 
@@ -1237,7 +1236,7 @@ func TestNestedFolderService(t *testing.T) {
 			nestedFolderUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersWrite: {dashboards.ScopeFoldersProvider.GetResourceAllScope()}}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, &dashboards.FakeDashboardStore{}, foldertest.NewFakeFolderStore(t), folder.NewFakeStore(), features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, &dashboards.FakeDashboardStore{}, foldertest.NewFakeFolderStore(t), folder.NewFakeStore(), features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: accesscontrol.K6FolderUID, NewParentUID: "newFolder", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.Error(t, err, folder.ErrBadRequest)
 		})
@@ -1255,7 +1254,7 @@ func TestNestedFolderService(t *testing.T) {
 			}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, &dashboards.FakeDashboardStore{}, foldertest.NewFakeFolderStore(t), nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, &dashboards.FakeDashboardStore{}, foldertest.NewFakeFolderStore(t), nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: childUID, NewParentUID: "newFolder", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.Error(t, err, folder.ErrBadRequest)
 		})
@@ -1271,7 +1270,7 @@ func TestNestedFolderService(t *testing.T) {
 			nestedFolderUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersWrite: {dashboards.ScopeFoldersProvider.GetResourceScopeUID("")}}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: "myFolder", NewParentUID: "", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.Error(t, err, dashboards.ErrFolderAccessDenied)
 		})
@@ -1297,7 +1296,7 @@ func TestNestedFolderService(t *testing.T) {
 			}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: "myFolder", NewParentUID: "", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.NoError(t, err)
 			// the folder is set inside InTransaction() but the fake one is called
@@ -1314,7 +1313,7 @@ func TestNestedFolderService(t *testing.T) {
 			nestedFolderUser.Permissions[orgID] = map[string][]string{dashboards.ActionFoldersCreate: {dashboards.ScopeFoldersProvider.GetResourceScopeUID("some_subfolder")}}
 
 			features := featuremgmt.WithFeatures("nestedFolders")
-			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+			folderSvc := setup(t, dashStore, dashboardFolderStore, nestedFolderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 			_, err := folderSvc.Move(context.Background(), &folder.MoveFolderCommand{UID: "myFolder", NewParentUID: "", OrgID: orgID, SignedInUser: nestedFolderUser})
 			require.Error(t, err)
 		})
@@ -1470,7 +1469,7 @@ func TestIntegrationNestedFolderSharedWithMe(t *testing.T) {
 	nestedFolderStore := ProvideStore(db)
 
 	b := bus.ProvideBus(tracing.InitializeTracerForTest())
-	ac := acimpl.ProvideAccessControl(featuresFlagOn, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuresFlagOn)
 
 	serviceWithFlagOn := &Service{
 		log:                  slog.New(logtest.NewTestHandler(t)).With("logger", "test-folder-service"),
@@ -1496,7 +1495,6 @@ func TestIntegrationNestedFolderSharedWithMe(t *testing.T) {
 		serviceWithFlagOn,
 		nestedFolderStore,
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
@@ -1897,7 +1895,7 @@ func TestFolderServiceGetFolder(t *testing.T) {
 		nestedFolderStore := ProvideStore(db)
 
 		b := bus.ProvideBus(tracing.InitializeTracerForTest())
-		ac := acimpl.ProvideAccessControl(featuresFlagOff, zanzana.NewNoopClient())
+		ac := acimpl.ProvideAccessControl(featuresFlagOff)
 
 		return Service{
 			log:                  slog.New(logtest.NewTestHandler(t)).With("logger", "test-folder-service"),
@@ -1992,7 +1990,7 @@ func TestFolderServiceGetFolders(t *testing.T) {
 	nestedFolderStore := ProvideStore(db)
 
 	b := bus.ProvideBus(tracing.InitializeTracerForTest())
-	ac := acimpl.ProvideAccessControl(featuresFlagOff, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuresFlagOff)
 
 	serviceWithFlagOff := &Service{
 		log:                  slog.New(logtest.NewTestHandler(t)).With("logger", "test-folder-service"),
@@ -2076,7 +2074,7 @@ func TestGetChildrenFilterByPermission(t *testing.T) {
 	nestedFolderStore := ProvideStore(db)
 
 	b := bus.ProvideBus(tracing.InitializeTracerForTest())
-	ac := acimpl.ProvideAccessControl(featuresFlagOff, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuresFlagOff)
 
 	features := featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders)
 
@@ -2342,7 +2340,7 @@ func TestIntegration_canMove(t *testing.T) {
 	require.NoError(t, err)
 
 	features := featuremgmt.WithFeatures("nestedFolders")
-	folderSvc := setup(t, dashStore, dashboardFolderStore, folderStore, features, acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()), dbtest.NewFakeDB())
+	folderSvc := setup(t, dashStore, dashboardFolderStore, folderStore, features, acimpl.ProvideAccessControl(features), dbtest.NewFakeDB())
 
 	testCases := []struct {
 		description       string
diff --git a/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go b/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
index 8f757975d6c..4b18053cb3e 100644
--- a/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
+++ b/pkg/services/folder/folderimpl/folder_unifiedstorage_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder"
@@ -179,7 +178,7 @@ func TestIntegrationFolderServiceViaUnifiedStorage(t *testing.T) {
 		features:     features,
 		bus:          bus.ProvideBus(tracing.InitializeTracerForTest()),
 		// db:            db,
-		accessControl: acimpl.ProvideAccessControl(features, zanzana.NewNoopClient()),
+		accessControl: acimpl.ProvideAccessControl(features),
 		registry:      make(map[string]folder.RegistryService),
 		metrics:       newFoldersMetrics(nil),
 		tracer:        tracing.InitializeTracerForTest(),
diff --git a/pkg/services/guardian/accesscontrol_guardian_test.go b/pkg/services/guardian/accesscontrol_guardian_test.go
index ae6aaf279b7..8d24b282395 100644
--- a/pkg/services/guardian/accesscontrol_guardian_test.go
+++ b/pkg/services/guardian/accesscontrol_guardian_test.go
@@ -11,7 +11,6 @@ import (
 
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
@@ -957,7 +956,7 @@ func setupAccessControlGuardianTest(
 	fakeDashboardService := dashboards.NewFakeDashboardService(t)
 	fakeDashboardService.On("GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery")).Maybe().Return(d, nil)
 
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	folderSvc := foldertest.NewFakeService()
 
 	folderStore := foldertest.NewFakeFolderStore(t)
diff --git a/pkg/services/ldap/api/service_test.go b/pkg/services/ldap/api/service_test.go
index c914ded932f..33db7a0a4bb 100644
--- a/pkg/services/ldap/api/service_test.go
+++ b/pkg/services/ldap/api/service_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/auth/authtest"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/ldap"
 	"github.com/grafana/grafana/pkg/services/ldap/multildap"
@@ -70,7 +69,7 @@ func setupAPITest(t *testing.T, opts ...func(a *Service)) (*Service, *webtest.Se
 
 	a := ProvideService(cfg,
 		router,
-		acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		usertest.NewUserServiceFake(),
 		&authinfotest.FakeService{},
 		ldap.ProvideGroupsService(),
diff --git a/pkg/services/libraryelements/libraryelements_test.go b/pkg/services/libraryelements/libraryelements_test.go
index d9b9fb833f9..33ea027b8c1 100644
--- a/pkg/services/libraryelements/libraryelements_test.go
+++ b/pkg/services/libraryelements/libraryelements_test.go
@@ -25,7 +25,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
@@ -310,7 +309,6 @@ func createDashboard(t *testing.T, sqlStore db.DB, user user.SignedInUser, dash
 		foldertest.NewFakeService(),
 		folder.NewFakeStore(),
 		nil,
-		zanzana.NewNoopClient(),
 		nil,
 		nil,
 		nil,
@@ -400,12 +398,7 @@ func scenarioWithPanel(t *testing.T, desc string, fn func(t *testing.T, sc scena
 		cfg, dashboardStore, folderStore,
 		features, folderPermissions, dashboardPermissions, ac,
 		foldertest.NewFakeService(), folder.NewFakeStore(),
-		nil, zanzana.NewNoopClient(),
-		nil,
-		nil,
-		nil,
-		quotaService,
-		nil,
+		nil, nil, nil, nil, quotaService, nil,
 	)
 	require.NoError(t, svcErr)
 	guardian.InitAccessControlGuardian(cfg, ac, dashboardService)
@@ -458,7 +451,7 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
 		quotaService := quotatest.New(false, nil)
 		dashboardStore, err := database.ProvideDashboardStore(sqlStore, cfg, features, tagimpl.ProvideService(sqlStore))
 		require.NoError(t, err)
-		ac := acimpl.ProvideAccessControl(features, zanzana.NewNoopClient())
+		ac := acimpl.ProvideAccessControl(features)
 		folderPermissions := acmock.NewMockedPermissionsService()
 		folderPermissions.On("SetPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]accesscontrol.ResourcePermission{}, nil)
 		dashboardPermissions := acmock.NewMockedPermissionsService()
@@ -467,7 +460,7 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
 			cfg, dashboardStore, folderStore,
 			features, folderPermissions, dashboardPermissions, ac,
 			foldertest.NewFakeService(), folder.NewFakeStore(),
-			nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+			nil, nil, nil, nil, quotaService, nil,
 		)
 		require.NoError(t, dashSvcErr)
 		guardian.InitAccessControlGuardian(cfg, ac, dashService)
diff --git a/pkg/services/librarypanels/librarypanels_test.go b/pkg/services/librarypanels/librarypanels_test.go
index b911a31be4b..a820b9659f3 100644
--- a/pkg/services/librarypanels/librarypanels_test.go
+++ b/pkg/services/librarypanels/librarypanels_test.go
@@ -21,7 +21,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashboardservice "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -735,7 +734,7 @@ func createDashboard(t *testing.T, sqlStore db.DB, user *user.SignedInUser, dash
 		cfg, dashboardStore, folderStore,
 		featuremgmt.WithFeatures(), acmock.NewMockedPermissionsService(), dashPermissionService, ac,
 		foldertest.NewFakeService(), folder.NewFakeStore(),
-		nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+		nil, nil, nil, nil, quotaService, nil,
 	)
 	require.NoError(t, err)
 	dashboard, err := service.SaveDashboard(context.Background(), dashItem, true)
@@ -830,7 +829,7 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
 			cfg, dashStore, folderStore,
 			features, acmock.NewMockedPermissionsService(), dashPermissionService, ac,
 			foldertest.NewFakeService(), folder.NewFakeStore(),
-			nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+			nil, nil, nil, nil, quotaService, nil,
 		)
 		require.NoError(t, err)
 		guardian.InitAccessControlGuardian(cfg, ac, dashService)
diff --git a/pkg/services/live/live_test.go b/pkg/services/live/live_test.go
index 427a6abf2aa..447910e1b84 100644
--- a/pkg/services/live/live_test.go
+++ b/pkg/services/live/live_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/usagestats"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/setting"
@@ -37,7 +36,7 @@ func Test_provideLiveService_RedisUnavailable(t *testing.T) {
 		nil,
 		&usagestats.UsageStatsMock{T: t},
 		nil,
-		featuremgmt.WithFeatures(), acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), &dashboards.FakeDashboardService{}, annotationstest.NewFakeAnnotationsRepo(), nil)
+		featuremgmt.WithFeatures(), acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), &dashboards.FakeDashboardService{}, annotationstest.NewFakeAnnotationsRepo(), nil)
 
 	// Proceeds without live HA if redis is unavaialble
 	require.NoError(t, err)
diff --git a/pkg/services/navtree/navtreeimpl/applinks_test.go b/pkg/services/navtree/navtreeimpl/applinks_test.go
index 40978045b44..b064430e7fc 100644
--- a/pkg/services/navtree/navtreeimpl/applinks_test.go
+++ b/pkg/services/navtree/navtreeimpl/applinks_test.go
@@ -12,7 +12,6 @@ import (
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	accesscontrolmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -443,7 +442,7 @@ func TestAddAppLinksAccessControl(t *testing.T) {
 	service := ServiceImpl{
 		log:            log.New("navtree"),
 		cfg:            cfg,
-		accessControl:  acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		accessControl:  acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		pluginSettings: &pluginSettings,
 		features:       featuremgmt.WithFeatures(),
 		pluginStore: &pluginstore.FakePluginStore{
diff --git a/pkg/services/ngalert/accesscontrol/rules_test.go b/pkg/services/ngalert/accesscontrol/rules_test.go
index 8c823763308..56fe885f87c 100644
--- a/pkg/services/ngalert/accesscontrol/rules_test.go
+++ b/pkg/services/ngalert/accesscontrol/rules_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/grafana/grafana/pkg/expr"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -427,7 +426,7 @@ func TestAuthorizeRuleChanges(t *testing.T) {
 				}
 			})
 
-			ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+			ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			srv := NewRuleService(ac)
 			err := srv.AuthorizeRuleChanges(context.Background(), createUserWithPermissions(permissions), groupChanges)
 			require.NoError(t, err)
diff --git a/pkg/services/ngalert/api/api_alertmanager_test.go b/pkg/services/ngalert/api/api_alertmanager_test.go
index 1787dcfa5e9..302dc468788 100644
--- a/pkg/services/ngalert/api/api_alertmanager_test.go
+++ b/pkg/services/ngalert/api/api_alertmanager_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 
 	"github.com/grafana/grafana/pkg/api/response"
@@ -565,9 +564,9 @@ func createSut(t *testing.T) AlertmanagerSrv {
 	}
 	mam := createMultiOrgAlertmanager(t, configs)
 	log := log.NewNopLogger()
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	ruleStore := ngfakes.NewRuleStore(t)
-	ruleAuthzService := accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()))
+	ruleAuthzService := accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures()))
 	return AlertmanagerSrv{
 		mam:            mam,
 		crypto:         mam.Crypto,
diff --git a/pkg/services/ngalert/api/api_prometheus_test.go b/pkg/services/ngalert/api/api_prometheus_test.go
index de2401e147f..6f699f087e8 100644
--- a/pkg/services/ngalert/api/api_prometheus_test.go
+++ b/pkg/services/ngalert/api/api_prometheus_test.go
@@ -20,7 +20,6 @@ import (
 	"github.com/grafana/grafana/pkg/expr"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -562,7 +561,7 @@ func TestRouteGetRuleStatuses(t *testing.T) {
 			manager: fakeAIM,
 			status:  newFakeSchedulerReader(t).setupStates(fakeAIM),
 			store:   ruleStore,
-			authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())),
+			authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures())),
 		}
 
 		permissions := createPermissionsForRules(slices.Concat(rulesInGroup1, rulesInGroup2, rulesInGroup3), orgID)
@@ -688,7 +687,7 @@ func TestRouteGetRuleStatuses(t *testing.T) {
 			manager: fakeAIM,
 			status:  newFakeSchedulerReader(t).setupStates(fakeAIM),
 			store:   ruleStore,
-			authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())),
+			authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures())),
 		}
 
 		permissions := createPermissionsForRules(allRules, orgID)
@@ -825,7 +824,7 @@ func TestRouteGetRuleStatuses(t *testing.T) {
 				manager: fakeAIM,
 				status:  newFakeSchedulerReader(t).setupStates(fakeAIM),
 				store:   ruleStore,
-				authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())),
+				authz:   accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures())),
 			}
 
 			c := &contextmodel.ReqContext{Context: &web.Context{Req: req}, SignedInUser: &user.SignedInUser{OrgID: orgID, Permissions: createPermissionsForRules(rules, orgID)}}
diff --git a/pkg/services/ngalert/api/api_ruler_test.go b/pkg/services/ngalert/api/api_ruler_test.go
index 6a346c29102..ede0a00b799 100644
--- a/pkg/services/ngalert/api/api_ruler_test.go
+++ b/pkg/services/ngalert/api/api_ruler_test.go
@@ -20,7 +20,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/datasources"
@@ -656,7 +655,7 @@ func createService(store *fakes.RuleStore) *RulerSrv {
 		cfg: &setting.UnifiedAlertingSettings{
 			BaseInterval: 10 * time.Second,
 		},
-		authz:          accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())),
+		authz:          accesscontrol.NewRuleService(acimpl.ProvideAccessControl(featuremgmt.WithFeatures())),
 		amConfigStore:  &fakeAMRefresher{},
 		amRefresher:    &fakeAMRefresher{},
 		featureManager: featuremgmt.WithFeatures(featuremgmt.FlagGrafanaManagedRecordingRules),
diff --git a/pkg/services/ngalert/notifier/receiver_svc_test.go b/pkg/services/ngalert/notifier/receiver_svc_test.go
index 2318dd5a938..d8c27a5d0c7 100644
--- a/pkg/services/ngalert/notifier/receiver_svc_test.go
+++ b/pkg/services/ngalert/notifier/receiver_svc_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	ac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -968,7 +967,7 @@ func TestReceiverServiceAC_Read(t *testing.T) {
 				}
 				return false
 			}
-			sut.authz = ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), true)
+			sut.authz = ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), true)
 			for _, recv := range allReceivers() {
 				response, err := sut.GetReceiver(context.Background(), singleQ(orgId, recv.Name), usr)
 				if isVisibleInProvisioning(recv.UID) {
@@ -1477,7 +1476,7 @@ func createReceiverServiceSut(t *testing.T, encryptSvc secretService) *ReceiverS
 	provisioningStore := fakes.NewFakeProvisioningStore()
 
 	return NewReceiverService(
-		ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), false),
+		ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), false),
 		legacy_storage.NewAlertmanagerConfigStore(store),
 		provisioningStore,
 		&fakeAlertRuleNotificationStore{},
diff --git a/pkg/services/ngalert/provisioning/contactpoints_test.go b/pkg/services/ngalert/provisioning/contactpoints_test.go
index 7f27a70496d..7a8c5e5bd10 100644
--- a/pkg/services/ngalert/provisioning/contactpoints_test.go
+++ b/pkg/services/ngalert/provisioning/contactpoints_test.go
@@ -20,7 +20,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	ac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -487,7 +486,7 @@ func createContactPointServiceSutWithConfigStore(t *testing.T, secretService sec
 	provisioningStore := fakes.NewFakeProvisioningStore()
 
 	receiverService := notifier.NewReceiverService(
-		ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()), true),
+		ac.NewReceiverAccess[*models.Receiver](acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), true),
 		legacy_storage.NewAlertmanagerConfigStore(configStore),
 		provisioningStore,
 		&fakeAlertRuleNotificationStore{},
diff --git a/pkg/services/ngalert/testutil/testutil.go b/pkg/services/ngalert/testutil/testutil.go
index fd70d0563df..84e8ffcde42 100644
--- a/pkg/services/ngalert/testutil/testutil.go
+++ b/pkg/services/ngalert/testutil/testutil.go
@@ -11,7 +11,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashboardservice "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -61,7 +60,7 @@ func SetupDashboardService(tb testing.TB, sqlStore db.DB, fs *folderimpl.Dashboa
 		cfg, dashboardStore, fs,
 		features, folderPermissions, dashboardPermissions, ac,
 		foldertest.NewFakeService(), folder.NewFakeStore(),
-		nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil,
+		nil, nil, nil, nil, quotaService, nil,
 	)
 	require.NoError(tb, err)
 
diff --git a/pkg/services/publicdashboards/api/common_test.go b/pkg/services/publicdashboards/api/common_test.go
index 85de1714450..4dbe97407a2 100644
--- a/pkg/services/publicdashboards/api/common_test.go
+++ b/pkg/services/publicdashboards/api/common_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/contexthandler/ctxkey"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/datasources"
@@ -56,7 +55,7 @@ func setupTestServer(
 	// build router to register routes
 	rr := routing.NewRouteRegister()
 
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 
 	// build mux
 	m := web.New()
diff --git a/pkg/services/publicdashboards/api/query_test.go b/pkg/services/publicdashboards/api/query_test.go
index 33b12afcbd4..ec230a0e78f 100644
--- a/pkg/services/publicdashboards/api/query_test.go
+++ b/pkg/services/publicdashboards/api/query_test.go
@@ -25,7 +25,6 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
 	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	dashboardStore "github.com/grafana/grafana/pkg/services/dashboards/database"
 	"github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -326,7 +325,7 @@ func TestIntegrationUnauthenticatedUserCanGetPubdashPanelQueryData(t *testing.T)
 	dashService, err := service.ProvideDashboardServiceImpl(
 		cfg, dashboardStoreService, folderStore,
 		featuremgmt.WithFeatures(), acmock.NewMockedPermissionsService(), dashPermissionService, ac,
-		foldertest.NewFakeService(), folder.NewFakeStore(), nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil,
+		foldertest.NewFakeService(), folder.NewFakeStore(), nil, nil, nil, nil, quotatest.New(false, nil), nil,
 	)
 	require.NoError(t, err)
 
diff --git a/pkg/services/publicdashboards/service/service_test.go b/pkg/services/publicdashboards/service/service_test.go
index dfccfc3aa29..f6f34043568 100644
--- a/pkg/services/publicdashboards/service/service_test.go
+++ b/pkg/services/publicdashboards/service/service_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	dashboardsDB "github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashsvc "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -1397,7 +1396,7 @@ func TestPublicDashboardServiceImpl_ListPublicDashboards(t *testing.T) {
 	folderStore := folderimpl.ProvideDashboardFolderStore(testDB)
 	folderSvc := folderimpl.ProvideService(fStore, ac, bus.ProvideBus(tracing.InitializeTracerForTest()), dashStore, folderStore, testDB, features, supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 
-	dashboardService, err := dashsvc.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), folderPermissions, &actest.FakePermissionsService{}, ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotatest.New(false, nil), nil)
+	dashboardService, err := dashsvc.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), folderPermissions, &actest.FakePermissionsService{}, ac, folderSvc, fStore, nil, nil, nil, nil, quotatest.New(false, nil), nil)
 	require.NoError(t, err)
 	fakeGuardian := &guardian.FakeDashboardGuardian{
 		CanSaveValue: true,
diff --git a/pkg/services/quota/quotaimpl/quota_test.go b/pkg/services/quota/quotaimpl/quota_test.go
index f7f84de157e..4a2e9fa311f 100644
--- a/pkg/services/quota/quotaimpl/quota_test.go
+++ b/pkg/services/quota/quotaimpl/quota_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/apikey/apikeyimpl"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/auth/authimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	dashboardStore "github.com/grafana/grafana/pkg/services/dashboards/database"
 	dashService "github.com/grafana/grafana/pkg/services/dashboards/service"
@@ -491,12 +490,12 @@ func setupEnv(t *testing.T, sqlStore db.DB, cfg *setting.Cfg, b bus.Bus, quotaSe
 	fStore := folderimpl.ProvideStore(sqlStore)
 	dashStore, err := dashboardStore.ProvideDashboardStore(sqlStore, cfg, featuremgmt.WithFeatures(), tagimpl.ProvideService(sqlStore))
 	require.NoError(t, err)
-	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	folderSvc := folderimpl.ProvideService(fStore, acmock.New(), bus.ProvideBus(tracing.InitializeTracerForTest()),
 		dashStore, folderStore, sqlStore, featuremgmt.WithFeatures(),
 		supportbundlestest.NewFakeBundleService(), cfg, nil, tracing.InitializeTracerForTest())
 	_, err = dashService.ProvideDashboardServiceImpl(cfg, dashStore, folderStore, featuremgmt.WithFeatures(), acmock.NewMockedPermissionsService(), acmock.NewMockedPermissionsService(),
-		ac, folderSvc, fStore, nil, zanzana.NewNoopClient(), nil, nil, nil, quotaService, nil)
+		ac, folderSvc, fStore, nil, nil, nil, nil, quotaService, nil)
 
 	require.NoError(t, err)
 	secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
diff --git a/pkg/services/serviceaccounts/api/api_test.go b/pkg/services/serviceaccounts/api/api_test.go
index 03713c57e2a..144869b390a 100644
--- a/pkg/services/serviceaccounts/api/api_test.go
+++ b/pkg/services/serviceaccounts/api/api_test.go
@@ -16,7 +16,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/serviceaccounts"
@@ -307,7 +306,7 @@ func setupTests(t *testing.T, opts ...func(a *ServiceAccountsAPI)) *webtest.Serv
 		cfg:                  cfg,
 		service:              &satests.FakeServiceAccountService{},
 		accesscontrolService: &actest.FakeService{},
-		accesscontrol:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		accesscontrol:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		RouterRegister:       routing.NewRouteRegister(),
 		log:                  log.NewNopLogger(),
 		permissionService:    &actest.FakePermissionsService{},
diff --git a/pkg/services/ssosettings/api/api_test.go b/pkg/services/ssosettings/api/api_test.go
index c70dbd36165..9084d4d3155 100644
--- a/pkg/services/ssosettings/api/api_test.go
+++ b/pkg/services/ssosettings/api/api_test.go
@@ -19,7 +19,6 @@ import (
 	"github.com/grafana/grafana/pkg/login/social"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/ssosettings"
@@ -565,7 +564,7 @@ func setupTests(t *testing.T, service ssosettings.Service) *webtest.Server {
 	api := &Api{
 		Log:                logger,
 		RouteRegister:      routing.NewRouteRegister(),
-		AccessControl:      acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		AccessControl:      acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		SSOSettingsService: service,
 	}
 
diff --git a/pkg/services/ssosettings/ssosettingsimpl/service_test.go b/pkg/services/ssosettings/ssosettingsimpl/service_test.go
index fef330771e1..4882f22674d 100644
--- a/pkg/services/ssosettings/ssosettingsimpl/service_test.go
+++ b/pkg/services/ssosettings/ssosettingsimpl/service_test.go
@@ -21,7 +21,6 @@ import (
 	"github.com/grafana/grafana/pkg/login/social"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/licensing/licensingtest"
 	secretsFakes "github.com/grafana/grafana/pkg/services/secrets/fakes"
@@ -1892,7 +1891,7 @@ func setupTestEnv(t *testing.T, isLicensingEnabled, keepFallbackStratergies, sam
 	store := ssosettingstests.NewFakeStore()
 	fallbackStrategy := ssosettingstests.NewFakeFallbackStrategy()
 	secrets := secretsFakes.NewMockService(t)
-	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient())
+	accessControl := acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 	reloadables := make(map[string]ssosettings.Reloadable)
 
 	fallbackStrategy.ExpectedIsMatch = true
diff --git a/pkg/services/team/teamapi/team_members_test.go b/pkg/services/team/teamapi/team_members_test.go
index 43727d6e5cf..b51718214ce 100644
--- a/pkg/services/team/teamapi/team_members_test.go
+++ b/pkg/services/team/teamapi/team_members_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/licensing"
@@ -41,7 +40,7 @@ func SetupAPITestServer(t *testing.T, teamService team.Service, opts ...func(a *
 	a := ProvideTeamAPI(router,
 		teamService,
 		actest.FakeService{},
-		acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+		acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		&actest.FakePermissionsService{},
 		&usertest.FakeUserService{},
 		&licensing.OSSLicensingService{},
@@ -296,7 +295,7 @@ func Test_getTeamMembershipUpdates(t *testing.T) {
 			tapi := ProvideTeamAPI(routing.NewRouteRegister(),
 				teamSvc,
 				actest.FakeService{},
-				acimpl.ProvideAccessControl(featuremgmt.WithFeatures(), zanzana.NewNoopClient()),
+				acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 				&actest.FakePermissionsService{},
 				userService,
 				&licensing.OSSLicensingService{},
diff --git a/pkg/tests/apis/alerting/notifications/receivers/receiver_test.go b/pkg/tests/apis/alerting/notifications/receivers/receiver_test.go
index d7b3435afe8..b7a314b5c96 100644
--- a/pkg/tests/apis/alerting/notifications/receivers/receiver_test.go
+++ b/pkg/tests/apis/alerting/notifications/receivers/receiver_test.go
@@ -33,7 +33,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/ossaccesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	alertingac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
@@ -864,7 +863,7 @@ func TestIntegrationProvisioning(t *testing.T) {
 	admin := org.Admin
 	adminClient := newClient(t, helper.Org1.Admin)
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 
@@ -1164,7 +1163,7 @@ func TestIntegrationReferentialIntegrity(t *testing.T) {
 	ctx := context.Background()
 	helper := getTestHelper(t)
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 	orgID := helper.Org1.Admin.Identity.GetOrgID()
@@ -1474,7 +1473,7 @@ func TestIntegrationReceiverListSelector(t *testing.T) {
 	require.NoError(t, err)
 
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 	require.NoError(t, db.SetProvenance(ctx, &definitions.EmbeddedContactPoint{
diff --git a/pkg/tests/apis/alerting/notifications/routingtree/routing_tree_test.go b/pkg/tests/apis/alerting/notifications/routingtree/routing_tree_test.go
index bbf00e76238..29b941106ad 100644
--- a/pkg/tests/apis/alerting/notifications/routingtree/routing_tree_test.go
+++ b/pkg/tests/apis/alerting/notifications/routingtree/routing_tree_test.go
@@ -25,7 +25,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -295,7 +294,7 @@ func TestIntegrationProvisioning(t *testing.T) {
 	adminClient := newClient(t, admin)
 
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 
diff --git a/pkg/tests/apis/alerting/notifications/templategroup/templates_group_test.go b/pkg/tests/apis/alerting/notifications/templategroup/templates_group_test.go
index f2b77a7445c..3e6ef4dc14a 100644
--- a/pkg/tests/apis/alerting/notifications/templategroup/templates_group_test.go
+++ b/pkg/tests/apis/alerting/notifications/templategroup/templates_group_test.go
@@ -21,7 +21,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -381,7 +380,7 @@ func TestIntegrationProvisioning(t *testing.T) {
 	adminClient := newClient(t, admin)
 
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 
@@ -598,7 +597,7 @@ func TestIntegrationListSelector(t *testing.T) {
 	template2, err = adminClient.Create(ctx, template2, v1.CreateOptions{})
 	require.NoError(t, err)
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 	require.NoError(t, db.SetProvenance(ctx, &definitions.NotificationTemplate{
diff --git a/pkg/tests/apis/alerting/notifications/timeinterval/timeinterval_test.go b/pkg/tests/apis/alerting/notifications/timeinterval/timeinterval_test.go
index 52d7cbdb1f8..e3e83bd800e 100644
--- a/pkg/tests/apis/alerting/notifications/timeinterval/timeinterval_test.go
+++ b/pkg/tests/apis/alerting/notifications/timeinterval/timeinterval_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
-	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -353,7 +352,7 @@ func TestIntegrationTimeIntervalProvisioning(t *testing.T) {
 	adminClient := newClient(t, helper.Org1.Admin)
 
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 
@@ -577,7 +576,7 @@ func TestIntegrationTimeIntervalListSelector(t *testing.T) {
 	interval2, err = adminClient.Create(ctx, interval2, v1.CreateOptions{})
 	require.NoError(t, err)
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 	require.NoError(t, db.SetProvenance(ctx, &definitions.MuteTimeInterval{
@@ -637,7 +636,7 @@ func TestIntegrationTimeIntervalReferentialIntegrity(t *testing.T) {
 	ctx := context.Background()
 	helper := getTestHelper(t)
 	env := helper.GetEnv()
-	ac := acimpl.ProvideAccessControl(env.FeatureToggles, zanzana.NewNoopClient())
+	ac := acimpl.ProvideAccessControl(env.FeatureToggles)
 	db, err := store.ProvideDBStore(env.Cfg, env.FeatureToggles, env.SQLStore, &foldertest.FakeService{}, &dashboards.FakeDashboardService{}, ac, bus.ProvideBus(tracing.InitializeTracerForTest()))
 	require.NoError(t, err)
 	orgID := helper.Org1.Admin.Identity.GetOrgID()

From 36d6fad421fb15ca7534725a1ee71f619f245020 Mon Sep 17 00:00:00 2001
From: Mariell Hoversholm <mariell.hoversholm@grafana.com>
Date: Tue, 14 Jan 2025 10:34:57 +0100
Subject: [PATCH 21/24] Feat: Setup the App SDK logging module (#98927)

* Feat: Setup the App SDK logging module

* Build: Depend on logging pkg and update App SDK

* Chore: Assign owner to logging module
---
 apps/alerting/notifications/go.mod  |  2 +-
 apps/alerting/notifications/go.sum  |  4 ++--
 apps/investigation/go.mod           |  8 ++++++--
 apps/investigation/go.sum           | 18 ++++++++++++++++--
 apps/playlist/go.mod                |  8 ++++++--
 apps/playlist/go.sum                | 18 ++++++++++++++++--
 go.mod                              |  3 ++-
 go.sum                              |  6 ++++--
 go.work.sum                         |  7 +++++++
 kindsv2/go.mod                      |  3 +--
 kindsv2/go.sum                      |  4 ++--
 pkg/infra/log/log.go                |  3 +++
 pkg/promlib/go.mod                  |  2 +-
 pkg/promlib/go.sum                  |  4 ++--
 pkg/storage/unified/apistore/go.mod |  1 +
 pkg/storage/unified/apistore/go.sum |  2 ++
 pkg/storage/unified/resource/go.mod |  1 +
 pkg/storage/unified/resource/go.sum |  2 ++
 18 files changed, 75 insertions(+), 21 deletions(-)

diff --git a/apps/alerting/notifications/go.mod b/apps/alerting/notifications/go.mod
index 1b6cc345dd7..8652ac7f708 100644
--- a/apps/alerting/notifications/go.mod
+++ b/apps/alerting/notifications/go.mod
@@ -6,7 +6,7 @@ replace github.com/grafana/grafana => ../../..
 
 require (
 	github.com/grafana/grafana v0.0.0-00010101000000-000000000000
-	github.com/grafana/grafana-app-sdk v0.23.1
+	github.com/grafana/grafana-app-sdk v0.29.0
 	k8s.io/apimachinery v0.32.0
 	k8s.io/apiserver v0.32.0
 	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
diff --git a/apps/alerting/notifications/go.sum b/apps/alerting/notifications/go.sum
index f7ba719f1f1..1715e2d28f8 100644
--- a/apps/alerting/notifications/go.sum
+++ b/apps/alerting/notifications/go.sum
@@ -71,8 +71,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grafana/grafana-app-sdk v0.23.1 h1:BRpUG0bA0oVxjthkmO2thuJBo3nbjaRSSmZJHw+mA8I=
-github.com/grafana/grafana-app-sdk v0.23.1/go.mod h1:KzgPnTJfMeckGmMctv6CJb8Jr/o/5rwARDyjXoeR0Fc=
+github.com/grafana/grafana-app-sdk v0.29.0 h1:LMSm/+0LOBPd13fe1bs/4sKJmuLiixYUX9T0oqDqp4I=
+github.com/grafana/grafana-app-sdk v0.29.0/go.mod h1:XLt308EmK6kvqPlzjUyXxbwZKEk2vur/eiypUNDay5I=
 github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240821155123-6891eb1d35da h1:2E3c/I3ayAy4Z1GwIPqXNZcpUccRapE1aBXA1ho4g7o=
 github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240821155123-6891eb1d35da/go.mod h1:p09fvU5ujNL/Ig8HB7g4f+S0zyYbQq3x/f0jA4ujVOM=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
diff --git a/apps/investigation/go.mod b/apps/investigation/go.mod
index 00294747e47..d5d5c6cc49d 100644
--- a/apps/investigation/go.mod
+++ b/apps/investigation/go.mod
@@ -1,9 +1,9 @@
 module github.com/grafana/grafana/apps/investigation
 
-go 1.23.1
+go 1.23.4
 
 require (
-	github.com/grafana/grafana-app-sdk v0.23.1
+	github.com/grafana/grafana-app-sdk v0.29.0
 	k8s.io/apimachinery v0.32.0
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
@@ -29,7 +29,9 @@ require (
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/grafana/grafana-app-sdk/logging v0.29.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -61,10 +63,12 @@ require (
 	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
 	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
diff --git a/apps/investigation/go.sum b/apps/investigation/go.sum
index e421f943276..be0502d6005 100644
--- a/apps/investigation/go.sum
+++ b/apps/investigation/go.sum
@@ -29,6 +29,8 @@ github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -43,10 +45,14 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grafana/grafana-app-sdk v0.23.1 h1:BRpUG0bA0oVxjthkmO2thuJBo3nbjaRSSmZJHw+mA8I=
-github.com/grafana/grafana-app-sdk v0.23.1/go.mod h1:KzgPnTJfMeckGmMctv6CJb8Jr/o/5rwARDyjXoeR0Fc=
+github.com/grafana/grafana-app-sdk v0.29.0 h1:LMSm/+0LOBPd13fe1bs/4sKJmuLiixYUX9T0oqDqp4I=
+github.com/grafana/grafana-app-sdk v0.29.0/go.mod h1:XLt308EmK6kvqPlzjUyXxbwZKEk2vur/eiypUNDay5I=
+github.com/grafana/grafana-app-sdk/logging v0.29.0 h1:mgbXaAf33aFwqwGVeaX30l8rkeAJH0iACgX5Rn6YkN4=
+github.com/grafana/grafana-app-sdk/logging v0.29.0/go.mod h1:xy6ZyVXl50Z3DBDLybvBPphbykPhuVNed/VNmen9DQM=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -81,6 +87,10 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -150,6 +160,8 @@ golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -167,6 +179,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/apps/playlist/go.mod b/apps/playlist/go.mod
index 4059258b04f..e8174a96dcb 100644
--- a/apps/playlist/go.mod
+++ b/apps/playlist/go.mod
@@ -1,9 +1,9 @@
 module github.com/grafana/grafana/apps/playlist
 
-go 1.23.1
+go 1.23.4
 
 require (
-	github.com/grafana/grafana-app-sdk v0.23.1
+	github.com/grafana/grafana-app-sdk v0.29.0
 	k8s.io/apimachinery v0.32.0
 	k8s.io/client-go v0.32.0
 	k8s.io/klog/v2 v2.130.1
@@ -30,7 +30,9 @@ require (
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/grafana/grafana-app-sdk/logging v0.29.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -62,10 +64,12 @@ require (
 	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
 	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241216192217-9240e9c98484 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d // indirect
diff --git a/apps/playlist/go.sum b/apps/playlist/go.sum
index e421f943276..be0502d6005 100644
--- a/apps/playlist/go.sum
+++ b/apps/playlist/go.sum
@@ -29,6 +29,8 @@ github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -43,10 +45,14 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grafana/grafana-app-sdk v0.23.1 h1:BRpUG0bA0oVxjthkmO2thuJBo3nbjaRSSmZJHw+mA8I=
-github.com/grafana/grafana-app-sdk v0.23.1/go.mod h1:KzgPnTJfMeckGmMctv6CJb8Jr/o/5rwARDyjXoeR0Fc=
+github.com/grafana/grafana-app-sdk v0.29.0 h1:LMSm/+0LOBPd13fe1bs/4sKJmuLiixYUX9T0oqDqp4I=
+github.com/grafana/grafana-app-sdk v0.29.0/go.mod h1:XLt308EmK6kvqPlzjUyXxbwZKEk2vur/eiypUNDay5I=
+github.com/grafana/grafana-app-sdk/logging v0.29.0 h1:mgbXaAf33aFwqwGVeaX30l8rkeAJH0iACgX5Rn6YkN4=
+github.com/grafana/grafana-app-sdk/logging v0.29.0/go.mod h1:xy6ZyVXl50Z3DBDLybvBPphbykPhuVNed/VNmen9DQM=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -81,6 +87,10 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -150,6 +160,8 @@ golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -167,6 +179,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/go.mod b/go.mod
index fc775d26665..b2d57d2c85d 100644
--- a/go.mod
+++ b/go.mod
@@ -72,7 +72,8 @@ require (
 	github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040 // @grafana/grafana-backend-group
 	github.com/grafana/gofpdf v0.0.0-20231002120153-857cc45be447 // @grafana/sharing-squad
 	github.com/grafana/gomemcache v0.0.0-20240805133030-fdaf6a95408e // @grafana/grafana-operator-experience-squad
-	github.com/grafana/grafana-app-sdk v0.23.1 // @grafana/grafana-app-platform-squad
+	github.com/grafana/grafana-app-sdk v0.29.0 // @grafana/grafana-app-platform-squad
+	github.com/grafana/grafana-app-sdk/logging v0.29.0 // @grafana/grafana-app-platform-squad
 	github.com/grafana/grafana-aws-sdk v0.31.5 // @grafana/aws-datasources
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 // @grafana/partner-datasources
 	github.com/grafana/grafana-cloud-migration-snapshot v1.6.0 // @grafana/grafana-operator-experience-squad
diff --git a/go.sum b/go.sum
index f725276a745..a5e9100ceb0 100644
--- a/go.sum
+++ b/go.sum
@@ -1507,8 +1507,10 @@ github.com/grafana/gofpdf v0.0.0-20231002120153-857cc45be447 h1:jxJJ5z0GxqhWFbQU
 github.com/grafana/gofpdf v0.0.0-20231002120153-857cc45be447/go.mod h1:IxsY6mns6Q5sAnWcrptrgUrSglTZJXH/kXr9nbpb/9I=
 github.com/grafana/gomemcache v0.0.0-20240805133030-fdaf6a95408e h1:UlEET0InuoFautfaFp8lDrNF7rPHYXuBMrzwWx9XqFY=
 github.com/grafana/gomemcache v0.0.0-20240805133030-fdaf6a95408e/go.mod h1:IGRj8oOoxwJbHBYl1+OhS9UjQR0dv6SQOep7HqmtyFU=
-github.com/grafana/grafana-app-sdk v0.23.1 h1:BRpUG0bA0oVxjthkmO2thuJBo3nbjaRSSmZJHw+mA8I=
-github.com/grafana/grafana-app-sdk v0.23.1/go.mod h1:KzgPnTJfMeckGmMctv6CJb8Jr/o/5rwARDyjXoeR0Fc=
+github.com/grafana/grafana-app-sdk v0.29.0 h1:LMSm/+0LOBPd13fe1bs/4sKJmuLiixYUX9T0oqDqp4I=
+github.com/grafana/grafana-app-sdk v0.29.0/go.mod h1:XLt308EmK6kvqPlzjUyXxbwZKEk2vur/eiypUNDay5I=
+github.com/grafana/grafana-app-sdk/logging v0.29.0 h1:mgbXaAf33aFwqwGVeaX30l8rkeAJH0iACgX5Rn6YkN4=
+github.com/grafana/grafana-app-sdk/logging v0.29.0/go.mod h1:xy6ZyVXl50Z3DBDLybvBPphbykPhuVNed/VNmen9DQM=
 github.com/grafana/grafana-aws-sdk v0.31.5 h1:4HpMQx7n4Qqoi7Bgu8KHQ2QKT9fYYdHilX/Gh3FZKBE=
 github.com/grafana/grafana-aws-sdk v0.31.5/go.mod h1:5p4Cjyr5ZiR6/RT2nFWkJ8XpIKgX4lAUmUMu70m2yCM=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 h1:fV6IgVtViXcYZ4VqTAMuVBTLuGAnI27HhQkaLttzbPE=
diff --git a/go.work.sum b/go.work.sum
index 2b2e097cc4e..e6633f8a092 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -1913,6 +1913,8 @@ github.com/lyft/protoc-gen-star/v2 v2.0.4-0.20230330145011-496ad1ac90a4 h1:sIXJO
 github.com/lyft/protoc-gen-star/v2 v2.0.4-0.20230330145011-496ad1ac90a4/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
 github.com/mailgun/raymond/v2 v2.0.48 h1:5dmlB680ZkFG2RN/0lvTAghrSxIESeu9/2aeDqACtjw=
 github.com/mailgun/raymond/v2 v2.0.48/go.mod h1:lsgvL50kgt1ylcFJYZiULi5fjPBkkhNfj4KA0W54Z18=
+github.com/matryer/moq v0.3.3 h1:pScMH9VyrdT4S93yiLpVyU8rCDqGQr24uOyBxmktG5Q=
+github.com/matryer/moq v0.3.3/go.mod h1:RJ75ZZZD71hejp39j4crZLsEDszGk6iH4v4YsWFKH4s=
 github.com/matryer/moq v0.5.0 h1:h2PJUYjZSiyEahzVogDRmrgL9Bsx9xYAl8l+LPfmwL8=
 github.com/matryer/moq v0.5.0/go.mod h1:39GTnrD0mVWHPvWdYj5ki/lxfhLQEtHcLh+tWoYF/iE=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -2523,6 +2525,7 @@ golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
@@ -2544,6 +2547,7 @@ golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/tools v0.25.0/go.mod h1:/vtpO8WL1N9cQC3FN5zPqb//fRXskFHbLKk4OW1Q7rg=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.12.0/go.mod h1:73TDxJfAAHeA8Mk9mf8NlIppyhQNo5GLTcYeqgo2lvY=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0 h1:OE9mWmgKkjJyEmDAAtGMPjXu+YNeGvK9VTSHY6+Qihc=
@@ -2702,6 +2706,7 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241206012308-a4fef0638583/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
@@ -2730,6 +2735,7 @@ google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHh
 google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
 gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
@@ -2819,4 +2825,5 @@ sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h6
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e h1:4Z09Hglb792X0kfOBBJUPFEyvVfQWrYT/l8h5EKA6JQ=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/kindsv2/go.mod b/kindsv2/go.mod
index 3ffb84c1af2..37f632240d1 100644
--- a/kindsv2/go.mod
+++ b/kindsv2/go.mod
@@ -2,7 +2,7 @@ module github.com/grafana/grafana/kindsv2
 
 go 1.23.1
 
-require github.com/grafana/cog v0.0.5
+require github.com/grafana/cog v0.0.10
 
 require (
 	cuelabs.dev/go/oci/ociregistry v0.0.0-20240906074133-82eb438dd565 // indirect
@@ -33,7 +33,6 @@ require (
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20241112170944-20d2c9ebc01d // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
-	github.com/stretchr/testify v1.10.0 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
 	github.com/yalue/merged_fs v1.3.0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
diff --git a/kindsv2/go.sum b/kindsv2/go.sum
index 907ebfd7292..6a78ef7df75 100644
--- a/kindsv2/go.sum
+++ b/kindsv2/go.sum
@@ -26,8 +26,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grafana/codejen v0.0.4-0.20230321061741-77f656893a3d h1:hrXbGJ5jgp6yNITzs5o+zXq0V5yT3siNJ+uM8LGwWKk=
 github.com/grafana/codejen v0.0.4-0.20230321061741-77f656893a3d/go.mod h1:zmwwM/DRyQB7pfuBjTWII3CWtxcXh8LTwAYGfDfpR6s=
-github.com/grafana/cog v0.0.5 h1:BCa+10i3KvV+KMSQuxlN1DS9cZEwN+EAFc7ZmXqHxQE=
-github.com/grafana/cog v0.0.5/go.mod h1:lzetOuhGUl/JaSACiJoHvBokf9/fS6PEFaWZvnQu2vs=
+github.com/grafana/cog v0.0.10 h1:YqtqZ1a51njXEVRKspuQifRwgYgU5NcK5KwuiEDGUqo=
+github.com/grafana/cog v0.0.10/go.mod h1:HwJbc60fZ+viayROClLGdDwO5w/JjBOpO9wjGnAfMLc=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
diff --git a/pkg/infra/log/log.go b/pkg/infra/log/log.go
index 03623e5ee55..702bbc66f92 100644
--- a/pkg/infra/log/log.go
+++ b/pkg/infra/log/log.go
@@ -22,6 +22,7 @@ import (
 	"github.com/mattn/go-isatty"
 	"gopkg.in/ini.v1"
 
+	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana/pkg/infra/log/term"
 	"github.com/grafana/grafana/pkg/infra/log/text"
 	"github.com/grafana/grafana/pkg/util"
@@ -60,6 +61,8 @@ func init() {
 		}
 		return nil, false
 	})
+
+	logging.DefaultLogger = logging.NewSLogLogger(slog.Default().Handler())
 }
 
 // logManager manage loggers
diff --git a/pkg/promlib/go.mod b/pkg/promlib/go.mod
index d02c0410320..31830262cfa 100644
--- a/pkg/promlib/go.mod
+++ b/pkg/promlib/go.mod
@@ -57,7 +57,7 @@ require (
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-plugin v1.6.2 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/invopop/jsonschema v0.12.0 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
 	github.com/invopop/yaml v0.3.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 // indirect
diff --git a/pkg/promlib/go.sum b/pkg/promlib/go.sum
index ce1ce9a4189..05729d91c09 100644
--- a/pkg/promlib/go.sum
+++ b/pkg/promlib/go.sum
@@ -140,8 +140,8 @@ github.com/hashicorp/go-plugin v1.6.2 h1:zdGAEd0V1lCaU0u+MxWQhtSDQmahpkwOun8U8Ei
 github.com/hashicorp/go-plugin v1.6.2/go.mod h1:CkgLQ5CZqNmdL9U9JzM532t8ZiYQ35+pj3b1FD37R0Q=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/invopop/jsonschema v0.12.0 h1:6ovsNSuvn9wEQVOyc72aycBMVQFKz7cPdMJn10CvzRI=
-github.com/invopop/jsonschema v0.12.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
 github.com/invopop/yaml v0.3.1 h1:f0+ZpmhfBSS4MhG+4HYseMdJhoeeopbSKbq5Rpeelso=
 github.com/invopop/yaml v0.3.1/go.mod h1:PMOp3nn4/12yEZUFfmOuNHJsZToEEOwoWsT+D81KkeA=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
diff --git a/pkg/storage/unified/apistore/go.mod b/pkg/storage/unified/apistore/go.mod
index 2aadfed0fda..2eaebf1d2b2 100644
--- a/pkg/storage/unified/apistore/go.mod
+++ b/pkg/storage/unified/apistore/go.mod
@@ -173,6 +173,7 @@ require (
 	github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040 // indirect
+	github.com/grafana/grafana-app-sdk/logging v0.29.0 // indirect
 	github.com/grafana/grafana-aws-sdk v0.31.5 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 // indirect
 	github.com/grafana/grafana-plugin-sdk-go v0.261.0 // indirect
diff --git a/pkg/storage/unified/apistore/go.sum b/pkg/storage/unified/apistore/go.sum
index 5c74ef8d68e..8125f211acf 100644
--- a/pkg/storage/unified/apistore/go.sum
+++ b/pkg/storage/unified/apistore/go.sum
@@ -555,6 +555,8 @@ github.com/grafana/dataplane/sdata v0.0.9 h1:AGL1LZnCUG4MnQtnWpBPbQ8ZpptaZs14w6k
 github.com/grafana/dataplane/sdata v0.0.9/go.mod h1:Jvs5ddpGmn6vcxT7tCTWAZ1mgi4sbcdFt9utQx5uMAU=
 github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040 h1:IR+UNYHqaU31t8/TArJk8K/GlDwOyxMpGNkWCXeZ28g=
 github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040/go.mod h1:SPLNCARd4xdjCkue0O6hvuoveuS1dGJjDnfxYe405YQ=
+github.com/grafana/grafana-app-sdk/logging v0.29.0 h1:mgbXaAf33aFwqwGVeaX30l8rkeAJH0iACgX5Rn6YkN4=
+github.com/grafana/grafana-app-sdk/logging v0.29.0/go.mod h1:xy6ZyVXl50Z3DBDLybvBPphbykPhuVNed/VNmen9DQM=
 github.com/grafana/grafana-aws-sdk v0.31.5 h1:4HpMQx7n4Qqoi7Bgu8KHQ2QKT9fYYdHilX/Gh3FZKBE=
 github.com/grafana/grafana-aws-sdk v0.31.5/go.mod h1:5p4Cjyr5ZiR6/RT2nFWkJ8XpIKgX4lAUmUMu70m2yCM=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 h1:fV6IgVtViXcYZ4VqTAMuVBTLuGAnI27HhQkaLttzbPE=
diff --git a/pkg/storage/unified/resource/go.mod b/pkg/storage/unified/resource/go.mod
index 30dacf1bed3..a10e7c59844 100644
--- a/pkg/storage/unified/resource/go.mod
+++ b/pkg/storage/unified/resource/go.mod
@@ -118,6 +118,7 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grafana/alerting v0.0.0-20250110220613-267368fd1968 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
+	github.com/grafana/grafana-app-sdk/logging v0.29.0 // indirect
 	github.com/grafana/grafana-aws-sdk v0.31.5 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 // indirect
 	github.com/grafana/grafana/pkg/apiserver v0.0.0-20240821155123-6891eb1d35da // indirect
diff --git a/pkg/storage/unified/resource/go.sum b/pkg/storage/unified/resource/go.sum
index 9a6c58f32e1..9d62e56b250 100644
--- a/pkg/storage/unified/resource/go.sum
+++ b/pkg/storage/unified/resource/go.sum
@@ -408,6 +408,8 @@ github.com/grafana/dataplane/sdata v0.0.9 h1:AGL1LZnCUG4MnQtnWpBPbQ8ZpptaZs14w6k
 github.com/grafana/dataplane/sdata v0.0.9/go.mod h1:Jvs5ddpGmn6vcxT7tCTWAZ1mgi4sbcdFt9utQx5uMAU=
 github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040 h1:IR+UNYHqaU31t8/TArJk8K/GlDwOyxMpGNkWCXeZ28g=
 github.com/grafana/dskit v0.0.0-20241105154643-a6b453a88040/go.mod h1:SPLNCARd4xdjCkue0O6hvuoveuS1dGJjDnfxYe405YQ=
+github.com/grafana/grafana-app-sdk/logging v0.29.0 h1:mgbXaAf33aFwqwGVeaX30l8rkeAJH0iACgX5Rn6YkN4=
+github.com/grafana/grafana-app-sdk/logging v0.29.0/go.mod h1:xy6ZyVXl50Z3DBDLybvBPphbykPhuVNed/VNmen9DQM=
 github.com/grafana/grafana-aws-sdk v0.31.5 h1:4HpMQx7n4Qqoi7Bgu8KHQ2QKT9fYYdHilX/Gh3FZKBE=
 github.com/grafana/grafana-aws-sdk v0.31.5/go.mod h1:5p4Cjyr5ZiR6/RT2nFWkJ8XpIKgX4lAUmUMu70m2yCM=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.1.2 h1:fV6IgVtViXcYZ4VqTAMuVBTLuGAnI27HhQkaLttzbPE=

From 65f5a176a8c432c216c92a1175a0db2293130482 Mon Sep 17 00:00:00 2001
From: Josh Hunt <joshhunt@users.noreply.github.com>
Date: Tue, 14 Jan 2025 09:35:27 +0000
Subject: [PATCH 22/24] Chore: Import Combobox from main grafana-ui package
 (#98897)

---
 .../src/querybuilder/components/MetricCombobox.tsx             | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx b/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
index 0c156da10f0..62e75dee1eb 100644
--- a/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
+++ b/packages/grafana-prometheus/src/querybuilder/components/MetricCombobox.tsx
@@ -2,8 +2,7 @@ import { useCallback, useState } from 'react';
 
 import { SelectableValue } from '@grafana/data';
 import { EditorField, EditorFieldGroup, InputGroup } from '@grafana/experimental';
-import { Button, InlineField, InlineFieldRow } from '@grafana/ui';
-import { Combobox, ComboboxOption } from '@grafana/ui/src/components/Combobox/Combobox';
+import { Button, InlineField, InlineFieldRow, Combobox, ComboboxOption } from '@grafana/ui';
 
 import { PrometheusDatasource } from '../../datasource';
 import { regexifyLabelValuesQueryString } from '../parsingUtils';

From 5c49b6cf73b145e29a65d314acd357d8e71132dd Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jan 2025 09:46:18 +0000
Subject: [PATCH 23/24] Update dependency knip to v5.42.0 (#98892)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 yarn.lock | 79 +++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 53 insertions(+), 26 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index f3098f7ddcb..27ed4812045 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4898,6 +4898,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@nodelib/fs.scandir@npm:4.0.1":
+  version: 4.0.1
+  resolution: "@nodelib/fs.scandir@npm:4.0.1"
+  dependencies:
+    "@nodelib/fs.stat": "npm:4.0.0"
+    run-parallel: "npm:^1.2.0"
+  checksum: 10/44b2b2b34e48ca88ee004413f5033db31cd6d5ecf8c7bbef0e33b6672d603f3e23b57d5fbb1bd5f83f8992df58381be6600006d92a903f085e698a37bdfe3c89
+  languageName: node
+  linkType: hard
+
 "@nodelib/fs.stat@npm:2.0.5, @nodelib/fs.stat@npm:^2.0.2":
   version: 2.0.5
   resolution: "@nodelib/fs.stat@npm:2.0.5"
@@ -4905,7 +4915,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@nodelib/fs.walk@npm:1.2.8, @nodelib/fs.walk@npm:^1.2.3, @nodelib/fs.walk@npm:^1.2.6":
+"@nodelib/fs.stat@npm:4.0.0":
+  version: 4.0.0
+  resolution: "@nodelib/fs.stat@npm:4.0.0"
+  checksum: 10/1f87199fdab938d2ed6f5e10debc006f7965081e2cd147ed3d2333049a030cad1949bd76556a5f5364f062c3e1edcc3d0981189b065336fc92c503ead463f4e1
+  languageName: node
+  linkType: hard
+
+"@nodelib/fs.walk@npm:3.0.1":
+  version: 3.0.1
+  resolution: "@nodelib/fs.walk@npm:3.0.1"
+  dependencies:
+    "@nodelib/fs.scandir": "npm:4.0.1"
+    fastq: "npm:^1.15.0"
+  checksum: 10/7b76a0139dec52e3f2a3a0bb4f13dbf72a6b79d8076ec4b5deea9e75bd1b79d7abda53776f93b5aefda9a5e40f0e31f49f6e35bf5460a402f0aee7bcf3b26d85
+  languageName: node
+  linkType: hard
+
+"@nodelib/fs.walk@npm:^1.2.3, @nodelib/fs.walk@npm:^1.2.6":
   version: 1.2.8
   resolution: "@nodelib/fs.walk@npm:1.2.8"
   dependencies:
@@ -14947,13 +14974,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"enhanced-resolve@npm:^5.17.1":
-  version: 5.17.1
-  resolution: "enhanced-resolve@npm:5.17.1"
+"enhanced-resolve@npm:^5.17.1, enhanced-resolve@npm:^5.18.0":
+  version: 5.18.0
+  resolution: "enhanced-resolve@npm:5.18.0"
   dependencies:
     graceful-fs: "npm:^4.2.4"
     tapable: "npm:^2.2.0"
-  checksum: 10/e8e03cb7a4bf3c0250a89afbd29e5ec20e90ba5fcd026066232a0754864d7d0a393fa6fc0e5379314a6529165a1834b36731147080714459d98924520410d8f5
+  checksum: 10/e88463ef97b68d40d0da0cd0c572e23f43dba0be622d6d44eae5cafed05f0c5dac43e463a83a86c4f70186d029357f82b56d9e1e47e8fc91dce3d6602f8bd6ce
   languageName: node
   linkType: hard
 
@@ -16148,16 +16175,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-glob@npm:^3.0.3, fast-glob@npm:^3.2.9, fast-glob@npm:^3.3.2":
-  version: 3.3.2
-  resolution: "fast-glob@npm:3.3.2"
+"fast-glob@npm:^3.0.3, fast-glob@npm:^3.2.9, fast-glob@npm:^3.3.2, fast-glob@npm:^3.3.3":
+  version: 3.3.3
+  resolution: "fast-glob@npm:3.3.3"
   dependencies:
     "@nodelib/fs.stat": "npm:^2.0.2"
     "@nodelib/fs.walk": "npm:^1.2.3"
     glob-parent: "npm:^5.1.2"
     merge2: "npm:^1.3.0"
-    micromatch: "npm:^4.0.4"
-  checksum: 10/222512e9315a0efca1276af9adb2127f02105d7288fa746145bf45e2716383fb79eb983c89601a72a399a56b7c18d38ce70457c5466218c5f13fad957cee16df
+    micromatch: "npm:^4.0.8"
+  checksum: 10/dcc6432b269762dd47381d8b8358bf964d8f4f60286ac6aa41c01ade70bda459ff2001b516690b96d5365f68a49242966112b5d5cc9cd82395fa8f9d017c90ad
   languageName: node
   linkType: hard
 
@@ -16231,12 +16258,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fastq@npm:^1.13.0, fastq@npm:^1.6.0":
-  version: 1.17.1
-  resolution: "fastq@npm:1.17.1"
+"fastq@npm:^1.13.0, fastq@npm:^1.15.0, fastq@npm:^1.6.0":
+  version: 1.18.0
+  resolution: "fastq@npm:1.18.0"
   dependencies:
     reusify: "npm:^1.0.4"
-  checksum: 10/a443180068b527dd7b3a63dc7f2a47ceca2f3e97b9c00a1efe5538757e6cc4056a3526df94308075d7727561baf09ebaa5b67da8dcbddb913a021c5ae69d1f69
+  checksum: 10/c5b501333dc8f5d188d828ea162aad03ff5a81aed185b6d4a5078aaeae0a42babc34296d7af13ebce86401cccd93c9b7b3cbf61280821c5f20af233378b42fbb
   languageName: node
   linkType: hard
 
@@ -20072,12 +20099,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jiti@npm:^2.4.0":
-  version: 2.4.0
-  resolution: "jiti@npm:2.4.0"
+"jiti@npm:^2.4.2":
+  version: 2.4.2
+  resolution: "jiti@npm:2.4.2"
   bin:
     jiti: lib/jiti-cli.mjs
-  checksum: 10/10aa999a4f9bccc82b1dab9ebaf4484a8770450883c1bf7fafc07f8fca1e417fd8e7731e651337d1060c9e2ff3f97362dcdfd27e86d1f385db97f4adf7b5a21d
+  checksum: 10/e2b07eb2e3fbb245e29ad288dddecab31804967fc84d5e01d39858997d2743b5e248946defcecf99272275a00284ecaf7ec88b8c841331324f0c946d8274414b
   languageName: node
   linkType: hard
 
@@ -20533,15 +20560,15 @@ __metadata:
   linkType: hard
 
 "knip@npm:^5.10.0":
-  version: 5.41.1
-  resolution: "knip@npm:5.41.1"
+  version: 5.42.0
+  resolution: "knip@npm:5.42.0"
   dependencies:
-    "@nodelib/fs.walk": "npm:1.2.8"
+    "@nodelib/fs.walk": "npm:3.0.1"
     "@snyk/github-codeowners": "npm:1.1.0"
     easy-table: "npm:1.2.0"
-    enhanced-resolve: "npm:^5.17.1"
-    fast-glob: "npm:^3.3.2"
-    jiti: "npm:^2.4.0"
+    enhanced-resolve: "npm:^5.18.0"
+    fast-glob: "npm:^3.3.3"
+    jiti: "npm:^2.4.2"
     js-yaml: "npm:^4.1.0"
     minimist: "npm:^1.2.8"
     picocolors: "npm:^1.1.0"
@@ -20558,7 +20585,7 @@ __metadata:
   bin:
     knip: bin/knip.js
     knip-bun: bin/knip-bun.js
-  checksum: 10/683afc2abf205598d015106175dcdd8847e99db4a1e9daff160d6144032b5ece39aca82e23ba9e33f41b7df95858389edc954b07be230a87736197305cd2511e
+  checksum: 10/e12b0d669a8659ed12cf2e8d9f5bbac5acbfe721549294ba5ecd81806040c5a71a20d3a724cacfa3f60e4b74d71418529b5b69aaf6d2233b31f4e5abf6835857
   languageName: node
   linkType: hard
 
@@ -26841,7 +26868,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"run-parallel@npm:^1.1.9":
+"run-parallel@npm:^1.1.9, run-parallel@npm:^1.2.0":
   version: 1.2.0
   resolution: "run-parallel@npm:1.2.0"
   dependencies:

From 1281b0f09462eeacd8f557bf122be43d4b04d6dd Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jan 2025 12:09:54 +0200
Subject: [PATCH 24/24] Update dependency @types/node to v22.10.6 (#98934)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package.json                                  |  2 +-
 packages/grafana-data/package.json            |  2 +-
 packages/grafana-e2e-selectors/package.json   |  2 +-
 packages/grafana-flamegraph/package.json      |  2 +-
 packages/grafana-icons/package.json           |  2 +-
 .../grafana-o11y-ds-frontend/package.json     |  2 +-
 packages/grafana-prometheus/package.json      |  2 +-
 packages/grafana-sql/package.json             |  2 +-
 packages/grafana-ui/package.json              |  2 +-
 .../datasource/azuremonitor/package.json      |  2 +-
 .../datasource/cloud-monitoring/package.json  |  2 +-
 .../package.json                              |  2 +-
 .../grafana-pyroscope-datasource/package.json |  2 +-
 .../grafana-testdata-datasource/package.json  |  2 +-
 .../plugins/datasource/jaeger/package.json    |  2 +-
 .../app/plugins/datasource/mssql/package.json |  2 +-
 .../app/plugins/datasource/mysql/package.json |  2 +-
 .../app/plugins/datasource/parca/package.json |  2 +-
 .../app/plugins/datasource/tempo/package.json |  2 +-
 .../plugins/datasource/zipkin/package.json    |  2 +-
 yarn.lock                                     | 48 +++++++++----------
 21 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/package.json b/package.json
index 965b46b4b69..f8ffd2f3e0d 100644
--- a/package.json
+++ b/package.json
@@ -123,7 +123,7 @@
     "@types/lodash": "4.17.14",
     "@types/logfmt": "^1.2.3",
     "@types/lucene": "^2",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/node-forge": "^1",
     "@types/ol-ext": "npm:@siedlerchr/types-ol-ext@3.2.4",
     "@types/pluralize": "^0.0.33",
diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json
index 514c99cdf89..a647ed0fc70 100644
--- a/packages/grafana-data/package.json
+++ b/packages/grafana-data/package.json
@@ -65,7 +65,7 @@
     "@rollup/plugin-node-resolve": "16.0.0",
     "@types/history": "4.7.11",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/papaparse": "5.3.15",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
diff --git a/packages/grafana-e2e-selectors/package.json b/packages/grafana-e2e-selectors/package.json
index a29265d2de3..ce6eba55710 100644
--- a/packages/grafana-e2e-selectors/package.json
+++ b/packages/grafana-e2e-selectors/package.json
@@ -40,7 +40,7 @@
   },
   "devDependencies": {
     "@rollup/plugin-node-resolve": "16.0.0",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/semver": "7.5.8",
     "esbuild": "0.24.2",
     "rimraf": "6.0.1",
diff --git a/packages/grafana-flamegraph/package.json b/packages/grafana-flamegraph/package.json
index 96a203fd92c..ea058b8c6a4 100644
--- a/packages/grafana-flamegraph/package.json
+++ b/packages/grafana-flamegraph/package.json
@@ -68,7 +68,7 @@
     "@types/d3": "^7",
     "@types/jest": "^29.5.4",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-virtualized-auto-sizer": "1.0.4",
     "@types/tinycolor2": "1.4.6",
diff --git a/packages/grafana-icons/package.json b/packages/grafana-icons/package.json
index 46f8196c9d4..600fd4e7d2a 100644
--- a/packages/grafana-icons/package.json
+++ b/packages/grafana-icons/package.json
@@ -45,7 +45,7 @@
     "@svgr/plugin-prettier": "^8.1.0",
     "@svgr/plugin-svgo": "^8.1.0",
     "@types/babel__core": "^7",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "esbuild": "0.24.2",
diff --git a/packages/grafana-o11y-ds-frontend/package.json b/packages/grafana-o11y-ds-frontend/package.json
index a21f3a48fa1..1151cf467a6 100644
--- a/packages/grafana-o11y-ds-frontend/package.json
+++ b/packages/grafana-o11y-ds-frontend/package.json
@@ -36,7 +36,7 @@
     "@testing-library/react": "16.1.0",
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "^29.5.4",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/systemjs": "6.15.1",
     "jest": "^29.6.4",
diff --git a/packages/grafana-prometheus/package.json b/packages/grafana-prometheus/package.json
index 621f72cb0b5..218cbe453db 100644
--- a/packages/grafana-prometheus/package.json
+++ b/packages/grafana-prometheus/package.json
@@ -92,7 +92,7 @@
     "@types/jest": "29.5.14",
     "@types/jquery": "3.5.32",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/pluralize": "^0.0.33",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
diff --git a/packages/grafana-sql/package.json b/packages/grafana-sql/package.json
index 72c804aea23..275bce455e2 100644
--- a/packages/grafana-sql/package.json
+++ b/packages/grafana-sql/package.json
@@ -41,7 +41,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "^29.5.4",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "@types/react-virtualized-auto-sizer": "1.0.4",
diff --git a/packages/grafana-ui/package.json b/packages/grafana-ui/package.json
index 4ae44e7b035..648ae06c78d 100644
--- a/packages/grafana-ui/package.json
+++ b/packages/grafana-ui/package.json
@@ -145,7 +145,7 @@
     "@types/is-hotkey": "0.1.10",
     "@types/jest": "29.5.14",
     "@types/mock-raf": "1.0.6",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
     "@types/react-color": "3.0.13",
diff --git a/public/app/plugins/datasource/azuremonitor/package.json b/public/app/plugins/datasource/azuremonitor/package.json
index ba57c65f716..9bbf1a6eba8 100644
--- a/public/app/plugins/datasource/azuremonitor/package.json
+++ b/public/app/plugins/datasource/azuremonitor/package.json
@@ -33,7 +33,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
diff --git a/public/app/plugins/datasource/cloud-monitoring/package.json b/public/app/plugins/datasource/cloud-monitoring/package.json
index fa077b0f07d..0f643df47a3 100644
--- a/public/app/plugins/datasource/cloud-monitoring/package.json
+++ b/public/app/plugins/datasource/cloud-monitoring/package.json
@@ -35,7 +35,7 @@
     "@types/debounce-promise": "3.1.9",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
diff --git a/public/app/plugins/datasource/grafana-postgresql-datasource/package.json b/public/app/plugins/datasource/grafana-postgresql-datasource/package.json
index e91b1f93d9a..593af71577b 100644
--- a/public/app/plugins/datasource/grafana-postgresql-datasource/package.json
+++ b/public/app/plugins/datasource/grafana-postgresql-datasource/package.json
@@ -23,7 +23,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "ts-node": "10.9.2",
     "typescript": "5.7.3",
diff --git a/public/app/plugins/datasource/grafana-pyroscope-datasource/package.json b/public/app/plugins/datasource/grafana-pyroscope-datasource/package.json
index 42e78235bfa..2a13b7b1b56 100644
--- a/public/app/plugins/datasource/grafana-pyroscope-datasource/package.json
+++ b/public/app/plugins/datasource/grafana-pyroscope-datasource/package.json
@@ -27,7 +27,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
diff --git a/public/app/plugins/datasource/grafana-testdata-datasource/package.json b/public/app/plugins/datasource/grafana-testdata-datasource/package.json
index 915fbd100f3..1c5df61e1f4 100644
--- a/public/app/plugins/datasource/grafana-testdata-datasource/package.json
+++ b/public/app/plugins/datasource/grafana-testdata-datasource/package.json
@@ -30,7 +30,7 @@
     "@types/d3-random": "^3.0.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "@types/uuid": "10.0.0",
diff --git a/public/app/plugins/datasource/jaeger/package.json b/public/app/plugins/datasource/jaeger/package.json
index 6c3960ed6eb..ac050e970c0 100644
--- a/public/app/plugins/datasource/jaeger/package.json
+++ b/public/app/plugins/datasource/jaeger/package.json
@@ -31,7 +31,7 @@
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
     "@types/logfmt": "^1.2.3",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "@types/react-window": "1.8.8",
diff --git a/public/app/plugins/datasource/mssql/package.json b/public/app/plugins/datasource/mssql/package.json
index ccd4c0e12d4..4aef3fa4423 100644
--- a/public/app/plugins/datasource/mssql/package.json
+++ b/public/app/plugins/datasource/mssql/package.json
@@ -23,7 +23,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "ts-node": "10.9.2",
     "typescript": "5.7.3",
diff --git a/public/app/plugins/datasource/mysql/package.json b/public/app/plugins/datasource/mysql/package.json
index b11f21d97bb..ae52e02d39a 100644
--- a/public/app/plugins/datasource/mysql/package.json
+++ b/public/app/plugins/datasource/mysql/package.json
@@ -23,7 +23,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "ts-node": "10.9.2",
     "typescript": "5.7.3",
diff --git a/public/app/plugins/datasource/parca/package.json b/public/app/plugins/datasource/parca/package.json
index 62e5e148c85..4fc5665ab48 100644
--- a/public/app/plugins/datasource/parca/package.json
+++ b/public/app/plugins/datasource/parca/package.json
@@ -23,7 +23,7 @@
     "@testing-library/react": "16.1.0",
     "@testing-library/user-event": "14.5.2",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "ts-node": "10.9.2",
diff --git a/public/app/plugins/datasource/tempo/package.json b/public/app/plugins/datasource/tempo/package.json
index 4f5a0dd150a..58f9e94541a 100644
--- a/public/app/plugins/datasource/tempo/package.json
+++ b/public/app/plugins/datasource/tempo/package.json
@@ -46,7 +46,7 @@
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/prismjs": "1.26.5",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
diff --git a/public/app/plugins/datasource/zipkin/package.json b/public/app/plugins/datasource/zipkin/package.json
index bddcc14764f..f881ca3b3e0 100644
--- a/public/app/plugins/datasource/zipkin/package.json
+++ b/public/app/plugins/datasource/zipkin/package.json
@@ -26,7 +26,7 @@
     "@testing-library/react": "16.1.0",
     "@types/jest": "29.5.14",
     "@types/lodash": "4.17.14",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.6",
     "@types/react": "18.3.3",
     "@types/react-dom": "18.2.25",
     "ts-node": "10.9.2",
diff --git a/yarn.lock b/yarn.lock
index 27ed4812045..8076c6341cf 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2679,7 +2679,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
@@ -2721,7 +2721,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     lodash: "npm:4.17.21"
     react: "npm:18.2.0"
@@ -2751,7 +2751,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
@@ -2793,7 +2793,7 @@ __metadata:
     "@types/d3-random": "npm:^3.0.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     "@types/uuid": "npm:10.0.0"
@@ -2834,7 +2834,7 @@ __metadata:
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
     "@types/logfmt": "npm:^1.2.3"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     "@types/react-window": "npm:1.8.8"
@@ -2874,7 +2874,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     lodash: "npm:4.17.21"
     react: "npm:18.2.0"
@@ -2905,7 +2905,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     lodash: "npm:4.17.21"
     react: "npm:18.2.0"
@@ -2933,7 +2933,7 @@ __metadata:
     "@testing-library/react": "npm:16.1.0"
     "@testing-library/user-event": "npm:14.5.2"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     lodash: "npm:4.17.21"
@@ -2971,7 +2971,7 @@ __metadata:
     "@types/debounce-promise": "npm:3.1.9"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
@@ -3024,7 +3024,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
@@ -3074,7 +3074,7 @@ __metadata:
     "@testing-library/react": "npm:16.1.0"
     "@types/jest": "npm:29.5.14"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     lodash: "npm:4.17.21"
@@ -3132,7 +3132,7 @@ __metadata:
     "@types/d3-interpolate": "npm:^3.0.0"
     "@types/history": "npm:4.7.11"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/papaparse": "npm:5.3.15"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
@@ -3179,7 +3179,7 @@ __metadata:
   dependencies:
     "@grafana/tsconfig": "npm:^2.0.0"
     "@rollup/plugin-node-resolve": "npm:16.0.0"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/semver": "npm:7.5.8"
     esbuild: "npm:0.24.2"
     rimraf: "npm:6.0.1"
@@ -3314,7 +3314,7 @@ __metadata:
     "@types/d3": "npm:^7"
     "@types/jest": "npm:^29.5.4"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-virtualized-auto-sizer": "npm:1.0.4"
     "@types/tinycolor2": "npm:1.4.6"
@@ -3398,7 +3398,7 @@ __metadata:
     "@testing-library/react": "npm:16.1.0"
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:^29.5.4"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/systemjs": "npm:6.15.1"
     jest: "npm:^29.6.4"
@@ -3518,7 +3518,7 @@ __metadata:
     "@types/jest": "npm:29.5.14"
     "@types/jquery": "npm:3.5.32"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/pluralize": "npm:^0.0.33"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
@@ -3649,7 +3649,7 @@ __metadata:
     "@svgr/plugin-prettier": "npm:^8.1.0"
     "@svgr/plugin-svgo": "npm:^8.1.0"
     "@types/babel__core": "npm:^7"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     esbuild: "npm:0.24.2"
@@ -3747,7 +3747,7 @@ __metadata:
     "@testing-library/user-event": "npm:14.5.2"
     "@types/jest": "npm:^29.5.4"
     "@types/lodash": "npm:4.17.14"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/react": "npm:18.3.3"
     "@types/react-dom": "npm:18.2.25"
     "@types/react-virtualized-auto-sizer": "npm:1.0.4"
@@ -3834,7 +3834,7 @@ __metadata:
     "@types/jquery": "npm:3.5.32"
     "@types/lodash": "npm:4.17.14"
     "@types/mock-raf": "npm:1.0.6"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/prismjs": "npm:1.26.5"
     "@types/react": "npm:18.3.3"
     "@types/react-color": "npm:3.0.13"
@@ -9430,12 +9430,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/node@npm:*, @types/node@npm:22.10.5, @types/node@npm:>=10.0.0, @types/node@npm:>=13.7.0, @types/node@npm:>=13.7.4, @types/node@npm:^22.0.0":
-  version: 22.10.5
-  resolution: "@types/node@npm:22.10.5"
+"@types/node@npm:*, @types/node@npm:22.10.6, @types/node@npm:>=10.0.0, @types/node@npm:>=13.7.0, @types/node@npm:>=13.7.4, @types/node@npm:^22.0.0":
+  version: 22.10.6
+  resolution: "@types/node@npm:22.10.6"
   dependencies:
     undici-types: "npm:~6.20.0"
-  checksum: 10/a5366961ffa9921e8f15435bc18ea9f8b7a7bb6b3d92dd5e93ebcd25e8af65708872bd8e6fee274b4655bab9ca80fbff9f0e42b5b53857790f13cf68cf4cbbfc
+  checksum: 10/ac93c9b6337ddb70176abade1ca4cdec24cde93cfc19023f3e001d80cb42f1d3c2487dd1626ce016985953319de30528d9e73dc5c6e2e28be9eaa9ec0237fc1d
   languageName: node
   linkType: hard
 
@@ -17466,7 +17466,7 @@ __metadata:
     "@types/lodash": "npm:4.17.14"
     "@types/logfmt": "npm:^1.2.3"
     "@types/lucene": "npm:^2"
-    "@types/node": "npm:22.10.5"
+    "@types/node": "npm:22.10.6"
     "@types/node-forge": "npm:^1"
     "@types/ol-ext": "npm:@siedlerchr/types-ol-ext@3.2.4"
     "@types/pluralize": "npm:^0.0.33"