[Provisioning] Add more explicit setup warnings if webhook integration and image rendering are disabled (#101304)

* Setup warnings if renders or webhooks are not possible

* Improve display

* Use a single Alert

* Make design more compact

* Only display local config is missing critical feature toggles

* Improve styling of required flags

* Add file name to the custom ini itself

* Add copy button

* Add FeatureSection Component

* Commit betterer

* Use an interactive table

* Use a modal for instructions

* Use the same modal for example config

* Improve setup steps

* Improve stepper

* Copy code ctrl + c

* Make it more compact

* Select feature to enable

* Improve the height of alerts

* Separate components

* Better warnings

* Improve the page

* Improve the cards

* Improve cards even more

* Improve cards

* Improve cards

* Optional copy in code block

* Add side bar with steps

* Improve styling

* Style modal

* Clean up Code

* Remove index file

* Simplify Step Component

* Commit betterer

* Simplify components

* Use CodeEditor and Clipboard components

* Do not show scrollback on minimum size

* Fix positioning of footer

* Separate Component for Feature

* Use different styling

* Commit betterer

* Use more Grafana components in the FeatureCard

* Separate sidebar into own components

* Simplify sidebar code

* Commit betterer

* Remove connector

* Simplify styling further

* Use cards

* Improve code

* Use more grafana component in InstructionsModal

* Further simplify

* Simplify the code

* Simplify style

* Clean up

* Simplify the Wizard

* Use little icons

* Improve feature cards

* Improve cards

* Commit betterer

* Add description to feature setup

* Improve instructions for snapshot preview

* Move all files into Setup folder

* Commit betterer

* Clean up the warnings code

* Improve coding

* Move sidebar item to separate fiel

* Rename components

* Fix issues

* Use stack instead

* Improve style

* Don't show setup button if configured already

* Simplify again CSS

* Use secondary actions

* Style a bit more

* Improve wording

* Update warning

* Refer to docs in Image Renderer

* More clean up

* Revert changes in generated client

pkg/registry/apis/provisioning/jobs/pullrequest/render.go

@@ -20,18 +20,20 @@ type screenshotRenderer struct {
 	render      rendering.Service
 	blobstore   resource.BlobStoreClient
 	urlProvider func(namespace string) string
+	isPublic    bool
 }
 
-func NewScreenshotRenderer(render rendering.Service, blobstore resource.BlobStoreClient, urlProvider func(namespace string) string) *screenshotRenderer {
+func NewScreenshotRenderer(render rendering.Service, blobstore resource.BlobStoreClient, isPublic bool, urlProvider func(namespace string) string) *screenshotRenderer {
 	return &screenshotRenderer{
 		render:      render,
 		blobstore:   blobstore,
 		urlProvider: urlProvider,
+		isPublic:    isPublic,
 	}
 }
 
 func (r *screenshotRenderer) IsAvailable(ctx context.Context) bool {
-	return r.render != nil && r.render.IsAvailable(ctx)
+	return r.render != nil && r.render.IsAvailable(ctx) && r.blobstore != nil && r.isPublic
 }
 
 func (r *screenshotRenderer) RenderDashboardPreview(ctx context.Context, namespace, repoName, path, ref string) (string, error) {

pkg/registry/apis/provisioning/register.go

@@ -70,6 +70,7 @@ var (
 type APIBuilder struct {
 	urlProvider      func(namespace string) string
 	webhookSecretKey string
+	isPublic         bool
 
 	features          featuremgmt.FeatureToggles
 	getter            rest.Getter
@@ -107,10 +108,15 @@ func NewAPIBuilder(
 	secrets secrets.Service,
 ) *APIBuilder {
 	clientFactory := resources.NewFactory(configProvider)
+
+	// HACK: Assume is only public if it is HTTPS
+	isPublic := strings.HasPrefix(urlProvider(""), "https://")
+
 	return &APIBuilder{
 		urlProvider:       urlProvider,
 		localFileResolver: local,
 		webhookSecretKey:  webhookSecretKey,
+		isPublic:          isPublic,
 		features:          features,
 		ghFactory:         ghFactory,
 		client:            clientFactory,
@@ -220,8 +226,9 @@ func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupI
 	storage[provisioning.RepositoryResourceInfo.StoragePath()] = repositoryStorage
 	storage[provisioning.RepositoryResourceInfo.StoragePath("status")] = repositoryStatusStorage
 	storage[provisioning.RepositoryResourceInfo.StoragePath("webhook")] = &webhookConnector{
-		getter: b,
-		jobs:   b.jobs,
+		getter:          b,
+		jobs:            b.jobs,
+		webhooksEnabled: b.isPublic,
 	}
 	storage[provisioning.RepositoryResourceInfo.StoragePath("test")] = &testConnector{
 		getter: b,
@@ -418,7 +425,7 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 			))
 
 			// Pull request worker
-			renderer := pullrequest.NewScreenshotRenderer(b.render, b.unified, b.urlProvider)
+			renderer := pullrequest.NewScreenshotRenderer(b.render, b.unified, b.isPublic, b.urlProvider)
 			previewer := pullrequest.NewPreviewer(renderer, b.urlProvider)
 			pullRequestWorker, err := pullrequest.NewPullRequestWorker(b.parsers, previewer)
 			if err != nil {
@@ -916,15 +923,18 @@ func (b *APIBuilder) AsRepository(ctx context.Context, r *provisioning.Repositor
 		return repository.NewLocal(r, b.localFileResolver), nil
 	case provisioning.GitHubRepositoryType:
 		gvr := provisioning.RepositoryResourceInfo.GroupVersionResource()
-		webhookURL := fmt.Sprintf(
-			"%sapis/%s/%s/namespaces/%s/%s/%s/webhook",
-			b.urlProvider(r.GetNamespace()),
-			gvr.Group,
-			gvr.Version,
-			r.GetNamespace(),
-			gvr.Resource,
-			r.GetName(),
-		)
+		var webhookURL string
+		if b.isPublic {
+			webhookURL = fmt.Sprintf(
+				"%sapis/%s/%s/namespaces/%s/%s/%s/webhook",
+				b.urlProvider(r.GetNamespace()),
+				gvr.Group,
+				gvr.Version,
+				r.GetNamespace(),
+				gvr.Resource,
+				r.GetName(),
+			)
+		}
 		return repository.NewGitHub(ctx, r, b.ghFactory, b.secrets, webhookURL)
 	default:
 		return nil, errors.New("unknown repository type")

pkg/registry/apis/provisioning/repository/github.go

@@ -805,18 +805,11 @@ func (r *githubRepository) deleteWebhook(ctx context.Context) error {
 	return nil
 }
 
-func (r *githubRepository) supportsWebhook() bool {
-	u, err := url.Parse(r.webhookURL)
-	if err != nil || u.Hostname() == "localhost" {
-		return false
-	}
-	return true
-}
-
 func (r *githubRepository) OnCreate(ctx context.Context) (*provisioning.WebhookStatus, error) {
-	if !r.supportsWebhook() {
+	if len(r.webhookURL) == 0 {
 		return nil, nil
 	}
+
 	ctx, _ = r.logger(ctx, "")
 	hook, err := r.createWebhook(ctx)
 	if err != nil {
@@ -831,7 +824,7 @@ func (r *githubRepository) OnCreate(ctx context.Context) (*provisioning.WebhookS
 }
 
 func (r *githubRepository) OnUpdate(ctx context.Context) (*provisioning.WebhookStatus, error) {
-	if !r.supportsWebhook() {
+	if len(r.webhookURL) == 0 {
 		return nil, nil
 	}
 	ctx, _ = r.logger(ctx, "")
@@ -849,6 +842,9 @@ func (r *githubRepository) OnUpdate(ctx context.Context) (*provisioning.WebhookS
 }
 
 func (r *githubRepository) OnDelete(ctx context.Context) error {
+	if len(r.webhookURL) == 0 {
+		return nil
+	}
 	ctx, _ = r.logger(ctx, "")
 	return r.deleteWebhook(ctx)
 }

pkg/registry/apis/provisioning/webhook.go

@@ -20,8 +20,9 @@ import (
 
 // This only works for github right now
 type webhookConnector struct {
-	getter RepoGetter
-	jobs   jobs.JobQueue
+	getter          RepoGetter
+	jobs            jobs.JobQueue
+	webhooksEnabled bool
 }
 
 func (*webhookConnector) New() runtime.Object {
@@ -65,6 +66,10 @@ func (s *webhookConnector) Connect(ctx context.Context, name string, opts runtim
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		logger := logging.FromContext(r.Context()).With("logger", "webhook-connector", "repo", name)
 		ctx := logging.Context(r.Context(), logger)
+		if !s.webhooksEnabled {
+			responder.Error(errors.NewBadRequest("webhooks are not enabled"))
+			return
+		}
 
 		hooks, ok := repo.(repository.Hooks)
 		if !ok {

pkg/tests/apis/openapi_snapshots/provisioning.grafana.app-v0alpha1.json

@@ -3583,6 +3583,9 @@
         "description": "Summary shows a view of the configuration that is sanitized and is OK for logged in users to see",
         "type": "object",
         "required": [
+          "legacyStorage",
+          "generateDashboardPreviews",
+          "githubWebhooks",
           "items"
         ],
         "properties": {
@@ -3590,6 +3593,16 @@
             "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
             "type": "string"
           },
+          "generateDashboardPreviews": {
+            "description": "GenerateDashboardPreviews is available to render dashboard previews",
+            "type": "boolean",
+            "default": false
+          },
+          "githubWebhooks": {
+            "description": "GithubWebhooks is available to sync changes from a repository as soon as they are pushed or react to pull requests",
+            "type": "boolean",
+            "default": false
+          },
           "items": {
             "type": "array",
             "items": {
@@ -3607,7 +3620,8 @@
           },
           "legacyStorage": {
             "description": "The backend is using legacy storage FIXME: Not sure where this should be exposed... but we need it somewhere The UI should force the onboarding workflow when this is true",
-            "type": "boolean"
+            "type": "boolean",
+            "default": false
           }
         }
       },