Provisioning: Allow disabling of instance sync (#111270)

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

pkg/registry/apis/provisioning/register.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"slices"
 	"strings"
 	"time"
 
@@ -83,6 +84,8 @@ type APIBuilder struct {
 	// TODO: Set this up in the standalone API server
 	onlyApiServer bool
 
+	allowedTargets []provisioning.SyncTargetType
+
 	features   featuremgmt.FeatureToggles
 	usageStats usagestats.Service
 
@@ -128,6 +131,7 @@ func NewAPIBuilder(
 	extraBuilders []ExtraBuilder,
 	extraWorkers []jobs.Worker,
 	jobHistoryConfig *JobHistoryConfig,
+	allowedTargets []provisioning.SyncTargetType,
 ) *APIBuilder {
 	clients := resources.NewClientFactory(configProvider)
 	parsers := resources.NewParserFactory(clients)
@@ -149,6 +153,7 @@ func NewAPIBuilder(
 		access:              access,
 		jobHistoryConfig:    jobHistoryConfig,
 		extraWorkers:        extraWorkers,
+		allowedTargets:      allowedTargets,
 	}
 
 	for _, builder := range extraBuilders {
@@ -213,6 +218,11 @@ func RegisterAPIService(
 		return nil, nil
 	}
 
+	allowedTargets := []provisioning.SyncTargetType{}
+	for _, target := range cfg.ProvisioningAllowedTargets {
+		allowedTargets = append(allowedTargets, provisioning.SyncTargetType(target))
+	}
+
 	builder := NewAPIBuilder(
 		cfg.ProvisioningDisableControllers,
 		repoFactory,
@@ -226,6 +236,7 @@ func RegisterAPIService(
 		extraBuilders,
 		extraWorkers,
 		createJobHistoryConfigFromSettings(cfg),
+		allowedTargets,
 	)
 	apiregistration.RegisterAPI(builder)
 	return builder, nil
@@ -538,6 +549,10 @@ func (b *APIBuilder) Validate(ctx context.Context, a admission.Attributes, o adm
 	list := repository.ValidateRepository(repo)
 	cfg := repo.Config()
 
+	if !slices.Contains(b.allowedTargets, cfg.Spec.Sync.Target) {
+		return fmt.Errorf("sync target %s is not supported", cfg.Spec.Sync.Target)
+	}
+
 	if a.GetOperation() == admission.Update {
 		oldRepo, err := b.asRepository(ctx, a.GetOldObject(), nil)
 		if err != nil {

pkg/registry/apis/provisioning/routes.go

@@ -162,7 +162,8 @@ func (b *APIBuilder) handleSettings(w http.ResponseWriter, r *http.Request) {
 	}
 
 	settings := provisioning.RepositoryViewList{
-		Items: make([]provisioning.RepositoryView, len(all)),
+		Items:          make([]provisioning.RepositoryView, len(all)),
+		AllowedTargets: b.allowedTargets,
 		// FIXME: this shouldn't be here in provisioning but at the dual writer or something about the storage
 		LegacyStorage:            legacyStorage,
 		AvailableRepositoryTypes: b.repoFactory.Types(),

pkg/setting/setting.go

@@ -134,6 +134,7 @@ type Cfg struct {
 	PermittedProvisioningPaths []string
 	// Provisioning config
 	ProvisioningDisableControllers bool
+	ProvisioningAllowedTargets     []string
 	ProvisioningRepositoryTypes    []string
 	ProvisioningLokiURL            string
 	ProvisioningLokiUser           string
@@ -2119,6 +2120,10 @@ func (cfg *Cfg) readProvisioningSettings(iniFile *ini.File) error {
 	}
 
 	cfg.ProvisioningDisableControllers = iniFile.Section("provisioning").Key("disable_controllers").MustBool(false)
+	cfg.ProvisioningAllowedTargets = iniFile.Section("provisioning").Key("allowed_targets").Strings("|")
+	if len(cfg.ProvisioningAllowedTargets) == 0 {
+		cfg.ProvisioningAllowedTargets = []string{"instance", "folder"}
+	}
 
 	// Read job history configuration
 	cfg.ProvisioningLokiURL = valueAsString(iniFile.Section("provisioning"), "loki_url", "")

pkg/tests/apis/openapi_snapshots/provisioning.grafana.app-v0alpha1.json

@@ -4352,6 +4352,18 @@
           "items"
         ],
         "properties": {
+          "allowedTargets": {
+            "description": "The valid targets (can disable instance or folder types)",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "default": "",
+              "enum": [
+                "folder",
+                "instance"
+              ]
+            }
+          },
           "apiVersion": {
             "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
             "type": "string"

pkg/tests/apis/provisioning/secrets_test.go

@@ -39,6 +39,8 @@ func TestIntegrationProvisioning_InlineSecrets(t *testing.T) {
 			values: map[string]any{
 				"SecureTokenCreate":         "some-token",
 				"SecureWebhookSecretCreate": "some-secret",
+				"SyncEnabled":               true,
+				"Target":                    "folder",
 			},
 			inputFile: "testdata/github-with-inline-secrets.json.tmpl",
 			expectedFields: []expectedField{

pkg/tests/apis/provisioning/testdata/github-with-inline-secrets.json.tmpl

@@ -13,6 +13,11 @@
             "branch": "{{ or .Branch "integration-test" }}",
             "generateDashboardPreviews": {{ if .GenerateDashboardPreviews }} true {{ else }} false {{ end }},
             "path": "{{ or .Path "grafana/" }}"
+        },
+        "sync": {
+            "enabled": {{ if .SyncEnabled }} true {{ else }} false {{ end }},
+            "target": "{{ or .Target "folder" }}",
+            "intervalSeconds": {{ or .SyncIntervalSeconds 60 }}
         }
     },
     "secure": {