Commit Graph

16334 Commits

Author SHA1 Message Date
Jean-Philippe Quéméner 1a216a8fff feat(unified-storage): use logger from context for dualwriter (#106473) 2025-06-10 15:33:14 +02:00
Mariell Hoversholm b823437958 Crypto: Use crypto/pbkdf2 instead of x (#106474) 2025-06-10 14:48:44 +02:00
Stephanie Hingtgen ed5104a6c6 K8s: Only register internal kind once (#106239) 2025-06-10 05:09:12 -06:00
Alexander Akhmetov 7c3f7b9e8b Alerting: Use default_datasource_uid as the default target for recording rules in UI (#106415)
* Alerting: Use default_datasource_uid as the default target for recording rules

* Add tests

---------

Co-authored-by: Konrad Lalik <konradlalik@gmail.com>
2025-06-10 11:58:42 +02:00
Alexander Akhmetov a4fa8ab891 Alerting: Empty endpoint to load alertmanager config with mimirtool (#106266) 2025-06-10 11:35:57 +02:00
Alexander Akhmetov f14ed750f5 Alerting: Add feature toggle for Alertmanager import config API (#106424) 2025-06-10 10:32:50 +02:00
Vadim Stepanov 1df888c517 Alerting: Provisioning API returns 403 on quota exceeded for rule group PUT (#106409) 2025-06-09 11:12:22 +01:00
Christian Simon 549511597c Datasource: grafana-pyroscope-datasource/parca: Fix the passing of response headers (#106293)
pkgs/tsdb/[grafana-pyroscope-datasource|parca]: Fix use of request headers in responses

In the parca and the grafana-pyroscope-datasource we were wrongly using the request headers instead of the response
header when communication the results to the backend.

This PR fixes this bug.

Was reported by an user via community slack, who faced issues, with a request header of `content-length: 0` being
inserted by a intermediate proxy.
2025-06-09 09:43:34 +00:00
Matheus Macabu 90c4868c8c CloudMigrations: Add test case for invalid permissions to fetch contact points (#106143) 2025-06-09 09:49:46 +02:00
Alexander Akhmetov 3bb4c92028 Alerting: Fix resolved notifications for same-label Error to Normal transitions (#106210)
What is this feature?

Ensures that resolved notifications are sent when alert states transition from Error to Normal after the configured number of evaluation intervals: Missing series evaluations to resolve.

Why do we need this feature?

Before this change, when an alert was transitioning from Error to Normal, in case when the labels on the new Normal alert instance are the same, Grafana would not send resolved notifications for the Error alert state. The alert would be resolved after a few evaluation intervals automatically in the alertmanager, following the endsAt.

With this change the resolved notification is sent after the configured number of evaluation intervals: Missing series evaluations to resolve.
2025-06-07 14:03:11 +02:00
colin-stuart 34b6d51016 SCIM: Update Provisioned User's Role using SAML Assertion (#106374)
* SCIM: fix provisioned user role assignment from SAML assertion

* revert org_sync_test changes

* clean up tests

* skip user lookup during org sync

* sanitize log output

* only log non-sensitive fields
2025-06-06 10:09:51 -04:00
Steve Simpson f81031f945 Alerting: Add placeholder feature toggle for enrichment. (#106399) 2025-06-06 14:16:07 +02:00
Alexander Akhmetov f7a52bc04e Alerting: Fix group-level labels and query_offset in the import API (#106379)
What is this feature?

Fixes a bug when group-level query_offset and labels parameters are ignored and not saved

Why do we need this feature?

In the import API Prometheus YAML rule definitions are supported:

groups:
  - name: group-1
    interval: 1m
    query_offset: 10m
    labels:
      severity: "warning"
    rules:
      - alert: Alert 0 > 0
        expr: vector(0) > 0

But applying group-level labels and query_offset is broken and they are not saved right now because during the conversion of the API model to PrometheusRuleGroup they aren't saved to the new structure.
2025-06-06 11:21:39 +02:00
Christian Simon 30dc3a3ce4 Datasource/grafana-pyroscope: Do healthcheck on a window without data (#106312)
This will makes the healthcheck cheaper to anwser, as we would not expect data at this time window.

Fixes #106311
2025-06-06 08:29:31 +01:00
Alexander Zobnin aa92dc860b Zanzana: Improve server side error handling (#106378)
* Zanzana: Split client and server logs

* Zanzana: Improve error handling and logging

* log internal error at the server side

* refactor

* improve errors for list request

* update go modules

* handle errors for read and write

* refactor

* reset go.mod changes
2025-06-05 22:11:26 +02:00
Vadim Stepanov 5137995830 Alerting: Add support for Redis Sentinel for Alerting HA (#106322)
* Alerting: Add support for Redis Sentinel

* docs

* docs

* Use minisentinel in test

* Apply suggestions from code review

Co-authored-by: Johnny Kartheiser <140559259+JohnnyK-Grafana@users.noreply.github.com>
Co-authored-by: Fayzal Ghantiwala <114010985+fayzal-g@users.noreply.github.com>

* "address(es)" -> "address or addresses"

* make update-workspace

* make lint-go-diff

---------

Co-authored-by: Johnny Kartheiser <140559259+JohnnyK-Grafana@users.noreply.github.com>
Co-authored-by: Fayzal Ghantiwala <114010985+fayzal-g@users.noreply.github.com>
2025-06-05 15:02:40 +01:00
Moustafa Baiou 941162ca79 Alerting: Optimize prometheus api permission checks (#106299)
* Alerting: Optimize prometheus api permission checks

This improves the performance of the Prometheus API by performing the permission checks for rule read permission in a folder upfront, rather than checking permissions for each rule group individually. This reduces the number of permission checks and should speed up the API response time.

* refactor vars

---------

Co-authored-by: Konrad Lalik <konradlalik@gmail.com>
2025-06-05 09:43:06 -04:00
Alexander Akhmetov 82549ea8b3 Alerting: Add state label to prometheus_imported_rules metric (#106365) 2025-06-05 14:24:48 +02:00
Alexander Akhmetov da88e5912f Alerting: Evaluate all imported from Prometheus rules sequentially (#106295)
What is this feature?

Makes all alert rules imported from a Prometheus YAML or Prometheus-compatible data source evaluate sequentially.

Why do we need this feature?

Currently only alert rules [imported via the API](https://grafana.com/docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/alerting-migration/migration-api/) are evaluated sequentially, because only they have the original alert rule definition in YAML. But alert rules can be imported [in the UI, and from a YAML file](https://grafana.com/docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/alerting-migration/), and they won't be evaluated sequentially which can lead to issues with recording rules.
2025-06-05 12:08:44 +02:00
Andreas Christou e4c9d10bfb Azure: Improved identification of Application Insights resouces (#106281)
Compare namespace to lowercase URL
2025-06-05 11:03:34 +01:00
Ieva d7a4f497bc Folders: Correctly resolve nested folder breadcrumbs (#106344)
correctly use UID scope instead of ID based scope
2025-06-05 10:02:07 +01:00
Yuri Tseretyan 33298550b4 Update Alerting module (#106272)
* set kind in TemplateDefinition
2025-06-04 16:05:05 -04:00
Mihai Doarna d57d184d20 Auth: Remove api key endpoints (#106019)
* remove api key endpoints

* generate openapi specs

* remove methods from mock service

* remove ApiKeyDTO

* generate openapi specs

* remove apikey migration endpoints

* remove unused function
2025-06-04 17:03:06 +03:00
Moustafa Baiou 0ce086bd2e Alerting: Ensure errors cleared when Alerting after error (#105246)
When a rule configured with `ExecErrState` state of `Alerting`, has an instance which is Alerting then has a data source error, then successfully evaluates and continues to be Alerting, the cached instance keeps the error cached until it is no longer firing.

This is unexpected and leads to misleading results.
2025-06-04 12:16:14 +02:00
Kevin Minehart 5bfcbc1f47 CI: Temporarily disable --verify in nightly release (#106313)
Temporarily disable --verify in nightly release
2025-06-04 12:04:59 +02:00
Misi f34d372bd3 Auth: Enable ssoSettingsLDAP by default (#106310) 2025-06-04 10:47:47 +02:00
Kevin Minehart a2b0e20a8e CI: Use sh in daggerbuild scripts instead of bash (#106306)
Use sh in daggerbuild scripts
2025-06-04 10:15:37 +02:00
Cory Forseth 40164cb09e Authorization: Fix/provisioned permission display (#106179)
* add isProvisioned flag to permission DTO

* handle provisioned permissions explicitly

* lint

* swagger

* simplify logic to always show non-managed permissions first; remove unnecessary isProvisioned

* fix docs

* oops

* actually just generate the docs
2025-06-03 11:21:42 -05:00
beejeebus 6a0cf22b53 Revert "Postgres: Switch the datasource plugin from lib/pq to pgx (#103961)" (#106270)
This reverts commit 1e383b0c1e.
2025-06-03 08:45:07 -04:00
xavi 86f2bf2940 IAM: Skip token rotation if it has been rotated recently (#106075) 2025-06-03 08:59:40 +02:00
Alexander Zobnin cb05eb3cd6 RBAC: Return bad request when header is malformed (#105448) 2025-06-02 16:31:15 +02:00
Alexander Akhmetov 6ff67722b8 Alerting: Include rules imported in the UI into prometheus_imported_rules metric (#106229) 2025-06-02 12:47:09 +02:00
xavi 31a9ddc47a IAM: Run user creation inside transaction (#106113) 2025-06-02 11:29:57 +02:00
linoman 374bd5bec7 SCIM: Change SCIM hook registration (#106200)
* Add function to skip provisioning hook

* Rework provisioning hook to PostLoginHook

* Revert back to PostAuthHook and remove unused tests

* Fix tests
2025-06-02 11:04:14 +02:00
Alexander Akhmetov e256f2d5e2 Alerting: Enable recording rules by default (#105603) 2025-06-02 10:56:05 +02:00
Alexander Akhmetov 4cde79e802 Alerting: Clean up join errors code (#106243) 2025-06-02 10:30:04 +02:00
Mihai Doarna 6ab9c8bf57 Auth: Remove code for authenticating API keys (#105998)
* remove auth for plain API keys

* move condition to validateApiKey()

* fix typo

* remove GetApiKeyById() method
2025-06-02 09:54:10 +03:00
maicon 6fb0ed9886 Bump tempo to 20250529124718-87c2dc380cec (#106220)
* Bump tempo to 20250529124718-87c2dc380cec

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Add owners to pkg/build

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* update workspace

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* update pkg/build/go.sum

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* update pkg/build/go.sum

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
2025-05-29 23:43:13 -05:00
Adam Simpson 729f0a6ba5 ds-querier: handle downstream 500s (#105890)
* ds-querier: add new metric for the total request

Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com>

* fix logger and trace

Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com>

* ds-querier: rewrite downstream 500s to 400

---------

Co-authored-by: Sarah Zinger <sarah.zinger@grafana.com>
2025-05-29 17:30:45 -04:00
Alexander Akhmetov eae77aa695 Alerting: Resend alerts for states that are missing in the eval results (#105965)
What is this feature?

This PR fixes the MissingSeriesEvalsToResolve behavior when it's set to more than 4 evaluation intervals.

Why do we need this feature?

The MissingSeriesEvalsToResolve setting was not working correctly due to alerts being auto-resolved by Alertmanager after 4 evaluation intervals (via the endsAt field).

Before we had deleteStaleStatesFromCache method that was returning only stale states that had to be resolved. Non-stale states for which the current evaluation does not have a series never had endsAt updated and were never resend to the Alertmanager, so they were automatically resolved after 4 evaluations regardless of the setting.

The new processMissingSeriesStates returns state for each missing series on every evaluation, and resolves the stale ones. This guarantees that alerts without series still alert for the configured number of evaluations.
2025-05-29 23:22:35 +02:00
Ashley Harrison 4ac248a512 Internationalisation: Mark up panel plugins for translations (#106068)
* config for panel plugin translations

* markup

* tweaks

* prettier

* use data-testid

* rename disable rule now it's been moved

* final markup
2025-05-29 18:13:25 +01:00
David Kim (DK) 939f2c9828 Navigation: Add the new badge to the SLO reports nav item (#105707)
* attempt to add slo reports badge

* fix build

* add new badge for reports for subitem in grafana-slo-app
2025-05-29 16:37:14 +01:00
Sarah Zinger 020780f5ac DS-querier: define func to fetch instance config settings (#106172)
DS-querier: define func to fetch instance config settings to be passed into executing query
2025-05-29 11:07:40 -04:00
Eric Leijonmarck 69653ea3dc Zanzana: Adds running migrations from openfga w. RunMigrations() (#105691) 2025-05-29 15:54:12 +01:00
Collin Fingar c23ee1e116 QueryLibrary: Adding Tags as new set field to queries (#105702) 2025-05-29 08:47:30 -04:00
Mykhailo Zahlada fc988c8771 Auth: Add Azure/Entra workload identity support (#104807)
* fixes/adds azure workload identity authentication. Issue #78249

* Updates default values. Adds `workload_identity_token_file` defaults

* Updates example config. Adds `workload_identity_token_file`

* Updates docummentation: adds Federated credentials for Workload Identity

* Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Docs: add link to official documentation. Clarifies example.

* 1. Add workload_identity_enabled and workload_identity_token_file settings to [auth.azuread] for workload identity support.

2. Extend OAuthInfo struct to include workload identity fields.
3. Update OAuth authentication logic to handle Azure AD workload identity using federated token as client assertion.
4. Update sample configuration and documentation for new settings.

* ensure environment variable overrides are respected for OAuth SSO settings

- Ensure that settings loaded in pkg/services/ssosettings/strategies/oauth_strategy.go correctly reflect environment variable overrides, matching Grafana's config behavior.
- Align config loading logic with main config loader to prevent issues where INI values would override environment variables.

* updates documentation

* test: add workload identity configuration tests for Azure AD OAuth strategy. Add test coverage for workload_identity_enabled and workload_identity_token_file settings

* feat: add workload identity support to Azure AD SSO configuration UI

* updates documentation

* Simplify OAuth flow by removing unnecessary switch-case structure

* Small changes

* Lint + i18n gen

* refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication

* update documentation

* refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication

* updates documentation - configuration options table: adds `client_authentication`, `workload_identity_token_file`, and `federated_credential_audience`

* Small changes, lint, i18n

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2025-05-29 14:09:18 +02:00
Kyle Brandt 601676b98e TestData: Adds Frame Type to "Predictable" Scenarios to enable SQL expressions (#106177) 2025-05-29 07:22:51 -04:00
Andres Martinez Gotor e2e8de29ba Advisor: Check plugin signature (#106044) 2025-05-29 11:33:19 +02:00
Stephanie Hingtgen 5303a1cc7e Org: Fix org deletion (#106193) 2025-05-29 09:40:06 +03:00
Stephanie Hingtgen ab99211b40 Dashboard Provisioning: Reduce db load (#106114) 2025-05-29 09:39:07 +03:00