ran prettier

* WIP: mutator added, start working on validator

* first validator iteration

* second validator iteration

* wip: working on integration tests

* re-working mutation and validation, using Connection interface

* fixing some rebase things

* fixing integration tests

* formatting

* fixing unit tests

* k8s codegen

* linting

* moving tests which are available only for enterprise

* addressing comments: using repo config for connections, updating tests

* addressing comments: adding some more info in the app and installation

* fixing app data

* addressing comments: updating connection implementation

* addressing comments

* formatting

* fixing tests

.github/actions/change-detection/action.yml

@@ -14,6 +14,9 @@ outputs:
   frontend:
     description: Whether the frontend or self has changed in any way
     value: ${{ steps.changed-files.outputs.frontend_any_changed || 'true' }}
+  frontend-packages:
+    description: Whether any frontend packages have changed
+    value: ${{ steps.changed-files.outputs.frontend_packages_any_changed || 'true' }}
   e2e:
     description: Whether the e2e tests or self have changed in any way
     value: ${{ steps.changed-files.outputs.e2e_any_changed == 'true' ||
@@ -97,6 +100,12 @@ runs:
             - '.yarn/**'
             - 'apps/dashboard/pkg/migration/**'
             - '${{ inputs.self }}'
+          frontend_packages:
+            - '.github/actions/checkout/**'
+            - '.github/actions/change-detection/**'
+            - 'packages/**'
+            - './scripts/validate-npm-packages.sh'
+            - '${{ inputs.self }}'
           e2e:
             - 'e2e/**'
             - 'e2e-playwright/**'
@@ -153,6 +162,8 @@ runs:
         echo " --> ${{ steps.changed-files.outputs.backend_all_changed_files }}"
         echo "Frontend: ${{ steps.changed-files.outputs.frontend_any_changed || 'true' }}"
         echo " --> ${{ steps.changed-files.outputs.frontend_all_changed_files }}"
+        echo "Frontend packages: ${{ steps.changed-files.outputs.frontend_packages_any_changed || 'true' }}"
+        echo " --> ${{ steps.changed-files.outputs.frontend_packages_all_changed_files }}"
         echo "E2E: ${{ steps.changed-files.outputs.e2e_any_changed || 'true' }}"
         echo " --> ${{ steps.changed-files.outputs.e2e_all_changed_files }}"
         echo " --> ${{ steps.changed-files.outputs.backend_all_changed_files }}"

.github/actions/setup-node/action.yml

@@ -4,8 +4,8 @@ description: Sets up a node.js environment with presets for the Grafana reposito
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version-file: '.nvmrc'
         cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+        cache-dependency-path: 'yarn.lock'

.github/workflows/frontend-lint.yml

@@ -17,6 +17,7 @@ jobs:
     outputs:
       changed: ${{ steps.detect-changes.outputs.frontend }}
       prettier: ${{ steps.detect-changes.outputs.frontend == 'true' || steps.detect-changes.outputs.docs == 'true' }}
+      changed-frontend-packages: ${{ steps.detect-changes.outputs.frontend-packages }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -42,11 +43,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - run: yarn install --immutable --check-cache
     - run: yarn run prettier:check
     - run: yarn run lint
@@ -63,11 +61,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - name: Setup Enterprise
       uses: ./.github/actions/setup-enterprise
       with:
@@ -89,11 +84,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - run: yarn install --immutable --check-cache
     - run: yarn run typecheck
   lint-frontend-typecheck-enterprise:
@@ -109,11 +101,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - name: Setup Enterprise
       uses: ./.github/actions/setup-enterprise
       with:
@@ -133,11 +122,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - run: yarn install --immutable --check-cache
     - name: Generate API clients
       run: |
@@ -164,11 +150,8 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
-        cache-dependency-path: 'yarn.lock'
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
     - name: Setup Enterprise
       uses: ./.github/actions/setup-enterprise
       with:
@@ -187,3 +170,26 @@ jobs:
             echo "${uncommited_error_message}"
             exit 1
         fi
+  lint-frontend-packed-packages:
+    needs: detect-changes
+    permissions:
+      contents: read
+      id-token: write
+    if: github.event_name == 'pull_request' && needs.detect-changes.outputs.changed-frontend-packages == 'true'
+    name: Verify packed frontend packages
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout build commit
+      uses: actions/checkout@v5
+      with:
+        persist-credentials: false
+    - name: Setup Node
+      uses: ./.github/actions/setup-node
+    - name: Install dependencies
+      run: yarn install --immutable
+    - name: Build and pack packages
+      run: |
+        yarn run packages:build
+        yarn run packages:pack
+    - name: Validate packages
+      run: ./scripts/validate-npm-packages.sh

apps/dashboard/pkg/migration/conversion/testdata/input/v2alpha1.ds-data-query.json

@@ -852,6 +852,194 @@
             }
           }
         }
+      },
+      "panel-7": {
+        "kind": "Panel",
+        "spec": {
+          "id": 7,
+          "title": "Single Dashboard DS Query",
+          "description": "Panel with a single -- Dashboard -- datasource query",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "stat",
+            "spec": {
+              "pluginVersion": "12.1.0-pre",
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
+      },
+      "panel-8": {
+        "kind": "Panel",
+        "spec": {
+          "id": 8,
+          "title": "Multiple Dashboard DS Queries",
+          "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 2,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "B",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 3,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "C",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "stat",
+            "spec": {
+              "pluginVersion": "12.1.0-pre",
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
       }
     },
     "layout": {
@@ -914,6 +1102,24 @@
                 "name": "panel-6"
               }
             }
+          },
+          {
+            "kind": "AutoGridLayoutItem",
+            "spec": {
+              "element": {
+                "kind": "ElementReference",
+                "name": "panel-7"
+              }
+            }
+          },
+          {
+            "kind": "AutoGridLayoutItem",
+            "spec": {
+              "element": {
+                "kind": "ElementReference",
+                "name": "panel-8"
+              }
+            }
           }
         ]
       }

apps/dashboard/pkg/migration/conversion/testdata/input/v2beta1.ds-data-query.json

@@ -879,6 +879,200 @@
             }
           }
         }
+      },
+      "panel-7": {
+        "kind": "Panel",
+        "spec": {
+          "id": 7,
+          "title": "Single Dashboard DS Query",
+          "description": "Panel with a single -- Dashboard -- datasource query",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "VizConfig",
+            "group": "stat",
+            "version": "12.1.0-pre",
+            "spec": {
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
+      },
+      "panel-8": {
+        "kind": "Panel",
+        "spec": {
+          "id": 8,
+          "title": "Multiple Dashboard DS Queries",
+          "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 2,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "B",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 3,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "C",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "VizConfig",
+            "group": "stat",
+            "version": "12.1.0-pre",
+            "spec": {
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
       }
     },
     "layout": {
@@ -973,6 +1167,32 @@
                           "name": "panel-6"
                         }
                       }
+                    },
+                    {
+                      "kind": "GridLayoutItem",
+                      "spec": {
+                        "x": 0,
+                        "y": 6,
+                        "width": 8,
+                        "height": 3,
+                        "element": {
+                          "kind": "ElementReference",
+                          "name": "panel-7"
+                        }
+                      }
+                    },
+                    {
+                      "kind": "GridLayoutItem",
+                      "spec": {
+                        "x": 8,
+                        "y": 6,
+                        "width": 8,
+                        "height": 3,
+                        "element": {
+                          "kind": "ElementReference",
+                          "name": "panel-8"
+                        }
+                      }
                     }
                   ]
                 }

apps/dashboard/pkg/migration/conversion/testdata/output/v2alpha1.ds-data-query.v0alpha1.json

@@ -711,6 +711,146 @@
         ],
         "title": "Mixed DS WITHOUT REFS",
         "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "datasource",
+          "uid": "-- Dashboard --"
+        },
+        "description": "Panel with a single -- Dashboard -- datasource query",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 9,
+          "w": 8,
+          "x": 0,
+          "y": 18
+        },
+        "id": 7,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          }
+        ],
+        "title": "Single Dashboard DS Query",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "mixed",
+          "uid": "-- Mixed --"
+        },
+        "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 9,
+          "w": 8,
+          "x": 8,
+          "y": 18
+        },
+        "id": 8,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 2,
+            "refId": "B",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 3,
+            "refId": "C",
+            "withTransforms": true
+          }
+        ],
+        "title": "Multiple Dashboard DS Queries",
+        "type": "stat"
       }
     ],
     "preload": false,

apps/dashboard/pkg/migration/conversion/testdata/output/v2alpha1.ds-data-query.v1beta1.json

@@ -711,6 +711,146 @@
         ],
         "title": "Mixed DS WITHOUT REFS",
         "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "datasource",
+          "uid": "-- Dashboard --"
+        },
+        "description": "Panel with a single -- Dashboard -- datasource query",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 9,
+          "w": 8,
+          "x": 0,
+          "y": 18
+        },
+        "id": 7,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          }
+        ],
+        "title": "Single Dashboard DS Query",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "mixed",
+          "uid": "-- Mixed --"
+        },
+        "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 9,
+          "w": 8,
+          "x": 8,
+          "y": 18
+        },
+        "id": 8,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 2,
+            "refId": "B",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 3,
+            "refId": "C",
+            "withTransforms": true
+          }
+        ],
+        "title": "Multiple Dashboard DS Queries",
+        "type": "stat"
       }
     ],
     "preload": false,

apps/dashboard/pkg/migration/conversion/testdata/output/v2alpha1.ds-data-query.v2beta1.json

@@ -879,6 +879,200 @@
             }
           }
         }
+      },
+      "panel-7": {
+        "kind": "Panel",
+        "spec": {
+          "id": 7,
+          "title": "Single Dashboard DS Query",
+          "description": "Panel with a single -- Dashboard -- datasource query",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "VizConfig",
+            "group": "stat",
+            "version": "12.1.0-pre",
+            "spec": {
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
+      },
+      "panel-8": {
+        "kind": "Panel",
+        "spec": {
+          "id": 8,
+          "title": "Multiple Dashboard DS Queries",
+          "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 2,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "B",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "-- Dashboard --"
+                      },
+                      "spec": {
+                        "panelId": 3,
+                        "withTransforms": true
+                      }
+                    },
+                    "refId": "C",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "VizConfig",
+            "group": "stat",
+            "version": "12.1.0-pre",
+            "spec": {
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
       }
     },
     "layout": {
@@ -941,6 +1135,24 @@
                 "name": "panel-6"
               }
             }
+          },
+          {
+            "kind": "AutoGridLayoutItem",
+            "spec": {
+              "element": {
+                "kind": "ElementReference",
+                "name": "panel-7"
+              }
+            }
+          },
+          {
+            "kind": "AutoGridLayoutItem",
+            "spec": {
+              "element": {
+                "kind": "ElementReference",
+                "name": "panel-8"
+              }
+            }
           }
         ]
       }

apps/dashboard/pkg/migration/conversion/testdata/output/v2beta1.ds-data-query.v0alpha1.json

@@ -711,6 +711,146 @@
         ],
         "title": "Mixed DS WITHOUT REFS",
         "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "datasource",
+          "uid": "-- Dashboard --"
+        },
+        "description": "Panel with a single -- Dashboard -- datasource query",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 8,
+          "x": 0,
+          "y": 6
+        },
+        "id": 7,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          }
+        ],
+        "title": "Single Dashboard DS Query",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "mixed",
+          "uid": "-- Mixed --"
+        },
+        "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 8,
+          "x": 8,
+          "y": 6
+        },
+        "id": 8,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 2,
+            "refId": "B",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 3,
+            "refId": "C",
+            "withTransforms": true
+          }
+        ],
+        "title": "Multiple Dashboard DS Queries",
+        "type": "stat"
       }
     ],
     "preload": false,

apps/dashboard/pkg/migration/conversion/testdata/output/v2beta1.ds-data-query.v1beta1.json

@@ -711,6 +711,146 @@
         ],
         "title": "Mixed DS WITHOUT REFS",
         "type": "timeseries"
+      },
+      {
+        "datasource": {
+          "type": "datasource",
+          "uid": "-- Dashboard --"
+        },
+        "description": "Panel with a single -- Dashboard -- datasource query",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 8,
+          "x": 0,
+          "y": 6
+        },
+        "id": 7,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          }
+        ],
+        "title": "Single Dashboard DS Query",
+        "type": "stat"
+      },
+      {
+        "datasource": {
+          "type": "mixed",
+          "uid": "-- Mixed --"
+        },
+        "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+        "fieldConfig": {
+          "defaults": {
+            "color": {
+              "mode": "thresholds"
+            },
+            "thresholds": {
+              "mode": "absolute",
+              "steps": [
+                {
+                  "color": "green",
+                  "value": 0
+                }
+              ]
+            }
+          }
+        },
+        "gridPos": {
+          "h": 3,
+          "w": 8,
+          "x": 8,
+          "y": 6
+        },
+        "id": 8,
+        "options": {
+          "colorMode": "value",
+          "graphMode": "area",
+          "justifyMode": "auto",
+          "orientation": "auto",
+          "percentChangeColorMode": "standard",
+          "reduceOptions": {
+            "calcs": [
+              "lastNotNull"
+            ],
+            "fields": "",
+            "values": false
+          },
+          "showPercentChange": false,
+          "textMode": "auto",
+          "wideLayout": true
+        },
+        "pluginVersion": "12.1.0-pre",
+        "targets": [
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 1,
+            "refId": "A",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 2,
+            "refId": "B",
+            "withTransforms": true
+          },
+          {
+            "datasource": {
+              "type": "datasource",
+              "uid": "-- Dashboard --"
+            },
+            "panelId": 3,
+            "refId": "C",
+            "withTransforms": true
+          }
+        ],
+        "title": "Multiple Dashboard DS Queries",
+        "type": "stat"
       }
     ],
     "preload": false,

apps/dashboard/pkg/migration/conversion/testdata/output/v2beta1.ds-data-query.v2alpha1.json

@@ -852,6 +852,194 @@
             }
           }
         }
+      },
+      "panel-7": {
+        "kind": "Panel",
+        "spec": {
+          "id": 7,
+          "title": "Single Dashboard DS Query",
+          "description": "Panel with a single -- Dashboard -- datasource query",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "stat",
+            "spec": {
+              "pluginVersion": "12.1.0-pre",
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
+      },
+      "panel-8": {
+        "kind": "Panel",
+        "spec": {
+          "id": 8,
+          "title": "Multiple Dashboard DS Queries",
+          "description": "Panel with multiple -- Dashboard -- datasource queries (should be mixed)",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 1,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 2,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "B",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "datasource",
+                      "spec": {
+                        "panelId": 3,
+                        "withTransforms": true
+                      }
+                    },
+                    "datasource": {
+                      "type": "datasource",
+                      "uid": "-- Dashboard --"
+                    },
+                    "refId": "C",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "stat",
+            "spec": {
+              "pluginVersion": "12.1.0-pre",
+              "options": {
+                "colorMode": "value",
+                "graphMode": "area",
+                "justifyMode": "auto",
+                "orientation": "auto",
+                "percentChangeColorMode": "standard",
+                "reduceOptions": {
+                  "calcs": [
+                    "lastNotNull"
+                  ],
+                  "fields": "",
+                  "values": false
+                },
+                "showPercentChange": false,
+                "textMode": "auto",
+                "wideLayout": true
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "thresholds": {
+                    "mode": "absolute",
+                    "steps": [
+                      {
+                        "value": 0,
+                        "color": "green"
+                      }
+                    ]
+                  },
+                  "color": {
+                    "mode": "thresholds"
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
       }
     },
     "layout": {
@@ -946,6 +1134,32 @@
                           "name": "panel-6"
                         }
                       }
+                    },
+                    {
+                      "kind": "GridLayoutItem",
+                      "spec": {
+                        "x": 0,
+                        "y": 6,
+                        "width": 8,
+                        "height": 3,
+                        "element": {
+                          "kind": "ElementReference",
+                          "name": "panel-7"
+                        }
+                      }
+                    },
+                    {
+                      "kind": "GridLayoutItem",
+                      "spec": {
+                        "x": 8,
+                        "y": 6,
+                        "width": 8,
+                        "height": 3,
+                        "element": {
+                          "kind": "ElementReference",
+                          "name": "panel-8"
+                        }
+                      }
                     }
                   ]
                 }

apps/dashboard/pkg/migration/conversion/v2alpha1_to_v1beta1.go

@@ -1195,16 +1195,36 @@ func getDataSourceForQuery(explicitDS *dashv2alpha1.DashboardDataSourceRef, quer
 // getPanelDatasource determines the panel-level datasource for V1.
 // Returns:
 // - Mixed datasource reference if queries use different datasources
+// - Mixed datasource reference if multiple queries use Dashboard datasource (they fetch from different panels)
+// - Dashboard datasource reference if a single query uses Dashboard datasource
 // - First query's datasource if all queries use the same datasource
 // - nil if no queries exist
 // Compares based on V2 input without runtime resolution:
 // - If query has explicit datasource.uid → use that UID and type
 // - Else → use query.Kind as type (empty UID)
 func getPanelDatasource(queries []dashv2alpha1.DashboardPanelQueryKind) map[string]interface{} {
+	const sharedDashboardQuery = "-- Dashboard --"
+
 	if len(queries) == 0 {
 		return nil
 	}
 
+	// Count how many queries use Dashboard datasource
+	// Multiple dashboard queries need mixed mode because they fetch from different panels
+	// which may have different underlying datasources
+	dashboardDsQueryCount := 0
+	for _, query := range queries {
+		if query.Spec.Datasource != nil && query.Spec.Datasource.Uid != nil && *query.Spec.Datasource.Uid == sharedDashboardQuery {
+			dashboardDsQueryCount++
+		}
+	}
+	if dashboardDsQueryCount > 1 {
+		return map[string]interface{}{
+			"type": "mixed",
+			"uid":  "-- Mixed --",
+		}
+	}
+
 	var firstUID, firstType string
 	var hasFirst bool
 
@@ -1239,6 +1259,16 @@ func getPanelDatasource(queries []dashv2alpha1.DashboardPanelQueryKind) map[stri
 		}
 	}
 
+	// Handle case when a single query uses Dashboard datasource.
+	// This is needed for the frontend to properly activate and fetch data from source panels.
+	// See DashboardDatasourceBehaviour.tsx for more details.
+	if firstUID == sharedDashboardQuery {
+		return map[string]interface{}{
+			"type": "datasource",
+			"uid":  sharedDashboardQuery,
+		}
+	}
+
 	// Not mixed - return the first query's datasource so the panel has a datasource set.
 	// This is required because the frontend's legacy PanelModel.PanelQueryRunner.run uses panel.datasource
 	// to resolve the datasource, and if undefined, it falls back to the default datasource

apps/provisioning/pkg/apis/provisioning/v0alpha1/connections.go

@@ -32,7 +32,7 @@ type ConnectionSecure struct {
 
 	// Token is the reference of the token used to act as the Connection.
 	// This value is stored securely and cannot be read back
-	Token common.InlineSecureValue `json:"webhook,omitzero,omitempty"`
+	Token common.InlineSecureValue `json:"token,omitzero,omitempty"`
 }
 
 func (v ConnectionSecure) IsZero() bool {

apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.openapi.go

@@ -320,7 +320,7 @@ func schema_pkg_apis_provisioning_v0alpha1_ConnectionSecure(ref common.Reference
 							Ref:         ref("github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1.InlineSecureValue"),
 						},
 					},
-					"webhook": {
+					"token": {
 						SchemaProps: spec.SchemaProps{
 							Description: "Token is the reference of the token used to act as the Connection. This value is stored securely and cannot be read back",
 							Default:     map[string]interface{}{},

apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.openapi_violation_exceptions.list

@@ -22,7 +22,6 @@ API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioni
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,ResourceList,Items
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,TestResults,Errors
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,WebhookStatus,SubscribedEvents
-API rule violation: names_match,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,ConnectionSecure,Token
 API rule violation: names_match,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,ConnectionSpec,GitHub
 API rule violation: names_match,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobSpec,PullRequest
 API rule violation: names_match,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobStatus,URLs

apps/provisioning/pkg/connection/connection.go

@@ -0,0 +1,16 @@
+package connection
+
+import (
+	"context"
+)
+
+//go:generate mockery --name Connection --structname MockConnection --inpackage --filename connection_mock.go --with-expecter
+type Connection interface {
+	// Validate ensures the resource _looks_ correct.
+	// It should be called before trying to upsert a resource into the Kubernetes API server.
+	// This is not an indication that the connection information works, just that they are reasonably configured.
+	Validate(ctx context.Context) error
+
+	// Mutate performs in place mutation of the underneath resource.
+	Mutate(context.Context) error
+}

apps/provisioning/pkg/connection/connection_mock.go

@@ -0,0 +1,128 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package connection
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockConnection is an autogenerated mock type for the Connection type
+type MockConnection struct {
+	mock.Mock
+}
+
+type MockConnection_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockConnection) EXPECT() *MockConnection_Expecter {
+	return &MockConnection_Expecter{mock: &_m.Mock}
+}
+
+// Mutate provides a mock function with given fields: _a0
+func (_m *MockConnection) Mutate(_a0 context.Context) error {
+	ret := _m.Called(_a0)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Mutate")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockConnection_Mutate_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Mutate'
+type MockConnection_Mutate_Call struct {
+	*mock.Call
+}
+
+// Mutate is a helper method to define mock.On call
+//   - _a0 context.Context
+func (_e *MockConnection_Expecter) Mutate(_a0 interface{}) *MockConnection_Mutate_Call {
+	return &MockConnection_Mutate_Call{Call: _e.mock.On("Mutate", _a0)}
+}
+
+func (_c *MockConnection_Mutate_Call) Run(run func(_a0 context.Context)) *MockConnection_Mutate_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
+	return _c
+}
+
+func (_c *MockConnection_Mutate_Call) Return(_a0 error) *MockConnection_Mutate_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockConnection_Mutate_Call) RunAndReturn(run func(context.Context) error) *MockConnection_Mutate_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Validate provides a mock function with given fields: ctx
+func (_m *MockConnection) Validate(ctx context.Context) error {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Validate")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockConnection_Validate_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Validate'
+type MockConnection_Validate_Call struct {
+	*mock.Call
+}
+
+// Validate is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockConnection_Expecter) Validate(ctx interface{}) *MockConnection_Validate_Call {
+	return &MockConnection_Validate_Call{Call: _e.mock.On("Validate", ctx)}
+}
+
+func (_c *MockConnection_Validate_Call) Run(run func(ctx context.Context)) *MockConnection_Validate_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
+	return _c
+}
+
+func (_c *MockConnection_Validate_Call) Return(_a0 error) *MockConnection_Validate_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockConnection_Validate_Call) RunAndReturn(run func(context.Context) error) *MockConnection_Validate_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockConnection creates a new instance of MockConnection. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockConnection(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockConnection {
+	mock := &MockConnection{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

apps/provisioning/pkg/connection/extra_mock.go

@@ -0,0 +1,141 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package connection
+
+import (
+	context "context"
+
+	v0alpha1 "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockExtra is an autogenerated mock type for the Extra type
+type MockExtra struct {
+	mock.Mock
+}
+
+type MockExtra_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockExtra) EXPECT() *MockExtra_Expecter {
+	return &MockExtra_Expecter{mock: &_m.Mock}
+}
+
+// Build provides a mock function with given fields: ctx, r
+func (_m *MockExtra) Build(ctx context.Context, r *v0alpha1.Connection) (Connection, error) {
+	ret := _m.Called(ctx, r)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Build")
+	}
+
+	var r0 Connection
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0alpha1.Connection) (Connection, error)); ok {
+		return rf(ctx, r)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *v0alpha1.Connection) Connection); ok {
+		r0 = rf(ctx, r)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(Connection)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *v0alpha1.Connection) error); ok {
+		r1 = rf(ctx, r)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockExtra_Build_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Build'
+type MockExtra_Build_Call struct {
+	*mock.Call
+}
+
+// Build is a helper method to define mock.On call
+//   - ctx context.Context
+//   - r *v0alpha1.Connection
+func (_e *MockExtra_Expecter) Build(ctx interface{}, r interface{}) *MockExtra_Build_Call {
+	return &MockExtra_Build_Call{Call: _e.mock.On("Build", ctx, r)}
+}
+
+func (_c *MockExtra_Build_Call) Run(run func(ctx context.Context, r *v0alpha1.Connection)) *MockExtra_Build_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(*v0alpha1.Connection))
+	})
+	return _c
+}
+
+func (_c *MockExtra_Build_Call) Return(_a0 Connection, _a1 error) *MockExtra_Build_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockExtra_Build_Call) RunAndReturn(run func(context.Context, *v0alpha1.Connection) (Connection, error)) *MockExtra_Build_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Type provides a mock function with no fields
+func (_m *MockExtra) Type() v0alpha1.ConnectionType {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Type")
+	}
+
+	var r0 v0alpha1.ConnectionType
+	if rf, ok := ret.Get(0).(func() v0alpha1.ConnectionType); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(v0alpha1.ConnectionType)
+	}
+
+	return r0
+}
+
+// MockExtra_Type_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Type'
+type MockExtra_Type_Call struct {
+	*mock.Call
+}
+
+// Type is a helper method to define mock.On call
+func (_e *MockExtra_Expecter) Type() *MockExtra_Type_Call {
+	return &MockExtra_Type_Call{Call: _e.mock.On("Type")}
+}
+
+func (_c *MockExtra_Type_Call) Run(run func()) *MockExtra_Type_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockExtra_Type_Call) Return(_a0 v0alpha1.ConnectionType) *MockExtra_Type_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockExtra_Type_Call) RunAndReturn(run func() v0alpha1.ConnectionType) *MockExtra_Type_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockExtra creates a new instance of MockExtra. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockExtra(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockExtra {
+	mock := &MockExtra{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

apps/provisioning/pkg/connection/factory.go

@@ -0,0 +1,75 @@
+package connection
+
+import (
+	"context"
+	"fmt"
+	"sort"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+//go:generate mockery --name=Extra --structname=MockExtra --inpackage --filename=extra_mock.go --with-expecter
+type Extra interface {
+	Type() provisioning.ConnectionType
+	Build(ctx context.Context, r *provisioning.Connection) (Connection, error)
+}
+
+//go:generate mockery --name=Factory --structname=MockFactory --inpackage --filename=factory_mock.go --with-expecter
+type Factory interface {
+	Types() []provisioning.ConnectionType
+	Build(ctx context.Context, r *provisioning.Connection) (Connection, error)
+}
+
+type factory struct {
+	extras  map[provisioning.ConnectionType]Extra
+	enabled map[provisioning.ConnectionType]struct{}
+}
+
+func ProvideFactory(enabled map[provisioning.ConnectionType]struct{}, extras []Extra) (Factory, error) {
+	f := &factory{
+		enabled: enabled,
+		extras:  make(map[provisioning.ConnectionType]Extra, len(extras)),
+	}
+
+	for _, e := range extras {
+		if _, exists := f.extras[e.Type()]; exists {
+			return nil, fmt.Errorf("connection type %q is already registered", e.Type())
+		}
+		f.extras[e.Type()] = e
+	}
+
+	return f, nil
+}
+
+func (f *factory) Types() []provisioning.ConnectionType {
+	var types []provisioning.ConnectionType
+	for t := range f.enabled {
+		if _, exists := f.extras[t]; exists {
+			types = append(types, t)
+		}
+	}
+
+	sort.Slice(types, func(i, j int) bool {
+		return string(types[i]) < string(types[j])
+	})
+
+	return types
+}
+
+func (f *factory) Build(ctx context.Context, c *provisioning.Connection) (Connection, error) {
+	for _, e := range f.extras {
+		if e.Type() == c.Spec.Type {
+			if _, enabled := f.enabled[e.Type()]; !enabled {
+				return nil, fmt.Errorf("connection type %q is not enabled", e.Type())
+			}
+
+			return e.Build(ctx, c)
+		}
+	}
+
+	return nil, fmt.Errorf("connection type %q is not supported", c.Spec.Type)
+}
+
+var (
+	_ Factory = (*factory)(nil)
+)

apps/provisioning/pkg/connection/factory_mock.go

@@ -0,0 +1,143 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package connection
+
+import (
+	context "context"
+
+	v0alpha1 "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockFactory is an autogenerated mock type for the Factory type
+type MockFactory struct {
+	mock.Mock
+}
+
+type MockFactory_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockFactory) EXPECT() *MockFactory_Expecter {
+	return &MockFactory_Expecter{mock: &_m.Mock}
+}
+
+// Build provides a mock function with given fields: ctx, r
+func (_m *MockFactory) Build(ctx context.Context, r *v0alpha1.Connection) (Connection, error) {
+	ret := _m.Called(ctx, r)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Build")
+	}
+
+	var r0 Connection
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0alpha1.Connection) (Connection, error)); ok {
+		return rf(ctx, r)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *v0alpha1.Connection) Connection); ok {
+		r0 = rf(ctx, r)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(Connection)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *v0alpha1.Connection) error); ok {
+		r1 = rf(ctx, r)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockFactory_Build_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Build'
+type MockFactory_Build_Call struct {
+	*mock.Call
+}
+
+// Build is a helper method to define mock.On call
+//   - ctx context.Context
+//   - r *v0alpha1.Connection
+func (_e *MockFactory_Expecter) Build(ctx interface{}, r interface{}) *MockFactory_Build_Call {
+	return &MockFactory_Build_Call{Call: _e.mock.On("Build", ctx, r)}
+}
+
+func (_c *MockFactory_Build_Call) Run(run func(ctx context.Context, r *v0alpha1.Connection)) *MockFactory_Build_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(*v0alpha1.Connection))
+	})
+	return _c
+}
+
+func (_c *MockFactory_Build_Call) Return(_a0 Connection, _a1 error) *MockFactory_Build_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockFactory_Build_Call) RunAndReturn(run func(context.Context, *v0alpha1.Connection) (Connection, error)) *MockFactory_Build_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Types provides a mock function with no fields
+func (_m *MockFactory) Types() []v0alpha1.ConnectionType {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Types")
+	}
+
+	var r0 []v0alpha1.ConnectionType
+	if rf, ok := ret.Get(0).(func() []v0alpha1.ConnectionType); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]v0alpha1.ConnectionType)
+		}
+	}
+
+	return r0
+}
+
+// MockFactory_Types_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Types'
+type MockFactory_Types_Call struct {
+	*mock.Call
+}
+
+// Types is a helper method to define mock.On call
+func (_e *MockFactory_Expecter) Types() *MockFactory_Types_Call {
+	return &MockFactory_Types_Call{Call: _e.mock.On("Types")}
+}
+
+func (_c *MockFactory_Types_Call) Run(run func()) *MockFactory_Types_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockFactory_Types_Call) Return(_a0 []v0alpha1.ConnectionType) *MockFactory_Types_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockFactory_Types_Call) RunAndReturn(run func() []v0alpha1.ConnectionType) *MockFactory_Types_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockFactory creates a new instance of MockFactory. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockFactory(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockFactory {
+	mock := &MockFactory{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

apps/provisioning/pkg/connection/factory_test.go

@@ -0,0 +1,309 @@
+package connection
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestProvideFactory(t *testing.T) {
+	t.Run("should create factory with valid extras", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+			provisioning.GitlabConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.NoError(t, err)
+		require.NotNil(t, factory)
+	})
+
+	t.Run("should create factory with empty extras", func(t *testing.T) {
+		enabled := map[provisioning.ConnectionType]struct{}{}
+
+		factory, err := ProvideFactory(enabled, []Extra{})
+		require.NoError(t, err)
+		require.NotNil(t, factory)
+	})
+
+	t.Run("should create factory with nil enabled map", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		factory, err := ProvideFactory(nil, []Extra{extra1})
+		require.NoError(t, err)
+		require.NotNil(t, factory)
+	})
+
+	t.Run("should return error when duplicate repository types", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.Error(t, err)
+		assert.Nil(t, factory)
+		assert.Contains(t, err.Error(), "connection type \"github\" is already registered")
+	})
+}
+
+func TestFactory_Types(t *testing.T) {
+	t.Run("should return only enabled types that have extras", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+			provisioning.GitlabConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Len(t, types, 2)
+		assert.Contains(t, types, provisioning.GithubConnectionType)
+		assert.Contains(t, types, provisioning.GitlabConnectionType)
+	})
+
+	t.Run("should return sorted list of types", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+			provisioning.GitlabConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Len(t, types, 2)
+		// github should come before gitlab alphabetically
+		assert.Equal(t, provisioning.GithubConnectionType, types[0])
+		assert.Equal(t, provisioning.GitlabConnectionType, types[1])
+	})
+
+	t.Run("should return empty list when no types are enabled", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Empty(t, types)
+	})
+
+	t.Run("should not return types that are enabled but have no extras", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+			provisioning.GitlabConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Len(t, types, 1)
+		assert.Contains(t, types, provisioning.GithubConnectionType)
+		assert.NotContains(t, types, provisioning.GitlabConnectionType)
+	})
+
+	t.Run("should not return types that have extras but are not enabled", func(t *testing.T) {
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Len(t, types, 1)
+		assert.Contains(t, types, provisioning.GithubConnectionType)
+		assert.NotContains(t, types, provisioning.GitlabConnectionType)
+	})
+
+	t.Run("should return empty list when no extras are provided", func(t *testing.T) {
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{})
+		require.NoError(t, err)
+
+		types := factory.Types()
+		assert.Empty(t, types)
+	})
+}
+
+func TestFactory_Build(t *testing.T) {
+	t.Run("should successfully build connection when type is enabled and has extra", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+			},
+		}
+
+		mockConnection := NewMockConnection(t)
+		extra := NewMockExtra(t)
+		extra.EXPECT().Type().Return(provisioning.GithubConnectionType)
+		extra.EXPECT().Build(ctx, conn).Return(mockConnection, nil)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra})
+		require.NoError(t, err)
+
+		result, err := factory.Build(ctx, conn)
+		require.NoError(t, err)
+		assert.Equal(t, mockConnection, result)
+	})
+
+	t.Run("should return error when type is not enabled", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GitlabConnectionType,
+			},
+		}
+
+		extra := NewMockExtra(t)
+		extra.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra})
+		require.NoError(t, err)
+
+		result, err := factory.Build(ctx, conn)
+		require.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "connection type \"gitlab\" is not enabled")
+	})
+
+	t.Run("should return error when type is not supported", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GitlabConnectionType,
+			},
+		}
+
+		extra := NewMockExtra(t)
+		extra.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra})
+		require.NoError(t, err)
+
+		result, err := factory.Build(ctx, conn)
+		require.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "connection type \"gitlab\" is not supported")
+	})
+
+	t.Run("should pass through errors from extra.Build()", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+			},
+		}
+
+		expectedErr := errors.New("build error")
+		extra := NewMockExtra(t)
+		extra.EXPECT().Type().Return(provisioning.GithubConnectionType)
+		extra.EXPECT().Build(ctx, conn).Return(nil, expectedErr)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra})
+		require.NoError(t, err)
+
+		result, err := factory.Build(ctx, conn)
+		require.Error(t, err)
+		assert.Nil(t, result)
+		assert.Equal(t, expectedErr, err)
+	})
+
+	t.Run("should build with multiple extras registered", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GitlabConnectionType,
+			},
+		}
+
+		mockConnection := NewMockConnection(t)
+
+		extra1 := NewMockExtra(t)
+		extra1.EXPECT().Type().Return(provisioning.GithubConnectionType)
+
+		extra2 := NewMockExtra(t)
+		extra2.EXPECT().Type().Return(provisioning.GitlabConnectionType)
+		extra2.EXPECT().Build(ctx, conn).Return(mockConnection, nil)
+
+		enabled := map[provisioning.ConnectionType]struct{}{
+			provisioning.GithubConnectionType: {},
+			provisioning.GitlabConnectionType: {},
+		}
+
+		factory, err := ProvideFactory(enabled, []Extra{extra1, extra2})
+		require.NoError(t, err)
+
+		result, err := factory.Build(ctx, conn)
+		require.NoError(t, err)
+		assert.Equal(t, mockConnection, result)
+	})
+}

apps/provisioning/pkg/connection/github/client.go

@@ -0,0 +1,93 @@
+package github
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/google/go-github/v70/github"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// API errors that we need to convey after parsing real GH errors (or faking them).
+var (
+	//lint:ignore ST1005 this is not punctuation
+	ErrServiceUnavailable = apierrors.NewServiceUnavailable("github is unavailable")
+)
+
+//go:generate mockery --name Client --structname MockClient --inpackage --filename client_mock.go --with-expecter
+type Client interface {
+	// Apps and installations
+	GetApp(ctx context.Context) (App, error)
+	GetAppInstallation(ctx context.Context, installationID string) (AppInstallation, error)
+}
+
+// App represents a Github App.
+type App struct {
+	// ID represents the GH app ID.
+	ID int64
+	// Slug represents the GH app slug.
+	Slug string
+	// Owner represents the GH account/org owning the app
+	Owner string
+}
+
+// AppInstallation represents a Github App Installation.
+type AppInstallation struct {
+	// ID represents the GH installation ID.
+	ID int64
+	// Whether the installation is enabled or not.
+	Enabled bool
+}
+
+type githubClient struct {
+	gh *github.Client
+}
+
+func NewClient(client *github.Client) Client {
+	return &githubClient{client}
+}
+
+// GetApp gets the app by using the given token.
+func (r *githubClient) GetApp(ctx context.Context) (App, error) {
+	app, _, err := r.gh.Apps.Get(ctx, "")
+	if err != nil {
+		var ghErr *github.ErrorResponse
+		if errors.As(err, &ghErr) && ghErr.Response.StatusCode == http.StatusServiceUnavailable {
+			return App{}, ErrServiceUnavailable
+		}
+		return App{}, err
+	}
+
+	// TODO(ferruvich): do we need any other info?
+	return App{
+		ID:    app.GetID(),
+		Slug:  app.GetSlug(),
+		Owner: app.GetOwner().GetLogin(),
+	}, nil
+}
+
+// GetAppInstallation gets the installation of the app related to the given token.
+func (r *githubClient) GetAppInstallation(ctx context.Context, installationID string) (AppInstallation, error) {
+	id, err := strconv.Atoi(installationID)
+	if err != nil {
+		return AppInstallation{}, fmt.Errorf("invalid installation ID: %s", installationID)
+	}
+
+	installation, _, err := r.gh.Apps.GetInstallation(ctx, int64(id))
+	if err != nil {
+		var ghErr *github.ErrorResponse
+		if errors.As(err, &ghErr) && ghErr.Response.StatusCode == http.StatusServiceUnavailable {
+			return AppInstallation{}, ErrServiceUnavailable
+		}
+		return AppInstallation{}, err
+	}
+
+	// TODO(ferruvich): do we need any other info?
+	return AppInstallation{
+		ID:      installation.GetID(),
+		Enabled: installation.GetSuspendedAt().IsZero(),
+	}, nil
+}

apps/provisioning/pkg/connection/github/client_mock.go

@@ -0,0 +1,149 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package github
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockClient is an autogenerated mock type for the Client type
+type MockClient struct {
+	mock.Mock
+}
+
+type MockClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockClient) EXPECT() *MockClient_Expecter {
+	return &MockClient_Expecter{mock: &_m.Mock}
+}
+
+// GetApp provides a mock function with given fields: ctx
+func (_m *MockClient) GetApp(ctx context.Context) (App, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetApp")
+	}
+
+	var r0 App
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (App, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) App); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Get(0).(App)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockClient_GetApp_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetApp'
+type MockClient_GetApp_Call struct {
+	*mock.Call
+}
+
+// GetApp is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockClient_Expecter) GetApp(ctx interface{}) *MockClient_GetApp_Call {
+	return &MockClient_GetApp_Call{Call: _e.mock.On("GetApp", ctx)}
+}
+
+func (_c *MockClient_GetApp_Call) Run(run func(ctx context.Context)) *MockClient_GetApp_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
+	return _c
+}
+
+func (_c *MockClient_GetApp_Call) Return(_a0 App, _a1 error) *MockClient_GetApp_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockClient_GetApp_Call) RunAndReturn(run func(context.Context) (App, error)) *MockClient_GetApp_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// GetAppInstallation provides a mock function with given fields: ctx, installationID
+func (_m *MockClient) GetAppInstallation(ctx context.Context, installationID string) (AppInstallation, error) {
+	ret := _m.Called(ctx, installationID)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetAppInstallation")
+	}
+
+	var r0 AppInstallation
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (AppInstallation, error)); ok {
+		return rf(ctx, installationID)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) AppInstallation); ok {
+		r0 = rf(ctx, installationID)
+	} else {
+		r0 = ret.Get(0).(AppInstallation)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, installationID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockClient_GetAppInstallation_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetAppInstallation'
+type MockClient_GetAppInstallation_Call struct {
+	*mock.Call
+}
+
+// GetAppInstallation is a helper method to define mock.On call
+//   - ctx context.Context
+//   - installationID string
+func (_e *MockClient_Expecter) GetAppInstallation(ctx interface{}, installationID interface{}) *MockClient_GetAppInstallation_Call {
+	return &MockClient_GetAppInstallation_Call{Call: _e.mock.On("GetAppInstallation", ctx, installationID)}
+}
+
+func (_c *MockClient_GetAppInstallation_Call) Run(run func(ctx context.Context, installationID string)) *MockClient_GetAppInstallation_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *MockClient_GetAppInstallation_Call) Return(_a0 AppInstallation, _a1 error) *MockClient_GetAppInstallation_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockClient_GetAppInstallation_Call) RunAndReturn(run func(context.Context, string) (AppInstallation, error)) *MockClient_GetAppInstallation_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockClient creates a new instance of MockClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockClient {
+	mock := &MockClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

apps/provisioning/pkg/connection/github/client_test.go

@@ -0,0 +1,297 @@
+package github_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/go-github/v70/github"
+	conngh "github.com/grafana/grafana/apps/provisioning/pkg/connection/github"
+	mockhub "github.com/migueleliasweb/go-github-mock/src/mock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGithubClient_GetApp(t *testing.T) {
+	tests := []struct {
+		name        string
+		mockHandler *http.Client
+		token       string
+		wantApp     conngh.App
+		wantErr     error
+	}{
+		{
+			name: "get app successfully",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetApp,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						app := &github.App{
+							ID:   github.Ptr(int64(12345)),
+							Slug: github.Ptr("my-test-app"),
+							Owner: &github.User{
+								Login: github.Ptr("grafana"),
+							},
+						}
+						w.WriteHeader(http.StatusOK)
+						require.NoError(t, json.NewEncoder(w).Encode(app))
+					}),
+				),
+			),
+			token: "test-token",
+			wantApp: conngh.App{
+				ID:    12345,
+				Slug:  "my-test-app",
+				Owner: "grafana",
+			},
+			wantErr: nil,
+		},
+		{
+			name: "service unavailable",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetApp,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusServiceUnavailable)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusServiceUnavailable,
+							},
+							Message: "Service unavailable",
+						}))
+					}),
+				),
+			),
+			token:   "test-token",
+			wantApp: conngh.App{},
+			wantErr: conngh.ErrServiceUnavailable,
+		},
+		{
+			name: "other error",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetApp,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusInternalServerError)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusInternalServerError,
+							},
+							Message: "Internal server error",
+						}))
+					}),
+				),
+			),
+			token:   "test-token",
+			wantApp: conngh.App{},
+			wantErr: &github.ErrorResponse{
+				Response: &http.Response{
+					StatusCode: http.StatusInternalServerError,
+				},
+				Message: "Internal server error",
+			},
+		},
+		{
+			name: "unauthorized error",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetApp,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusUnauthorized)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusUnauthorized,
+							},
+							Message: "Bad credentials",
+						}))
+					}),
+				),
+			),
+			token:   "invalid-token",
+			wantApp: conngh.App{},
+			wantErr: &github.ErrorResponse{
+				Response: &http.Response{
+					StatusCode: http.StatusUnauthorized,
+				},
+				Message: "Bad credentials",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a mock client
+			ghClient := github.NewClient(tt.mockHandler)
+			client := conngh.NewClient(ghClient)
+
+			// Call the method being tested
+			app, err := client.GetApp(context.Background())
+
+			// Check the error
+			if tt.wantErr != nil {
+				assert.Error(t, err)
+				assert.Equal(t, tt.wantApp, app)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.wantApp, app)
+			}
+		})
+	}
+}
+
+func TestGithubClient_GetAppInstallation(t *testing.T) {
+	tests := []struct {
+		name             string
+		mockHandler      *http.Client
+		appToken         string
+		installationID   string
+		wantInstallation conngh.AppInstallation
+		wantErr          bool
+		errContains      string
+	}{
+		{
+			name: "get disabled app installation successfully",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetAppInstallationsByInstallationId,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						installation := &github.Installation{
+							ID:          github.Ptr(int64(67890)),
+							SuspendedAt: github.Ptr(github.Timestamp{Time: time.Now()}),
+						}
+						w.WriteHeader(http.StatusOK)
+						require.NoError(t, json.NewEncoder(w).Encode(installation))
+					}),
+				),
+			),
+			appToken:       "test-app-token",
+			installationID: "67890",
+			wantInstallation: conngh.AppInstallation{
+				ID:      67890,
+				Enabled: false,
+			},
+			wantErr: false,
+		},
+		{
+			name: "get enabled app installation successfully",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetAppInstallationsByInstallationId,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						installation := &github.Installation{
+							ID:          github.Ptr(int64(67890)),
+							SuspendedAt: nil,
+						}
+						w.WriteHeader(http.StatusOK)
+						require.NoError(t, json.NewEncoder(w).Encode(installation))
+					}),
+				),
+			),
+			appToken:       "test-app-token",
+			installationID: "67890",
+			wantInstallation: conngh.AppInstallation{
+				ID:      67890,
+				Enabled: true,
+			},
+			wantErr: false,
+		},
+		{
+			name:             "invalid installation ID",
+			mockHandler:      mockhub.NewMockedHTTPClient(),
+			appToken:         "test-app-token",
+			installationID:   "not-a-number",
+			wantInstallation: conngh.AppInstallation{},
+			wantErr:          true,
+			errContains:      "invalid installation ID",
+		},
+		{
+			name: "service unavailable",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetAppInstallationsByInstallationId,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusServiceUnavailable)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusServiceUnavailable,
+							},
+							Message: "Service unavailable",
+						}))
+					}),
+				),
+			),
+			appToken:         "test-app-token",
+			installationID:   "67890",
+			wantInstallation: conngh.AppInstallation{},
+			wantErr:          true,
+		},
+		{
+			name: "installation not found",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetAppInstallationsByInstallationId,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusNotFound)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusNotFound,
+							},
+							Message: "Not Found",
+						}))
+					}),
+				),
+			),
+			appToken:         "test-app-token",
+			installationID:   "99999",
+			wantInstallation: conngh.AppInstallation{},
+			wantErr:          true,
+		},
+		{
+			name: "other error",
+			mockHandler: mockhub.NewMockedHTTPClient(
+				mockhub.WithRequestMatchHandler(
+					mockhub.GetAppInstallationsByInstallationId,
+					http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+						w.WriteHeader(http.StatusInternalServerError)
+						require.NoError(t, json.NewEncoder(w).Encode(github.ErrorResponse{
+							Response: &http.Response{
+								StatusCode: http.StatusInternalServerError,
+							},
+							Message: "Internal server error",
+						}))
+					}),
+				),
+			),
+			appToken:         "test-app-token",
+			installationID:   "67890",
+			wantInstallation: conngh.AppInstallation{},
+			wantErr:          true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a mock client
+			ghClient := github.NewClient(tt.mockHandler)
+			client := conngh.NewClient(ghClient)
+
+			// Call the method being tested
+			installation, err := client.GetAppInstallation(context.Background(), tt.installationID)
+
+			// Check the error
+			if tt.wantErr {
+				assert.Error(t, err)
+				if tt.errContains != "" {
+					assert.Contains(t, err.Error(), tt.errContains)
+				}
+			} else {
+				assert.NoError(t, err)
+			}
+
+			// Check the result
+			assert.Equal(t, tt.wantInstallation, installation)
+		})
+	}
+}

apps/provisioning/pkg/connection/github/connection.go

@@ -0,0 +1,192 @@
+package github
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+//go:generate mockery --name GithubFactory --structname MockGithubFactory --inpackage --filename factory_mock.go --with-expecter
+type GithubFactory interface {
+	New(ctx context.Context, ghToken common.RawSecureValue) Client
+}
+
+type Connection struct {
+	obj       *provisioning.Connection
+	ghFactory GithubFactory
+}
+
+func NewConnection(
+	obj *provisioning.Connection,
+	factory GithubFactory,
+) Connection {
+	return Connection{
+		obj:       obj,
+		ghFactory: factory,
+	}
+}
+
+const (
+	//TODO(ferruvich): these probably need to be setup in API configuration.
+	githubInstallationURL = "https://github.com/settings/installations"
+	jwtExpirationMinutes  = 10 // GitHub Apps JWT tokens expire in 10 minutes maximum
+)
+
+// Mutate performs in place mutation of the underneath resource.
+func (c *Connection) Mutate(_ context.Context) error {
+	// Do nothing in case spec.Github is nil.
+	// If this field is required, we should fail at validation time.
+	if c.obj.Spec.GitHub == nil {
+		return nil
+	}
+
+	c.obj.Spec.URL = fmt.Sprintf("%s/%s", githubInstallationURL, c.obj.Spec.GitHub.InstallationID)
+
+	// Generate JWT token if private key is being provided.
+	// Same as for the spec.Github, if such a field is required, Validation will take care of that.
+	if !c.obj.Secure.PrivateKey.Create.IsZero() {
+		token, err := generateToken(c.obj.Spec.GitHub.AppID, c.obj.Secure.PrivateKey.Create)
+		if err != nil {
+			return fmt.Errorf("failed to generate JWT token: %w", err)
+		}
+
+		// Store the generated token
+		c.obj.Secure.Token = common.InlineSecureValue{Create: token}
+	}
+
+	return nil
+}
+
+// Token generates and returns the Connection token.
+func generateToken(appID string, privateKey common.RawSecureValue) (common.RawSecureValue, error) {
+	// Decode base64-encoded private key
+	privateKeyPEM, err := base64.StdEncoding.DecodeString(string(privateKey))
+	if err != nil {
+		return "", fmt.Errorf("failed to decode base64 private key: %w", err)
+	}
+
+	// Parse the private key
+	key, err := jwt.ParseRSAPrivateKeyFromPEM(privateKeyPEM)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse private key: %w", err)
+	}
+
+	// Create the JWT token
+	now := time.Now()
+	claims := jwt.RegisteredClaims{
+		IssuedAt:  jwt.NewNumericDate(now),
+		ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(jwtExpirationMinutes) * time.Minute)),
+		Issuer:    appID,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	signedToken, err := token.SignedString(key)
+	if err != nil {
+		return "", fmt.Errorf("failed to sign JWT token: %w", err)
+	}
+
+	return common.RawSecureValue(signedToken), nil
+}
+
+// Validate ensures the resource _looks_ correct.
+func (c *Connection) Validate(ctx context.Context) error {
+	list := field.ErrorList{}
+
+	if c.obj.Spec.Type != provisioning.GithubConnectionType {
+		list = append(list, field.Invalid(field.NewPath("spec", "type"), c.obj.Spec.Type, "invalid connection type"))
+
+		// Doesn't make much sense to continue validating a connection which is not a Github one.
+		return toError(c.obj.GetName(), list)
+	}
+
+	if c.obj.Spec.GitHub == nil {
+		list = append(
+			list, field.Required(field.NewPath("spec", "github"), "github info must be specified for GitHub connection"),
+		)
+
+		// Doesn't make much sense to continue validating a connection with no information.
+		return toError(c.obj.GetName(), list)
+	}
+
+	if c.obj.Secure.PrivateKey.IsZero() {
+		list = append(list, field.Required(field.NewPath("secure", "privateKey"), "privateKey must be specified for GitHub connection"))
+	}
+	if c.obj.Secure.Token.IsZero() {
+		list = append(list, field.Required(field.NewPath("secure", "token"), "token must be specified for GitHub connection"))
+	}
+	if !c.obj.Secure.ClientSecret.IsZero() {
+		list = append(list, field.Forbidden(field.NewPath("secure", "clientSecret"), "clientSecret is forbidden in GitHub connection"))
+	}
+
+	// Validate GitHub configuration fields
+	if c.obj.Spec.GitHub.AppID == "" {
+		list = append(list, field.Required(field.NewPath("spec", "github", "appID"), "appID must be specified for GitHub connection"))
+	}
+	if c.obj.Spec.GitHub.InstallationID == "" {
+		list = append(list, field.Required(field.NewPath("spec", "github", "installationID"), "installationID must be specified for GitHub connection"))
+	}
+
+	// In case we have any error above, we don't go forward with the validation, and return the errors.
+	if len(list) > 0 {
+		return toError(c.obj.GetName(), list)
+	}
+
+	// Validating app content via GH API
+	if err := c.validateAppAndInstallation(ctx); err != nil {
+		list = append(list, err)
+	}
+
+	return toError(c.obj.GetName(), list)
+}
+
+// validateAppAndInstallation validates the appID and installationID against the given github token.
+func (c *Connection) validateAppAndInstallation(ctx context.Context) *field.Error {
+	ghClient := c.ghFactory.New(ctx, c.obj.Secure.Token.Create)
+
+	app, err := ghClient.GetApp(ctx)
+	if err != nil {
+		if errors.Is(err, ErrServiceUnavailable) {
+			return field.InternalError(field.NewPath("spec", "token"), ErrServiceUnavailable)
+		}
+		return field.Invalid(field.NewPath("spec", "token"), "[REDACTED]", "invalid token")
+	}
+
+	if fmt.Sprintf("%d", app.ID) != c.obj.Spec.GitHub.AppID {
+		return field.Invalid(field.NewPath("spec", "appID"), c.obj.Spec.GitHub.AppID, "appID mismatch")
+	}
+
+	_, err = ghClient.GetAppInstallation(ctx, c.obj.Spec.GitHub.InstallationID)
+	if err != nil {
+		if errors.Is(err, ErrServiceUnavailable) {
+			return field.InternalError(field.NewPath("spec", "token"), ErrServiceUnavailable)
+		}
+		return field.Invalid(field.NewPath("spec", "installationID"), c.obj.Spec.GitHub.InstallationID, "invalid installation ID")
+	}
+
+	return nil
+}
+
+// toError converts a field.ErrorList to an error, returning nil if the list is empty
+func toError(name string, list field.ErrorList) error {
+	if len(list) == 0 {
+		return nil
+	}
+	return apierrors.NewInvalid(
+		provisioning.ConnectionResourceInfo.GroupVersionKind().GroupKind(),
+		name,
+		list,
+	)
+}
+
+var (
+	_ connection.Connection = (*Connection)(nil)
+)

apps/provisioning/pkg/connection/github/connection_test.go

@@ -0,0 +1,434 @@
+package github
+
+import (
+	"context"
+	"encoding/base64"
+	"testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+//nolint:gosec // Test RSA private key (generated for testing purposes only)
+const testPrivateKeyPEM = `-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAoInVbLY9io2Q/wHvUIXlEHg2Qyvd8eRzBAVEJ92DS6fx9H10
+06V0VRm78S0MXyo6i+n8ZAbZ0/R+GWpP2Ephxm0Gs2zo+iO2mpB19xQFI4o6ZTOw
+b2WyjSaa2Vr4oyDkqti6AvfjW4VUAu932e08GkgwmmQSHXj7FX2CMWjgUwTTcuaX
+65SHNKLNYLUP0HTumLzoZeqDTdoMMpKNdgH9Avr4/8vkVJ0mD6rqvxnw3JHsseNO
+WdQTxf2aApBNHIIKxWZ2i/ZmjLNey7kltgjEquGiBdJvip3fHhH5XHdkrXcjRtnw
+OJDnDmi5lQwv5yUBOSkbvbXRv/L/m0YLoD/fbwIDAQABAoIBAFfl//hM8/cnuesV
++R1Con/ZAgTXQOdPqPXbmEyniVrkMqMmCdBUOBTcST4s5yg36+RtkeaGpb/ajyyF
+PAB2AYDucwvMpudGpJWOYTiOOp4R8hU1LvZfXVrRd1lo6NgQi4NLtNUpOtACeVQ+
+H4Yv0YemXQ47mnuOoRNMK/u3q5NoIdSahWptXBgUno8KklNpUrH3IYWaUxfBzDN3
+2xsVRTn2SfTSyoDmTDdTgptJONmoK1/sV7UsgWksdFc6XyYhsFAZgOGEJrBABRvF
+546dyQ0cWxuPyVXpM7CN3tqC5ssvLjElg3LicK1V6gnjpdRnnvX88d1Eh3Uc/9IM
+OZInT2ECgYEA6W8sQXTWinyEwl8SDKKMbB2ApIghAcFgdRxprZE4WFxjsYNCNL70
+dnSB7MRuzmxf5W77cV0N7JhH66N8HvY6Xq9olrpQ5dNttR4w8Pyv3wavDe8x7seL
+5L2Xtbu7ihDr8Dk27MjiBSin3IxhBP5CJS910+pR6LrAWtEuU+FzFfECgYEAsA6y
+qxHhCMXlTnauXhsnmPd1g61q7chW8kLQFYtHMLlQlgjHTW7irDZ9cPbPYDNjwRLO
+7KLorcpv2NKe7rqq2ZyCm6hf1b9WnlQjo3dLpNWMu6fhy/smK8MgbRqcWpX+oTKF
+79mK6hbY7o6eBzsQHBl7Z+LBNuwYmp9qOodPa18CgYEArv6ipKdcNhFGzRfMRiCN
+OHederp6VACNuP2F05IsNUF9kxOdTEFirnKE++P+VU01TqA2azOhPp6iO+ohIGzi
+MR06QNSH1OL9OWvasK4dggpWrRGF00VQgDgJRTnpS4WH+lxJ6pRlrAxgWpv6F24s
+VAgSQr1Ejj2B+hMasdMvHWECgYBJ4uE4yhgXBnZlp4kmFV9Y4wF+cZkekaVrpn6N
+jBYkbKFVVfnOlWqru3KJpgsB5I9IyAvvY68iwIKQDFSG+/AXw4dMrC0MF3DSoZ0T
+TU2Br92QI7SvVod+djV1lGVp3ukt3XY4YqPZ+hywgUnw3uiz4j3YK2HLGup4ec6r
+IX5DIQKBgHRLzvT3zqtlR1Oh0vv098clLwt+pGzXOxzJpxioOa5UqK13xIpFXbcg
+iWUVh5YXCcuqaICUv4RLIEac5xQitk9Is/9IhP0NJ/81rHniosvdSpCeFXzxTImS
+B8Uc0WUgheB4+yVKGnYpYaSOgFFI5+1BYUva/wDHLy2pWHz39Usb
+-----END RSA PRIVATE KEY-----`
+
+func TestConnection_Mutate(t *testing.T) {
+	t.Run("should add URL to Github connection", func(t *testing.T) {
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Name: "test-private-key",
+				},
+			},
+		}
+
+		mockFactory := NewMockGithubFactory(t)
+		conn := NewConnection(c, mockFactory)
+
+		require.NoError(t, conn.Mutate(context.Background()))
+		assert.Equal(t, "https://github.com/settings/installations/456", c.Spec.URL)
+	})
+
+	t.Run("should generate JWT token when private key is provided", func(t *testing.T) {
+		privateKeyBase64 := base64.StdEncoding.EncodeToString([]byte(testPrivateKeyPEM))
+
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Create: common.NewSecretValue(privateKeyBase64),
+				},
+			},
+		}
+
+		mockFactory := NewMockGithubFactory(t)
+		conn := NewConnection(c, mockFactory)
+
+		require.NoError(t, conn.Mutate(context.Background()))
+		assert.Equal(t, "https://github.com/settings/installations/456", c.Spec.URL)
+		assert.False(t, c.Secure.Token.Create.IsZero(), "JWT token should be generated")
+	})
+
+	t.Run("should do nothing when GitHub config is nil", func(t *testing.T) {
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GitlabConnectionType,
+				Gitlab: &provisioning.GitlabConnectionConfig{
+					ClientID: "clientID",
+				},
+			},
+		}
+
+		mockFactory := NewMockGithubFactory(t)
+		conn := NewConnection(c, mockFactory)
+
+		require.NoError(t, conn.Mutate(context.Background()))
+	})
+
+	t.Run("should fail when private key is not base64", func(t *testing.T) {
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Create: common.NewSecretValue("invalid-key"),
+				},
+			},
+		}
+
+		mockFactory := NewMockGithubFactory(t)
+		conn := NewConnection(c, mockFactory)
+
+		err := conn.Mutate(context.Background())
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to generate JWT token")
+		assert.Contains(t, err.Error(), "failed to decode base64 private key")
+	})
+
+	t.Run("should fail when private key is invalid", func(t *testing.T) {
+		c := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Create: common.NewSecretValue(base64.StdEncoding.EncodeToString([]byte("invalid-key"))),
+				},
+			},
+		}
+
+		mockFactory := NewMockGithubFactory(t)
+		conn := NewConnection(c, mockFactory)
+
+		err := conn.Mutate(context.Background())
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to generate JWT token")
+		assert.Contains(t, err.Error(), "failed to parse private key")
+	})
+}
+
+func TestConnection_Validate(t *testing.T) {
+	tests := []struct {
+		name           string
+		connection     *provisioning.Connection
+		setupMock      func(*MockGithubFactory)
+		wantErr        bool
+		errMsgContains []string
+	}{
+		{
+			name: "invalid type returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: "invalid",
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.type"},
+		},
+		{
+			name: "github type without github config returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.github"},
+		},
+		{
+			name: "github type without private key returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"secure.privateKey"},
+		},
+		{
+			name: "github type without token returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"secure.token"},
+		},
+		{
+			name: "github type with client secret returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					ClientSecret: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-client-secret"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"secure.clientSecret"},
+		},
+		{
+			name: "github type without appID returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+					Token: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-token"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.github.appID"},
+		},
+		{
+			name: "github type without installationID returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID: "123",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Name: "test-private-key",
+					},
+					Token: common.InlineSecureValue{
+						Name: "test-token",
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.github.installationID"},
+		},
+		{
+			name: "github type with valid config is valid",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+					Token: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-token"),
+					},
+				},
+			},
+			wantErr: false,
+			setupMock: func(mockFactory *MockGithubFactory) {
+				mockClient := NewMockClient(t)
+
+				mockFactory.EXPECT().New(mock.Anything, common.RawSecureValue("test-token")).Return(mockClient)
+				mockClient.EXPECT().GetApp(mock.Anything).Return(App{ID: 123, Slug: "test-app"}, nil)
+				mockClient.EXPECT().GetAppInstallation(mock.Anything, "456").Return(AppInstallation{ID: 456}, nil)
+			},
+		},
+		{
+			name: "problem getting app returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+					Token: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-token"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.token", "[REDACTED]"},
+			setupMock: func(mockFactory *MockGithubFactory) {
+				mockClient := NewMockClient(t)
+
+				mockFactory.EXPECT().New(mock.Anything, common.RawSecureValue("test-token")).Return(mockClient)
+				mockClient.EXPECT().GetApp(mock.Anything).Return(App{}, assert.AnError)
+			},
+		},
+		{
+			name: "mismatched app ID returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+					Token: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-token"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.appID"},
+			setupMock: func(mockFactory *MockGithubFactory) {
+				mockClient := NewMockClient(t)
+
+				mockFactory.EXPECT().New(mock.Anything, common.RawSecureValue("test-token")).Return(mockClient)
+				mockClient.EXPECT().GetApp(mock.Anything).Return(App{ID: 444, Slug: "test-app"}, nil)
+			},
+		},
+		{
+			name: "problem when getting installation returns error",
+			connection: &provisioning.Connection{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+				Spec: provisioning.ConnectionSpec{
+					Type: provisioning.GithubConnectionType,
+					GitHub: &provisioning.GitHubConnectionConfig{
+						AppID:          "123",
+						InstallationID: "456",
+					},
+				},
+				Secure: provisioning.ConnectionSecure{
+					PrivateKey: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-private-key"),
+					},
+					Token: common.InlineSecureValue{
+						Create: common.NewSecretValue("test-token"),
+					},
+				},
+			},
+			wantErr:        true,
+			errMsgContains: []string{"spec.installationID", "456"},
+			setupMock: func(mockFactory *MockGithubFactory) {
+				mockClient := NewMockClient(t)
+
+				mockFactory.EXPECT().New(mock.Anything, common.RawSecureValue("test-token")).Return(mockClient)
+				mockClient.EXPECT().GetApp(mock.Anything).Return(App{ID: 123, Slug: "test-app"}, nil)
+				mockClient.EXPECT().GetAppInstallation(mock.Anything, "456").Return(AppInstallation{}, assert.AnError)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mockFactory := NewMockGithubFactory(t)
+			if tt.setupMock != nil {
+				tt.setupMock(mockFactory)
+			}
+
+			conn := NewConnection(tt.connection, mockFactory)
+			err := conn.Validate(context.Background())
+			if tt.wantErr {
+				assert.Error(t, err)
+				for _, msg := range tt.errMsgContains {
+					assert.Contains(t, err.Error(), msg)
+				}
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

apps/provisioning/pkg/connection/github/extra.go

@@ -0,0 +1,36 @@
+package github
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/grafana/grafana-app-sdk/logging"
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
+)
+
+type extra struct {
+	factory GithubFactory
+}
+
+func (e *extra) Type() provisioning.ConnectionType {
+	return provisioning.GithubConnectionType
+}
+
+func (e *extra) Build(ctx context.Context, connection *provisioning.Connection) (connection.Connection, error) {
+	logger := logging.FromContext(ctx)
+	if connection == nil || connection.Spec.GitHub == nil {
+		logger.Error("connection is nil or github info is nil")
+
+		return nil, fmt.Errorf("invalid github connection")
+	}
+
+	c := NewConnection(connection, e.factory)
+	return &c, nil
+}
+
+func Extra(factory GithubFactory) connection.Extra {
+	return &extra{
+		factory: factory,
+	}
+}

apps/provisioning/pkg/connection/github/extra_test.go

@@ -0,0 +1,126 @@
+package github_test
+
+import (
+	"context"
+	"testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection/github"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestExtra_Type(t *testing.T) {
+	t.Run("should return GithubConnectionType", func(t *testing.T) {
+		mockFactory := github.NewMockGithubFactory(t)
+		e := github.Extra(mockFactory)
+		result := e.Type()
+		assert.Equal(t, provisioning.GithubConnectionType, result)
+	})
+}
+
+func TestExtra_Build(t *testing.T) {
+	t.Run("should successfully build connection", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Create: common.NewSecretValue("test-private-key"),
+				},
+			},
+		}
+
+		mockFactory := github.NewMockGithubFactory(t)
+
+		e := github.Extra(mockFactory)
+
+		result, err := e.Build(ctx, conn)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+	})
+
+	t.Run("should handle different connection configurations", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "another-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "789",
+					InstallationID: "101112",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				PrivateKey: common.InlineSecureValue{
+					Name: "existing-private-key",
+				},
+				Token: common.InlineSecureValue{
+					Name: "existing-token",
+				},
+			},
+		}
+
+		mockFactory := github.NewMockGithubFactory(t)
+
+		e := github.Extra(mockFactory)
+
+		result, err := e.Build(ctx, conn)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+	})
+
+	t.Run("should build connection with background context", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+		}
+
+		mockFactory := github.NewMockGithubFactory(t)
+		e := github.Extra(mockFactory)
+		result, err := e.Build(ctx, conn)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+	})
+
+	t.Run("should always pass empty token to factory.New", func(t *testing.T) {
+		ctx := context.Background()
+		conn := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
+			Spec: provisioning.ConnectionSpec{
+				Type: provisioning.GithubConnectionType,
+				GitHub: &provisioning.GitHubConnectionConfig{
+					AppID:          "123",
+					InstallationID: "456",
+				},
+			},
+			Secure: provisioning.ConnectionSecure{
+				Token: common.InlineSecureValue{
+					Create: common.NewSecretValue("some-token"),
+				},
+			},
+		}
+
+		mockFactory := github.NewMockGithubFactory(t)
+		e := github.Extra(mockFactory)
+		result, err := e.Build(ctx, conn)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+	})
+}

apps/provisioning/pkg/connection/github/factory.go

@@ -0,0 +1,39 @@
+package github
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/google/go-github/v70/github"
+	"golang.org/x/oauth2"
+
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+)
+
+// Factory creates new GitHub clients.
+// It exists only for the ability to test the code easily.
+type Factory struct {
+	// Client allows overriding the client to use in the GH client returned. It exists primarily for testing.
+	// FIXME: we should replace in this way. We should add some options pattern for the factory.
+	Client *http.Client
+}
+
+func ProvideFactory() GithubFactory {
+	return &Factory{}
+}
+
+func (r *Factory) New(ctx context.Context, ghToken common.RawSecureValue) Client {
+	if r.Client != nil {
+		return NewClient(github.NewClient(r.Client))
+	}
+
+	if !ghToken.IsZero() {
+		tokenSrc := oauth2.StaticTokenSource(
+			&oauth2.Token{AccessToken: string(ghToken)},
+		)
+		tokenClient := oauth2.NewClient(ctx, tokenSrc)
+		return NewClient(github.NewClient(tokenClient))
+	}
+
+	return NewClient(github.NewClient(&http.Client{}))
+}

apps/provisioning/pkg/connection/github/factory_mock.go

@@ -0,0 +1,86 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package github
+
+import (
+	context "context"
+
+	v0alpha1 "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockGithubFactory is an autogenerated mock type for the GithubFactory type
+type MockGithubFactory struct {
+	mock.Mock
+}
+
+type MockGithubFactory_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockGithubFactory) EXPECT() *MockGithubFactory_Expecter {
+	return &MockGithubFactory_Expecter{mock: &_m.Mock}
+}
+
+// New provides a mock function with given fields: ctx, ghToken
+func (_m *MockGithubFactory) New(ctx context.Context, ghToken v0alpha1.RawSecureValue) Client {
+	ret := _m.Called(ctx, ghToken)
+
+	if len(ret) == 0 {
+		panic("no return value specified for New")
+	}
+
+	var r0 Client
+	if rf, ok := ret.Get(0).(func(context.Context, v0alpha1.RawSecureValue) Client); ok {
+		r0 = rf(ctx, ghToken)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(Client)
+		}
+	}
+
+	return r0
+}
+
+// MockGithubFactory_New_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'New'
+type MockGithubFactory_New_Call struct {
+	*mock.Call
+}
+
+// New is a helper method to define mock.On call
+//   - ctx context.Context
+//   - ghToken v0alpha1.RawSecureValue
+func (_e *MockGithubFactory_Expecter) New(ctx interface{}, ghToken interface{}) *MockGithubFactory_New_Call {
+	return &MockGithubFactory_New_Call{Call: _e.mock.On("New", ctx, ghToken)}
+}
+
+func (_c *MockGithubFactory_New_Call) Run(run func(ctx context.Context, ghToken v0alpha1.RawSecureValue)) *MockGithubFactory_New_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(v0alpha1.RawSecureValue))
+	})
+	return _c
+}
+
+func (_c *MockGithubFactory_New_Call) Return(_a0 Client) *MockGithubFactory_New_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockGithubFactory_New_Call) RunAndReturn(run func(context.Context, v0alpha1.RawSecureValue) Client) *MockGithubFactory_New_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockGithubFactory creates a new instance of MockGithubFactory. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockGithubFactory(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockGithubFactory {
+	mock := &MockGithubFactory{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

apps/provisioning/pkg/connection/mutator.go

@@ -1,28 +0,0 @@
-package connection
-
-import (
-	"fmt"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-)
-
-const (
-	githubInstallationURL = "https://github.com/settings/installations"
-)
-
-func MutateConnection(connection *provisioning.Connection) error {
-	switch connection.Spec.Type {
-	case provisioning.GithubConnectionType:
-		// Do nothing in case spec.Github is nil.
-		// If this field is required, we should fail at validation time.
-		if connection.Spec.GitHub == nil {
-			return nil
-		}
-
-		connection.Spec.URL = fmt.Sprintf("%s/%s", githubInstallationURL, connection.Spec.GitHub.InstallationID)
-		return nil
-	default:
-		// TODO: we need to setup the URL for bitbucket and gitlab.
-		return nil
-	}
-}

apps/provisioning/pkg/connection/mutator_test.go

@@ -1,35 +0,0 @@
-package connection_test
-
-import (
-	"testing"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
-	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-func TestMutateConnection(t *testing.T) {
-	t.Run("should add URL to Github connection", func(t *testing.T) {
-		c := &provisioning.Connection{
-			ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-			Spec: provisioning.ConnectionSpec{
-				Type: provisioning.GithubConnectionType,
-				GitHub: &provisioning.GitHubConnectionConfig{
-					AppID:          "123",
-					InstallationID: "456",
-				},
-			},
-			Secure: provisioning.ConnectionSecure{
-				PrivateKey: common.InlineSecureValue{
-					Name: "test-private-key",
-				},
-			},
-		}
-
-		require.NoError(t, connection.MutateConnection(c))
-		assert.Equal(t, "https://github.com/settings/installations/456", c.Spec.URL)
-	})
-}

apps/provisioning/pkg/connection/validator.go

@@ -1,104 +0,0 @@
-package connection
-
-import (
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-)
-
-func ValidateConnection(connection *provisioning.Connection) error {
-	list := field.ErrorList{}
-
-	if connection.Spec.Type == "" {
-		list = append(list, field.Required(field.NewPath("spec", "type"), "type must be specified"))
-	}
-
-	switch connection.Spec.Type {
-	case provisioning.GithubConnectionType:
-		list = append(list, validateGithubConnection(connection)...)
-	case provisioning.BitbucketConnectionType:
-		list = append(list, validateBitbucketConnection(connection)...)
-	case provisioning.GitlabConnectionType:
-		list = append(list, validateGitlabConnection(connection)...)
-	default:
-		list = append(
-			list, field.NotSupported(
-				field.NewPath("spec", "type"),
-				connection.Spec.Type,
-				[]provisioning.ConnectionType{
-					provisioning.GithubConnectionType,
-					provisioning.BitbucketConnectionType,
-					provisioning.GitlabConnectionType,
-				}),
-		)
-	}
-
-	return toError(connection.GetName(), list)
-}
-
-func validateGithubConnection(connection *provisioning.Connection) field.ErrorList {
-	list := field.ErrorList{}
-
-	if connection.Spec.GitHub == nil {
-		list = append(
-			list, field.Required(field.NewPath("spec", "github"), "github info must be specified for GitHub connection"),
-		)
-	}
-
-	if connection.Secure.PrivateKey.IsZero() {
-		list = append(list, field.Required(field.NewPath("secure", "privateKey"), "privateKey must be specified for GitHub connection"))
-	}
-	if !connection.Secure.ClientSecret.IsZero() {
-		list = append(list, field.Forbidden(field.NewPath("secure", "clientSecret"), "clientSecret is forbidden in GitHub connection"))
-	}
-
-	return list
-}
-
-func validateBitbucketConnection(connection *provisioning.Connection) field.ErrorList {
-	list := field.ErrorList{}
-
-	if connection.Spec.Bitbucket == nil {
-		list = append(
-			list, field.Required(field.NewPath("spec", "bitbucket"), "bitbucket info must be specified in Bitbucket connection"),
-		)
-	}
-	if connection.Secure.ClientSecret.IsZero() {
-		list = append(list, field.Required(field.NewPath("secure", "clientSecret"), "clientSecret must be specified for Bitbucket connection"))
-	}
-	if !connection.Secure.PrivateKey.IsZero() {
-		list = append(list, field.Forbidden(field.NewPath("secure", "privateKey"), "privateKey is forbidden in Bitbucket connection"))
-	}
-
-	return list
-}
-
-func validateGitlabConnection(connection *provisioning.Connection) field.ErrorList {
-	list := field.ErrorList{}
-
-	if connection.Spec.Gitlab == nil {
-		list = append(
-			list, field.Required(field.NewPath("spec", "gitlab"), "gitlab info must be specified in Gitlab connection"),
-		)
-	}
-	if connection.Secure.ClientSecret.IsZero() {
-		list = append(list, field.Required(field.NewPath("secure", "clientSecret"), "clientSecret must be specified for Gitlab connection"))
-	}
-	if !connection.Secure.PrivateKey.IsZero() {
-		list = append(list, field.Forbidden(field.NewPath("secure", "privateKey"), "privateKey is forbidden in Gitlab connection"))
-	}
-
-	return list
-}
-
-// toError converts a field.ErrorList to an error, returning nil if the list is empty
-func toError(name string, list field.ErrorList) error {
-	if len(list) == 0 {
-		return nil
-	}
-	return apierrors.NewInvalid(
-		provisioning.ConnectionResourceInfo.GroupVersionKind().GroupKind(),
-		name,
-		list,
-	)
-}

apps/provisioning/pkg/connection/validator_test.go

@@ -1,253 +0,0 @@
-package connection_test
-
-import (
-	"testing"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
-	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
-	"github.com/stretchr/testify/assert"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-func TestValidateConnection(t *testing.T) {
-	tests := []struct {
-		name       string
-		connection *provisioning.Connection
-		wantErr    bool
-		errMsg     string
-	}{
-		{
-			name: "empty type returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec:       provisioning.ConnectionSpec{},
-			},
-			wantErr: true,
-			errMsg:  "spec.type",
-		},
-		{
-			name: "invalid type returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: "invalid",
-				},
-			},
-			wantErr: true,
-			errMsg:  "spec.type",
-		},
-		{
-			name: "github type without github config returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GithubConnectionType,
-				},
-			},
-			wantErr: true,
-			errMsg:  "spec.github",
-		},
-		{
-			name: "github type without private key returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GithubConnectionType,
-					GitHub: &provisioning.GitHubConnectionConfig{
-						AppID:          "123",
-						InstallationID: "456",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.privateKey",
-		},
-		{
-			name: "github type with client secret returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GithubConnectionType,
-					GitHub: &provisioning.GitHubConnectionConfig{
-						AppID:          "123",
-						InstallationID: "456",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					PrivateKey: common.InlineSecureValue{
-						Name: "test-private-key",
-					},
-					ClientSecret: common.InlineSecureValue{
-						Name: "test-client-secret",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.clientSecret",
-		},
-		{
-			name: "github type with github config is valid",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GithubConnectionType,
-					GitHub: &provisioning.GitHubConnectionConfig{
-						AppID:          "123",
-						InstallationID: "456",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					PrivateKey: common.InlineSecureValue{
-						Name: "test-private-key",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "bitbucket type without bitbucket config returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.BitbucketConnectionType,
-				},
-			},
-			wantErr: true,
-			errMsg:  "spec.bitbucket",
-		},
-		{
-			name: "bitbucket type without client secret returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.BitbucketConnectionType,
-					Bitbucket: &provisioning.BitbucketConnectionConfig{
-						ClientID: "client-123",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.clientSecret",
-		},
-		{
-			name: "bitbucket type with private key returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.BitbucketConnectionType,
-					Bitbucket: &provisioning.BitbucketConnectionConfig{
-						ClientID: "client-123",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					PrivateKey: common.InlineSecureValue{
-						Name: "test-private-key",
-					},
-					ClientSecret: common.InlineSecureValue{
-						Name: "test-client-secret",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.privateKey",
-		},
-		{
-			name: "bitbucket type with bitbucket config is valid",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.BitbucketConnectionType,
-					Bitbucket: &provisioning.BitbucketConnectionConfig{
-						ClientID: "client-123",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					ClientSecret: common.InlineSecureValue{
-						Name: "test-client-secret",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "gitlab type without gitlab config returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GitlabConnectionType,
-				},
-			},
-			wantErr: true,
-			errMsg:  "spec.gitlab",
-		},
-		{
-			name: "gitlab type without client secret returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GitlabConnectionType,
-					Gitlab: &provisioning.GitlabConnectionConfig{
-						ClientID: "client-456",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.clientSecret",
-		},
-		{
-			name: "gitlab type with private key returns error",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GitlabConnectionType,
-					Gitlab: &provisioning.GitlabConnectionConfig{
-						ClientID: "client-456",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					PrivateKey: common.InlineSecureValue{
-						Name: "test-private-key",
-					},
-					ClientSecret: common.InlineSecureValue{
-						Name: "test-client-secret",
-					},
-				},
-			},
-			wantErr: true,
-			errMsg:  "secure.privateKey",
-		},
-		{
-			name: "gitlab type with gitlab config is valid",
-			connection: &provisioning.Connection{
-				ObjectMeta: metav1.ObjectMeta{Name: "test-connection"},
-				Spec: provisioning.ConnectionSpec{
-					Type: provisioning.GitlabConnectionType,
-					Gitlab: &provisioning.GitlabConnectionConfig{
-						ClientID: "client-456",
-					},
-				},
-				Secure: provisioning.ConnectionSecure{
-					ClientSecret: common.InlineSecureValue{
-						Name: "test-client-secret",
-					},
-				},
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := connection.ValidateConnection(tt.connection)
-			if tt.wantErr {
-				assert.Error(t, err)
-				if tt.errMsg != "" {
-					assert.Contains(t, err.Error(), tt.errMsg)
-				}
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}

apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/connectionsecure.go

@@ -13,7 +13,7 @@ import (
 type ConnectionSecureApplyConfiguration struct {
 	PrivateKey   *commonv0alpha1.InlineSecureValue `json:"privateKey,omitempty"`
 	ClientSecret *commonv0alpha1.InlineSecureValue `json:"clientSecret,omitempty"`
-	Token        *commonv0alpha1.InlineSecureValue `json:"webhook,omitempty"`
+	Token        *commonv0alpha1.InlineSecureValue `json:"token,omitempty"`
 }
 
 // ConnectionSecureApplyConfiguration constructs a declarative configuration of the ConnectionSecure type for use with

docs/sources/administration/plugin-management/plugin-sign.md

@@ -25,7 +25,7 @@ Plugin signature verification, also known as _signing_, is a security measure to
 
 Learn more at [plugin policies](https://grafana.com/legal/plugins/).
 
-## How does verifiction work?
+## How does verification work?
 
 At startup, Grafana verifies the signatures of every plugin in the plugin directory.
 

docs/sources/datasources/mssql/_index.md

@@ -99,12 +99,27 @@ refs:
       destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/#query-and-resource-caching
     - pattern: /docs/grafana-cloud/
       destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/#query-and-resource-caching
+  mssql-troubleshoot:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/troubleshooting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/troubleshooting/
+  postgres:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/postgres/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/postgres/
+  mysql:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/
 ---
 
 # Microsoft SQL Server (MSSQL) data source
 
 Grafana ships with built-in support for Microsoft SQL Server (MSSQL).
-You can query and visualize data from any Microsoft SQL Server 2005 or newer, including the Microsoft Azure SQL Database.
+You can query and visualize data from any Microsoft SQL Server 2005 or newer, including Microsoft Azure SQL Database.
 
 Use this data source to create dashboards, explore SQL data, and monitor MSSQL-based workloads in real time.
 
@@ -113,10 +128,33 @@ The following documentation helps you get started working with the Microsoft SQL
 - [Configure the Microsoft SQL Server data source](ref:configure-mssql-data-source)
 - [Microsoft SQL Server query editor](ref:mssql-query-editor)
 - [Microsoft SQL Server template variables](ref:mssql-template-variables)
+- [Troubleshoot Microsoft SQL Server data source issues](ref:mssql-troubleshoot)
 
-## Get the most out of the data source
+## Supported versions
 
-After installing and configuring the Microsoft SQL Server data source, you can:
+This data source supports the following Microsoft SQL Server versions:
+
+- Microsoft SQL Server 2005 and newer
+- Microsoft Azure SQL Database
+- Azure SQL Managed Instance
+
+Grafana recommends using the latest available service pack for your SQL Server version for optimal compatibility.
+
+## Key capabilities
+
+The Microsoft SQL Server data source supports:
+
+- **Time series queries:** Visualize metrics over time using the built-in time grouping macros.
+- **Table queries:** Display query results in table format for any valid SQL query.
+- **Template variables:** Create dynamic dashboards with variable-driven queries.
+- **Annotations:** Overlay events from SQL Server on your dashboard graphs.
+- **Alerting:** Create alerts based on SQL Server query results.
+- **Stored procedures:** Execute stored procedures and visualize results.
+- **Macros:** Simplify queries with built-in macros for time filtering and grouping.
+
+## Additional resources
+
+After configuring the Microsoft SQL Server data source, you can:
 
 - Create a wide variety of [visualizations](ref:visualizations)
 - Configure and use [templates and variables](ref:variables)
@@ -124,3 +162,8 @@ After installing and configuring the Microsoft SQL Server data source, you can:
 - Add [annotations](ref:annotate-visualizations)
 - Set up [alerting](ref:alerting)
 - Optimize performance with [query caching](ref:query-caching)
+
+## Related data sources
+
+- [PostgreSQL](ref:postgres) - For PostgreSQL databases.
+- [MySQL](ref:mysql) - For MySQL and MariaDB databases.

docs/sources/datasources/mssql/configure/index.md

@@ -89,6 +89,26 @@ refs:
       destination: /docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-access/configure-authentication/azuread/#enable-azure-ad-oauth-in-grafana
     - pattern: /docs/grafana-cloud/
       destination: /docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-access/configure-authentication/azuread/#enable-azure-ad-oauth-in-grafana
+  mssql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/query-editor/
+  mssql-template-variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/template-variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/template-variables/
+  alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/
+  mssql-troubleshoot:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/troubleshooting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/troubleshooting/
 ---
 
 # Configure the Microsoft SQL Server data source
@@ -97,13 +117,28 @@ This document provides instructions for configuring the Microsoft SQL Server dat
 
 ## Before you begin
 
-- Grafana comes with a built-in MSSQL data source plugin, eliminating the need to install a plugin.
+Before configuring the Microsoft SQL Server data source, ensure you have the following:
 
-- You must have the `Organization administrator` role to configure the MSSQL data source. Organization administrators can also [configure the data source via YAML](#provision-the-data-source) with the Grafana provisioning system.
+- **Grafana permissions:** You must have the `Organization administrator` role to configure data sources. Organization administrators can also [configure the data source via YAML](#provision-the-data-source) with the Grafana provisioning system.
 
-- Familiarize yourself with your MSSQL security configuration and gather any necessary security certificates and client keys.
+- **A running SQL Server instance:** Microsoft SQL Server 2005 or newer, Azure SQL Database, or Azure SQL Managed Instance.
 
-- Verify that data from MSSQL is being written to your Grafana instance.
+- **Network access:** Grafana must be able to reach your SQL Server. The default port is `1433`.
+
+- **Authentication credentials:** Depending on your authentication method, you need one of:
+  - SQL Server login credentials (username and password).
+  - Windows/Kerberos credentials and configuration (not supported in Grafana Cloud).
+  - Azure Entra ID app registration or managed identity.
+
+- **Security certificates:** If using encrypted connections, gather any necessary TLS/SSL certificates.
+
+{{< admonition type="note" >}}
+Grafana ships with a built-in Microsoft SQL Server data source plugin. No additional installation is required.
+{{< /admonition >}}
+
+{{< admonition type="tip" >}}
+**Grafana Cloud users:** If your SQL Server is in a private network, you can configure [Private data source connect](ref:private-data-source-connect) to establish connectivity.
+{{< /admonition >}}
 
 ## Add the MSSQL data source
 
@@ -382,3 +417,48 @@ datasources:
     secureJsonData:
       password: 'Password!'
 ```
+
+### Configure with Terraform
+
+You can configure the Microsoft SQL Server data source using [Terraform](https://www.terraform.io/) with the [Grafana Terraform provider](https://registry.terraform.io/providers/grafana/grafana/latest/docs).
+
+For more information about provisioning resources with Terraform, refer to the [Grafana as code using Terraform](https://grafana.com/docs/grafana-cloud/developer-resources/infrastructure-as-code/terraform/) documentation.
+
+#### Terraform example
+
+The following example creates a basic Microsoft SQL Server data source:
+
+```hcl
+resource "grafana_data_source" "mssql" {
+  name = "MSSQL"
+  type = "mssql"
+  url  = "localhost:1433"
+  user = "grafana"
+
+  json_data_encoded = jsonencode({
+    database           = "grafana"
+    maxOpenConns       = 100
+    maxIdleConns       = 100
+    maxIdleConnsAuto   = true
+    connMaxLifetime    = 14400
+    connectionTimeout  = 0
+    encrypt            = "false"
+  })
+
+  secure_json_data_encoded = jsonencode({
+    password = "Password!"
+  })
+}
+```
+
+For all available configuration options, refer to the [Grafana provider data source resource documentation](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/data_source).
+
+## Next steps
+
+After configuring your Microsoft SQL Server data source, you can:
+
+- [Write queries](ref:mssql-query-editor) using the query editor to explore and visualize your data
+- [Create template variables](ref:mssql-template-variables) to build dynamic, reusable dashboards
+- [Add annotations](ref:annotate-visualizations) to overlay SQL Server events on your graphs
+- [Set up alerting](ref:alerting) to create alert rules based on your SQL Server data
+- [Troubleshoot issues](ref:mssql-troubleshoot) if you encounter problems with your data source

docs/sources/datasources/mssql/troubleshooting/index.md

@@ -0,0 +1,333 @@
+---
+description: Troubleshoot common problems with the Microsoft SQL Server data source in Grafana
+keywords:
+  - grafana
+  - MSSQL
+  - Microsoft
+  - SQL
+  - troubleshooting
+  - errors
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Troubleshooting
+title: Troubleshoot Microsoft SQL Server data source issues
+weight: 400
+refs:
+  configure-mssql-data-source:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/configure/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/configure/
+  mssql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/query-editor/
+  private-data-source-connect:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/
+---
+
+# Troubleshoot Microsoft SQL Server data source issues
+
+This document provides solutions to common issues you may encounter when configuring or using the Microsoft SQL Server (MSSQL) data source in Grafana.
+
+## Connection errors
+
+These errors occur when Grafana cannot establish or maintain a connection to the Microsoft SQL Server.
+
+### Unable to connect to the server
+
+**Error message:** "Unable to open tcp connection" or "dial tcp: connection refused"
+
+**Cause:** Grafana cannot establish a network connection to the SQL Server.
+
+**Solution:**
+
+1. Verify that the SQL Server is running and accessible.
+1. Check that the host and port are correct in the data source configuration. The default SQL Server port is `1433`.
+1. Ensure there are no firewall rules blocking the connection between Grafana and SQL Server.
+1. Verify that SQL Server is configured to allow remote connections.
+1. For Grafana Cloud, ensure you have configured [Private data source connect](ref:private-data-source-connect) if your SQL Server instance is not publicly accessible.
+
+### Connection timeout
+
+**Error message:** "Connection timed out" or "I/O timeout"
+
+**Cause:** The connection to SQL Server timed out before receiving a response.
+
+**Solution:**
+
+1. Check the network latency between Grafana and SQL Server.
+1. Verify that SQL Server is not overloaded or experiencing performance issues.
+1. Increase the **Connection timeout** setting in the data source configuration under **Additional settings**.
+1. Check if any network devices (load balancers, proxies) are timing out the connection.
+
+### Encryption-related connection failures
+
+**Error message:** "TLS handshake failed" or "certificate verify failed"
+
+**Cause:** There is a mismatch between the encryption settings in Grafana and what the SQL Server supports or requires.
+
+**Solution:**
+
+1. For older versions of SQL Server (2008, 2008R2), set the **Encrypt** option to **Disable** or **False** in the data source configuration.
+1. Verify that the SQL Server has a valid SSL certificate if encryption is enabled.
+1. Check that the certificate is trusted by the Grafana server.
+1. Ensure you're using the latest available service pack for your SQL Server version for optimal compatibility.
+
+### Named instance connection issues
+
+**Error message:** "Cannot connect to named instance" or connection fails when using instance name
+
+**Cause:** Grafana cannot resolve the SQL Server named instance.
+
+**Solution:**
+
+1. Use the format `hostname\instancename` or `hostname\instancename,port` in the **Host** field.
+1. Verify that the SQL Server Browser service is running on the SQL Server machine.
+1. If the Browser service is unavailable, specify the port number directly: `hostname,port`.
+1. Check that UDP port 1434 is open if using the SQL Server Browser service.
+
+## Authentication errors
+
+These errors occur when there are issues with authentication credentials or permissions.
+
+### Login failed for user
+
+**Error message:** "Login failed for user 'username'" or "Authentication failed"
+
+**Cause:** The authentication credentials are invalid or the user doesn't have permission to access the database.
+
+**Solution:**
+
+1. Verify that the username and password are correct.
+1. Check that the user exists in SQL Server and is enabled.
+1. Ensure the user has access to the specified database.
+1. For Windows Authentication, verify that the credentials are in the correct format (`DOMAIN\User`).
+1. Check that the SQL Server authentication mode allows the type of login you're using (SQL Server Authentication, Windows Authentication, or Mixed Mode).
+
+### Access denied to database
+
+**Error message:** "Cannot open database 'dbname' requested by the login"
+
+**Cause:** The authenticated user doesn't have permission to access the specified database.
+
+**Solution:**
+
+1. Verify that the database name is correct in the data source configuration.
+1. Ensure the user is mapped to the database with appropriate permissions.
+1. Grant at least `SELECT` permission on the required tables:
+
+   ```sql
+   USE [your_database]
+   GRANT SELECT ON dbo.YourTable TO [your_user]
+   ```
+
+1. Check that the user doesn't have any conflicting permissions from the public role.
+
+### Windows Authentication (Kerberos) issues
+
+**Error message:** "Kerberos authentication failed" or "Cannot initialize Kerberos"
+
+**Cause:** Kerberos configuration is incorrect or incomplete.
+
+**Solution:**
+
+1. Verify that the Kerberos configuration file (`krb5.conf`) path is correct in the data source settings.
+1. For keytab authentication, ensure the keytab file exists and is readable by Grafana.
+1. Check that the realm and KDC settings are correct in the Kerberos configuration.
+1. Verify DNS is correctly resolving the KDC servers.
+1. Ensure the service principal name (SPN) is registered for the SQL Server instance.
+
+{{< admonition type="note" >}}
+Kerberos authentication is not supported in Grafana Cloud.
+{{< /admonition >}}
+
+### Azure Entra ID authentication errors
+
+**Error message:** "AADSTS error codes" or "Azure AD authentication failed"
+
+**Cause:** Azure Entra ID (formerly Azure AD) authentication is misconfigured.
+
+**Solution:**
+
+1. For **App Registration** authentication:
+   - Verify the tenant ID, client ID, and client secret are correct.
+   - Ensure the app registration has been added as a user in the Azure SQL database.
+   - Check that the client secret hasn't expired.
+
+1. For **Managed Identity** authentication:
+   - Verify `managed_identity_enabled = true` is set in the Grafana server configuration.
+   - Ensure the managed identity has been added to the Azure SQL database.
+   - Confirm the Azure resource hosting Grafana has managed identity enabled.
+
+1. For **Current User** authentication:
+   - Ensure `user_identity_enabled = true` is set in the Grafana server configuration.
+   - Verify the app registration is configured to issue both Access Tokens and ID Tokens.
+   - Check that the required API permissions are configured (`user_impersonation` for Azure SQL).
+
+For detailed Azure authentication configuration, refer to [Configure the Microsoft SQL Server data source](ref:configure-mssql-data-source).
+
+## Query errors
+
+These errors occur when there are issues with query syntax or configuration.
+
+### Time column not found or invalid
+
+**Error message:** "Could not find time column" or time series visualization shows no data
+
+**Cause:** The query doesn't return a properly formatted `time` column for time series visualization.
+
+**Solution:**
+
+1. Ensure your query includes a column named `time` when using the **Time series** format.
+1. Use the `$__time()` macro to rename your date column: `$__time(your_date_column)`.
+1. Verify the time column is of a valid SQL date/time type (`datetime`, `datetime2`, `date`) or contains Unix epoch values.
+1. Ensure the result set is sorted by the time column using `ORDER BY`.
+
+### Macro expansion errors
+
+**Error message:** "Error parsing query" or macros appear unexpanded in the query
+
+**Cause:** Grafana macros are being used incorrectly.
+
+**Solution:**
+
+1. Verify macro syntax: use `$__timeFilter(column)` not `$_timeFilter(column)`.
+1. Macros don't work inside stored procedures—use explicit date parameters instead.
+1. Check that the column name passed to macros exists in your table.
+1. View the expanded query by clicking **Generated SQL** after running the query to debug macro expansion.
+
+### Timezone and time shift issues
+
+**Cause:** Time series data appears shifted or doesn't align with expected times.
+
+**Solution:**
+
+1. Store timestamps in UTC in your database to avoid timezone issues.
+1. Time macros (`$__time`, `$__timeFilter`, etc.) always expand to UTC values.
+1. If your timestamps are stored in local time, convert them to UTC in your query:
+
+   ```sql
+   SELECT
+     your_datetime_column AT TIME ZONE 'Your Local Timezone' AT TIME ZONE 'UTC' AS time,
+     value
+   FROM your_table
+   ```
+
+1. Don't pass timezone parameters to time macros—they're not supported.
+
+### Query returns too many rows
+
+**Error message:** "Result set too large" or browser becomes unresponsive
+
+**Cause:** The query returns more data than can be efficiently processed.
+
+**Solution:**
+
+1. Add time filters using `$__timeFilter(column)` to limit data to the dashboard time range.
+1. Use aggregations (`AVG`, `SUM`, `COUNT`) with `GROUP BY` instead of returning raw rows.
+1. Add a `TOP` clause to limit results: `SELECT TOP 1000 ...`.
+1. Use the `$__timeGroup()` macro to aggregate data into time intervals.
+
+### Stored procedure returns no data
+
+**Cause:** Stored procedure output isn't being captured correctly.
+
+**Solution:**
+
+1. Ensure the stored procedure uses `SELECT` statements, not just variable assignments.
+1. Remove `SET NOCOUNT ON` if present, or ensure it's followed by a `SELECT` statement.
+1. Verify the stored procedure parameters are being passed correctly.
+1. Test the stored procedure directly in SQL Server Management Studio with the same parameters.
+
+For more information on using stored procedures, refer to the [query editor documentation](ref:mssql-query-editor).
+
+## Performance issues
+
+These issues relate to slow queries or high resource usage.
+
+### Slow query execution
+
+**Cause:** Queries take a long time to execute.
+
+**Solution:**
+
+1. Reduce the dashboard time range to limit data volume.
+1. Add indexes to columns used in `WHERE` clauses and time filters.
+1. Use aggregations instead of returning individual rows.
+1. Increase the **Min time interval** setting to reduce the number of data points.
+1. Review the query execution plan in SQL Server Management Studio to identify bottlenecks.
+
+### Connection pool exhaustion
+
+**Error message:** "Too many connections" or "Connection pool exhausted"
+
+**Cause:** Too many concurrent connections to the database.
+
+**Solution:**
+
+1. Increase the **Max open** connection limit in the data source configuration.
+1. Enable **Auto max idle** to automatically manage idle connections.
+1. Reduce the number of panels querying the same data source simultaneously.
+1. Check for long-running queries that might be holding connections.
+
+## Other common issues
+
+The following issues don't produce specific error messages but are commonly encountered.
+
+### System databases appear in queries
+
+**Cause:** Queries accidentally access system databases.
+
+**Solution:**
+
+1. The query editor automatically excludes `tempdb`, `model`, `msdb`, and `master` from the database dropdown.
+1. Always specify the database in your data source configuration to restrict access.
+1. Ensure the database user only has permissions on the intended database.
+
+### Template variable queries fail
+
+**Cause:** Variable queries return unexpected results or errors.
+
+**Solution:**
+
+1. Verify the variable query syntax is valid SQL that returns a single column.
+1. Check that the data source connection is working.
+1. Ensure the user has permission to access the tables referenced in the variable query.
+1. Test the query in the query editor before using it as a variable query.
+
+### Data appears incorrect or misaligned
+
+**Cause:** Data formatting or type conversion issues.
+
+**Solution:**
+
+1. Use explicit column aliases to ensure consistent naming: `SELECT value AS metric`.
+1. Verify numeric columns are actually numeric types, not strings.
+1. Check for `NULL` values that might affect aggregations.
+1. Use the `FILL` option in `$__timeGroup()` macro to handle missing data points.
+
+## Get additional help
+
+If you continue to experience issues after following this troubleshooting guide:
+
+1. Check the [Grafana community forums](https://community.grafana.com/) for similar issues.
+1. Review the [Grafana GitHub issues](https://github.com/grafana/grafana/issues) for known bugs.
+1. Enable debug logging in Grafana to capture detailed error information.
+1. Check SQL Server logs for additional error details.
+1. Contact [Grafana Support](https://grafana.com/contact/) if you're an Enterprise or Cloud customer.
+
+When reporting issues, include:
+
+- Grafana version
+- SQL Server version
+- Error messages (redact sensitive information)
+- Steps to reproduce
+- Relevant query examples (redact sensitive data)

docs/sources/datasources/mysql/_index.md

@@ -17,52 +17,145 @@ menuTitle: MySQL
 title: MySQL data source
 weight: 1000
 refs:
-  annotate-visualizations:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
   configure-mysql-data-source:
     - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configuration/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configure/
     - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configuration/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configure/
   mysql-query-editor:
     - pattern: /docs/grafana/
       destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
     - pattern: /docs/grafana-cloud/
       destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
-  alerting:
+  troubleshoot-mysql:
     - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/troubleshooting/
     - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/troubleshooting/
+  mysql-template-variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
+  mysql-alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+  mysql-annotations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
   transformations:
     - pattern: /docs/grafana/
       destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/transform-data/
     - pattern: /docs/grafana-cloud/
       destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/transform-data/
+  visualizations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/visualizations/
+  variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/
+  query-caching:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/#query-and-resource-caching
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/#query-and-resource-caching
+  postgres:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/postgres/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/postgres/
+  mssql:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mssql/
 ---
 
 # MySQL data source
 
-Grafana ships with a built-in MySQL data source plugin that allows you to query and visualize data from a MySQL-compatible database like [MariaDB](https://mariadb.org/) or [Percona Server](https://www.percona.com/). You don't need to install a plugin in order to add the MySQL data source to your Grafana instance.
+Grafana ships with built-in support for MySQL.
+You can query and visualize data from MySQL-compatible databases like [MariaDB](https://mariadb.org/) or [Percona Server](https://www.percona.com/).
 
-Grafana offers several configuration options for this data source as well as a visual and code-based query editor.
+Use this data source to create dashboards, explore SQL data, and monitor MySQL-based workloads in real time.
 
-## Get started with the MySQL data source
+{{< docs/play title="MySQL Overview" url="https://play.grafana.org/d/edyh1ib7db6rkb/mysql-overview" >}}
 
-The following documents will help you get started with the MySQL data source in Grafana:
+## Supported databases
+
+This data source supports the following MySQL-compatible databases:
+
+- MySQL 5.7 and newer
+- MySQL 8.0 and newer
+- MariaDB 10.2 and newer
+- Percona Server 5.7 and newer
+- Amazon Aurora MySQL
+- Azure Database for MySQL
+- Google Cloud SQL for MySQL
+
+Grafana recommends using the latest available version for your database for optimal compatibility.
+
+## Key capabilities
+
+The MySQL data source supports:
+
+- **Time series queries:** Visualize metrics over time using built-in time grouping macros.
+- **Table queries:** Display query results in table format for any valid SQL query.
+- **Template variables:** Create dynamic dashboards with variable-driven queries.
+- **Annotations:** Overlay events from MySQL on your dashboard graphs.
+- **Alerting:** Create alerts based on MySQL query results.
+- **Macros:** Simplify queries with built-in macros for time filtering and grouping.
+
+## Get started
+
+The following documentation helps you get started with the MySQL data source:
 
 - [Configure the MySQL data source](ref:configure-mysql-data-source)
 - [MySQL query editor](ref:mysql-query-editor)
+- [MySQL template variables](ref:mysql-template-variables)
+- [MySQL annotations](ref:mysql-annotations)
+- [MySQL alerting](ref:mysql-alerting)
+- [Troubleshoot MySQL data source issues](ref:troubleshoot-mysql)
 
-Once you have configured the data source you can:
+## Additional resources
 
-- Add [annotations](ref:annotate-visualizations)
-- Set up [alerting](ref:alerting)
-- Add [transformations](ref:transformations)
+After configuring the MySQL data source, you can also:
 
-View a MySQL overview on Grafana Play:
+- Create a wide variety of [visualizations](ref:visualizations).
+- Configure and use [templates and variables](ref:variables).
+- Add [transformations](ref:transformations).
+- Optimize performance with [query caching](ref:query-caching).
 
-{{< docs/play title="MySQL Overview" url="https://play.grafana.org/d/edyh1ib7db6rkb/mysql-overview" >}}
+## Pre-configured dashboards
+
+If you want to monitor your MySQL server's performance metrics (connections, queries, replication, and more), Grafana provides pre-configured dashboards through the MySQL integration:
+
+- **MySQL Overview** - Key performance metrics for your MySQL server.
+- **MySQL Logs** - Log analysis for troubleshooting.
+
+The MySQL integration uses the Prometheus MySQL Exporter to collect server metrics and includes 15 pre-configured alert rules.
+
+To use these dashboards:
+
+1. In Grafana Cloud, navigate to **Connections** > **Add new connection**.
+1. Search for **MySQL** and select the MySQL integration.
+1. Follow the setup instructions to install the MySQL Exporter.
+1. Import the pre-configured dashboards from the integration page.
+
+For more MySQL dashboards, browse the [Grafana dashboard catalog](https://grafana.com/grafana/dashboards/?search=mysql).
+
+{{< admonition type="note" >}}
+The MySQL integration monitors your MySQL _server_ using Prometheus metrics. The MySQL _data source_ documented here queries data stored _in_ MySQL tables. These are complementary features for different use cases.
+{{< /admonition >}}
+
+## Related data sources
+
+- [PostgreSQL](ref:postgres) - For PostgreSQL databases.
+- [Microsoft SQL Server](ref:mssql) - For Microsoft SQL Server and Azure SQL databases.

docs/sources/datasources/mysql/alerting/index.md

@@ -0,0 +1,188 @@
+---
+description: Using Grafana Alerting with the MySQL data source
+keywords:
+  - grafana
+  - mysql
+  - alerting
+  - alerts
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Alerting
+title: MySQL alerting
+weight: 350
+refs:
+  alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/
+  create-alert-rule:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-grafana-managed-rule/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/create-grafana-managed-rule/
+  mysql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+---
+
+# MySQL alerting
+
+You can use Grafana Alerting with MySQL to create alerts based on your MySQL data. This allows you to monitor metrics, detect anomalies, and receive notifications when specific conditions are met.
+
+For general information about Grafana Alerting, refer to [Grafana Alerting](ref:alerting).
+
+## Before you begin
+
+Before creating alerts with MySQL, ensure you have:
+
+- A MySQL data source configured in Grafana.
+- Appropriate permissions to create alert rules.
+- Understanding of the metrics you want to monitor.
+
+## Supported query types
+
+MySQL alerting works with **time series queries** that return numeric data over time. Table formatted queries are not supported in alert rule conditions.
+
+To create a valid alert query:
+
+- Include a `time` column that returns a SQL datetime or UNIX epoch timestamp
+- Return numeric values for the metrics you want to alert on
+- Sort results by the time column
+
+For more information on writing time series queries, refer to [MySQL query editor](ref:mysql-query-editor).
+
+### Query format requirements
+
+| Query format | Alerting support | Notes                                    |
+| ------------ | ---------------- | ---------------------------------------- |
+| Time series  | Yes              | Required for alerting                    |
+| Table        | No               | Convert to time series format for alerts |
+
+## Create an alert rule
+
+To create an alert rule using MySQL:
+
+1. Navigate to **Alerting** > **Alert rules**.
+1. Click **New alert rule**.
+1. Enter a name for the alert rule.
+1. Select your **MySQL** data source.
+1. Build your query using the query editor:
+   - Set the **Format** to **Time series**
+   - Include a time column using the `$__time()` or `$__timeGroup()` macro
+   - Add numeric columns for the values to monitor
+   - Use `$__timeFilter()` to filter data by the dashboard time range
+1. Configure the alert condition (for example, when the average is above a threshold).
+1. Set the evaluation interval and pending period.
+1. Configure notifications and labels.
+1. Click **Save rule**.
+
+For detailed instructions, refer to [Create a Grafana-managed alert rule](ref:create-alert-rule).
+
+## Example alert queries
+
+The following examples show common alerting scenarios with MySQL.
+
+### Alert on high error count
+
+Monitor the number of errors over time:
+
+```sql
+SELECT
+  $__timeGroup(created_at, '1m') AS time,
+  COUNT(*) AS error_count
+FROM error_logs
+WHERE $__timeFilter(created_at)
+  AND level = 'error'
+GROUP BY time
+ORDER BY time
+```
+
+**Condition:** When error_count is above 100.
+
+### Alert on average response time
+
+Monitor API response times:
+
+```sql
+SELECT
+  $__timeGroup(request_time, '5m') AS time,
+  AVG(response_time_ms) AS avg_response_time
+FROM api_requests
+WHERE $__timeFilter(request_time)
+GROUP BY time
+ORDER BY time
+```
+
+**Condition:** When avg_response_time is above 500 (milliseconds).
+
+### Alert on low order volume
+
+Detect drops in order activity:
+
+```sql
+SELECT
+  $__timeGroup(order_date, '1h') AS time,
+  COUNT(*) AS order_count
+FROM orders
+WHERE $__timeFilter(order_date)
+GROUP BY time
+ORDER BY time
+```
+
+**Condition:** When order_count is below 10.
+
+### Alert on disk usage percentage
+
+Monitor database storage metrics:
+
+```sql
+SELECT
+  $__timeGroup(recorded_at, '5m') AS time,
+  AVG(disk_used_percent) AS disk_usage
+FROM system_metrics
+WHERE $__timeFilter(recorded_at)
+  AND metric_type = 'disk'
+GROUP BY time
+ORDER BY time
+```
+
+**Condition:** When disk_usage is above 85.
+
+## Limitations
+
+When using MySQL with Grafana Alerting, be aware of the following limitations:
+
+### Template variables not supported
+
+Alert queries cannot contain template variables. Grafana evaluates alert rules on the backend without dashboard context, so variables like `$hostname` or `$environment` won't be resolved.
+
+If your dashboard query uses template variables, create a separate query for alerting with hard coded values.
+
+### Table format not supported
+
+Queries using the **Table** format cannot be used for alerting. Set the query format to **Time series** and ensure your query returns a time column.
+
+### Query timeout
+
+Complex queries with large datasets may timeout during alert evaluation. Optimize queries for alerting by:
+
+- Adding appropriate `WHERE` clauses to limit data
+- Using indexes on time and filter columns
+- Reducing the time range evaluated
+
+## Best practices
+
+Follow these best practices when creating MySQL alerts:
+
+- **Use time series format:** Always set the query format to Time series for alert queries.
+- **Include time filters:** Use the `$__timeFilter()` macro to limit data to the evaluation window.
+- **Optimize queries:** Add indexes on columns used in `WHERE` clauses and `GROUP BY`.
+- **Test queries first:** Verify your query returns expected results in Explore before creating an alert.
+- **Set realistic thresholds:** Base alert thresholds on historical data patterns.
+- **Use meaningful names:** Give alert rules descriptive names that indicate what they monitor.

docs/sources/datasources/mysql/annotations/index.md

@@ -0,0 +1,163 @@
+---
+description: Using annotations with MySQL in Grafana
+keywords:
+  - grafana
+  - mysql
+  - annotations
+  - events
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Annotations
+title: MySQL annotations
+weight: 340
+refs:
+  annotate-visualizations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+---
+
+# MySQL annotations
+
+Annotations overlay event data on your dashboard graphs, helping you correlate events with metrics.
+You can use MySQL as a data source for annotations to display events such as deployments, alerts, or other significant occurrences on your visualizations.
+
+For general information about annotations, refer to [Annotate visualizations](ref:annotate-visualizations).
+
+## Before you begin
+
+Before creating MySQL annotations, ensure you have:
+
+- A MySQL data source configured in Grafana.
+- Tables containing event data with timestamp fields.
+- Read access to the tables containing your events.
+
+## Create an annotation query
+
+To add a MySQL annotation to your dashboard:
+
+1. Navigate to your dashboard and click **Dashboard settings** (gear icon).
+1. Select **Annotations** in the left menu.
+1. Click **Add annotation query**.
+1. Enter a **Name** for the annotation.
+1. Select your **MySQL** data source from the **Data source** drop-down.
+1. Write a SQL query that returns the required columns.
+1. Click **Save dashboard**.
+
+## Query columns
+
+Your annotation query must return a `time` column and can optionally include `timeend`, `text`, and `tags` columns.
+
+| Column    | Required | Description                                                                                   |
+| --------- | -------- | --------------------------------------------------------------------------------------------- |
+| `time`    | Yes      | The timestamp for the annotation. Can be a SQL datetime or UNIX epoch value.                  |
+| `timeend` | No       | The end timestamp for range annotations. Creates a shaded region instead of a vertical line.  |
+| `text`    | No       | The annotation description displayed when you hover over the annotation.                      |
+| `tags`    | No       | Tags for the annotation as a comma-separated string. Helps categorize and filter annotations. |
+
+## Example queries
+
+The following examples show common annotation query patterns.
+
+### Basic annotation with epoch time
+
+Display events using UNIX epoch timestamps:
+
+```sql
+SELECT
+  epoch_time as time,
+  description as text,
+  CONCAT(tag1, ',', tag2) as tags
+FROM events
+WHERE $__unixEpochFilter(epoch_time)
+```
+
+### Annotation with a single tag
+
+Display events with a single tag value:
+
+```sql
+SELECT
+  epoch_time as time,
+  message as text,
+  category as tags
+FROM event_log
+WHERE $__unixEpochFilter(epoch_time)
+```
+
+### Range annotation with start and end time
+
+Display events with duration as shaded regions:
+
+```sql
+SELECT
+  start_time as time,
+  end_time as timeend,
+  description as text,
+  CONCAT(type, ',', severity) as tags
+FROM incidents
+WHERE $__unixEpochFilter(start_time)
+```
+
+### Annotation with native SQL datetime
+
+Display events using native MySQL datetime columns:
+
+```sql
+SELECT
+  event_date as time,
+  message as text,
+  CONCAT(category, ',', priority) as tags
+FROM system_events
+WHERE $__timeFilter(event_date)
+```
+
+### Deployment annotations
+
+Display deployment events:
+
+```sql
+SELECT
+  deployed_at as time,
+  CONCAT('Deployed ', version, ' to ', environment) as text,
+  environment as tags
+FROM deployments
+WHERE $__timeFilter(deployed_at)
+```
+
+### Maintenance window annotations
+
+Display maintenance windows as range annotations:
+
+```sql
+SELECT
+  start_time as time,
+  end_time as timeend,
+  CONCAT('Maintenance: ', description) as text,
+  'maintenance' as tags
+FROM maintenance_windows
+WHERE $__timeFilter(start_time)
+```
+
+## Macros
+
+Use these macros in your annotation queries to filter by the dashboard time range:
+
+| Macro                        | Description                                                      |
+| ---------------------------- | ---------------------------------------------------------------- |
+| `$__timeFilter(column)`      | Filters by time range using a native SQL datetime column.        |
+| `$__unixEpochFilter(column)` | Filters by time range using a column with UNIX epoch timestamps. |
+
+## Best practices
+
+Follow these best practices when creating MySQL annotations:
+
+- **Use time filters:** Always include `$__timeFilter()` or `$__unixEpochFilter()` to limit results to the dashboard time range.
+- **Keep queries efficient:** Add indexes on time columns and filter columns to improve query performance.
+- **Use meaningful text:** Include descriptive information in the `text` column to make annotations useful.
+- **Organize with tags:** Use consistent tag values to categorize annotations and enable filtering.
+- **Test queries first:** Verify your query returns expected results in Explore before adding it as an annotation.

docs/sources/datasources/mysql/configure/_index.md

@@ -1,4 +1,6 @@
 ---
+aliases:
+  - ../configuration/
 description: This document provides instructions for configuring the MySQL data source and explains available configuration options.
 keywords:
   - grafana
@@ -10,7 +12,7 @@ labels:
     - cloud
     - enterprise
     - oss
-menuTitle: Configure the MySQL data source
+menuTitle: Configure
 title: Configure the MySQL data source
 weight: 10
 refs:
@@ -34,6 +36,41 @@ refs:
       destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
     - pattern: /docs/grafana-cloud/
       destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
+  mysql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+  annotate-visualizations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
+  alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/
+  mysql-alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+  mysql-annotations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
+  mysql-troubleshoot:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/troubleshooting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/troubleshooting/
+  mysql-template-variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
 ---
 
 # Configure the MySQL data source
@@ -42,24 +79,35 @@ This document provides instructions for configuring the MySQL data source and ex
 
 ## Before you begin
 
-You must have the `Organization administrator` role in order to configure the MySQL data source.
-Administrators can also [configure the data source via YAML](#provision-the-data-source) with Grafana's provisioning system.
+Before configuring the MySQL data source, ensure you have the following:
+
+- **Grafana permissions:** You must have the `Organization administrator` role to configure data sources. Organization administrators can also [configure the data source via YAML](#provision-the-data-source) with the Grafana provisioning system.
+
+- **A running MySQL instance:** MySQL 5.7 or newer, MariaDB 10.2 or newer, or a compatible MySQL-based database such as Percona Server.
+
+- **Network access:** Grafana must be able to reach your MySQL server. The default port is `3306`.
+
+- **Authentication credentials:** A MySQL user with at least `SELECT` permissions on the databases and tables you want to query.
+
+- **Security certificates:** If using encrypted connections, gather any necessary TLS/SSL certificates.
 
 {{< admonition type="note" >}}
-Grafana ships with the MySQL data source by default, so no additional installation is required.
+Grafana ships with a built-in MySQL data source plugin. No additional installation is required.
 {{< /admonition >}}
 
-{{< admonition type="caution" >}}
-When adding a data source, ensure the database user you specify has only `SELECT` permissions on the relevant database and tables. Grafana does not validate the safety of queries, which means they can include potentially harmful SQL statements, such as `USE otherdb;` or `DROP TABLE user;`, which could get executed.
-
-To minimize this risk, Grafana strongly recommends creating a dedicated MySQL user with restricted permissions.
+{{< admonition type="tip" >}}
+**Grafana Cloud users:** If your MySQL server is in a private network, you can configure [Private data source connect](https://grafana.com/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/) to establish connectivity.
 {{< /admonition >}}
 
-Example:
+### Database user permissions
+
+When adding a data source, ensure the database user you specify has only `SELECT` permissions on the relevant database and tables. Grafana doesn't validate the safety of queries, which means they can include potentially harmful SQL statements, such as `USE otherdb;` or `DROP TABLE user;`, which could get executed.
+
+To minimize this risk, Grafana strongly recommends creating a dedicated MySQL user with restricted permissions:
 
 ```sql
- CREATE USER 'grafanaReader' IDENTIFIED BY 'password';
- GRANT SELECT ON mydatabase.mytable TO 'grafanaReader';
+CREATE USER 'grafanaReader' IDENTIFIED BY 'password';
+GRANT SELECT ON mydatabase.mytable TO 'grafanaReader';
 ```
 
 Use wildcards (`*`) in place of a database or table if you want to grant access to more databases and tables.
@@ -213,3 +261,46 @@ datasources:
       tlsClientCert: ${GRAFANA_TLS_CLIENT_CERT}
       tlsCACert: ${GRAFANA_TLS_CA_CERT}
 ```
+
+## Configure with Terraform
+
+You can configure the MySQL data source using [Terraform](https://www.terraform.io/) with the [Grafana Terraform provider](https://registry.terraform.io/providers/grafana/grafana/latest/docs).
+
+For more information about provisioning resources with Terraform, refer to the [Grafana as code using Terraform](https://grafana.com/docs/grafana-cloud/developer-resources/infrastructure-as-code/terraform/) documentation.
+
+### Terraform example
+
+The following example creates a basic MySQL data source:
+
+```hcl
+resource "grafana_data_source" "mysql" {
+  name = "MySQL"
+  type = "mysql"
+  url  = "localhost:3306"
+  user = "grafana"
+
+  json_data_encoded = jsonencode({
+    database         = "grafana"
+    maxOpenConns     = 100
+    maxIdleConns     = 100
+    maxIdleConnsAuto = true
+    connMaxLifetime  = 14400
+  })
+
+  secure_json_data_encoded = jsonencode({
+    password = "password"
+  })
+}
+```
+
+For all available configuration options, refer to the [Grafana provider data source resource documentation](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/data_source).
+
+## Next steps
+
+After configuring your MySQL data source, you can:
+
+- [Write queries](ref:mysql-query-editor) using the query editor to explore and visualize your data.
+- [Use template variables](ref:mysql-template-variables) to create dynamic, reusable dashboards.
+- [Add annotations](ref:mysql-annotations) to overlay MySQL events on your graphs.
+- [Set up alerting](ref:mysql-alerting) to create alert rules based on your MySQL data.
+- [Troubleshoot issues](ref:mysql-troubleshoot) if you encounter problems with your data source.

docs/sources/datasources/mysql/query-editor/_index.md

@@ -9,7 +9,7 @@ labels:
     - cloud
     - enterprise
     - oss
-menuTitle: MySQL query editor
+menuTitle: Query editor
 title: MySQL query editor
 weight: 30
 refs:
@@ -61,6 +61,21 @@ refs:
   configure-standard-options:
     - pattern: /docs/grafana/
     - destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/
+  mysql-template-variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/template-variables/
+  mysql-alerting:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/alerting/
+  mysql-annotations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/annotations/
 ---
 
 # MySQL query editor
@@ -305,171 +320,20 @@ Table panel result:
 
 The query returns multiple columns representing minimum and maximum values within the defined range.
 
-## Templating
+## Template variables
 
-Instead of hardcoding values like server, application, or sensor names in your metric queries, you can use variables. Variables appear as drop-down select boxes at the top of the dashboard. These drop-downs make it easy to change the data being displayed in your dashboard.
+Instead of hard-coding values like server, application, or sensor names in your metric queries, you can use variables. Variables appear as drop-down select boxes at the top of the dashboard, making it easy to change the data displayed in your dashboard.
 
-Refer to [Templates](ref:variables) for an introduction to creating template variables as well as the different types.
-
-### Query variable
-
-If you add a `Query` template variable you can write a MySQL query to retrieve items such as measurement names, key names, or key values, which will be displayed in the drop-down menu.
-
-For example, you can use a variable to retrieve all the values from the `hostname` column in a table by creating the following query in the templating variable _Query_ setting.
-
-```sql
-SELECT hostname FROM my_host
-```
-
-A query can return multiple columns, and Grafana will automatically generate a list based on the query results. For example, the following query returns a list with values from `hostname` and `hostname2`.
-
-```sql
-SELECT my_host.hostname, my_other_host.hostname2 FROM my_host JOIN my_other_host ON my_host.city = my_other_host.city
-```
-
-To use time range dependent macros like `$__timeFilter(column)` in your query,you must set the template variable's refresh mode to _On Time Range Change_.
-
-```sql
-SELECT event_name FROM event_log WHERE $__timeFilter(time_column)
-```
-
-Another option is a query that can create a key/value variable. The query should return two columns that are named `__text` and `__value`. The `__text` column must contain unique values (if not, only the first value is used). This allows the drop-down options to display a text-friendly name as the text while using an ID as the value. For example, a query could use `hostname` as the text and `id` as the value:
-
-```sql
-SELECT hostname AS __text, id AS __value FROM my_host
-```
-
-You can also create nested variables. For example, if you have a variable named `region`, you can configure the `hosts` variable to display only the hosts within the currently selected region as shown in the following example. If `region` is a multi-value variable, use the `IN` operator instead of `=` to match multiple values.
-
-```sql
-SELECT hostname FROM my_host  WHERE region IN($region)
-```
-
-#### Use `__searchFilter` to filter results in a query variable
-
-Using `__searchFilter` in the query field allows the query results to be filtered based on the user’s input in the drop-down selection box. If you do not enter anything, the default value for `__searchFilter` is %
-
-Note that you must enclose the `__searchFilter` expression in quotes as Grafana does not add them automatically.
-
-The following example demonstrates how to use `__searchFilter` in the query field to enable real-time searching for `hostname` as the user type in the drop-down selection box.
-
-```sql
-SELECT hostname FROM my_host  WHERE hostname LIKE '$__searchFilter'
-```
-
-### Using variables in queries
-
-Template variable values are only quoted when the template variable is a `multi-value`.
-
-If the variable is a multi-value variable, use the `IN` comparison operator instead of `=` to match against multiple values.
-
-You can use two different syntaxes:
-
-`$<varname>` Example with a template variable named `hostname`:
-
-```sql
-SELECT
-  UNIX_TIMESTAMP(atimestamp) as time,
-  aint as value,
-  avarchar as metric
-FROM my_table
-WHERE $__timeFilter(atimestamp) and hostname in($hostname)
-ORDER BY atimestamp ASC
-```
-
-`[[varname]]` Example with a template variable named `hostname`:
-
-```sql
-SELECT
-  UNIX_TIMESTAMP(atimestamp) as time,
-  aint as value,
-  avarchar as metric
-FROM my_table
-WHERE $__timeFilter(atimestamp) and hostname in([[hostname]])
-ORDER BY atimestamp ASC
-```
-
-#### Disabling quoting for multi-value variables
-
-Grafana automatically creates a quoted, comma-separated string for multi-value variables. For example: if `server01` and `server02` are selected then it will be formatted as: `'server01', 'server02'`. To disable quoting, use the csv formatting option for variables:
-
-Grafana automatically formats multi-value variables as a quoted, comma-separated string. For example, if `server01` and `server02` are selected, they are formatted as `'server01'`, `'server02'`. To remove the quotes, enable the CSV formatting option for the variables.
-
-`${servers:csv}`
-
-Read more about variable formatting options in the [Variables](ref:variable-syntax-advanced-variable-format-options) documentation.
+For detailed information on using template variables with MySQL, refer to [MySQL template variables](ref:mysql-template-variables).
 
 ## Annotations
 
-[Annotations](ref:annotate-visualizations) allow you to overlay rich event information on top of graphs. You add annotation queries via the **Dashboard settings > Annotations view**.
+Annotations allow you to overlay event information on your graphs, helping you correlate events with metrics. You can write SQL queries that return event data to display as annotations on your dashboards.
 
-**Example query using a`time` column with epoch values:**
-
-```sql
-SELECT
-  epoch_time as time,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__unixEpochFilter(epoch_time)
-```
-
-You may use one or more tags to show them as annotations in a common-separate string.
-
-**Example query using a `time` column with epoch values for a single tag:**
-
-```sql
-SELECT
-  epoch_time as time,
-  metric1 as text,
-  tag1 as tag
-FROM
-  my_data
-WHERE
-  $__unixEpochFilter(epoch_time)
-```
-
-**Example region query using `time` and `timeend` columns with epoch values:**
-
-```sql
-SELECT
-  epoch_time as time,
-  epoch_timeend as timeend,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__unixEpochFilter(epoch_time)
-```
-
-**Example query using a `time` column with a native SQL date/time data type:**
-
-```sql
-SELECT
-  native_date_time as time,
-  metric1 as text,
-  CONCAT(tag1, ',', tag2) as tags
-FROM
-  public.test_data
-WHERE
-  $__timeFilter(native_date_time)
-```
-
-| Name      | Description                                                                                                           |
-| --------- | --------------------------------------------------------------------------------------------------------------------- |
-| `time`    | The name of the date/time field, which can be a column with a native SQL date/time data type or epoch value.          |
-| `timeend` | Optional name of the end date/time field, which can be a column with a native SQL date/time data type or epoch value. |
-| `text`    | Event description field.                                                                                              |
-| `tags`    | Optional field name to use for event tags as a comma separated string.                                                |
+For detailed information on creating annotations with MySQL, refer to [MySQL annotations](ref:mysql-annotations).
 
 ## Alerting
 
-Use time series queries to create alerts. Table formatted queries aren't yet supported in alert rule conditions.
+You can use time series queries to create Grafana-managed alert rules. Table formatted queries are not supported in alert rule conditions.
 
-For more information regarding alerting refer to the following:
-
-- [Alert rules](ref:alert-rules)
-- [Template annotations and labels](ref:template-annotations-and-labels)
+For detailed information on creating alerts with MySQL, refer to [MySQL alerting](ref:mysql-alerting).

docs/sources/datasources/mysql/template-variables/index.md

@@ -0,0 +1,146 @@
+---
+description: Using template variables with MySQL in Grafana
+keywords:
+  - grafana
+  - mysql
+  - templates
+  - variables
+  - queries
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Template variables
+title: MySQL template variables
+weight: 300
+refs:
+  variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
+  variable-syntax-advanced-variable-format-options:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
+  add-template-variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/add-template-variables/
+---
+
+# MySQL template variables
+
+Instead of hard-coding details such as server, application, and sensor names in metric queries, you can use variables.
+Grafana displays these variables in drop-down select boxes at the top of the dashboard to help you change the data displayed in your dashboard.
+Grafana refers to such variables as **template variables**.
+
+For an introduction to templating and template variables, refer to [Templating](ref:variables) and [Add and manage variables](ref:add-template-variables).
+
+## Query variable
+
+A query variable in Grafana dynamically retrieves values from your data source using a query. With a query variable, you can write a SQL query that returns values such as measurement names, key names, or key values that are shown in a drop-down select box.
+
+For example, the following query returns all values from the `hostname` column:
+
+```sql
+SELECT hostname FROM my_host
+```
+
+A query can return multiple columns, and Grafana automatically generates a list using the values from those columns. For example, the following query returns values from both the `hostname` and `hostname2` columns, which are included in the variable's drop-down list.
+
+```sql
+SELECT my_host.hostname, my_other_host.hostname2 FROM my_host JOIN my_other_host ON my_host.city = my_other_host.city
+```
+
+To use time range dependent macros like `$__timeFilter(column)` in your query, you must set the template variable's refresh mode to **On Time Range Change**.
+
+```sql
+SELECT event_name FROM event_log WHERE $__timeFilter(time_column)
+```
+
+### Key/value variables
+
+You can create a key/value variable using a query that returns two columns named `__text` and `__value`.
+
+- The `__text` column defines the label shown in the drop-down.
+- The `__value` column defines the value passed to panel queries.
+
+This is useful when you want to display a user-friendly label (like a hostname) but use a different underlying value (like an ID).
+
+Note that the values in the `__text` column should be unique. If there are duplicates, Grafana uses only the first matching entry.
+
+```sql
+SELECT hostname AS __text, id AS __value FROM my_host
+```
+
+### Nested variables
+
+You can create nested variables, where one variable depends on the value of another. For example, if you have a variable named `region`, you can configure a `hosts` variable to only show hosts from the selected region. If `region` is a multi-value variable, use the `IN` operator instead of `=` to match against multiple selected values.
+
+```sql
+SELECT hostname FROM my_host WHERE region IN($region)
+```
+
+### Filter results with `__searchFilter`
+
+Using `__searchFilter` in the query field allows the query results to be filtered based on the user's input in the drop-down selection box. If you don't enter anything, the default value for `__searchFilter` is `%`.
+
+Note that you must enclose the `__searchFilter` expression in quotes as Grafana doesn't add them automatically.
+
+The following example demonstrates how to use `__searchFilter` in the query field to enable real-time searching for `hostname` as the user types in the drop-down selection box.
+
+```sql
+SELECT hostname FROM my_host WHERE hostname LIKE '$__searchFilter'
+```
+
+## Use variables in queries
+
+Grafana automatically quotes template variable values only when the template variable is a `multi-value`.
+
+When using a multi-value variable, use the `IN` comparison operator instead of `=` to match against multiple values.
+
+Grafana supports two syntaxes for using variables in queries:
+
+- **`$<varname>` syntax**
+
+Example with a template variable named `hostname`:
+
+```sql
+SELECT
+  UNIX_TIMESTAMP(atimestamp) as time,
+  aint as value,
+  avarchar as metric
+FROM my_table
+WHERE $__timeFilter(atimestamp) and hostname in($hostname)
+ORDER BY atimestamp ASC
+```
+
+- **`[[varname]]` syntax**
+
+Example with a template variable named `hostname`:
+
+```sql
+SELECT
+  UNIX_TIMESTAMP(atimestamp) as time,
+  aint as value,
+  avarchar as metric
+FROM my_table
+WHERE $__timeFilter(atimestamp) and hostname in([[hostname]])
+ORDER BY atimestamp ASC
+```
+
+### Disable quoting for multi-value variables
+
+By default, Grafana formats multi-value variables as a quoted, comma-separated string. For example, if `server01` and `server02` are selected, the result will be `'server01'`, `'server02'`. To disable quoting, use the `csv` formatting option for variables:
+
+```text
+${servers:csv}
+```
+
+This outputs the values as an unquoted comma-separated list.
+
+Refer to [Advanced variable format options](ref:variable-syntax-advanced-variable-format-options) for additional information.

docs/sources/datasources/mysql/troubleshoot/index.md

@@ -1,80 +0,0 @@
----
-description: Learn how to troubleshoot common problems with the Grafana MySQL data source plugin
-keywords:
-  - grafana
-  - mysql
-  - query
-labels:
-  products:
-    - cloud
-    - enterprise
-    - oss
-menuTitle: Troubleshoot
-title: Troubleshoot common problems with the Grafana MySQL data source plugin
-weight: 40
-refs:
-  variables:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/variables/
-  variable-syntax-advanced-variable-format-options:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/variables/variable-syntax/#advanced-variable-format-options
-  annotate-visualizations:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
-  explore:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
-  query-transform-data:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/
-  panel-inspector:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/panel-inspector/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/panel-inspector/
-  query-editor:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/#query-editors
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/#query-editors
-  alert-rules:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/
-  template-annotations-and-labels:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/templates/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/templates/
-  configure-standard-options:
-    - pattern: /docs/grafana/
-    - destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/
----
-
-# Troubleshoot common problems with the Grafana MySQL data source plugin
-
-This page lists common issues you might experience when setting up the Grafana MySQL data source plugin.
-
-### My data source connection fails when using the Grafana MySQL data source plugin
-
-- Check if the MySQL server is up and running.
-- Make sure that your firewall is open for MySQL server (default port is `3306`).
-- Ensure that you have the correct permissions to access the MySQL server and also have permission to access the database.
-- If the error persists, create a new user for the Grafana MySQL data source plugin with correct permissions and try to connect with it.
-
-### What should I do if I see "An unexpected error happened" or "Could not connect to MySQL" after trying all of the above?
-
-- Check the Grafana logs for more details about the error.
-- For Grafana Cloud customers, contact support.

docs/sources/datasources/mysql/troubleshooting/index.md

@@ -0,0 +1,370 @@
+---
+aliases:
+  - ../troubleshoot/
+description: Troubleshoot common problems with the MySQL data source in Grafana
+keywords:
+  - grafana
+  - mysql
+  - troubleshooting
+  - errors
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Troubleshooting
+title: Troubleshoot MySQL data source issues
+weight: 400
+refs:
+  configure-mysql-data-source:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configure/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/configure/
+  mysql-query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/mysql/query-editor/
+  private-data-source-connect:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/
+---
+
+# Troubleshoot MySQL data source issues
+
+This document provides solutions to common issues you may encounter when configuring or using the MySQL data source in Grafana.
+
+## Connection errors
+
+These errors occur when Grafana cannot establish or maintain a connection to the MySQL server.
+
+### Unable to connect to the server
+
+**Error message:** "dial tcp: connection refused" or "Could not connect to MySQL"
+
+**Cause:** Grafana cannot establish a network connection to the MySQL server.
+
+**Solution:**
+
+1. Verify that the MySQL server is running and accessible.
+1. Check that the host and port are correct in the data source configuration. The default MySQL port is `3306`.
+1. Ensure there are no firewall rules blocking the connection between Grafana and MySQL.
+1. Verify that MySQL is configured to allow remote connections by checking the `bind-address` setting in your MySQL configuration.
+1. For Grafana Cloud, ensure you have configured [Private data source connect](ref:private-data-source-connect) if your MySQL instance isn't publicly accessible.
+
+### Connection timeout
+
+**Error message:** "Connection timed out" or "I/O timeout"
+
+**Cause:** The connection to MySQL timed out before receiving a response.
+
+**Solution:**
+
+1. Check the network latency between Grafana and MySQL.
+1. Verify that MySQL isn't overloaded or experiencing performance issues.
+1. Check if any network devices (load balancers, proxies) are timing out the connection.
+1. Increase the `wait_timeout` setting in MySQL if connections are timing out during idle periods.
+
+### TLS/SSL connection failures
+
+**Error message:** "TLS handshake failed" or "x509: certificate verify failed"
+
+**Cause:** There is a mismatch between the TLS settings in Grafana and what the MySQL server supports or requires.
+
+**Solution:**
+
+1. Verify that the MySQL server has a valid SSL certificate if encryption is enabled.
+1. Check that the certificate is trusted by the Grafana server.
+1. If using a self-signed certificate, enable **With CA Cert** and provide the root certificate under **TLS/SSL Root Certificate**.
+1. To bypass certificate validation (not recommended for production), enable **Skip TLS Verification** in the data source configuration.
+1. Ensure the SSL certificate hasn't expired.
+
+### Connection reset by peer
+
+**Error message:** "Connection reset by peer" or "EOF"
+
+**Cause:** The MySQL server closed the connection unexpectedly.
+
+**Solution:**
+
+1. Check the `max_connections` setting on the MySQL server to ensure it isn't being exceeded.
+1. Verify the `wait_timeout` and `interactive_timeout` settings in MySQL aren't set too low.
+1. Increase the **Max lifetime** setting in Grafana's data source configuration to be lower than MySQL's `wait_timeout`.
+1. Check MySQL server logs for any errors or connection-related messages.
+
+## Authentication errors
+
+These errors occur when there are issues with authentication credentials or permissions.
+
+### Access denied for user
+
+**Error message:** "Access denied for user 'username'@'host'" or "Authentication failed"
+
+**Cause:** The authentication credentials are invalid or the user doesn't have permission to connect from the Grafana server's host.
+
+**Solution:**
+
+1. Verify that the username and password are correct.
+1. Check that the user exists in MySQL and is enabled.
+1. Ensure the user has permission to connect from the Grafana server's IP address. MySQL restricts access based on the connecting host:
+
+   ```sql
+   SELECT user, host FROM mysql.user WHERE user = 'your_user';
+   ```
+
+1. If necessary, create a user that can connect from the Grafana server:
+
+   ```sql
+   CREATE USER 'grafana'@'grafana_server_ip' IDENTIFIED BY 'password';
+   ```
+
+1. If using the `mysql_native_password` authentication plugin, ensure it's enabled on the server.
+
+### Cannot access database
+
+**Error message:** "Access denied for user 'username'@'host' to database 'dbname'"
+
+**Cause:** The authenticated user doesn't have permission to access the specified database.
+
+**Solution:**
+
+1. Verify that the database name is correct in the data source configuration.
+1. Ensure the user has the required permissions on the database:
+
+   ```sql
+   GRANT SELECT ON your_database.* TO 'grafana'@'grafana_server_ip';
+   FLUSH PRIVILEGES;
+   ```
+
+1. For production environments, grant permissions only on specific tables:
+
+   ```sql
+   GRANT SELECT ON your_database.your_table TO 'grafana'@'grafana_server_ip';
+   ```
+
+### PAM authentication issues
+
+**Error message:** "Authentication plugin 'auth_pam' cannot be loaded" or cleartext password errors
+
+**Cause:** PAM (Pluggable Authentication Modules) authentication requires cleartext password transmission.
+
+**Solution:**
+
+1. Enable **Allow Cleartext Passwords** in the data source configuration if using PAM authentication.
+1. Ensure TLS is enabled to protect password transmission when using cleartext passwords.
+1. Verify that the PAM plugin is correctly installed and configured on the MySQL server.
+
+## Query errors
+
+These errors occur when there are issues with query syntax or configuration.
+
+### Time column not found or invalid
+
+**Error message:** "Could not find time column" or time series visualization shows no data
+
+**Cause:** The query doesn't return a properly formatted `time` column for time series visualization.
+
+**Solution:**
+
+1. Ensure your query includes a column named `time` when using the **Time series** format.
+1. Use the `$__time()` macro to convert your date column: `$__time(your_date_column)`.
+1. Verify the time column is of a valid MySQL date/time type (`DATETIME`, `TIMESTAMP`, `DATE`) or contains Unix epoch values.
+1. Ensure the result set is sorted by the time column using `ORDER BY`.
+
+### Macro expansion errors
+
+**Error message:** "Error parsing query" or macros appear unexpanded in the query
+
+**Cause:** Grafana macros are being used incorrectly.
+
+**Solution:**
+
+1. Verify macro syntax: use `$__timeFilter(column)` not `$_timeFilter(column)`.
+1. Check that the column name passed to macros exists in your table.
+1. View the expanded query by clicking **Generated SQL** after running the query to debug macro expansion.
+1. Ensure backticks are used for reserved words or special characters in column names: `$__timeFilter(\`time-column\`)`.
+
+### Timezone and time shift issues
+
+**Cause:** Time series data appears shifted or doesn't align with expected times.
+
+**Solution:**
+
+1. Store timestamps in UTC in your database to avoid timezone issues.
+1. Time macros (`$__time`, `$__timeFilter`, etc.) always expand to UTC values.
+1. Set the **Session Timezone** in the data source configuration to match your data's timezone, or use `+00:00` for UTC.
+1. If your timestamps are stored in local time, convert them to UTC in your query:
+
+   ```sql
+   SELECT
+     CONVERT_TZ(your_datetime_column, 'Your/Timezone', 'UTC') AS time,
+     value
+   FROM your_table
+   ```
+
+### Query returns too many rows
+
+**Error message:** "Result set too large" or browser becomes unresponsive
+
+**Cause:** The query returns more data than can be efficiently processed.
+
+**Solution:**
+
+1. Add time filters using `$__timeFilter(column)` to limit data to the dashboard time range.
+1. Use aggregations (`AVG`, `SUM`, `COUNT`) with `GROUP BY` instead of returning raw rows.
+1. Add a `LIMIT` clause to restrict results: `SELECT ... LIMIT 1000`.
+1. Use the `$__timeGroup()` macro to aggregate data into time intervals.
+
+### Syntax error in SQL statement
+
+**Error message:** "You have an error in your SQL syntax" followed by specific error details
+
+**Cause:** The SQL query contains invalid syntax.
+
+**Solution:**
+
+1. Check for missing or extra commas, parentheses, or quotes.
+1. Ensure reserved words used as identifiers are enclosed in backticks: `` `table` ``, `` `select` ``.
+1. Verify that template variable syntax is correct: `$variable` or `${variable}`.
+1. Test the query directly in a MySQL client to isolate Grafana-specific issues.
+
+### Unknown column in field list
+
+**Error message:** "Unknown column 'column_name' in 'field list'"
+
+**Cause:** The specified column doesn't exist in the table or is misspelled.
+
+**Solution:**
+
+1. Verify the column name is spelled correctly.
+1. Check that the column exists in the specified table.
+1. If the column name contains special characters or spaces, enclose it in backticks: `` `column-name` ``.
+1. Ensure the correct database is selected if you're referencing columns without the full table path.
+
+## Performance issues
+
+These issues relate to slow queries or high resource usage.
+
+### Slow query execution
+
+**Cause:** Queries take a long time to execute.
+
+**Solution:**
+
+1. Reduce the dashboard time range to limit data volume.
+1. Add indexes to columns used in `WHERE` clauses and time filters:
+
+   ```sql
+   CREATE INDEX idx_time ON your_table(time_column);
+   ```
+
+1. Use aggregations instead of returning individual rows.
+1. Increase the **Min time interval** setting to reduce the number of data points.
+1. Review the query execution plan using `EXPLAIN` to identify bottlenecks:
+
+   ```sql
+   EXPLAIN SELECT * FROM your_table WHERE time_column > NOW() - INTERVAL 1 HOUR;
+   ```
+
+### Connection pool exhaustion
+
+**Error message:** "Too many connections" or "Connection pool exhausted"
+
+**Cause:** Too many concurrent connections to the database.
+
+**Solution:**
+
+1. Increase the **Max open** connection limit in the data source configuration.
+1. Enable **Auto (max idle)** to automatically manage idle connections.
+1. Reduce the number of panels querying the same data source simultaneously.
+1. Check for long-running queries that might be holding connections.
+1. Increase the `max_connections` setting in MySQL if necessary:
+
+   ```sql
+   SHOW VARIABLES LIKE 'max_connections';
+   SET GLOBAL max_connections = 200;
+   ```
+
+### Query timeout
+
+**Error message:** "Query execution was interrupted" or "Lock wait timeout exceeded"
+
+**Cause:** The query takes too long and exceeds the configured timeout.
+
+**Solution:**
+
+1. Optimize the query by adding appropriate indexes.
+1. Reduce the amount of data being queried by narrowing the time range.
+1. Use aggregations to reduce the result set size.
+1. Check for table locks that might be blocking the query.
+
+## Other common issues
+
+The following issues don't produce specific error messages but are commonly encountered.
+
+### Template variable queries fail
+
+**Cause:** Variable queries return unexpected results or errors.
+
+**Solution:**
+
+1. Verify the variable query syntax is valid SQL that returns a single column.
+1. Check that the data source connection is working.
+1. Ensure the user has permission to access the tables referenced in the variable query.
+1. Test the query in the query editor before using it as a variable query.
+
+### Data appears incorrect or misaligned
+
+**Cause:** Data formatting or type conversion issues.
+
+**Solution:**
+
+1. Use explicit column aliases to ensure consistent naming: `SELECT value AS metric`.
+1. Verify numeric columns are actually numeric types, not strings.
+1. Check for `NULL` values that might affect aggregations.
+1. Use the `FILL` option in `$__timeGroup()` macro to handle missing data points.
+
+### Special characters in database or table names
+
+**Cause:** Queries fail when tables or databases contain reserved words or special characters.
+
+**Solution:**
+
+1. Enclose identifiers with special characters in backticks: `` `my-database`.`my-table` ``.
+1. The query editor automatically handles this for selections, but manual queries require backticks.
+1. Avoid using reserved words as identifiers when possible.
+
+### An unexpected error happened
+
+**Error message:** "An unexpected error happened"
+
+**Cause:** A general error occurred that doesn't have a specific error message.
+
+**Solution:**
+
+1. Check the Grafana server logs for more details about the error.
+1. Verify all data source configuration settings are correct.
+1. Test the connection using the **Save & test** button.
+1. Ensure the MySQL server is accessible and responding to queries.
+1. For Grafana Cloud customers, contact support for assistance.
+
+## Get additional help
+
+If you continue to experience issues after following this troubleshooting guide:
+
+1. Check the [Grafana community forums](https://community.grafana.com/) for similar issues.
+1. Review the [Grafana GitHub issues](https://github.com/grafana/grafana/issues) for known bugs.
+1. Enable debug logging in Grafana to capture detailed error information.
+1. Check MySQL error logs for additional details.
+1. Contact Grafana Support if you're an Enterprise or Cloud customer.
+
+When reporting issues, include:
+
+- Grafana version
+- MySQL version
+- Error messages (redact sensitive information)
+- Steps to reproduce
+- Relevant query examples (redact sensitive data)

docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md

@@ -66,7 +66,6 @@ Most [generally available](https://grafana.com/docs/release-life-cycle/#general-
 | `sharingDashboardImage`               | Enables image sharing functionality for dashboards                                                                                                            | Yes                |
 | `tabularNumbers`                      | Use fixed-width numbers globally in the UI                                                                                                                    |                    |
 | `azureResourcePickerUpdates`          | Enables the updated Azure Monitor resource picker                                                                                                             | Yes                |
-| `tempoSearchBackendMigration`         | Run search queries through the tempo backend                                                                                                                  |                    |
 | `opentsdbBackendMigration`            | Run queries through the data source backend                                                                                                                   |                    |
 
 ## Public preview feature toggles

eslint-suppressions.json

@@ -1021,11 +1021,6 @@
       "count": 2
     }
   },
-  "public/app/core/actions/index.ts": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 4
-    }
-  },
   "public/app/core/components/AccessControl/PermissionList.tsx": {
     "no-restricted-syntax": {
       "count": 1
@@ -4025,11 +4020,6 @@
       "count": 1
     }
   },
-  "public/app/plugins/datasource/parca/webpack.config.ts": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 1
-    }
-  },
   "public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx": {
     "no-restricted-syntax": {
       "count": 1
@@ -4098,7 +4088,7 @@
       "count": 1
     },
     "@typescript-eslint/no-explicit-any": {
-      "count": 2
+      "count": 1
     }
   },
   "public/app/plugins/datasource/tempo/resultTransformer.ts": {

eslint.config.js

@@ -585,6 +585,8 @@ module.exports = [
       // FIXME: Remove once all enterprise issues are fixed -
       // we don't have a suppressions file/approach for enterprise code yet
       ...enterpriseIgnores,
+      // Ignore decoupled plugin webpack configs
+      'public/app/**/webpack.config.ts',
     ],
     rules: {
       'no-barrel-files/no-barrel-files': 'error',

packages/grafana-api-clients/src/clients/rtkq/dashboard/v0alpha1/endpoints.gen.ts

@@ -246,6 +246,8 @@ const injectedRtkApi = api
             facetLimit: queryArg.facetLimit,
             tags: queryArg.tags,
             libraryPanel: queryArg.libraryPanel,
+            panelType: queryArg.panelType,
+            dataSourceType: queryArg.dataSourceType,
             permission: queryArg.permission,
             sort: queryArg.sort,
             limit: queryArg.limit,
@@ -674,6 +676,10 @@ export type SearchDashboardsAndFoldersApiArg = {
   tags?: string[];
   /** find dashboards that reference a given libraryPanel */
   libraryPanel?: string;
+  /** find dashboards using panels of a given plugin type */
+  panelType?: string;
+  /** find dashboards using datasources of a given plugin type */
+  dataSourceType?: string;
   /** permission needed for the resource (view, edit, admin) */
   permission?: 'view' | 'edit' | 'admin';
   /** sortable field */

packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts

@@ -1452,7 +1452,7 @@ export type ConnectionSecure = {
   /** PrivateKey is the reference to the private key used for GitHub App authentication. This value is stored securely and cannot be read back */
   privateKey?: InlineSecureValue;
   /** Token is the reference of the token used to act as the Connection. This value is stored securely and cannot be read back */
-  webhook?: InlineSecureValue;
+  token?: InlineSecureValue;
 };
 export type BitbucketConnectionConfig = {
   /** App client ID */

packages/grafana-data/src/field/fieldOverrides.test.ts

@@ -9,6 +9,7 @@ import { FieldColorModeId } from '../types/fieldColor';
 import { FieldConfigPropertyItem, FieldConfigSource } from '../types/fieldOverrides';
 import { InterpolateFunction } from '../types/panel';
 import { ThresholdsMode } from '../types/thresholds';
+import { MappingType } from '../types/valueMapping';
 import { Registry } from '../utils/Registry';
 import { locationUtil } from '../utils/location';
 import { mockStandardProperties } from '../utils/tests/mockStandardProperties';
@@ -999,6 +1000,45 @@ describe('setDynamicConfigValue', () => {
     expect(config.custom.property3).toEqual({});
     expect(config.displayName).toBeUndefined();
   });
+
+  it('works correctly with multiple value mappings in the same override', () => {
+    const config: FieldConfig = {
+      mappings: [{ type: MappingType.ValueToText, options: { existing: { text: 'existing' } } }],
+    };
+
+    setDynamicConfigValue(
+      config,
+      {
+        id: 'mappings',
+        value: [{ type: MappingType.ValueToText, options: { first: { text: 'first' } } }],
+      },
+      {
+        fieldConfigRegistry: customFieldRegistry,
+        data: [],
+        field: { type: FieldType.number } as Field,
+        dataFrameIndex: 0,
+      }
+    );
+
+    setDynamicConfigValue(
+      config,
+      {
+        id: 'mappings',
+        value: [{ type: MappingType.ValueToText, options: { second: { text: 'second' } } }],
+      },
+      {
+        fieldConfigRegistry: customFieldRegistry,
+        data: [],
+        field: { type: FieldType.number } as Field,
+        dataFrameIndex: 0,
+      }
+    );
+
+    expect(config.mappings).toHaveLength(3);
+    expect(config.mappings![0]).toEqual({ type: MappingType.ValueToText, options: { existing: { text: 'existing' } } });
+    expect(config.mappings![1]).toEqual({ type: MappingType.ValueToText, options: { first: { text: 'first' } } });
+    expect(config.mappings![2]).toEqual({ type: MappingType.ValueToText, options: { second: { text: 'second' } } });
+  });
 });
 
 describe('getLinksSupplier', () => {

packages/grafana-data/src/field/fieldOverrides.ts

@@ -341,7 +341,7 @@ export function setDynamicConfigValue(config: FieldConfig, value: DynamicConfigV
     return;
   }
 
-  const val = item.process(value.value, context, item.settings);
+  let val = item.process(value.value, context, item.settings);
 
   const remove = val === undefined || val === null;
 
@@ -352,6 +352,15 @@ export function setDynamicConfigValue(config: FieldConfig, value: DynamicConfigV
       unset(config, item.path);
     }
   } else {
+    // Merge arrays (e.g. mappings) when multiple overrides target the same field
+    if (Array.isArray(val)) {
+      const existingValue = item.isCustom ? get(config.custom, item.path) : get(config, item.path);
+
+      if (Array.isArray(existingValue)) {
+        val = [...existingValue, ...val];
+      }
+    }
+
     if (item.isCustom) {
       if (!config.custom) {
         config.custom = {};

packages/grafana-data/src/types/featureToggles.gen.ts

@@ -527,10 +527,6 @@ export interface FeatureToggles {
   */
   dashboardTemplates?: boolean;
   /**
-  * Sets the logs table as default visualisation in logs explore
-  */
-  logsExploreTableDefaultVisualization?: boolean;
-  /**
   * Enables the new alert list view design
   */
   alertingListViewV2?: boolean;
@@ -657,10 +653,6 @@ export interface FeatureToggles {
   */
   rolePickerDrawer?: boolean;
   /**
-  * Enable unified storage search
-  */
-  unifiedStorageSearch?: boolean;
-  /**
   * Enable sprinkles on unified storage search
   */
   unifiedStorageSearchSprinkles?: boolean;
@@ -957,7 +949,8 @@ export interface FeatureToggles {
   */
   alertingBulkActionsInUI?: boolean;
   /**
-  * Registers AuthZ /apis endpoint
+  * Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead
+  * @deprecated
   */
   kubernetesAuthzApis?: boolean;
   /**
@@ -973,6 +966,18 @@ export interface FeatureToggles {
   */
   kubernetesAuthzZanzanaSync?: boolean;
   /**
+  * Registers AuthZ Core Roles /apis endpoint
+  */
+  kubernetesAuthzCoreRolesApi?: boolean;
+  /**
+  * Registers AuthZ Roles /apis endpoint
+  */
+  kubernetesAuthzRolesApi?: boolean;
+  /**
+  * Registers AuthZ Role Bindings /apis endpoint
+  */
+  kubernetesAuthzRoleBindingsApi?: boolean;
+  /**
   * Enables create, delete, and update mutations for resources owned by IAM identity
   */
   kubernetesAuthnMutation?: boolean;
@@ -1124,11 +1129,6 @@ export interface FeatureToggles {
   */
   pluginContainers?: boolean;
   /**
-  * Run search queries through the tempo backend
-  * @default false
-  */
-  tempoSearchBackendMigration?: boolean;
-  /**
   * Prioritize loading plugins from the CDN before other sources
   * @default false
   */

packages/grafana-data/src/types/icon.ts

@@ -52,6 +52,7 @@ export const availableIconsIndex = {
   bookmark: true,
   'book-open': true,
   'brackets-curly': true,
+  brain: true,
   'browser-alt': true,
   bug: true,
   building: true,

packages/grafana-i18n/package.json

@@ -29,7 +29,6 @@
       "@grafana-app/source": "./src/internal/index.ts"
     },
     "./eslint-plugin": {
-      "@grafana-app/source": "./src/eslint/index.cjs",
       "types": "./src/eslint/index.d.ts",
       "default": "./src/eslint/index.cjs"
     }

packages/grafana-ui/src/components/InteractiveTable/InteractiveTable.tsx

@@ -153,6 +153,10 @@ interface BaseProps<TableData extends object> {
    * Optional way to set how the table is sorted from the beginning. Must be memoized.
    */
   initialSortBy?: Array<SortingRule<TableData>>;
+  /**
+   * Disable the ability to remove sorting on columns (none -> asc -> desc -> asc)
+   */
+  disableSortRemove?: boolean;
 }
 
 interface WithExpandableRow<TableData extends object> extends BaseProps<TableData> {
@@ -191,6 +195,7 @@ export function InteractiveTable<TableData extends object>({
   showExpandAll = false,
   fetchData,
   initialSortBy = [],
+  disableSortRemove,
 }: Props<TableData>) {
   const styles = useStyles2(getStyles);
   const tableColumns = useMemo(() => {
@@ -222,6 +227,7 @@ export function InteractiveTable<TableData extends object>({
       disableMultiSort: true,
       // If fetchData is provided, we disable client-side sorting
       manualSortBy: Boolean(fetchData),
+      disableSortRemove,
       getRowId,
       initialState: {
         hiddenColumns: [

packages/grafana-ui/src/components/InteractiveTable/types.ts

@@ -26,4 +26,8 @@ export interface Column<TableData extends object> {
    * If the provided function returns `false` the column will be hidden.
    */
   visible?: (data: TableData[]) => boolean;
+  /**
+   * Determines starting sort direction when the column header is clicked.
+   */
+  sortDescFirst?: boolean;
 }

packages/grafana-ui/src/components/InteractiveTable/utils.ts

@@ -33,6 +33,7 @@ export function getColumns<K extends object>(
       disableSortBy: !Boolean(column.sortType),
       width: column.disableGrow ? 0 : undefined,
       visible: column.visible,
+      ...(column.sortDescFirst !== undefined && { sortDescFirst: column.sortDescFirst }),
       ...(column.cell && { Cell: column.cell }),
     })),
   ];

pkg/apiserver/registry/generic/storage.go

@@ -1,26 +1,55 @@
 package generic
 
 import (
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/registry/generic"
 	"k8s.io/apiserver/pkg/registry/generic/registry"
+	"k8s.io/apiserver/pkg/storage"
 
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 )
 
+// SelectableFieldsOptions allows customizing field selector behavior for a resource.
+type SelectableFieldsOptions struct {
+	// GetAttrs returns labels and fields for the object.
+	// If nil, the default GetAttrs is used which only exposes metadata.name.
+	GetAttrs func(obj runtime.Object) (labels.Set, fields.Set, error)
+}
+
 func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter) (*registry.Store, error) {
+	return NewRegistryStoreWithSelectableFields(scheme, resourceInfo, optsGetter, SelectableFieldsOptions{})
+}
+
+// NewRegistryStoreWithSelectableFields creates a registry store with custom selectable fields support.
+// Use this when you need to filter resources by custom fields like spec.connection.name.
+func NewRegistryStoreWithSelectableFields(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter, fieldOpts SelectableFieldsOptions) (*registry.Store, error) {
 	gv := resourceInfo.GroupVersion()
 	gv.Version = runtime.APIVersionInternal
 	strategy := NewStrategy(scheme, gv)
 	if resourceInfo.IsClusterScoped() {
 		strategy = strategy.WithClusterScope()
 	}
+
+	// Use custom GetAttrs if provided, otherwise use default
+	var attrFunc storage.AttrFunc
+	var predicateFunc func(label labels.Selector, field fields.Selector) storage.SelectionPredicate
+	if fieldOpts.GetAttrs != nil {
+		attrFunc = fieldOpts.GetAttrs
+		// Pass nil predicateFunc to use default behavior with custom attrFunc
+		predicateFunc = nil
+	} else {
+		attrFunc = GetAttrs
+		predicateFunc = Matcher
+	}
+
 	store := &registry.Store{
 		NewFunc:                   resourceInfo.NewFunc,
 		NewListFunc:               resourceInfo.NewListFunc,
 		KeyRootFunc:               KeyRootFunc(resourceInfo.GroupResource()),
 		KeyFunc:                   NamespaceKeyFunc(resourceInfo.GroupResource()),
-		PredicateFunc:             Matcher,
+		PredicateFunc:             predicateFunc,
 		DefaultQualifiedResource:  resourceInfo.GroupResource(),
 		SingularQualifiedResource: resourceInfo.SingularGroupResource(),
 		TableConvertor:            resourceInfo.TableConverter(),
@@ -28,7 +57,7 @@ func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, o
 		UpdateStrategy:            strategy,
 		DeleteStrategy:            strategy,
 	}
-	options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: GetAttrs}
+	options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: attrFunc}
 	if err := store.CompleteWithOptions(options); err != nil {
 		return nil, err
 	}

pkg/build/e2e/README.md

@@ -0,0 +1,20 @@
+## Build artifacts
+
+Put the resulting tar in your `grafana` OSS path:
+```sh
+go -C grafana run ./pkg/build/cmd artifacts -a targz:enterprise:linux/amd64 --alpine-base=alpine:3.22 --tag-format='{{ .version }}-{{ .buildID }}-{{ .arch }}' --grafana-dir="${PWD}/grafana" --enterprise-dir="${PWD}/grafana-enterprise"
+```
+
+Also build the e2e test runner:
+```sh
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o ./e2e-runner ./e2e/
+```
+
+And then `chmod +x ./e2e-runner`.
+
+## Running tests
+
+Reporting tests with Image Renderer:
+```sh
+go run ./pkg/build/e2e --suite=e2e/extensions/enterprise/smtp-suite --license=e2e/extensions/enterprise/license.jwt --image-renderer
+```

pkg/build/e2e/main.go

@@ -138,6 +138,10 @@ func run(ctx context.Context, cmd *cli.Command) error {
 	}
 
 	if code != 0 {
+		if stdout, _ := c.Stdout(ctx); len(stdout) > 0 {
+			log.Printf("e2e test suite stdout:\n%s", stdout)
+		}
+
 		return fmt.Errorf("e2e tests failed with exit code %d", code)
 	}
 

pkg/build/e2e/run.go

@@ -8,10 +8,10 @@ import (
 
 func RunSuite(d *dagger.Client, svc *dagger.Service, src *dagger.Directory, cache *dagger.CacheVolume, suite, runnerFlags string) *dagger.Container {
 	command := fmt.Sprintf(
-		"./e2e-runner cypress --start-grafana=false --cypress-video"+
+		"./e2e-runner cypress --browser=electron --start-grafana=false --cypress-video"+
 			" --grafana-base-url http://grafana:3001 --suite %s %s", suite, runnerFlags)
 
-	return WithYarnCache(WithGrafanaFrontend(d.Container().From("cypress/included:13.1.0"), src), cache).
+	return WithYarnCache(WithGrafanaFrontend(d.Container().From("cypress/included:14.3.2"), src), cache).
 		WithWorkdir("/src").
 		WithServiceBinding("grafana", svc).
 		WithExec([]string{"yarn", "install", "--immutable"}).

pkg/build/e2e/service.go

@@ -99,13 +99,15 @@ func GrafanaService(ctx context.Context, d *dagger.Client, opts GrafanaServiceOp
 	}
 
 	if opts.StartImageRenderer {
-		container = container.WithEnvVariable("START_IMAGE_RENDERER", "true").
-			WithExec([]string{"apt-get", "update"}).
-			WithExec([]string{"apt-get", "install", "-y", "ca-certificates"})
+		imageRendererSvc := d.Container().From("grafana/grafana-image-renderer:" + opts.ImageRendererVersion).
+			WithExposedPort(8081).
+			AsService()
 
-		if opts.ImageRendererVersion != "" {
-			container = container.WithEnvVariable("IMAGE_RENDERER_VERSION", opts.ImageRendererVersion)
-		}
+		container = container.WithServiceBinding("image-renderer", imageRendererSvc).
+			WithExec([]string{"apt-get", "update"}).
+			WithExec([]string{"apt-get", "install", "-y", "ca-certificates"}).
+			WithEnvVariable("GF_RENDERING_CALLBACK_URL", "http://grafana:3001/").
+			WithEnvVariable("GF_RENDERING_SERVER_URL", "http://image-renderer:8081/render")
 	}
 
 	// We add all GF_ environment variables to allow for overriding Grafana configuration.

pkg/registry/apis/dashboard/search.go

@@ -142,6 +142,24 @@ func (s *SearchHandler) GetAPIRoutes(defs map[string]common.OpenAPIDefinition) *
 										Schema:      spec.StringProperty(),
 									},
 								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "panelType",
+										In:          "query",
+										Description: "find dashboards using panels of a given plugin type",
+										Required:    false,
+										Schema:      spec.StringProperty(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "dataSourceType",
+										In:          "query",
+										Description: "find dashboards using datasources of a given plugin type",
+										Required:    false,
+										Schema:      spec.StringProperty(),
+									},
+								},
 								{
 									ParameterProps: spec3.ParameterProps{
 										Name:        "permission",
@@ -430,14 +448,11 @@ func convertHttpSearchRequestToResourceSearchRequest(queryParams url.Values, use
 		}
 	}
 
-	// The facet term fields
+	// Apply facet terms
 	if facets, ok := queryParams["facet"]; ok {
 		if queryParams.Has("facetLimit") {
 			if parsed, err := strconv.Atoi(queryParams.Get("facetLimit")); err == nil && parsed > 0 {
-				facetLimit = parsed
-				if facetLimit > 1000 {
-					facetLimit = 1000
-				}
+				facetLimit = min(parsed, 1000)
 			}
 		}
 		searchRequest.Facet = make(map[string]*resourcepb.ResourceSearchRequest_Facet)
@@ -449,21 +464,35 @@ func convertHttpSearchRequestToResourceSearchRequest(queryParams url.Values, use
 		}
 	}
 
-	// The tags filter
-	if tags, ok := queryParams["tag"]; ok {
+	if v, ok := queryParams["tag"]; ok {
 		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
 			Key:      "tags",
 			Operator: "=",
-			Values:   tags,
+			Values:   v,
 		})
 	}
 
-	// The libraryPanel filter
-	if libraryPanel, ok := queryParams["libraryPanel"]; ok {
+	if v, ok := queryParams["panelType"]; ok {
+		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
+			Key:      resource.SEARCH_FIELD_PREFIX + builders.DASHBOARD_PANEL_TYPES,
+			Operator: "=",
+			Values:   v,
+		})
+	}
+
+	if v, ok := queryParams["dataSourceType"]; ok {
+		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
+			Key:      resource.SEARCH_FIELD_PREFIX + builders.DASHBOARD_DS_TYPES,
+			Operator: "=",
+			Values:   v,
+		})
+	}
+
+	if v, ok := queryParams["libraryPanel"]; ok {
 		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
 			Key:      builders.DASHBOARD_LIBRARY_PANEL_REFERENCE,
 			Operator: "=",
-			Values:   libraryPanel,
+			Values:   v,
 		})
 	}
 

pkg/registry/apis/datasource/plugincontext.go

@@ -71,7 +71,6 @@ type cachingDatasourceProvider struct {
 }
 
 func (q *cachingDatasourceProvider) GetDatasourceProvider(pluginJson plugins.JSONData) PluginDatasourceProvider {
-	group, _ := plugins.GetDatasourceGroupNameFromPluginID(pluginJson.ID)
 	return &scopedDatasourceProvider{
 		plugin:          pluginJson,
 		dsService:       q.dsService,
@@ -81,7 +80,7 @@ func (q *cachingDatasourceProvider) GetDatasourceProvider(pluginJson plugins.JSO
 			mapper: q.converter.mapper,
 			plugin: pluginJson.ID,
 			alias:  pluginJson.AliasIDs,
-			group:  group,
+			group:  pluginJson.ID,
 		},
 	}
 }

pkg/registry/apis/datasource/register.go

@@ -37,6 +37,11 @@ var (
 	_ builder.APIGroupBuilder = (*DataSourceAPIBuilder)(nil)
 )
 
+type DataSourceAPIBuilderConfig struct {
+	LoadQueryTypes bool
+	UseDualWriter  bool
+}
+
 // DataSourceAPIBuilder is used just so wire has something unique to return
 type DataSourceAPIBuilder struct {
 	datasourceResourceInfo utils.ResourceInfo
@@ -46,7 +51,7 @@ type DataSourceAPIBuilder struct {
 	contextProvider        PluginContextWrapper
 	accessControl          accesscontrol.AccessControl
 	queryTypes             *queryV0.QueryTypeDefinitionList
-	configCrudUseNewApis   bool
+	cfg                    DataSourceAPIBuilderConfig
 	dataSourceCRUDMetric   *prometheus.HistogramVec
 }
 
@@ -89,20 +94,24 @@ func RegisterAPIService(
 			return nil, fmt.Errorf("plugin client is not a PluginClient: %T", pluginClient)
 		}
 
+		groupName := pluginJSON.ID + ".datasource.grafana.app"
 		builder, err = NewDataSourceAPIBuilder(
+			groupName,
 			pluginJSON,
 			client,
 			datasources.GetDatasourceProvider(pluginJSON),
 			contextProvider,
 			accessControl,
-			//nolint:staticcheck // not yet migrated to OpenFeature
-			features.IsEnabledGlobally(featuremgmt.FlagDatasourceQueryTypes),
-			//nolint:staticcheck // not yet migrated to OpenFeature
-			features.IsEnabledGlobally(featuremgmt.FlagQueryServiceWithConnections),
+			DataSourceAPIBuilderConfig{
+				//nolint:staticcheck // not yet migrated to OpenFeature
+				LoadQueryTypes: features.IsEnabledGlobally(featuremgmt.FlagDatasourceQueryTypes),
+				UseDualWriter:  false,
+			},
 		)
 		if err != nil {
 			return nil, err
 		}
+
 		builder.SetDataSourceCRUDMetrics(dataSourceCRUDMetric)
 
 		apiRegistrar.RegisterAPI(builder)
@@ -120,31 +129,27 @@ type PluginClient interface {
 }
 
 func NewDataSourceAPIBuilder(
+	groupName string,
 	plugin plugins.JSONData,
 	client PluginClient,
 	datasources PluginDatasourceProvider,
 	contextProvider PluginContextWrapper,
 	accessControl accesscontrol.AccessControl,
-	loadQueryTypes bool,
-	configCrudUseNewApis bool,
+	cfg DataSourceAPIBuilderConfig,
 ) (*DataSourceAPIBuilder, error) {
-	group, err := plugins.GetDatasourceGroupNameFromPluginID(plugin.ID)
-	if err != nil {
-		return nil, err
-	}
-
 	builder := &DataSourceAPIBuilder{
-		datasourceResourceInfo: datasourceV0.DataSourceResourceInfo.WithGroupAndShortName(group, plugin.ID),
+		datasourceResourceInfo: datasourceV0.DataSourceResourceInfo.WithGroupAndShortName(groupName, plugin.ID),
 		pluginJSON:             plugin,
 		client:                 client,
 		datasources:            datasources,
 		contextProvider:        contextProvider,
 		accessControl:          accessControl,
-		configCrudUseNewApis:   configCrudUseNewApis,
+		cfg:                    cfg,
 	}
-	if loadQueryTypes {
+	var err error
+	if cfg.LoadQueryTypes {
 		// In the future, this will somehow come from the plugin
-		builder.queryTypes, err = getHardcodedQueryTypes(group)
+		builder.queryTypes, err = getHardcodedQueryTypes(groupName)
 	}
 	return builder, err
 }
@@ -154,9 +159,9 @@ func getHardcodedQueryTypes(group string) (*queryV0.QueryTypeDefinitionList, err
 	var err error
 	var raw json.RawMessage
 	switch group {
-	case "testdata.datasource.grafana.app":
+	case "testdata.datasource.grafana.app", "grafana-testdata-datasource":
 		raw, err = kinds.QueryTypeDefinitionListJSON()
-	case "prometheus.datasource.grafana.app":
+	case "prometheus.datasource.grafana.app", "prometheus":
 		raw, err = models.QueryTypeDefinitionListJSON()
 	}
 	if err != nil {
@@ -233,7 +238,7 @@ func (b *DataSourceAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver
 	storage["connections"] = &noopREST{}                            // hidden from openapi
 	storage["connections/query"] = storage[ds.StoragePath("query")] // deprecated in openapi
 
-	if b.configCrudUseNewApis {
+	if b.cfg.UseDualWriter {
 		legacyStore := &legacyStorage{
 			datasources:                     b.datasources,
 			resourceInfo:                    &ds,

pkg/registry/apis/iam/register.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"maps"
 	"strings"
+	"time"
 
+	"github.com/open-feature/go-sdk/openfeature"
 	"github.com/prometheus/client_golang/prometheus"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -209,8 +211,16 @@ func (b *IdentityAccessManagementAPIBuilder) GetGroupVersion() schema.GroupVersi
 }
 
 func (b *IdentityAccessManagementAPIBuilder) InstallSchema(scheme *runtime.Scheme) error {
-	//nolint:staticcheck // not yet migrated to OpenFeature
-	if b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis) {
+	client := openfeature.NewDefaultClient()
+	ctx, cancelFn := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancelFn()
+
+	// Check if any of the AuthZ APIs are enabled
+	enableCoreRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzCoreRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRoleBindingsApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRoleBindingsApi, false, openfeature.TransactionContext(ctx))
+
+	if enableCoreRolesApi || enableRolesApi || enableRoleBindingsApi {
 		if err := iamv0.AddAuthZKnownTypes(scheme); err != nil {
 			return err
 		}
@@ -244,10 +254,16 @@ func (b *IdentityAccessManagementAPIBuilder) AllowedV0Alpha1Resources() []string
 func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupInfo, opts builder.APIGroupOptions) error {
 	storage := map[string]rest.Storage{}
 
+	client := openfeature.NewDefaultClient()
+	ctx, cancelFn := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancelFn()
+
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	enableZanzanaSync := b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzZanzanaSync)
-	//nolint:staticcheck // not yet migrated to OpenFeature
-	enableAuthzApis := b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis)
+
+	enableCoreRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzCoreRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRoleBindingsApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRoleBindingsApi, false, openfeature.TransactionContext(ctx))
 
 	// teams + users must have shorter names because they are often used as part of another name
 	opts.StorageOptsRegister(iamv0.TeamResourceInfo.GroupResource(), apistore.StorageOptions{
@@ -283,17 +299,21 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 		return err
 	}
 
-	if enableAuthzApis {
+	if enableCoreRolesApi {
 		// v0alpha1
 		if err := b.UpdateCoreRolesAPIGroup(apiGroupInfo, opts, storage, enableZanzanaSync); err != nil {
 			return err
 		}
+	}
 
+	if enableRolesApi {
 		// Role registration is delegated to the RoleApiInstaller
 		if err := b.roleApiInstaller.RegisterStorage(apiGroupInfo, &opts, storage); err != nil {
 			return err
 		}
+	}
 
+	if enableRoleBindingsApi {
 		if err := b.UpdateRoleBindingsAPIGroup(apiGroupInfo, opts, storage, enableZanzanaSync); err != nil {
 			return err
 		}

pkg/registry/apis/provisioning/extras/register.go

@@ -2,6 +2,8 @@ package extras
 
 import (
 	apisprovisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
+	ghconnection "github.com/grafana/grafana/apps/provisioning/pkg/connection/github"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository/git"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository/github"
@@ -42,6 +44,15 @@ func ProvideProvisioningOSSRepositoryExtras(
 	}
 }
 
+func ProvideProvisioningOSSConnectionExtras(
+	_ *setting.Cfg,
+	ghFactory ghconnection.GithubFactory,
+) []connection.Extra {
+	return []connection.Extra{
+		ghconnection.Extra(ghFactory),
+	}
+}
+
 func ProvideExtraWorkers(pullRequestWorker *pullrequest.PullRequestWorker) []jobs.Worker {
 	return []jobs.Worker{pullRequestWorker}
 }
@@ -54,3 +65,12 @@ func ProvideFactoryFromConfig(cfg *setting.Cfg, extras []repository.Extra) (repo
 
 	return repository.ProvideFactory(enabledTypes, extras)
 }
+
+func ProvideConnectionFactoryFromConfig(cfg *setting.Cfg, extras []connection.Extra) (connection.Factory, error) {
+	enabledTypes := make(map[apisprovisioning.ConnectionType]struct{}, len(cfg.ProvisioningRepositoryTypes))
+	for _, e := range cfg.ProvisioningRepositoryTypes {
+		enabledTypes[apisprovisioning.ConnectionType(e)] = struct{}{}
+	}
+
+	return connection.ProvideFactory(enabledTypes, extras)
+}

pkg/registry/apis/provisioning/jobs/job_progress_recorder_mock.go

@@ -71,6 +71,98 @@ func (_c *MockJobProgressRecorder_Complete_Call) RunAndReturn(run func(context.C
 	return _c
 }
 
+// HasDirPathFailedDeletion provides a mock function with given fields: folderPath
+func (_m *MockJobProgressRecorder) HasDirPathFailedDeletion(folderPath string) bool {
+	ret := _m.Called(folderPath)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HasDirPathFailedDeletion")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = rf(folderPath)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// MockJobProgressRecorder_HasDirPathFailedDeletion_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HasDirPathFailedDeletion'
+type MockJobProgressRecorder_HasDirPathFailedDeletion_Call struct {
+	*mock.Call
+}
+
+// HasDirPathFailedDeletion is a helper method to define mock.On call
+//   - folderPath string
+func (_e *MockJobProgressRecorder_Expecter) HasDirPathFailedDeletion(folderPath interface{}) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	return &MockJobProgressRecorder_HasDirPathFailedDeletion_Call{Call: _e.mock.On("HasDirPathFailedDeletion", folderPath)}
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) Run(run func(folderPath string)) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) Return(_a0 bool) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) RunAndReturn(run func(string) bool) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// HasDirPathFailedCreation provides a mock function with given fields: path
+func (_m *MockJobProgressRecorder) HasDirPathFailedCreation(path string) bool {
+	ret := _m.Called(path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HasDirPathFailedCreation")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// MockJobProgressRecorder_HasDirPathFailedCreation_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HasDirPathFailedCreation'
+type MockJobProgressRecorder_HasDirPathFailedCreation_Call struct {
+	*mock.Call
+}
+
+// HasDirPathFailedCreation is a helper method to define mock.On call
+//   - path string
+func (_e *MockJobProgressRecorder_Expecter) HasDirPathFailedCreation(path interface{}) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	return &MockJobProgressRecorder_HasDirPathFailedCreation_Call{Call: _e.mock.On("HasDirPathFailedCreation", path)}
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) Run(run func(path string)) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) Return(_a0 bool) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) RunAndReturn(run func(string) bool) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Record provides a mock function with given fields: ctx, result
 func (_m *MockJobProgressRecorder) Record(ctx context.Context, result JobResourceResult) {
 	_m.Called(ctx, result)

pkg/registry/apis/provisioning/jobs/progress.go

@@ -2,6 +2,7 @@ package jobs
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sync"
 	"time"
@@ -9,6 +10,8 @@ import (
 	"github.com/grafana/grafana-app-sdk/logging"
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/apps/provisioning/pkg/safepath"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
 )
 
 // maybeNotifyProgress will only notify if a certain amount of time has passed
@@ -58,6 +61,8 @@ type jobProgressRecorder struct {
 	notifyImmediatelyFn ProgressFn
 	maybeNotifyFn       ProgressFn
 	summaries           map[string]*provisioning.JobResourceSummary
+	failedCreations     []string // Tracks folder paths that failed to be created
+	failedDeletions     []string // Tracks resource paths that failed to be deleted
 }
 
 func newJobProgressRecorder(ProgressFn ProgressFn) JobProgressRecorder {
@@ -84,10 +89,26 @@ func (r *jobProgressRecorder) Record(ctx context.Context, result JobResourceResu
 	if result.Error != nil {
 		shouldLogError = true
 		logErr = result.Error
-		if len(r.errors) < 20 {
-			r.errors = append(r.errors, result.Error.Error())
+
+		// Don't count ignored actions as errors in error count or error list
+		if result.Action != repository.FileActionIgnored {
+			if len(r.errors) < 20 {
+				r.errors = append(r.errors, result.Error.Error())
+			}
+			r.errorCount++
+		}
+
+		// Automatically track failed operations based on error type and action
+		// Check if this is a PathCreationError (folder creation failure)
+		var pathErr *resources.PathCreationError
+		if errors.As(result.Error, &pathErr) {
+			r.failedCreations = append(r.failedCreations, pathErr.Path)
+		}
+
+		// Track failed deletions, any deletion will stop the deletion of the parent folder (as it won't be empty)
+		if result.Action == repository.FileActionDeleted {
+			r.failedDeletions = append(r.failedDeletions, result.Path)
 		}
-		r.errorCount++
 	}
 
 	r.updateSummary(result)
@@ -112,6 +133,8 @@ func (r *jobProgressRecorder) ResetResults() {
 	r.errorCount = 0
 	r.errors = nil
 	r.summaries = make(map[string]*provisioning.JobResourceSummary)
+	r.failedCreations = nil
+	r.failedDeletions = nil
 }
 
 func (r *jobProgressRecorder) SetMessage(ctx context.Context, msg string) {
@@ -309,3 +332,29 @@ func (r *jobProgressRecorder) Complete(ctx context.Context, err error) provision
 
 	return jobStatus
 }
+
+// HasDirPathFailedCreation checks if a path is nested under any failed folder creation
+func (r *jobProgressRecorder) HasDirPathFailedCreation(path string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	for _, failedCreation := range r.failedCreations {
+		if safepath.InDir(path, failedCreation) {
+			return true
+		}
+	}
+	return false
+}
+
+// HasDirPathFailedDeletion checks if any resource deletions failed under a folder path
+func (r *jobProgressRecorder) HasDirPathFailedDeletion(folderPath string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	for _, failedDeletion := range r.failedDeletions {
+		if safepath.InDir(failedDeletion, folderPath) {
+			return true
+		}
+	}
+	return false
+}

pkg/registry/apis/provisioning/jobs/progress_test.go

@@ -7,6 +7,7 @@ import (
 
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -252,3 +253,221 @@ func TestJobProgressRecorderWarningOnlyNoErrors(t *testing.T) {
 	require.NotNil(t, finalStatus.Warnings)
 	assert.Len(t, finalStatus.Warnings, 1)
 }
+
+func TestJobProgressRecorderFolderFailureTracking(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record a folder creation failure with PathCreationError
+	pathErr := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr,
+	})
+
+	// Record another PathCreationError for a different folder
+	pathErr2 := &resources.PathCreationError{
+		Path: "folder2/subfolder/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr2,
+	})
+
+	// Record a deletion failure
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder3/file1.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Record another deletion failure
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder4/subfolder/file2.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Verify failed creations are tracked
+	recorder.mu.RLock()
+	assert.Len(t, recorder.failedCreations, 2)
+	assert.Contains(t, recorder.failedCreations, "folder1/")
+	assert.Contains(t, recorder.failedCreations, "folder2/subfolder/")
+
+	// Verify failed deletions are tracked
+	assert.Len(t, recorder.failedDeletions, 2)
+	assert.Contains(t, recorder.failedDeletions, "folder3/file1.json")
+	assert.Contains(t, recorder.failedDeletions, "folder4/subfolder/file2.json")
+	recorder.mu.RUnlock()
+}
+
+func TestJobProgressRecorderHasDirPathFailedCreation(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add failed creations via Record
+	pathErr1 := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr1,
+	})
+
+	pathErr2 := &resources.PathCreationError{
+		Path: "folder2/subfolder/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr2,
+	})
+
+	// Test nested paths
+	assert.True(t, recorder.HasDirPathFailedCreation("folder1/file.json"))
+	assert.True(t, recorder.HasDirPathFailedCreation("folder1/nested/file.json"))
+	assert.True(t, recorder.HasDirPathFailedCreation("folder2/subfolder/file.json"))
+
+	// Test non-nested paths
+	assert.False(t, recorder.HasDirPathFailedCreation("folder2/file2.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("folder2/othersubfolder/inside.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("other/file.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("folder3/file.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("file.json"))
+}
+
+func TestJobProgressRecorderHasDirPathFailedDeletion(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add failed deletions via Record
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file1.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file2.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder3/nested/deep/file3.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Test folder paths with failed deletions
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder1/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder2/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder2/subfolder/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/nested/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/nested/deep/"))
+
+	// Test folder paths without failed deletions
+	assert.False(t, recorder.HasDirPathFailedDeletion("other/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("different/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder2/othersubfolder/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder2/subfolder/othersubfolder/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder3/nested/anotherdeep/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder3/nested/deep/insidedeep/"))
+}
+
+func TestJobProgressRecorderResetResults(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add some data via Record
+	pathErr := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/file.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Verify data is stored
+	recorder.mu.RLock()
+	assert.Len(t, recorder.failedCreations, 1)
+	assert.Len(t, recorder.failedDeletions, 1)
+	recorder.mu.RUnlock()
+
+	// Reset results
+	recorder.ResetResults()
+
+	// Verify data is cleared
+	recorder.mu.RLock()
+	assert.Nil(t, recorder.failedCreations)
+	assert.Nil(t, recorder.failedDeletions)
+	recorder.mu.RUnlock()
+}
+
+func TestJobProgressRecorderIgnoredActionsDontCountAsErrors(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record an ignored action with error
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file1.json",
+		Action: repository.FileActionIgnored,
+		Error:  assert.AnError,
+	})
+
+	// Record a real error for comparison
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/file2.json",
+		Action: repository.FileActionCreated,
+		Error:  assert.AnError,
+	})
+
+	// Verify error count doesn't include ignored actions
+	recorder.mu.RLock()
+	assert.Equal(t, 1, recorder.errorCount, "ignored actions should not be counted as errors")
+	assert.Len(t, recorder.errors, 1, "ignored action errors should not be in error list")
+	recorder.mu.RUnlock()
+}

pkg/registry/apis/provisioning/jobs/queue.go

@@ -29,6 +29,10 @@ type JobProgressRecorder interface {
 	StrictMaxErrors(maxErrors int)
 	SetRefURLs(ctx context.Context, refURLs *provisioning.RepositoryURLs)
 	Complete(ctx context.Context, err error) provisioning.JobStatus
+	// HasDirPathFailedCreation checks if a path has any folder creations that failed
+	HasDirPathFailedCreation(path string) bool
+	// HasDirPathFailedDeletion checks if a folderPath has any folder deletions that failed
+	HasDirPathFailedDeletion(folderPath string) bool
 }
 
 // Worker is a worker that can process a job

pkg/registry/apis/provisioning/jobs/sync/full.go

@@ -75,11 +75,47 @@ func FullSync(
 	return applyChanges(ctx, changes, clients, repositoryResources, progress, tracer, maxSyncWorkers, metrics)
 }
 
+// shouldSkipChange checks if a change should be skipped based on previous failures on parent/child folders.
+// If there is a previous failure on the path, we don't need to process the change as it will fail anyway.
+func shouldSkipChange(ctx context.Context, change ResourceFileChange, progress jobs.JobProgressRecorder, tracer tracing.Tracer) bool {
+	if change.Action != repository.FileActionDeleted && progress.HasDirPathFailedCreation(change.Path) {
+		skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.skip_nested_resource")
+		skipSpan.SetAttributes(attribute.String("path", change.Path))
+		progress.Record(skipCtx, jobs.JobResourceResult{
+			Path:    change.Path,
+			Action:  repository.FileActionIgnored,
+			Warning: fmt.Errorf("resource was not processed because the parent folder could not be created"),
+		})
+		skipSpan.End()
+		return true
+	}
+
+	if change.Action == repository.FileActionDeleted && safepath.IsDir(change.Path) && progress.HasDirPathFailedDeletion(change.Path) {
+		skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.skip_folder_with_failed_deletions")
+		skipSpan.SetAttributes(attribute.String("path", change.Path))
+		progress.Record(skipCtx, jobs.JobResourceResult{
+			Path:    change.Path,
+			Action:  repository.FileActionIgnored,
+			Group:   resources.FolderKind.Group,
+			Kind:    resources.FolderKind.Kind,
+			Warning: fmt.Errorf("folder was not processed because children resources in its path could not be deleted"),
+		})
+		skipSpan.End()
+		return true
+	}
+
+	return false
+}
+
 func applyChange(ctx context.Context, change ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer) {
 	if ctx.Err() != nil {
 		return
 	}
 
+	if shouldSkipChange(ctx, change, progress, tracer) {
+		return
+	}
+
 	if change.Action == repository.FileActionDeleted {
 		deleteCtx, deleteSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.delete")
 		result := jobs.JobResourceResult{
@@ -138,6 +174,7 @@ func applyChange(ctx context.Context, change ResourceFileChange, clients resourc
 			ensureFolderSpan.RecordError(err)
 			ensureFolderSpan.End()
 			progress.Record(ctx, result)
+
 			return
 		}
 
@@ -253,8 +290,6 @@ func applyChanges(ctx context.Context, changes []ResourceFileChange, clients res
 }
 
 func applyFoldersSerially(ctx context.Context, folders []ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer) error {
-	logger := logging.FromContext(ctx)
-
 	for _, folder := range folders {
 		if ctx.Err() != nil {
 			return ctx.Err()
@@ -264,23 +299,9 @@ func applyFoldersSerially(ctx context.Context, folders []ResourceFileChange, cli
 			return err
 		}
 
-		folderCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
-
-		applyChange(folderCtx, folder, clients, repositoryResources, progress, tracer)
-
-		if folderCtx.Err() == context.DeadlineExceeded {
-			logger.Error("operation timed out after 15 seconds", "path", folder.Path, "action", folder.Action)
-
-			recordCtx, recordCancel := context.WithTimeout(context.Background(), 15*time.Second)
-			progress.Record(recordCtx, jobs.JobResourceResult{
-				Path:   folder.Path,
-				Action: folder.Action,
-				Error:  fmt.Errorf("operation timed out after 15 seconds"),
-			})
-			recordCancel()
-		}
-
-		cancel()
+		wrapWithTimeout(ctx, 15*time.Second, func(timeoutCtx context.Context) {
+			applyChange(timeoutCtx, folder, clients, repositoryResources, progress, tracer)
+		})
 	}
 
 	return nil
@@ -318,7 +339,9 @@ loop:
 			defer wg.Done()
 			defer func() { <-sem }()
 
-			applyChangeWithTimeout(ctx, change, clients, repositoryResources, progress, tracer, logger)
+			wrapWithTimeout(ctx, 15*time.Second, func(timeoutCtx context.Context) {
+				applyChange(timeoutCtx, change, clients, repositoryResources, progress, tracer)
+			})
 		}(change)
 	}
 
@@ -331,21 +354,10 @@ loop:
 	return ctx.Err()
 }
 
-func applyChangeWithTimeout(ctx context.Context, change ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer, logger logging.Logger) {
-	changeCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+// wrapWithTimeout wraps a function call with a timeout context
+func wrapWithTimeout(ctx context.Context, timeout time.Duration, fn func(context.Context)) {
+	timeoutCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	applyChange(changeCtx, change, clients, repositoryResources, progress, tracer)
-
-	if changeCtx.Err() == context.DeadlineExceeded {
-		logger.Error("operation timed out after 15 seconds", "path", change.Path, "action", change.Action)
-
-		recordCtx, recordCancel := context.WithTimeout(context.Background(), 15*time.Second)
-		progress.Record(recordCtx, jobs.JobResourceResult{
-			Path:   change.Path,
-			Action: change.Action,
-			Error:  fmt.Errorf("operation timed out after 15 seconds"),
-		})
-		recordCancel()
-	}
+	fn(timeoutCtx)
 }

pkg/registry/apis/provisioning/jobs/sync/full_hierarchical_test.go

@@ -0,0 +1,432 @@
+package sync
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+	k8testing "k8s.io/client-go/testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/jobs"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+)
+
+/*
+TestFullSync_HierarchicalErrorHandling tests the hierarchical error handling behavior:
+
+FOLDER CREATION FAILURES:
+- When a folder fails to be created with PathCreationError, all nested resources are skipped
+- Nested resources are recorded with FileActionIgnored and error "folder was not processed because children resources in its path could not be deleted"
+- Only the folder creation error counts toward error limits
+- Nested resource skips do NOT count toward error limits
+
+FOLDER DELETION FAILURES:
+- When a file deletion fails, it's tracked in failedDeletions
+- When cleaning up folders, we check HasDirPathFailedDeletion()
+- If children failed to delete, folder deletion is skipped with FileActionIgnored
+- This prevents orphaning resources that still exist
+
+DELETIONS NOT AFFECTED BY CREATION FAILURES:
+- If a folder creation fails, deletion operations for resources in that folder still proceed
+- This is because the resource might already exist from a previous sync
+- Only creations/updates/renames are affected by failed folder creation
+
+AUTOMATIC TRACKING:
+- Record() automatically detects PathCreationError and adds to failedCreations
+- Record() automatically detects deletion failures and adds to failedDeletions
+- No manual calls to AddFailedCreation/AddFailedDeletion needed
+*/
+func TestFullSync_HierarchicalErrorHandling(t *testing.T) { // nolint:gocyclo
+	tests := []struct {
+		name          string
+		setupMocks    func(*repository.MockRepository, *resources.MockRepositoryResources, *resources.MockResourceClients, *jobs.MockJobProgressRecorder, *dynamicfake.FakeDynamicClient)
+		changes       []ResourceFileChange
+		description   string
+		expectError   bool
+		errorContains string
+	}{
+		{
+			name:        "folder creation fails, nested file skipped",
+			description: "When folder1/ fails to create, folder1/file.json should be skipped with FileActionIgnored",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First, check if nested under failed creation - not yet
+				progress.On("HasDirPathFailedCreation", "folder1/file.json").Return(false).Once()
+
+				// WriteResourceFromFile fails with PathCreationError for folder1/
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				// File will be recorded with error, triggering automatic tracking of folder1/ failure
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file.json" && r.Error != nil && r.Action == repository.FileActionCreated
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder creation fails, multiple nested resources skipped",
+			description: "When folder1/ fails to create, all nested resources (subfolder, files) are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/file2.json", Action: repository.FileActionCreated},
+				{Path: "folder1/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First file triggers folder creation failure
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// Subsequent files in same folder are skipped
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/file2.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file3.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "file deletion failure tracked",
+			description: "When a file deletion fails, it's automatically tracked in failedDeletions",
+			changes: []ResourceFileChange{
+				{
+					Path:   "folder1/file.json",
+					Action: repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{
+						Name:     "file1",
+						Group:    "dashboard.grafana.app",
+						Resource: "dashboards",
+					},
+				},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				// File deletion fails
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				// File deletion recorded with error, automatically tracked in failedDeletions
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "deletion proceeds despite creation failure",
+			description: "When folder1/ fails to create, deletion of folder1/file2.json still proceeds (resource might exist from previous sync)",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{
+					Path:   "folder1/file2.json",
+					Action: repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{
+						Name:     "file2",
+						Group:    "dashboard.grafana.app",
+						Resource: "dashboards",
+					},
+				},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				// Creation fails
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// Deletion proceeds (NOT checking HasDirPathFailedCreation for deletions)
+				// Note: deletion will fail because resource doesn't exist, but that's fine for this test
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				// Record deletion attempt (will have error since resource doesn't exist, but that's ok)
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" &&
+						r.Action == repository.FileActionDeleted
+					// Not checking r.Error because resource doesn't exist in fake client
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multi-level nesting - all skipped",
+			description: "When level1/ fails, level1/level2/level3/file.json is also skipped",
+			changes: []ResourceFileChange{
+				{Path: "level1/file1.json", Action: repository.FileActionCreated},
+				{Path: "level1/level2/file2.json", Action: repository.FileActionCreated},
+				{Path: "level1/level2/level3/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First file triggers level1/ failure
+				progress.On("HasDirPathFailedCreation", "level1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "level1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "level1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// All nested files are skipped
+				for _, path := range []string{"level1/level2/file2.json", "level1/level2/level3/file3.json"} {
+					progress.On("HasDirPathFailedCreation", path).Return(true).Once()
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "mixed success and failure",
+			description: "When success/ works and failure/ fails, only failure/* are skipped",
+			changes: []ResourceFileChange{
+				{Path: "success/file1.json", Action: repository.FileActionCreated},
+				{Path: "failure/file2.json", Action: repository.FileActionCreated},
+				{Path: "failure/nested/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// Success path works
+				progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "").
+					Return("resource1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/file1.json" && r.Error == nil
+				})).Return().Once()
+
+				// Failure path fails
+				progress.On("HasDirPathFailedCreation", "failure/file2.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "failure/file2.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/file2.json" && r.Error != nil
+				})).Return().Once()
+
+				// Nested file in failure path is skipped
+				progress.On("HasDirPathFailedCreation", "failure/nested/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/nested/file3.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder creation fails with explicit folder in changes",
+			description: "When folder1/ is explicitly in changes and fails to create, all nested resources (subfolders and files) are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/", Action: repository.FileActionCreated},
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/file2.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				progress.On("HasDirPathFailedCreation", "folder1/").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "folder1/").Return("", folderErr).Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/").Return(true).Once()
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(true).Once()
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/file2.json").Return(true).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/file2.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder deletion prevented when child deletion fails",
+			description: "When a file deletion fails, folder deletion is skipped with FileActionIgnored to prevent orphaning resources",
+			changes: []ResourceFileChange{
+				{
+					Path:     "folder1/file1.json",
+					Action:   repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"},
+				},
+				{Path: "folder1/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "folder1", Group: "folder.grafana.app", Resource: "Folder"}},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedDeletion", "folder1/").Return(true).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multiple folder deletion failures",
+			description: "When multiple independent folders have child deletion failures, all folder deletions are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "folder1/", Action: repository.FileActionDeleted},
+				{Path: "folder2/file2.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file2", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "folder2/", Action: repository.FileActionDeleted},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				for _, path := range []string{"folder1/file1.json", "folder2/file2.json"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Error != nil
+					})).Return().Once()
+				}
+
+				progress.On("HasDirPathFailedDeletion", "folder1/").Return(true).Once()
+				progress.On("HasDirPathFailedDeletion", "folder2/").Return(true).Once()
+
+				for _, path := range []string{"folder1/", "folder2/"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "nested subfolder deletion failure",
+			description: "When a file deletion fails in a nested subfolder, both the subfolder and parent folder deletions are skipped",
+			changes: []ResourceFileChange{
+				{Path: "parent/subfolder/file.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "parent/subfolder/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "subfolder", Group: "folder.grafana.app", Resource: "Folder"}},
+				{Path: "parent/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "parent", Group: "folder.grafana.app", Resource: "Folder"}},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "parent/subfolder/file.json" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedDeletion", "parent/subfolder/").Return(true).Once()
+				progress.On("HasDirPathFailedDeletion", "parent/").Return(true).Once()
+
+				for _, path := range []string{"parent/subfolder/", "parent/"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			dynamicClient := dynamicfake.NewSimpleDynamicClient(scheme)
+
+			repo := repository.NewMockRepository(t)
+			repoResources := resources.NewMockRepositoryResources(t)
+			clients := resources.NewMockResourceClients(t)
+			progress := jobs.NewMockJobProgressRecorder(t)
+			compareFn := NewMockCompareFn(t)
+
+			repo.On("Config").Return(&provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-repo"},
+				Spec:       provisioning.RepositorySpec{Title: "Test Repo"},
+			})
+
+			tt.setupMocks(repo, repoResources, clients, progress, dynamicClient)
+
+			compareFn.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tt.changes, nil)
+			progress.On("SetTotal", mock.Anything, len(tt.changes)).Return()
+			progress.On("TooManyErrors").Return(nil).Maybe()
+
+			err := FullSync(context.Background(), repo, compareFn.Execute, clients, "ref", repoResources, progress, tracing.NewNoopTracerService(), 10, jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+
+			if tt.expectError {
+				require.Error(t, err)
+				if tt.errorContains != "" {
+					require.Contains(t, err.Error(), tt.errorContains)
+				}
+			} else {
+				require.NoError(t, err)
+			}
+
+			progress.AssertExpectations(t)
+			repoResources.AssertExpectations(t)
+		})
+	}
+}

pkg/registry/apis/provisioning/jobs/sync/full_test.go

@@ -213,6 +213,10 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 					return nil
 				})
 
+				progress.On("HasDirPathFailedCreation", mock.MatchedBy(func(path string) bool {
+					return path == "dashboards/one.json" || path == "dashboards/two.json" || path == "dashboards/three.json"
+				})).Return(false).Maybe()
+
 				repoResources.On("WriteResourceFromFile", mock.Anything, mock.MatchedBy(func(path string) bool {
 					return path == "dashboards/one.json" || path == "dashboards/two.json" || path == "dashboards/three.json"
 				}), "").Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil).Maybe()
@@ -235,6 +239,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -259,6 +264,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write error"))
@@ -285,6 +291,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -309,6 +316,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write error"))
@@ -335,6 +343,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "one/two/three/").Return(false)
 
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "one/two/three/").Return("some-folder", nil)
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
@@ -357,6 +366,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "one/two/three/").Return(false)
 
 				repoResources.On(
 					"EnsureFolderPathExist",
@@ -581,6 +591,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedDeletion", "to-be-deleted/").Return(false)
 
 				scheme := runtime.NewScheme()
 				require.NoError(t, metav1.AddMetaToScheme(scheme))
@@ -640,6 +651,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedDeletion", "to-be-deleted/").Return(false)
 
 				scheme := runtime.NewScheme()
 				require.NoError(t, metav1.AddMetaToScheme(scheme))
@@ -695,6 +707,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/slow.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/slow.json", "").
 					Run(func(args mock.Arguments) {
@@ -708,19 +721,13 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 					}).
 					Return("", schema.GroupVersionKind{}, context.DeadlineExceeded)
 
+				// applyChange records the error from WriteResourceFromFile
 				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
 					return result.Action == repository.FileActionCreated &&
 						result.Path == "dashboards/slow.json" &&
 						result.Error != nil &&
 						result.Error.Error() == "writing resource from file dashboards/slow.json: context deadline exceeded"
 				})).Return().Once()
-
-				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
-					return result.Action == repository.FileActionCreated &&
-						result.Path == "dashboards/slow.json" &&
-						result.Error != nil &&
-						result.Error.Error() == "operation timed out after 15 seconds"
-				})).Return().Once()
 			},
 		},
 	}

pkg/registry/apis/provisioning/jobs/sync/incremental.go

@@ -60,7 +60,7 @@ func IncrementalSync(ctx context.Context, repo repository.Versioned, previousRef
 	if len(affectedFolders) > 0 {
 		cleanupStart := time.Now()
 		span.AddEvent("checking if impacted folders should be deleted", trace.WithAttributes(attribute.Int("affected_folders", len(affectedFolders))))
-		err := cleanupOrphanedFolders(ctx, repo, affectedFolders, repositoryResources, tracer)
+		err := cleanupOrphanedFolders(ctx, repo, affectedFolders, repositoryResources, tracer, progress)
 		metrics.RecordIncrementalSyncPhase(jobs.IncrementalSyncPhaseCleanup, time.Since(cleanupStart))
 		if err != nil {
 			return tracing.Error(span, fmt.Errorf("cleanup orphaned folders: %w", err))
@@ -85,6 +85,20 @@ func applyIncrementalChanges(ctx context.Context, diff []repository.VersionedFil
 			return nil, tracing.Error(span, err)
 		}
 
+		// Check if this resource is nested under a failed folder creation
+		// This only applies to creation/update/rename operations, not deletions
+		if change.Action != repository.FileActionDeleted && progress.HasDirPathFailedCreation(change.Path) {
+			// Skip this resource since its parent folder failed to be created
+			skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.incremental.skip_nested_resource")
+			progress.Record(skipCtx, jobs.JobResourceResult{
+				Path:    change.Path,
+				Action:  repository.FileActionIgnored,
+				Warning: fmt.Errorf("resource was not processed because the parent folder could not be created"),
+			})
+			skipSpan.End()
+			continue
+		}
+
 		if err := resources.IsPathSupported(change.Path); err != nil {
 			ensureFolderCtx, ensureFolderSpan := tracer.Start(ctx, "provisioning.sync.incremental.ensure_folder_path_exist")
 			// Maintain the safe segment for empty folders
@@ -98,7 +112,15 @@ func applyIncrementalChanges(ctx context.Context, diff []repository.VersionedFil
 				if err != nil {
 					ensureFolderSpan.RecordError(err)
 					ensureFolderSpan.End()
-					return nil, tracing.Error(span, fmt.Errorf("unable to create empty file folder: %w", err))
+
+					progress.Record(ensureFolderCtx, jobs.JobResourceResult{
+						Path:   change.Path,
+						Action: repository.FileActionIgnored,
+						Group:  resources.FolderKind.Group,
+						Kind:   resources.FolderKind.Kind,
+						Error:  err,
+					})
+					continue
 				}
 
 				progress.Record(ensureFolderCtx, jobs.JobResourceResult{
@@ -185,6 +207,7 @@ func cleanupOrphanedFolders(
 	affectedFolders map[string]string,
 	repositoryResources resources.RepositoryResources,
 	tracer tracing.Tracer,
+	progress jobs.JobProgressRecorder,
 ) error {
 	ctx, span := tracer.Start(ctx, "provisioning.sync.incremental.cleanup_orphaned_folders")
 	defer span.End()
@@ -198,6 +221,12 @@ func cleanupOrphanedFolders(
 	for path, folderName := range affectedFolders {
 		span.SetAttributes(attribute.String("folder", folderName))
 
+		// Check if any resources under this folder failed to delete
+		if progress.HasDirPathFailedDeletion(path) {
+			span.AddEvent("skipping orphaned folder cleanup: a child resource in its path failed to be deleted")
+			continue
+		}
+
 		// if we can no longer find the folder in git, then we can delete it from grafana
 		_, err := readerRepo.Read(ctx, path, "")
 		if err != nil && (errors.Is(err, repository.ErrFileNotFound) || apierrors.IsNotFound(err)) {

pkg/registry/apis/provisioning/jobs/sync/incremental_hierarchical_test.go

@@ -0,0 +1,623 @@
+package sync
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/jobs"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+)
+
+/*
+TestIncrementalSync_HierarchicalErrorHandling tests the hierarchical error handling behavior:
+
+FOLDER CREATION FAILURES:
+- When EnsureFolderPathExist fails with PathCreationError, the path is tracked
+- Subsequent resources under that path are skipped with FileActionIgnored
+- Only the initial folder creation error counts toward error limits
+- WriteResourceFromFile can also return PathCreationError for implicit folder creation
+
+FOLDER DELETION FAILURES (cleanupOrphanedFolders):
+- When RemoveResourceFromFile fails, path is tracked in failedDeletions
+- In cleanupOrphanedFolders, HasDirPathFailedDeletion() is checked before RemoveFolder
+- If children failed to delete, folder cleanup is skipped with a span event
+
+DELETIONS NOT AFFECTED BY CREATION FAILURES:
+- HasDirPathFailedCreation is NOT checked for FileActionDeleted
+- Deletions proceed even if their parent folder failed to be created
+- This handles cleanup of resources that exist from previous syncs
+
+RENAME OPERATIONS:
+- RenameResourceFile can return PathCreationError for the destination folder
+- Renames are affected by failed destination folder creation
+- Renames are NOT skipped due to source folder creation failures
+
+AUTOMATIC TRACKING:
+- Record() automatically detects PathCreationError via errors.As() and adds to failedCreations
+- Record() automatically detects FileActionDeleted with error and adds to failedDeletions
+- No manual tracking calls needed
+*/
+func TestIncrementalSync_HierarchicalErrorHandling(t *testing.T) { // nolint:gocyclo
+	tests := []struct {
+		name          string
+		setupMocks    func(*repository.MockVersioned, *resources.MockRepositoryResources, *jobs.MockJobProgressRecorder)
+		changes       []repository.VersionedFileChange
+		previousRef   string
+		currentRef    string
+		description   string
+		expectError   bool
+		errorContains string
+	}{
+		{
+			name:        "folder creation fails, nested file skipped",
+			description: "When unsupported/ fails to create via EnsureFolderPathExist, nested file is skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "unsupported/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "unsupported/nested/file2.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file triggers folder creation which fails
+				progress.On("HasDirPathFailedCreation", "unsupported/file.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "unsupported/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/").Return("", folderErr).Once()
+
+				// First file recorded with error (note: error is from folder creation, but recorded against file)
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "unsupported/file.txt" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Error != nil
+				})).Return().Once()
+
+				// Second file is skipped because parent folder failed
+				progress.On("HasDirPathFailedCreation", "unsupported/nested/file2.txt").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "unsupported/nested/file2.txt" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "WriteResourceFromFile returns PathCreationError, nested resources skipped",
+			description: "When WriteResourceFromFile implicitly creates a folder and fails, nested resources are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "folder1/file1.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/file2.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/nested/file3.json", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file write fails with PathCreationError
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "new-ref").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				// First file recorded with error, automatically tracked
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" &&
+						r.Action == repository.FileActionCreated &&
+						r.Error != nil
+				})).Return().Once()
+
+				// Subsequent files are skipped
+				progress.On("HasDirPathFailedCreation", "folder1/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/nested/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/nested/file3.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "file deletion fails, folder cleanup skipped",
+			description: "When RemoveResourceFromFile fails, cleanupOrphanedFolders skips folder removal",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionDeleted, Path: "dashboards/file1.json", PreviousRef: "old-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// File deletion fails (deletions don't check HasDirPathFailedCreation)
+				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/file1.json", "old-ref").
+					Return("dashboard-1", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard"}, fmt.Errorf("permission denied")).Once()
+
+				// Error recorded, automatically tracked in failedDeletions
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "dashboards/file1.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error != nil
+				})).Return().Once()
+
+				// During cleanup, folder deletion is skipped
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(true).Once()
+
+				// Note: RemoveFolder should NOT be called (verified via AssertNotCalled in test)
+			},
+		},
+		{
+			name:        "deletion proceeds despite creation failure",
+			description: "When folder1/ creation fails, deletion of folder1/old.json still proceeds",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "folder1/new.json", Ref: "new-ref"},
+				{Action: repository.FileActionDeleted, Path: "folder1/old.json", PreviousRef: "old-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Creation fails
+				progress.On("HasDirPathFailedCreation", "folder1/new.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/new.json", "new-ref").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/new.json" && r.Error != nil
+				})).Return().Once()
+
+				// Deletion proceeds (NOT checking HasDirPathFailedCreation for deletions)
+				repoResources.On("RemoveResourceFromFile", mock.Anything, "folder1/old.json", "old-ref").
+					Return("old-resource", "", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/old.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error == nil // Deletion succeeds!
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multi-level nesting cascade",
+			description: "When level1/ fails, level1/level2/level3/file.json is also skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "level1/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "level1/level2/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "level1/level2/level3/file.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file triggers level1/ failure
+				progress.On("HasDirPathFailedCreation", "level1/file.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "level1/").Return("", folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "level1/file.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				// All nested files are skipped
+				for _, path := range []string{"level1/level2/file.txt", "level1/level2/level3/file.txt"} {
+					progress.On("HasDirPathFailedCreation", path).Return(true).Once()
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "mixed success and failure",
+			description: "When success/ works and failure/ fails, only failure/* are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "success/file1.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "success/nested/file2.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "failure/file3.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "failure/nested/file4.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Success path works
+				progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "new-ref").
+					Return("resource-1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/file1.json" && r.Error == nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "success/nested/file2.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/nested/file2.json", "new-ref").
+					Return("resource-2", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/nested/file2.json" && r.Error == nil
+				})).Return().Once()
+
+				// Failure path fails
+				progress.On("HasDirPathFailedCreation", "failure/file3.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "failure/").Return("", folderErr).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/file3.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				// Nested file in failure path is skipped
+				progress.On("HasDirPathFailedCreation", "failure/nested/file4.txt").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/nested/file4.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "rename with failed destination folder",
+			description: "When RenameResourceFile fails with PathCreationError for destination, rename is skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{
+					Action:       repository.FileActionRenamed,
+					Path:         "newfolder/file.json",
+					PreviousPath: "oldfolder/file.json",
+					Ref:          "new-ref",
+					PreviousRef:  "old-ref",
+				},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Rename fails with PathCreationError for destination folder
+				progress.On("HasDirPathFailedCreation", "newfolder/file.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "newfolder/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("RenameResourceFile", mock.Anything, "oldfolder/file.json", "old-ref", "newfolder/file.json", "new-ref").
+					Return("", "", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "newfolder/file.json" &&
+						r.Action == repository.FileActionRenamed &&
+						r.Error != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "renamed file still checked, subsequent nested resources skipped",
+			description: "After rename fails for folder1/file.json, other folder1/* files are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionRenamed, Path: "folder1/file1.json", PreviousPath: "old/file1.json", Ref: "new-ref", PreviousRef: "old-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/file2.json", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Rename is NOT skipped for creation failures (it's checking the destination path)
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+
+				// Second file also skipped
+				progress.On("HasDirPathFailedCreation", "folder1/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runHierarchicalErrorHandlingTest(t, tt)
+		})
+	}
+}
+
+type compositeRepoForTest struct {
+	*repository.MockVersioned
+	*repository.MockReader
+}
+
+func runHierarchicalErrorHandlingTest(t *testing.T, tt struct {
+	name          string
+	setupMocks    func(*repository.MockVersioned, *resources.MockRepositoryResources, *jobs.MockJobProgressRecorder)
+	changes       []repository.VersionedFileChange
+	previousRef   string
+	currentRef    string
+	description   string
+	expectError   bool
+	errorContains string
+}) {
+	var repo repository.Versioned
+	mockVersioned := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	// For tests that need cleanup (folder deletion), use composite repo
+	if tt.name == "file deletion fails, folder cleanup skipped" {
+		mockReader := repository.NewMockReader(t)
+		repo = &compositeRepoForTest{
+			MockVersioned: mockVersioned,
+			MockReader:    mockReader,
+		}
+	} else {
+		repo = mockVersioned
+	}
+
+	mockVersioned.On("CompareFiles", mock.Anything, tt.previousRef, tt.currentRef).Return(tt.changes, nil)
+	progress.On("SetTotal", mock.Anything, len(tt.changes)).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	tt.setupMocks(mockVersioned, repoResources, progress)
+
+	err := IncrementalSync(context.Background(), repo, tt.previousRef, tt.currentRef, repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+
+	if tt.expectError {
+		require.Error(t, err)
+		if tt.errorContains != "" {
+			require.Contains(t, err.Error(), tt.errorContains)
+		}
+	} else {
+		require.NoError(t, err)
+	}
+
+	progress.AssertExpectations(t)
+	repoResources.AssertExpectations(t)
+	// For deletion tests, verify RemoveFolder was NOT called
+	if tt.name == "file deletion fails, folder cleanup skipped" {
+		repoResources.AssertNotCalled(t, "RemoveFolder", mock.Anything, mock.Anything)
+	}
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_FailedFolderCreation tests nested resource skipping
+func TestIncrementalSync_HierarchicalErrorHandling_FailedFolderCreation(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "unsupported/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "unsupported/subfolder/file2.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "unsupported/file3.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "other/file.json", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 4).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	folderErr := &resources.PathCreationError{Path: "unsupported/", Err: fmt.Errorf("permission denied")}
+	// First check is before it fails.
+	progress.On("HasDirPathFailedCreation", "unsupported/file.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/").Return("", folderErr).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/file.txt" && r.Action == repository.FileActionIgnored && r.Error != nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "unsupported/subfolder/file2.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/subfolder/file2.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "unsupported/file3.json").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/file3.json" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "other/file.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "other/file.json", "new-ref").
+		Return("test-resource", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "other/file.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_FailedFileDeletion tests folder cleanup prevention
+func TestIncrementalSync_HierarchicalErrorHandling_FailedFileDeletion(t *testing.T) {
+	mockVersioned := repository.NewMockVersioned(t)
+	mockReader := repository.NewMockReader(t)
+	repo := &compositeRepoForTest{MockVersioned: mockVersioned, MockReader: mockReader}
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionDeleted, Path: "dashboards/file1.json", PreviousRef: "old-ref"},
+	}
+
+	mockVersioned.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 1).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	// Deletions don't check HasDirPathFailedCreation, they go straight to removal
+	repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/file1.json", "old-ref").
+		Return("dashboard-1", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard"}, fmt.Errorf("permission denied")).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "dashboards/file1.json" && r.Action == repository.FileActionDeleted &&
+			r.Error != nil && r.Error.Error() == "removing resource from file dashboards/file1.json: permission denied"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedDeletion", "dashboards/").Return(true).Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+	repoResources.AssertNotCalled(t, "RemoveFolder", mock.Anything, mock.Anything)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_DeletionNotAffectedByCreationFailure tests deletions proceed despite creation failures
+func TestIncrementalSync_HierarchicalErrorHandling_DeletionNotAffectedByCreationFailure(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "folder1/file.json", Ref: "new-ref"},
+		{Action: repository.FileActionDeleted, Path: "folder1/old.json", PreviousRef: "old-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 2).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	// Creation fails
+	progress.On("HasDirPathFailedCreation", "folder1/file.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file.json", "new-ref").
+		Return("", schema.GroupVersionKind{}, &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "folder1/file.json" && r.Error != nil
+	})).Return().Once()
+
+	// Deletion should NOT be skipped (not checking HasDirPathFailedCreation for deletions)
+	// Deletions don't check HasDirPathFailedCreation, they go straight to removal
+	repoResources.On("RemoveResourceFromFile", mock.Anything, "folder1/old.json", "old-ref").
+		Return("old-resource", "", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "folder1/old.json" && r.Action == repository.FileActionDeleted && r.Error == nil
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_MultiLevelNesting tests multi-level cascade
+func TestIncrementalSync_HierarchicalErrorHandling_MultiLevelNesting(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "level1/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "level1/level2/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "level1/level2/level3/file.txt", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 3).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+	// First check is before it fails.
+	progress.On("HasDirPathFailedCreation", "level1/file.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "level1/").Return("", folderErr).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/file.txt" && r.Action == repository.FileActionIgnored && r.Error != nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "level1/level2/file.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/level2/file.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "level1/level2/level3/file.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/level2/level3/file.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_MixedSuccessAndFailure tests partial failures
+func TestIncrementalSync_HierarchicalErrorHandling_MixedSuccessAndFailure(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "success/file1.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "success/nested/file2.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "failure/file3.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "failure/nested/file4.txt", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 4).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "new-ref").
+		Return("resource-1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "success/file1.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "success/nested/file2.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "success/nested/file2.json", "new-ref").
+		Return("resource-2", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "success/nested/file2.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+	progress.On("HasDirPathFailedCreation", "failure/file3.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "failure/").Return("", folderErr).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "failure/file3.txt" && r.Action == repository.FileActionIgnored
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "failure/nested/file4.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "failure/nested/file4.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+	repoResources.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_RenameWithFailedFolderCreation tests rename operations affected by folder failures
+func TestIncrementalSync_HierarchicalErrorHandling_RenameWithFailedFolderCreation(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionRenamed, Path: "newfolder/file.json", PreviousPath: "oldfolder/file.json", Ref: "new-ref", PreviousRef: "old-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 1).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	progress.On("HasDirPathFailedCreation", "newfolder/file.json").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "newfolder/file.json" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}

pkg/registry/apis/provisioning/jobs/sync/incremental_test.go

@@ -92,6 +92,10 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation checks
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
+				progress.On("HasDirPathFailedCreation", "alerts/alert.yaml").Return(false)
+
 				// Mock successful resource writes
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "new-ref").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -127,6 +131,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "unsupported/path/file.txt").Return(false)
+
 				// Mock folder creation
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/path/").
 					Return("test-folder", nil)
@@ -161,6 +168,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", ".unsupported/path/file.txt").Return(false)
+
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
 					Action: repository.FileActionIgnored,
 					Path:   ".unsupported/path/file.txt",
@@ -222,6 +232,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/new.json").Return(false)
+
 				// Mock resource rename
 				repoResources.On("RenameResourceFile", mock.Anything, "dashboards/old.json", "old-ref", "dashboards/new.json", "new-ref").
 					Return("renamed-dashboard", "", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -254,6 +267,10 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/ignored.json").Return(false)
+
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
 					Action: repository.FileActionIgnored,
 					Path:   "dashboards/ignored.json",
@@ -277,16 +294,28 @@ func TestIncrementalSync(t *testing.T) {
 				repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "unsupported/path/file.txt").Return(false)
 
 				// Mock folder creation error
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/path/").
 					Return("", fmt.Errorf("failed to create folder"))
 
+				// Mock progress recording with error
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
+					return result.Action == repository.FileActionIgnored &&
+						result.Path == "unsupported/path/file.txt" &&
+						result.Error != nil &&
+						result.Error.Error() == "failed to create folder"
+				})).Return()
+
 				progress.On("TooManyErrors").Return(nil)
 			},
 			previousRef:   "old-ref",
 			currentRef:    "new-ref",
-			expectedError: "unable to create empty file folder: failed to create folder",
+			expectedCalls: 1,
 		},
 		{
 			name: "error writing resource",
@@ -303,6 +332,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
+
 				// Mock resource write error
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "new-ref").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write failed"))
@@ -372,7 +404,8 @@ func TestIncrementalSync(t *testing.T) {
 				repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
-				// Mock too many errors
+
+				// Mock too many errors - this is checked before processing files, so HasDirPathFailedCreation won't be called
 				progress.On("TooManyErrors").Return(fmt.Errorf("too many errors occurred"))
 			},
 			previousRef:   "old-ref",
@@ -428,6 +461,9 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/old.json", "old-ref").
 					Return("old-dashboard", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
 
+				// Mock HasDirPathFailedDeletion check for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+
 				// if the folder is not found in git, there should be a call to remove the folder from grafana
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
@@ -453,6 +489,10 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/old.json", "old-ref").
 					Return("old-dashboard", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
+
+				// Mock HasDirPathFailedDeletion check for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+
 				// if the folder still exists in git, there should not be a call to delete it from grafana
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return(&repository.FileInfo{}, nil)
@@ -485,6 +525,13 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "alerts/old-alert.yaml", "old-ref").
 					Return("old-alert", "folder-uid-2", schema.GroupVersionKind{Kind: "Alert", Group: "alerts"}, nil)
 
+				progress.On("Record", mock.Anything, mock.Anything).Return()
+				progress.On("TooManyErrors").Return(nil)
+
+				// Mock HasDirPathFailedDeletion checks for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+				progress.On("HasDirPathFailedDeletion", "alerts/").Return(false)
+
 				// both not found in git, both should be deleted
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
@@ -492,9 +539,6 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
 				repoResources.On("RemoveFolder", mock.Anything, "folder-uid-1").Return(nil)
 				repoResources.On("RemoveFolder", mock.Anything, "folder-uid-2").Return(nil)
-
-				progress.On("Record", mock.Anything, mock.Anything).Return()
-				progress.On("TooManyErrors").Return(nil)
 			},
 		},
 	}

pkg/registry/apis/provisioning/register.go

@@ -30,7 +30,7 @@ import (
 
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
 	"github.com/grafana/grafana/apps/provisioning/pkg/auth"
-	connectionvalidation "github.com/grafana/grafana/apps/provisioning/pkg/connection"
+	"github.com/grafana/grafana/apps/provisioning/pkg/connection"
 	appcontroller "github.com/grafana/grafana/apps/provisioning/pkg/controller"
 	clientset "github.com/grafana/grafana/apps/provisioning/pkg/generated/clientset/versioned"
 	client "github.com/grafana/grafana/apps/provisioning/pkg/generated/clientset/versioned/typed/provisioning/v0alpha1"
@@ -105,20 +105,21 @@ type APIBuilder struct {
 		jobs.Queue
 		jobs.Store
 	}
-	jobHistoryConfig *JobHistoryConfig
-	jobHistoryLoki   *jobs.LokiJobHistory
-	resourceLister   resources.ResourceLister
-	dashboardAccess  legacy.MigrationDashboardAccessor
-	unified          resource.ResourceClient
-	repoFactory      repository.Factory
-	client           client.ProvisioningV0alpha1Interface
-	access           auth.AccessChecker
-	accessWithAdmin  auth.AccessChecker
-	accessWithEditor auth.AccessChecker
-	accessWithViewer auth.AccessChecker
-	statusPatcher    *appcontroller.RepositoryStatusPatcher
-	healthChecker    *controller.HealthChecker
-	validator        repository.RepositoryValidator
+	jobHistoryConfig  *JobHistoryConfig
+	jobHistoryLoki    *jobs.LokiJobHistory
+	resourceLister    resources.ResourceLister
+	dashboardAccess   legacy.MigrationDashboardAccessor
+	unified           resource.ResourceClient
+	repoFactory       repository.Factory
+	connectionFactory connection.Factory
+	client            client.ProvisioningV0alpha1Interface
+	access            auth.AccessChecker
+	accessWithAdmin   auth.AccessChecker
+	accessWithEditor  auth.AccessChecker
+	accessWithViewer  auth.AccessChecker
+	statusPatcher     *appcontroller.RepositoryStatusPatcher
+	healthChecker     *controller.HealthChecker
+	repoValidator     repository.RepositoryValidator
 	// Extras provides additional functionality to the API.
 	extras       []Extra
 	extraWorkers []jobs.Worker
@@ -133,6 +134,7 @@ type APIBuilder struct {
 func NewAPIBuilder(
 	onlyApiServer bool,
 	repoFactory repository.Factory,
+	connectionFactory connection.Factory,
 	features featuremgmt.FeatureToggles,
 	unified resource.ResourceClient,
 	configProvider apiserver.RestConfigProvider,
@@ -176,6 +178,7 @@ func NewAPIBuilder(
 		usageStats:                          usageStats,
 		features:                            features,
 		repoFactory:                         repoFactory,
+		connectionFactory:                   connectionFactory,
 		clients:                             clients,
 		parsers:                             parsers,
 		repositoryResources:                 resources.NewRepositoryResourcesFactory(parsers, clients, resourceLister),
@@ -192,7 +195,7 @@ func NewAPIBuilder(
 		allowedTargets:                      allowedTargets,
 		allowImageRendering:                 allowImageRendering,
 		registry:                            registry,
-		validator:                           repository.NewValidator(minSyncInterval, allowedTargets, allowImageRendering),
+		repoValidator:                       repository.NewValidator(minSyncInterval, allowedTargets, allowImageRendering),
 		useExclusivelyAccessCheckerForAuthz: useExclusivelyAccessCheckerForAuthz,
 	}
 
@@ -253,6 +256,7 @@ func RegisterAPIService(
 	extraBuilders []ExtraBuilder,
 	extraWorkers []jobs.Worker,
 	repoFactory repository.Factory,
+	connectionFactory connection.Factory,
 ) (*APIBuilder, error) {
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if !features.IsEnabledGlobally(featuremgmt.FlagProvisioning) {
@@ -271,6 +275,7 @@ func RegisterAPIService(
 	builder := NewAPIBuilder(
 		cfg.DisableControllers,
 		repoFactory,
+		connectionFactory,
 		features,
 		client,
 		configProvider,
@@ -559,6 +564,22 @@ func (b *APIBuilder) InstallSchema(scheme *runtime.Scheme) error {
 		return err
 	}
 
+	// Register custom field label conversion for Repository to enable field selectors like spec.connection.name
+	err = scheme.AddFieldLabelConversionFunc(
+		provisioning.SchemeGroupVersion.WithKind("Repository"),
+		func(label, value string) (string, string, error) {
+			switch label {
+			case "metadata.name", "metadata.namespace", "spec.connection.name":
+				return label, value, nil
+			default:
+				return "", "", fmt.Errorf("field label not supported for Repository: %s", label)
+			}
+		},
+	)
+	if err != nil {
+		return err
+	}
+
 	metav1.AddToGroupVersion(scheme, provisioning.SchemeGroupVersion)
 	// Only 1 version (for now?)
 	return scheme.SetVersionPriority(provisioning.SchemeGroupVersion)
@@ -569,10 +590,19 @@ func (b *APIBuilder) AllowedV0Alpha1Resources() []string {
 }
 
 func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupInfo, opts builder.APIGroupOptions) error {
-	repositoryStorage, err := grafanaregistry.NewRegistryStore(opts.Scheme, provisioning.RepositoryResourceInfo, opts.OptsGetter)
+	// Create repository storage with custom field selectors (e.g., spec.connection.name)
+	repositoryStorage, err := grafanaregistry.NewRegistryStoreWithSelectableFields(
+		opts.Scheme,
+		provisioning.RepositoryResourceInfo,
+		opts.OptsGetter,
+		grafanaregistry.SelectableFieldsOptions{
+			GetAttrs: RepositoryGetAttrs,
+		},
+	)
 	if err != nil {
 		return fmt.Errorf("failed to create repository storage: %w", err)
 	}
+
 	repositoryStatusStorage := grafanaregistry.NewRegistryStatusStore(opts.Scheme, repositoryStorage)
 	b.store = repositoryStorage
 
@@ -616,7 +646,7 @@ func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupI
 	storage[provisioning.ConnectionResourceInfo.StoragePath("repositories")] = NewConnectionRepositoriesConnector()
 
 	// TODO: Add some logic so that the connectors can registered themselves and we don't have logic all over the place
-	storage[provisioning.RepositoryResourceInfo.StoragePath("test")] = NewTestConnector(b, repository.NewRepositoryTesterWithExistingChecker(repository.NewSimpleRepositoryTester(b.validator), b.VerifyAgainstExistingRepositories))
+	storage[provisioning.RepositoryResourceInfo.StoragePath("test")] = NewTestConnector(b, repository.NewRepositoryTesterWithExistingChecker(repository.NewSimpleRepositoryTester(b.repoValidator), b.VerifyAgainstExistingRepositories))
 	storage[provisioning.RepositoryResourceInfo.StoragePath("files")] = NewFilesConnector(b, b.parsers, b.clients, b.accessWithAdmin)
 	storage[provisioning.RepositoryResourceInfo.StoragePath("refs")] = NewRefsConnector(b)
 	storage[provisioning.RepositoryResourceInfo.StoragePath("resources")] = &listConnector{
@@ -657,10 +687,15 @@ func (b *APIBuilder) Mutate(ctx context.Context, a admission.Attributes, o admis
 	if ok {
 		return nil
 	}
-	// TODO: complete this as part of https://github.com/grafana/git-ui-sync-project/issues/700
+
 	c, ok := obj.(*provisioning.Connection)
 	if ok {
-		return connectionvalidation.MutateConnection(c)
+		conn, err := b.asConnection(ctx, c, nil)
+		if err != nil {
+			return err
+		}
+
+		return conn.Mutate(ctx)
 	}
 
 	r, ok := obj.(*provisioning.Repository)
@@ -711,9 +746,15 @@ func (b *APIBuilder) Validate(ctx context.Context, a admission.Attributes, o adm
 		return nil
 	}
 
-	connection, ok := obj.(*provisioning.Connection)
+	// Validate connections
+	c, ok := obj.(*provisioning.Connection)
 	if ok {
-		return connectionvalidation.ValidateConnection(connection)
+		conn, err := b.asConnection(ctx, c, a.GetOldObject())
+		if err != nil {
+			return err
+		}
+
+		return conn.Validate(ctx)
 	}
 
 	// Validate Jobs
@@ -733,7 +774,7 @@ func (b *APIBuilder) Validate(ctx context.Context, a admission.Attributes, o adm
 	// the only time to add configuration checks here is if you need to compare
 	// the incoming change to the current configuration
 	isCreate := a.GetOperation() == admission.Create
-	list := b.validator.ValidateRepository(repo, isCreate)
+	list := b.repoValidator.ValidateRepository(repo, isCreate)
 	cfg := repo.Config()
 
 	if a.GetOperation() == admission.Update {
@@ -806,7 +847,7 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 			}
 
 			b.statusPatcher = appcontroller.NewRepositoryStatusPatcher(b.GetClient())
-			b.healthChecker = controller.NewHealthChecker(b.statusPatcher, b.registry, repository.NewSimpleRepositoryTester(b.validator))
+			b.healthChecker = controller.NewHealthChecker(b.statusPatcher, b.registry, repository.NewSimpleRepositoryTester(b.repoValidator))
 
 			// if running solely CRUD, skip the rest of the setup
 			if b.onlyApiServer {
@@ -1424,6 +1465,35 @@ func (b *APIBuilder) asRepository(ctx context.Context, obj runtime.Object, old r
 	return b.repoFactory.Build(ctx, r)
 }
 
+func (b *APIBuilder) asConnection(ctx context.Context, obj runtime.Object, old runtime.Object) (connection.Connection, error) {
+	if obj == nil {
+		return nil, fmt.Errorf("missing connection object")
+	}
+
+	c, ok := obj.(*provisioning.Connection)
+	if !ok {
+		return nil, fmt.Errorf("expected connection object")
+	}
+
+	// Copy previous values if they exist
+	if old != nil {
+		o, ok := old.(*provisioning.Connection)
+		if ok && !o.Secure.IsZero() {
+			if c.Secure.PrivateKey.IsZero() {
+				c.Secure.PrivateKey = o.Secure.PrivateKey
+			}
+			if c.Secure.Token.IsZero() {
+				c.Secure.Token = o.Secure.Token
+			}
+			if c.Secure.ClientSecret.IsZero() {
+				c.Secure.ClientSecret = o.Secure.ClientSecret
+			}
+		}
+	}
+
+	return b.connectionFactory.Build(ctx, c)
+}
+
 func getJSONResponse(ref string) *spec3.Responses {
 	return &spec3.Responses{
 		ResponsesProps: spec3.ResponsesProps{

pkg/registry/apis/provisioning/register_validate_test.go

@@ -28,7 +28,7 @@ func TestAPIBuilderValidate(t *testing.T) {
 		repoFactory:         factory,
 		allowedTargets:      []v0alpha1.SyncTargetType{v0alpha1.SyncTargetTypeFolder},
 		allowImageRendering: false,
-		validator:           validator,
+		repoValidator:       validator,
 	}
 
 	t.Run("min sync interval is less than 10 seconds", func(t *testing.T) {

pkg/registry/apis/provisioning/repository_fields.go

@@ -0,0 +1,44 @@
+package provisioning
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/registry/generic"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+// RepositoryToSelectableFields returns a field set that can be used for field selectors.
+// This includes standard metadata fields plus custom fields like spec.connection.name.
+func RepositoryToSelectableFields(obj *provisioning.Repository) fields.Set {
+	objectMetaFields := generic.ObjectMetaFieldsSet(&obj.ObjectMeta, true)
+
+	// Add custom selectable fields
+	specificFields := fields.Set{
+		"spec.connection.name": getConnectionName(obj),
+	}
+
+	return generic.MergeFieldsSets(objectMetaFields, specificFields)
+}
+
+// getConnectionName safely extracts the connection name from a Repository.
+// Returns empty string if no connection is configured.
+func getConnectionName(obj *provisioning.Repository) string {
+	if obj == nil || obj.Spec.Connection == nil {
+		return ""
+	}
+	return obj.Spec.Connection.Name
+}
+
+// RepositoryGetAttrs returns labels and fields of a Repository object.
+// This is used by the storage layer for filtering.
+func RepositoryGetAttrs(obj runtime.Object) (labels.Set, fields.Set, error) {
+	repo, ok := obj.(*provisioning.Repository)
+	if !ok {
+		return nil, nil, fmt.Errorf("given object is not a Repository")
+	}
+	return labels.Set(repo.Labels), RepositoryToSelectableFields(repo), nil
+}

pkg/registry/apis/provisioning/repository_fields_test.go

@@ -0,0 +1,184 @@
+package provisioning
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+func TestGetConnectionName(t *testing.T) {
+	tests := []struct {
+		name     string
+		repo     *provisioning.Repository
+		expected string
+	}{
+		{
+			name:     "nil repository returns empty string",
+			repo:     nil,
+			expected: "",
+		},
+		{
+			name: "repository without connection returns empty string",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "repository with connection returns connection name",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "my-connection",
+					},
+				},
+			},
+			expected: "my-connection",
+		},
+		{
+			name: "repository with empty connection name returns empty string",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "",
+					},
+				},
+			},
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getConnectionName(tt.repo)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestRepositoryToSelectableFields(t *testing.T) {
+	tests := []struct {
+		name           string
+		repo           *provisioning.Repository
+		expectedFields map[string]string
+	}{
+		{
+			name: "includes metadata.name and metadata.namespace",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-repo",
+					Namespace: "default",
+				},
+				Spec: provisioning.RepositorySpec{
+					Title: "Test Repository",
+				},
+			},
+			expectedFields: map[string]string{
+				"metadata.name":        "test-repo",
+				"metadata.namespace":   "default",
+				"spec.connection.name": "",
+			},
+		},
+		{
+			name: "includes spec.connection.name when set",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "repo-with-connection",
+					Namespace: "org-1",
+				},
+				Spec: provisioning.RepositorySpec{
+					Title: "Repo With Connection",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "github-connection",
+					},
+				},
+			},
+			expectedFields: map[string]string{
+				"metadata.name":        "repo-with-connection",
+				"metadata.namespace":   "org-1",
+				"spec.connection.name": "github-connection",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fields := RepositoryToSelectableFields(tt.repo)
+
+			for key, expectedValue := range tt.expectedFields {
+				actualValue, exists := fields[key]
+				assert.True(t, exists, "field %s should exist", key)
+				assert.Equal(t, expectedValue, actualValue, "field %s should have correct value", key)
+			}
+		})
+	}
+}
+
+func TestRepositoryGetAttrs(t *testing.T) {
+	t.Run("returns error for non-Repository object", func(t *testing.T) {
+		// Pass a different runtime.Object type instead of a Repository
+		connection := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "not-a-repository",
+			},
+		}
+		_, _, err := RepositoryGetAttrs(connection)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not a Repository")
+	})
+
+	t.Run("returns labels and fields for valid Repository", func(t *testing.T) {
+		repo := &provisioning.Repository{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-repo",
+				Namespace: "default",
+				Labels: map[string]string{
+					"app": "grafana",
+					"env": "test",
+				},
+			},
+			Spec: provisioning.RepositorySpec{
+				Title: "Test Repository",
+				Connection: &provisioning.ConnectionInfo{
+					Name: "my-connection",
+				},
+			},
+		}
+
+		labels, fields, err := RepositoryGetAttrs(repo)
+		require.NoError(t, err)
+
+		// Check labels
+		assert.Equal(t, "grafana", labels["app"])
+		assert.Equal(t, "test", labels["env"])
+
+		// Check fields
+		assert.Equal(t, "test-repo", fields["metadata.name"])
+		assert.Equal(t, "default", fields["metadata.namespace"])
+		assert.Equal(t, "my-connection", fields["spec.connection.name"])
+	})
+
+	t.Run("returns empty connection name when not set", func(t *testing.T) {
+		repo := &provisioning.Repository{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-repo",
+				Namespace: "default",
+			},
+			Spec: provisioning.RepositorySpec{
+				Title: "Test Repository",
+			},
+		}
+
+		_, fields, err := RepositoryGetAttrs(repo)
+		require.NoError(t, err)
+		assert.Equal(t, "", fields["spec.connection.name"])
+	})
+}

pkg/registry/apis/provisioning/resources/folders.go

@@ -20,6 +20,21 @@ import (
 
 const MaxNumberOfFolders = 10000
 
+// PathCreationError represents an error that occurred while creating a folder path.
+// It contains the path that failed and the underlying error.
+type PathCreationError struct {
+	Path string
+	Err  error
+}
+
+func (e *PathCreationError) Unwrap() error {
+	return e.Err
+}
+
+func (e *PathCreationError) Error() string {
+	return fmt.Sprintf("failed to create path %s: %v", e.Path, e.Err)
+}
+
 type FolderManager struct {
 	repo   repository.ReaderWriter
 	tree   FolderTree
@@ -73,7 +88,11 @@ func (fm *FolderManager) EnsureFolderPathExist(ctx context.Context, filePath str
 		}
 
 		if err := fm.EnsureFolderExists(ctx, f, parent); err != nil {
-			return fmt.Errorf("ensure folder exists: %w", err)
+			// Wrap in PathCreationError to indicate which path failed
+			return &PathCreationError{
+				Path: f.Path,
+				Err:  fmt.Errorf("ensure folder exists: %w", err),
+			}
 		}
 
 		fm.tree.Add(f, parent)

pkg/registry/apis/provisioning/resources/folders_test.go

@@ -0,0 +1,68 @@
+package resources_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPathCreationError(t *testing.T) {
+	t.Run("Error method returns formatted message", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		expectedMsg := "failed to create path grafana/folder-1: underlying error"
+		require.Equal(t, expectedMsg, pathErr.Error())
+	})
+
+	t.Run("Unwrap returns underlying error", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		unwrapped := pathErr.Unwrap()
+		require.Equal(t, underlyingErr, unwrapped)
+		require.EqualError(t, unwrapped, "underlying error")
+	})
+
+	t.Run("errors.Is finds underlying error", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		require.True(t, errors.Is(pathErr, underlyingErr))
+		require.False(t, errors.Is(pathErr, fmt.Errorf("different error")))
+	})
+
+	t.Run("errors.As extracts PathCreationError", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		var extractedErr *resources.PathCreationError
+		require.True(t, errors.As(pathErr, &extractedErr))
+		require.NotNil(t, extractedErr)
+		require.Equal(t, "grafana/folder-1", extractedErr.Path)
+		require.Equal(t, underlyingErr, extractedErr.Err)
+	})
+
+	t.Run("errors.As returns false for non-PathCreationError", func(t *testing.T) {
+		regularErr := fmt.Errorf("regular error")
+
+		var extractedErr *resources.PathCreationError
+		require.False(t, errors.As(regularErr, &extractedErr))
+		require.Nil(t, extractedErr)
+	})
+}

pkg/registry/apis/wireset.go

@@ -44,6 +44,7 @@ var provisioningExtras = wire.NewSet(
 	pullrequest.ProvidePullRequestWorker,
 	webhooks.ProvideWebhooksWithImages,
 	extras.ProvideFactoryFromConfig,
+	extras.ProvideConnectionFactoryFromConfig,
 	extras.ProvideProvisioningExtraAPIs,
 	extras.ProvideExtraWorkers,
 )

pkg/server/test_env.go

@@ -3,6 +3,7 @@ package server
 import (
 	"github.com/stretchr/testify/mock"
 
+	githubconnection "github.com/grafana/grafana/apps/provisioning/pkg/connection/github"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository/github"
 	"github.com/grafana/grafana/apps/secret/pkg/decrypt"
 	"github.com/grafana/grafana/pkg/infra/db"
@@ -34,24 +35,26 @@ func ProvideTestEnv(
 	featureMgmt featuremgmt.FeatureToggles,
 	resourceClient resource.ResourceClient,
 	idService auth.IDService,
-	githubFactory *github.Factory,
+	githubRepoFactory *github.Factory,
+	githubConnectionFactory githubconnection.GithubFactory,
 	decryptService decrypt.DecryptService,
 ) (*TestEnv, error) {
 	return &TestEnv{
-		TestingT:            testingT,
-		Server:              server,
-		SQLStore:            db,
-		Cfg:                 cfg,
-		NotificationService: ns,
-		GRPCServer:          grpcServer,
-		PluginRegistry:      pluginRegistry,
-		HTTPClientProvider:  httpClientProvider,
-		OAuthTokenService:   oAuthTokenService,
-		FeatureToggles:      featureMgmt,
-		ResourceClient:      resourceClient,
-		IDService:           idService,
-		GitHubFactory:       githubFactory,
-		DecryptService:      decryptService,
+		TestingT:                testingT,
+		Server:                  server,
+		SQLStore:                db,
+		Cfg:                     cfg,
+		NotificationService:     ns,
+		GRPCServer:              grpcServer,
+		PluginRegistry:          pluginRegistry,
+		HTTPClientProvider:      httpClientProvider,
+		OAuthTokenService:       oAuthTokenService,
+		FeatureToggles:          featureMgmt,
+		ResourceClient:          resourceClient,
+		IDService:               idService,
+		GithubRepoFactory:       githubRepoFactory,
+		GithubConnectionFactory: githubConnectionFactory,
+		DecryptService:          decryptService,
 	}, nil
 }
 
@@ -60,18 +63,19 @@ type TestEnv struct {
 		mock.TestingT
 		Cleanup(func())
 	}
-	Server              *Server
-	SQLStore            db.DB
-	Cfg                 *setting.Cfg
-	NotificationService *notifications.NotificationServiceMock
-	GRPCServer          grpcserver.Provider
-	PluginRegistry      registry.Service
-	HTTPClientProvider  httpclient.Provider
-	OAuthTokenService   *oauthtokentest.Service
-	RequestMiddleware   web.Middleware
-	FeatureToggles      featuremgmt.FeatureToggles
-	ResourceClient      resource.ResourceClient
-	IDService           auth.IDService
-	GitHubFactory       *github.Factory
-	DecryptService      decrypt.DecryptService
+	Server                  *Server
+	SQLStore                db.DB
+	Cfg                     *setting.Cfg
+	NotificationService     *notifications.NotificationServiceMock
+	GRPCServer              grpcserver.Provider
+	PluginRegistry          registry.Service
+	HTTPClientProvider      httpclient.Provider
+	OAuthTokenService       *oauthtokentest.Service
+	RequestMiddleware       web.Middleware
+	FeatureToggles          featuremgmt.FeatureToggles
+	ResourceClient          resource.ResourceClient
+	IDService               auth.IDService
+	GithubRepoFactory       *github.Factory
+	GithubConnectionFactory githubconnection.GithubFactory
+	DecryptService          decrypt.DecryptService
 }

pkg/server/wire.go

@@ -15,6 +15,7 @@ import (
 	"go.opentelemetry.io/otel/trace"
 
 	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	ghconnection "github.com/grafana/grafana/apps/provisioning/pkg/connection/github"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository/github"
 	"github.com/grafana/grafana/pkg/api"
 	"github.com/grafana/grafana/pkg/api/avatar"
@@ -297,6 +298,7 @@ var wireBasicSet = wire.NewSet(
 	notifications.ProvideService,
 	notifications.ProvideSmtpService,
 	github.ProvideFactory,
+	ghconnection.ProvideFactory,
 	tracing.ProvideService,
 	tracing.ProvideTracingConfig,
 	wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)),

pkg/server/wireexts_oss.go

@@ -72,6 +72,7 @@ import (
 
 var provisioningExtras = wire.NewSet(
 	extras.ProvideProvisioningOSSRepositoryExtras,
+	extras.ProvideProvisioningOSSConnectionExtras,
 )
 
 var configProviderExtras = wire.NewSet(

pkg/services/featuremgmt/registry.go

@@ -872,13 +872,6 @@ var (
 			Owner:        grafanaSharingSquad,
 			FrontendOnly: false,
 		},
-		{
-			Name:         "logsExploreTableDefaultVisualization",
-			Description:  "Sets the logs table as default visualisation in logs explore",
-			Stage:        FeatureStageExperimental,
-			Owner:        grafanaObservabilityLogsSquad,
-			FrontendOnly: true,
-		},
 		{
 			Name:         "alertingListViewV2",
 			Description:  "Enables the new alert list view design",
@@ -1087,13 +1080,6 @@ var (
 			Stage:       FeatureStageExperimental,
 			Owner:       identityAccessTeam,
 		},
-		{
-			Name:         "unifiedStorageSearch",
-			Description:  "Enable unified storage search",
-			Stage:        FeatureStageExperimental,
-			Owner:        grafanaSearchAndStorageSquad,
-			HideFromDocs: true,
-		},
 		{
 			Name:         "unifiedStorageSearchSprinkles",
 			Description:  "Enable sprinkles on unified storage search",
@@ -1585,8 +1571,8 @@ var (
 		},
 		{
 			Name:         "kubernetesAuthzApis",
-			Description:  "Registers AuthZ /apis endpoint",
-			Stage:        FeatureStageExperimental,
+			Description:  "Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead",
+			Stage:        FeatureStageDeprecated,
 			Owner:        identityAccessTeam,
 			HideFromDocs: true,
 		},
@@ -1611,6 +1597,27 @@ var (
 			Owner:        identityAccessTeam,
 			HideFromDocs: true,
 		},
+		{
+			Name:         "kubernetesAuthzCoreRolesApi",
+			Description:  "Registers AuthZ Core Roles /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
+		{
+			Name:         "kubernetesAuthzRolesApi",
+			Description:  "Registers AuthZ Roles /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
+		{
+			Name:         "kubernetesAuthzRoleBindingsApi",
+			Description:  "Registers AuthZ Role Bindings /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
 		{
 			Name:         "kubernetesAuthnMutation",
 			Description:  "Enables create, delete, and update mutations for resources owned by IAM identity",
@@ -1859,14 +1866,6 @@ var (
 			Expression:      "false",
 			RequiresRestart: true,
 		},
-		{
-			Name:            "tempoSearchBackendMigration",
-			Description:     "Run search queries through the tempo backend",
-			Stage:           FeatureStageGeneralAvailability,
-			Owner:           grafanaOSSBigTent,
-			Expression:      "false",
-			RequiresRestart: true,
-		},
 		{
 			Name:         "cdnPluginsLoadFirst",
 			Description:  "Prioritize loading plugins from the CDN before other sources",

pkg/services/featuremgmt/toggles_gen.csv

@@ -120,7 +120,6 @@ queryLibrary,preview,@grafana/sharing-squad,false,false,false
 dashboardLibrary,experimental,@grafana/sharing-squad,false,false,false
 suggestedDashboards,experimental,@grafana/sharing-squad,false,false,false
 dashboardTemplates,preview,@grafana/sharing-squad,false,false,false
-logsExploreTableDefaultVisualization,experimental,@grafana/observability-logs,false,false,true
 alertingListViewV2,privatePreview,@grafana/alerting-squad,false,false,true
 alertingSavedSearches,experimental,@grafana/alerting-squad,false,false,true
 alertingDisableSendAlertsExternal,experimental,@grafana/alerting-squad,false,false,false
@@ -150,7 +149,6 @@ alertingQueryAndExpressionsStepMode,GA,@grafana/alerting-squad,false,false,true
 improvedExternalSessionHandling,GA,@grafana/identity-access-team,false,false,false
 useSessionStorageForRedirection,GA,@grafana/identity-access-team,false,false,false
 rolePickerDrawer,experimental,@grafana/identity-access-team,false,false,false
-unifiedStorageSearch,experimental,@grafana/search-and-storage,false,false,false
 unifiedStorageSearchSprinkles,experimental,@grafana/search-and-storage,false,false,false
 managedDualWriter,experimental,@grafana/search-and-storage,false,false,false
 pluginsSriChecks,GA,@grafana/plugins-platform-backend,false,false,false
@@ -217,10 +215,13 @@ pluginsAutoUpdate,experimental,@grafana/plugins-platform-backend,false,false,fal
 alertingListViewV2PreviewToggle,privatePreview,@grafana/alerting-squad,false,false,true
 alertRuleUseFiredAtForStartsAt,experimental,@grafana/alerting-squad,false,false,false
 alertingBulkActionsInUI,GA,@grafana/alerting-squad,false,false,true
-kubernetesAuthzApis,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzApis,deprecated,@grafana/identity-access-team,false,false,false
 kubernetesAuthZHandlerRedirect,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthzResourcePermissionApis,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthzZanzanaSync,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzCoreRolesApi,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzRolesApi,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzRoleBindingsApi,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthnMutation,experimental,@grafana/identity-access-team,false,false,false
 kubernetesExternalGroupMapping,experimental,@grafana/identity-access-team,false,false,false
 restoreDashboards,experimental,@grafana/grafana-search-navigate-organise,false,false,false
@@ -253,7 +254,6 @@ graphiteBackendMode,privatePreview,@grafana/partner-datasources,false,false,fals
 azureResourcePickerUpdates,GA,@grafana/partner-datasources,false,false,true
 prometheusTypeMigration,experimental,@grafana/partner-datasources,false,true,false
 pluginContainers,privatePreview,@grafana/plugins-platform-backend,false,true,false
-tempoSearchBackendMigration,GA,@grafana/oss-big-tent,false,true,false
 cdnPluginsLoadFirst,experimental,@grafana/plugins-platform-backend,false,false,false
 cdnPluginsUrls,experimental,@grafana/plugins-platform-backend,false,false,false
 pluginInstallAPISync,experimental,@grafana/plugins-platform-backend,false,false,false

pkg/services/featuremgmt/toggles_gen.go

@@ -455,10 +455,6 @@ const (
 	// Enables the new role picker drawer design
 	FlagRolePickerDrawer = "rolePickerDrawer"
 
-	// FlagUnifiedStorageSearch
-	// Enable unified storage search
-	FlagUnifiedStorageSearch = "unifiedStorageSearch"
-
 	// FlagUnifiedStorageSearchSprinkles
 	// Enable sprinkles on unified storage search
 	FlagUnifiedStorageSearchSprinkles = "unifiedStorageSearchSprinkles"
@@ -631,7 +627,7 @@ const (
 	FlagAlertRuleUseFiredAtForStartsAt = "alertRuleUseFiredAtForStartsAt"
 
 	// FlagKubernetesAuthzApis
-	// Registers AuthZ /apis endpoint
+	// Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead
 	FlagKubernetesAuthzApis = "kubernetesAuthzApis"
 
 	// FlagKubernetesAuthZHandlerRedirect
@@ -646,6 +642,18 @@ const (
 	// Enable sync of Zanzana authorization store on AuthZ CRD mutations
 	FlagKubernetesAuthzZanzanaSync = "kubernetesAuthzZanzanaSync"
 
+	// FlagKubernetesAuthzCoreRolesApi
+	// Registers AuthZ Core Roles /apis endpoint
+	FlagKubernetesAuthzCoreRolesApi = "kubernetesAuthzCoreRolesApi"
+
+	// FlagKubernetesAuthzRolesApi
+	// Registers AuthZ Roles /apis endpoint
+	FlagKubernetesAuthzRolesApi = "kubernetesAuthzRolesApi"
+
+	// FlagKubernetesAuthzRoleBindingsApi
+	// Registers AuthZ Role Bindings /apis endpoint
+	FlagKubernetesAuthzRoleBindingsApi = "kubernetesAuthzRoleBindingsApi"
+
 	// FlagKubernetesAuthnMutation
 	// Enables create, delete, and update mutations for resources owned by IAM identity
 	FlagKubernetesAuthnMutation = "kubernetesAuthnMutation"
@@ -730,10 +738,6 @@ const (
 	// Enables running plugins in containers
 	FlagPluginContainers = "pluginContainers"
 
-	// FlagTempoSearchBackendMigration
-	// Run search queries through the tempo backend
-	FlagTempoSearchBackendMigration = "tempoSearchBackendMigration"
-
 	// FlagCdnPluginsLoadFirst
 	// Prioritize loading plugins from the CDN before other sources
 	FlagCdnPluginsLoadFirst = "cdnPluginsLoadFirst"

pkg/services/featuremgmt/toggles_gen.json

@@ -1951,11 +1951,27 @@
     {
       "metadata": {
         "name": "kubernetesAuthzApis",
-        "resourceVersion": "1764664939750",
-        "creationTimestamp": "2025-06-18T07:43:01Z"
+        "resourceVersion": "1767954559317",
+        "creationTimestamp": "2025-06-18T07:43:01Z",
+        "annotations": {
+          "grafana.app/updatedTimestamp": "2026-01-09 10:29:19.317164 +0000 UTC"
+        }
       },
       "spec": {
-        "description": "Registers AuthZ /apis endpoint",
+        "description": "Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead",
+        "stage": "deprecated",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzCoreRolesApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Core Roles /apis endpoint",
         "stage": "experimental",
         "codeowner": "@grafana/identity-access-team",
         "hideFromDocs": true
@@ -1975,6 +1991,32 @@
         "hideFromDocs": true
       }
     },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzRoleBindingsApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Role Bindings /apis endpoint",
+        "stage": "experimental",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzRolesApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Roles /apis endpoint",
+        "stage": "experimental",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
     {
       "metadata": {
         "name": "kubernetesAuthzZanzanaSync",
@@ -2204,7 +2246,8 @@
       "metadata": {
         "name": "logsExploreTableDefaultVisualization",
         "resourceVersion": "1764664939750",
-        "creationTimestamp": "2024-05-02T15:28:15Z"
+        "creationTimestamp": "2024-05-02T15:28:15Z",
+        "deletionTimestamp": "2026-01-12T14:11:46Z"
       },
       "spec": {
         "description": "Sets the logs table as default visualisation in logs explore",
@@ -3655,7 +3698,8 @@
       "metadata": {
         "name": "unifiedStorageSearch",
         "resourceVersion": "1764664939750",
-        "creationTimestamp": "2024-09-30T19:46:14Z"
+        "creationTimestamp": "2024-09-30T19:46:14Z",
+        "deletionTimestamp": "2026-01-12T10:02:12Z"
       },
       "spec": {
         "description": "Enable unified storage search",

pkg/services/store/kind/dashboard/ds_lookup.go

@@ -100,6 +100,9 @@ func (d *DsLookup) ByRef(ref *DataSourceRef) *DataSourceRef {
 	if ref == nil {
 		return d.defaultDS
 	}
+	if ref.UID == "default" && ref.Type == "" {
+		return d.defaultDS
+	}
 
 	key := ""
 	if ref.UID != "" {
@@ -117,7 +120,13 @@ func (d *DsLookup) ByRef(ref *DataSourceRef) *DataSourceRef {
 		return ds
 	}
 
-	return d.byName[key]
+	ds, ok = d.byName[key]
+	if ok {
+		return ds
+	}
+
+	// With nothing was found (or configured), use the original reference
+	return ref
 }
 
 func (d *DsLookup) ByType(dsType string) []DataSourceRef {

pkg/services/store/kind/dashboard/testdata/panel-with-library-panel-field-info.json

@@ -4,8 +4,8 @@
   "tags": null,
   "datasource": [
     {
-      "uid": "default.uid",
-      "type": "default.type"
+      "uid": "000000001",
+      "type": "graphite"
     }
   ],
   "panels": [
@@ -16,8 +16,8 @@
       "libraryPanel": "dfkljg98345dkf",
       "datasource": [
         {
-          "uid": "default.uid",
-          "type": "default.type"
+          "uid": "000000001",
+          "type": "graphite"
         }
       ]
     }

pkg/services/store/kind/dashboard/types.go

@@ -1,5 +1,7 @@
 package dashboard
 
+import "iter"
+
 type PanelSummaryInfo struct {
 	ID            int64           `json:"id"`
 	Title         string          `json:"title"`
@@ -30,3 +32,20 @@ type DashboardSummaryInfo struct {
 	Refresh       string             `json:"refresh,omitempty"`
 	ReadOnly      bool               `json:"readOnly,omitempty"` // editable = false
 }
+
+func (d *DashboardSummaryInfo) PanelIterator() iter.Seq[PanelSummaryInfo] {
+	return func(yield func(PanelSummaryInfo) bool) {
+		for _, p := range d.Panels {
+			if len(p.Collapsed) > 0 {
+				for _, c := range p.Collapsed {
+					if !yield(c) { // NOTE, rows can only be one level deep!
+						return
+					}
+				}
+			}
+			if !yield(p) {
+				return
+			}
+		}
+	}
+}

pkg/storage/unified/README.md

@@ -236,7 +236,6 @@ kubernetesDashboards = true
 kubernetesFolders = true
 unifiedStorage = true
 unifiedStorageHistoryPruner = true
-unifiedStorageSearch = true
 unifiedStorageSearchPermissionFiltering = false
 unifiedStorageSearchSprinkles = false
 

pkg/storage/unified/resource/search.go

@@ -863,7 +863,7 @@ func newRebuildRequest(key NamespacedResource, minBuildTime, lastImportTime time
 
 func (s *searchSupport) getOrCreateIndex(ctx context.Context, stats *SearchStats, key NamespacedResource, reason string) (ResourceIndex, error) {
 	if s == nil || s.search == nil {
-		return nil, fmt.Errorf("search is not configured properly (missing unifiedStorageSearch feature toggle?)")
+		return nil, fmt.Errorf("search is not configured properly (missing enable_search config?)")
 	}
 
 	ctx, span := tracer.Start(ctx, "resource.searchSupport.getOrCreateIndex")