Update .github/CODEOWNERS

Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>

.github/CODEOWNERS

@@ -77,11 +77,11 @@
 /.air.toml @macabu
 
 # Git Sync / App Platform Provisioning
-/apps/provisioning/ @grafana/grafana-git-ui-sync-team
-/pkg/operators @grafana/grafana-git-ui-sync-team
-/public/app/features/provisioning @grafana/grafana-git-ui-sync-team
-/pkg/registry/apis/provisioning @grafana/grafana-git-ui-sync-team
-/pkg/tests/apis/provisioning @grafana/grafana-git-ui-sync-team
+/apps/provisioning/ @grafana/grafana-app-platform-squad
+/pkg/operators @grafana/grafana-app-platform-squad
+/public/app/features/provisioning @grafana/grafana-search-navigate-organise
+/pkg/registry/apis/provisioning @grafana/grafana-app-platform-squad
+/pkg/tests/apis/provisioning @grafana/grafana-app-platform-squad
 # Git Sync frontend owned by frontend team as a whole.
 
 /apps/alerting/ @grafana/alerting-backend
@@ -753,7 +753,7 @@ i18next.config.ts @grafana/grafana-frontend-platform
 /packages/grafana-api-clients/src/clients/rtkq/iam/ @grafana/access-squad @grafana/identity-squad
 /packages/grafana-api-clients/src/clients/rtkq/logsdrilldown/ @grafana/observability-logs
 /packages/grafana-api-clients/src/clients/rtkq/preferences/ @grafana/plugins-platform-frontend
-/packages/grafana-api-clients/src/clients/rtkq/provisioning/ @grafana/grafana-git-ui-sync-team
+/packages/grafana-api-clients/src/clients/rtkq/provisioning/ @grafana/grafana-search-navigate-organise
 /packages/grafana-api-clients/src/clients/rtkq/shorturl/ @grafana/sharing-squad
 
 # root files, mostly frontend
@@ -1084,7 +1084,7 @@ playwright.storybook.config.ts @grafana/grafana-frontend-platform
 eslint-suppressions.json @grafanabot
 
 # Design system
-/public/img/icons/unicons/ @grafana/design-system
+/public/img/icons/unicons/ @grafana/product-design-engineering
 
 # Core datasources
 /public/app/plugins/datasource/dashboard/ @grafana/dashboards-squad
@@ -1260,11 +1260,11 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/stale.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/storybook-a11y.yml @grafana/grafana-frontend-platform
 /.github/workflows/update-make-docs.yml @grafana/docs-tooling
-/.github/workflows/scripts/kinds/verify-kinds.go @grafana/platform-monitoring
+/.github/workflows/scripts/kinds/verify-kinds.go @grafana/grafana-app-platform-squad
 /.github/workflows/scripts/create-security-branch/create-security-branch.sh @grafana/grafana-developer-enablement-squad
-/.github/workflows/publish-kinds-next.yml @grafana/platform-monitoring
-/.github/workflows/publish-kinds-release.yml @grafana/platform-monitoring
-/.github/workflows/verify-kinds.yml @grafana/platform-monitoring
+/.github/workflows/publish-kinds-next.yml @grafana/grafana-app-platform-squad
+/.github/workflows/publish-kinds-release.yml @grafana/grafana-app-platform-squad
+/.github/workflows/verify-kinds.yml @grafana/grafana-app-platform-squad
 /.github/workflows/dashboards-issue-add-label.yml @grafana/dashboards-squad
 /.github/workflows/run-schema-v2-e2e.yml  @grafana/dashboards-squad
 /.github/workflows/run-dashboard-search-e2e.yml  @grafana/grafana-search-and-storage
@@ -1325,7 +1325,7 @@ embed.go @grafana/grafana-as-code
 /conf/provisioning/dashboards/ @grafana/dashboards-squad
 /conf/provisioning/datasources/ @grafana/plugins-platform-backend
 /conf/provisioning/plugins/ @grafana/plugins-platform-backend
-/conf/provisioning/sample/ @grafana/grafana-git-ui-sync-team
+/conf/provisioning/sample/ @grafana/grafana-app-platform-squad
 
 # Security
 /relyance.yaml @grafana/security-team

apps/dashboard/pkg/migration/testdata/dev-dashboards-output/panel-gauge/gauge_tests_new.v42.json

@@ -1603,7 +1603,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1671,7 +1670,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 98,
           "min": 5,
           "noise": 22,
@@ -1689,7 +1687,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1757,7 +1754,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 98,
           "min": 5,
           "noise": 22,
@@ -1788,7 +1784,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1857,7 +1852,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 8,
           "min": 1,
           "noise": 2,
@@ -1875,7 +1869,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1944,7 +1937,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 12,
           "min": 1,
           "noise": 2,
@@ -1962,7 +1954,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -2030,7 +2021,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 100,
           "min": 10,
           "noise": 22,
@@ -2048,7 +2038,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -2116,7 +2105,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 100,
           "min": 10,
           "noise": 22,
@@ -2129,6 +2117,147 @@
       ],
       "title": "Backend",
       "type": "radialbar"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 66
+      },
+      "id": 35,
+      "panels": [],
+      "title": "Empty data",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "grafana-testdata-datasource"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 6,
+        "x": 0,
+        "y": 67
+      },
+      "id": 36,
+      "options": {
+        "barWidthFactor": 0.5,
+        "effects": {
+          "barGlow": false,
+          "centerGlow": false,
+          "gradient": true,
+          "rounded": false,
+          "spotlight": false
+        },
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "segmentCount": 1,
+        "segmentSpacing": 0.3,
+        "shape": "gauge",
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sparkline": true
+      },
+      "pluginVersion": "13.0.0-pre",
+      "targets": [
+        {
+          "refId": "A",
+          "scenarioId": "random_walk",
+          "seriesCount": 0
+        }
+      ],
+      "title": "Numeric, no series",
+      "type": "gauge"
+    },
+    {
+      "datasource": {
+        "type": "grafana-testdata-datasource"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 6,
+        "x": 6,
+        "y": 67
+      },
+      "id": 37,
+      "options": {
+        "barWidthFactor": 0.5,
+        "effects": {
+          "barGlow": false,
+          "centerGlow": false,
+          "gradient": true,
+          "rounded": false,
+          "spotlight": false
+        },
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "segmentCount": 1,
+        "segmentSpacing": 0.3,
+        "shape": "gauge",
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sparkline": true
+      },
+      "pluginVersion": "13.0.0-pre",
+      "targets": [
+        {
+          "refId": "A",
+          "scenarioId": "logs"
+        }
+      ],
+      "title": "Non-numeric",
+      "type": "gauge"
     }
   ],
   "preload": false,

apps/provisioning/pkg/apis/provisioning/v0alpha1/jobs.go

@@ -198,6 +198,7 @@ type JobStatus struct {
 	Finished int64    `json:"finished,omitempty"`
 	Message  string   `json:"message,omitempty"`
 	Errors   []string `json:"errors,omitempty"`
+	Warnings []string `json:"warnings,omitempty"`
 
 	// Optional value 0-100 that can be set while running
 	Progress float64 `json:"progress,omitempty"`
@@ -225,18 +226,20 @@ type JobResourceSummary struct {
 	Kind  string `json:"kind,omitempty"`
 	Total int64  `json:"total,omitempty"` // the count (if known)
 
-	Create int64 `json:"create,omitempty"`
-	Update int64 `json:"update,omitempty"`
-	Delete int64 `json:"delete,omitempty"`
-	Write  int64 `json:"write,omitempty"` // Create or update (export)
-	Error  int64 `json:"error,omitempty"` // The error count
+	Create  int64 `json:"create,omitempty"`
+	Update  int64 `json:"update,omitempty"`
+	Delete  int64 `json:"delete,omitempty"`
+	Write   int64 `json:"write,omitempty"`   // Create or update (export)
+	Error   int64 `json:"error,omitempty"`   // The error count
+	Warning int64 `json:"warning,omitempty"` // The warning count
 
 	// No action required (useful for sync)
 	Noop int64 `json:"noop,omitempty"`
 
-	// Report errors for this resource type
+	// Report errors/warnings for this resource type
 	// This may not be an exhaustive list and recommend looking at the logs for more info
-	Errors []string `json:"errors,omitempty"`
+	Errors   []string `json:"errors,omitempty"`
+	Warnings []string `json:"warnings,omitempty"`
 }
 
 // HistoricJob is an append only log, saving all jobs that have been processed.

apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.deepcopy.go

@@ -401,6 +401,11 @@ func (in *JobResourceSummary) DeepCopyInto(out *JobResourceSummary) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.Warnings != nil {
+		in, out := &in.Warnings, &out.Warnings
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -468,6 +473,11 @@ func (in *JobStatus) DeepCopyInto(out *JobStatus) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.Warnings != nil {
+		in, out := &in.Warnings, &out.Warnings
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.Summary != nil {
 		in, out := &in.Summary, &out.Summary
 		*out = make([]*JobResourceSummary, len(*in))

apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.openapi.go

@@ -889,6 +889,13 @@ func schema_pkg_apis_provisioning_v0alpha1_JobResourceSummary(ref common.Referen
 							Format:      "int64",
 						},
 					},
+					"warning": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The error count",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
 					"noop": {
 						SchemaProps: spec.SchemaProps{
 							Description: "No action required (useful for sync)",
@@ -898,7 +905,7 @@ func schema_pkg_apis_provisioning_v0alpha1_JobResourceSummary(ref common.Referen
 					},
 					"errors": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Report errors for this resource type This may not be an exhaustive list and recommend looking at the logs for more info",
+							Description: "Report errors/warnings for this resource type This may not be an exhaustive list and recommend looking at the logs for more info",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -911,6 +918,20 @@ func schema_pkg_apis_provisioning_v0alpha1_JobResourceSummary(ref common.Referen
 							},
 						},
 					},
+					"warnings": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
 				},
 			},
 		},
@@ -1029,6 +1050,20 @@ func schema_pkg_apis_provisioning_v0alpha1_JobStatus(ref common.ReferenceCallbac
 							},
 						},
 					},
+					"warnings": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
 					"progress": {
 						SchemaProps: spec.SchemaProps{
 							Description: "Optional value 0-100 that can be set while running",

apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.openapi_violation_exceptions.list

@@ -3,8 +3,10 @@ API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioni
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,FileList,Items
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,HistoryList,Items
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobResourceSummary,Errors
+API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobResourceSummary,Warnings
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobStatus,Errors
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobStatus,Summary
+API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,JobStatus,Warnings
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,ManagerStats,Stats
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,MoveJobOptions,Paths
 API rule violation: list_type_missing,github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1,MoveJobOptions,Resources

apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/jobresourcesummary.go

@@ -7,16 +7,18 @@ package v0alpha1
 // JobResourceSummaryApplyConfiguration represents a declarative configuration of the JobResourceSummary type for use
 // with apply.
 type JobResourceSummaryApplyConfiguration struct {
-	Group  *string  `json:"group,omitempty"`
-	Kind   *string  `json:"kind,omitempty"`
-	Total  *int64   `json:"total,omitempty"`
-	Create *int64   `json:"create,omitempty"`
-	Update *int64   `json:"update,omitempty"`
-	Delete *int64   `json:"delete,omitempty"`
-	Write  *int64   `json:"write,omitempty"`
-	Error  *int64   `json:"error,omitempty"`
-	Noop   *int64   `json:"noop,omitempty"`
-	Errors []string `json:"errors,omitempty"`
+	Group    *string  `json:"group,omitempty"`
+	Kind     *string  `json:"kind,omitempty"`
+	Total    *int64   `json:"total,omitempty"`
+	Create   *int64   `json:"create,omitempty"`
+	Update   *int64   `json:"update,omitempty"`
+	Delete   *int64   `json:"delete,omitempty"`
+	Write    *int64   `json:"write,omitempty"`
+	Error    *int64   `json:"error,omitempty"`
+	Warning  *int64   `json:"warning,omitempty"`
+	Noop     *int64   `json:"noop,omitempty"`
+	Errors   []string `json:"errors,omitempty"`
+	Warnings []string `json:"warnings,omitempty"`
 }
 
 // JobResourceSummaryApplyConfiguration constructs a declarative configuration of the JobResourceSummary type for use with
@@ -89,6 +91,14 @@ func (b *JobResourceSummaryApplyConfiguration) WithError(value int64) *JobResour
 	return b
 }
 
+// WithWarning sets the Warning field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Warning field is set to the value of the last call.
+func (b *JobResourceSummaryApplyConfiguration) WithWarning(value int64) *JobResourceSummaryApplyConfiguration {
+	b.Warning = &value
+	return b
+}
+
 // WithNoop sets the Noop field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Noop field is set to the value of the last call.
@@ -106,3 +116,13 @@ func (b *JobResourceSummaryApplyConfiguration) WithErrors(values ...string) *Job
 	}
 	return b
 }
+
+// WithWarnings adds the given value to the Warnings field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Warnings field.
+func (b *JobResourceSummaryApplyConfiguration) WithWarnings(values ...string) *JobResourceSummaryApplyConfiguration {
+	for i := range values {
+		b.Warnings = append(b.Warnings, values[i])
+	}
+	return b
+}

apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/jobstatus.go

@@ -16,6 +16,7 @@ type JobStatusApplyConfiguration struct {
 	Finished *int64                                     `json:"finished,omitempty"`
 	Message  *string                                    `json:"message,omitempty"`
 	Errors   []string                                   `json:"errors,omitempty"`
+	Warnings []string                                   `json:"warnings,omitempty"`
 	Progress *float64                                   `json:"progress,omitempty"`
 	Summary  []*provisioningv0alpha1.JobResourceSummary `json:"summary,omitempty"`
 	URLs     *RepositoryURLsApplyConfiguration          `json:"url,omitempty"`
@@ -69,6 +70,16 @@ func (b *JobStatusApplyConfiguration) WithErrors(values ...string) *JobStatusApp
 	return b
 }
 
+// WithWarnings adds the given value to the Warnings field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Warnings field.
+func (b *JobStatusApplyConfiguration) WithWarnings(values ...string) *JobStatusApplyConfiguration {
+	for i := range values {
+		b.Warnings = append(b.Warnings, values[i])
+	}
+	return b
+}
+
 // WithProgress sets the Progress field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Progress field is set to the value of the last call.

devenv/dev-dashboards/panel-gauge/gauge_tests_new.json

@@ -75,9 +75,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": false,
           "rounded": true,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -152,9 +152,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -229,9 +229,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -306,9 +306,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -383,9 +383,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -460,9 +460,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": false,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -537,9 +537,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": false,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -627,9 +627,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -704,9 +704,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -781,9 +781,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -858,9 +858,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": false,
           "rounded": true,
-          "spotlight": true,
-          "gradient": false
+          "spotlight": true
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -952,9 +952,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": false,
           "rounded": false,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1029,9 +1029,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": false,
           "rounded": false,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1106,9 +1106,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": true,
           "rounded": false,
-          "spotlight": false,
-          "gradient": true
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1183,9 +1183,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": false,
           "rounded": false,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1260,9 +1260,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": false,
           "rounded": false,
-          "spotlight": false,
-          "gradient": false
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1354,9 +1354,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": true,
           "rounded": false,
-          "spotlight": false,
-          "gradient": true
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1435,9 +1435,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": true,
           "rounded": false,
-          "spotlight": false,
-          "gradient": true
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1516,9 +1516,9 @@
         "effects": {
           "barGlow": false,
           "centerGlow": false,
+          "gradient": true,
           "rounded": false,
-          "spotlight": false,
-          "gradient": true
+          "spotlight": false
         },
         "orientation": "auto",
         "reduceOptions": {
@@ -1565,7 +1565,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1606,9 +1605,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -1631,7 +1630,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 98,
           "min": 5,
           "noise": 22,
@@ -1649,7 +1647,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1690,9 +1687,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -1715,7 +1712,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 98,
           "min": 5,
           "noise": 22,
@@ -1746,7 +1742,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1788,9 +1783,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -1813,7 +1808,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 8,
           "min": 1,
           "noise": 2,
@@ -1831,7 +1825,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1873,9 +1866,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -1898,7 +1891,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 12,
           "min": 1,
           "noise": 2,
@@ -1916,7 +1908,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -1957,9 +1948,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -1982,7 +1973,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 100,
           "min": 10,
           "noise": 22,
@@ -2000,7 +1990,6 @@
       "datasource": {
         "type": "grafana-testdata-datasource"
       },
-      "description": "",
       "fieldConfig": {
         "defaults": {
           "color": {
@@ -2041,9 +2030,9 @@
         "effects": {
           "barGlow": true,
           "centerGlow": true,
+          "gradient": true,
           "rounded": true,
-          "spotlight": true,
-          "gradient": true
+          "spotlight": true
         },
         "glow": "both",
         "orientation": "auto",
@@ -2066,7 +2055,6 @@
           "datasource": {
             "type": "grafana-testdata-datasource"
           },
-          "hide": false,
           "max": 100,
           "min": 10,
           "noise": 22,
@@ -2079,6 +2067,147 @@
       ],
       "title": "Backend",
       "type": "radialbar"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 66
+      },
+      "id": 35,
+      "panels": [],
+      "title": "Empty data",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "grafana-testdata-datasource"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 6,
+        "x": 0,
+        "y": 67
+      },
+      "id": 36,
+      "options": {
+        "barWidthFactor": 0.5,
+        "effects": {
+          "barGlow": false,
+          "centerGlow": false,
+          "gradient": true,
+          "rounded": false,
+          "spotlight": false
+        },
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "segmentCount": 1,
+        "segmentSpacing": 0.3,
+        "shape": "gauge",
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sparkline": true
+      },
+      "pluginVersion": "13.0.0-pre",
+      "targets": [
+        {
+          "refId": "A",
+          "scenarioId": "random_walk",
+          "seriesCount": 0
+        }
+      ],
+      "title": "Numeric, no series",
+      "type": "gauge"
+    },
+    {
+      "datasource": {
+        "type": "grafana-testdata-datasource"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 6,
+        "x": 6,
+        "y": 67
+      },
+      "id": 37,
+      "options": {
+        "barWidthFactor": 0.5,
+        "effects": {
+          "barGlow": false,
+          "centerGlow": false,
+          "gradient": true,
+          "rounded": false,
+          "spotlight": false
+        },
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "segmentCount": 1,
+        "segmentSpacing": 0.3,
+        "shape": "gauge",
+        "showThresholdLabels": false,
+        "showThresholdMarkers": true,
+        "sparkline": true
+      },
+      "pluginVersion": "13.0.0-pre",
+      "targets": [
+        {
+          "refId": "A",
+          "scenarioId": "logs"
+        }
+      ],
+      "title": "Non-numeric",
+      "type": "gauge"
     }
   ],
   "preload": false,
@@ -2095,5 +2224,5 @@
   "timezone": "browser",
   "title": "Panel tests - Gauge (new)",
   "uid": "panel-tests-gauge-new",
-  "version": 6
+  "version": 9
 }

docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-alertmanager.md

@@ -59,9 +59,9 @@ For more details on contact points, including how to test them and enable notifi
 
 ## Alertmanager settings
 
-| Option | Description                                                                                                                        |
-| ------ | ---------------------------------------------------------------------------------------------------------------------------------- |
-| URL    | The Alertmanager URL. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
+| Option | Description                                                                                                       |
+| ------ | ----------------------------------------------------------------------------------------------------------------- |
+| URL    | The Alertmanager URL. This field is [protected](ref:configure-contact-points) from modification in Grafana Cloud. |
 
 #### Optional settings
 

docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-jira.md

@@ -49,14 +49,14 @@ For more details on contact points, including how to test them and enable notifi
 
 ### Required Settings
 
-| Key                 | Description                                                                                                                                                                                                                                         |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| URL                 | The URL of the REST API of your Jira instance. Supported versions: `2` and `3` (e.g., `https://your-domain.atlassian.net/rest/api/3`). This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
-| Basic Auth User     | Username for authentication. For Jira Cloud, use your email address.                                                                                                                                                                                |
-| Basic Auth Password | Password or personal token. For Jira Cloud, you need to obtain a personal token [here](https://id.atlassian.com/manage-profile/security/api-tokens) and use it as the password.                                                                     |
-| API Token           | An alternative to basic authentication, a bearer token is used to authorize the API requests. See [Jira documentation](https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html) for more information.              |
-| Project Key         | The project key identifying the project where issues will be created. Project keys are unique identifiers for a project.                                                                                                                            |
-| Issue Type          | The type of issue to create (e.g., `Task`, `Bug`, `Incident`). Make sure that you specify a type that is available in your project.                                                                                                                 |
+| Key                 | Description                                                                                                                                                                                                                            |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| URL                 | The URL of the REST API of your Jira instance. Supported versions: `2` and `3` (e.g., `https://your-domain.atlassian.net/rest/api/3`). This field is [protected](ref:configure-contact-points) from modification in Grafana Cloud.     |
+| Basic Auth User     | Username for authentication. For Jira Cloud, use your email address.                                                                                                                                                                   |
+| Basic Auth Password | Password or personal token. For Jira Cloud, you need to obtain a personal token [here](https://id.atlassian.com/manage-profile/security/api-tokens) and use it as the password.                                                        |
+| API Token           | An alternative to basic authentication, a bearer token is used to authorize the API requests. See [Jira documentation](https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html) for more information. |
+| Project Key         | The project key identifying the project where issues will be created. Project keys are unique identifiers for a project.                                                                                                               |
+| Issue Type          | The type of issue to create (e.g., `Task`, `Bug`, `Incident`). Make sure that you specify a type that is available in your project.                                                                                                    |
 
 ### Optional Settings
 

docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-mqtt.md

@@ -54,10 +54,10 @@ For more details on contact points, including how to test them and enable notifi
 
 ### Required Settings
 
-| Option     | Description                                                                                                                              |
-| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Broker URL | The URL of the MQTT broker. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
-| Topic      | The topic to which the message will be sent.                                                                                             |
+| Option     | Description                                                                                                             |
+| ---------- | ----------------------------------------------------------------------------------------------------------------------- |
+| Broker URL | The URL of the MQTT broker. This field is [protected](ref:configure-contact-points) from modification in Grafana Cloud. |
+| Topic      | The topic to which the message will be sent.                                                                            |
 
 ### Optional Settings
 

docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-slack.md

@@ -51,8 +51,8 @@ You can customize the `title` and `body` of the Slack message using [notificatio
 
 If you are using a Slack API Token, complete the following steps.
 
-1. Follow steps 1 and 2 of the [Slack API Quickstart](https://api.slack.com/start/quickstart).
-1. Add the [chat:write.public](https://api.slack.com/scopes/chat:write.public) scope to give your app the ability to post in all public channels without joining.
+1. Follow step 1 of the [Slack API Quickstart](https://docs.slack.dev/app-management/quickstart-app-settings/#creating) to create the app.
+1. Continue onto the second step of the [Slack API Quickstart](https://docs.slack.dev/app-management/quickstart-app-settings/#scopes) and add the [chat:write.public](https://api.slack.com/scopes/chat:write.public) scope as described to give your app the ability to post in all public channels without joining.
 1. In OAuth Tokens for Your Workspace, copy the Bot User OAuth Token.
 1. Open your Slack workplace.
 1. Right click the channel you want to receive notifications in.

docs/sources/alerting/configure-notifications/manage-contact-points/integrations/webhook-notifier.md

@@ -62,9 +62,9 @@ For more details on contact points, including how to test them and enable notifi
 
 ## Webhook settings
 
-| Option | Description                                                                                                                   |
-| ------ | ----------------------------------------------------------------------------------------------------------------------------- |
-| URL    | The Webhook URL. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
+| Option | Description                                                                                                  |
+| ------ | ------------------------------------------------------------------------------------------------------------ |
+| URL    | The Webhook URL. This field is [protected](ref:configure-contact-points) from modification in Grafana Cloud. |
 
 #### Optional settings
 

docs/sources/as-code/infrastructure-as-code/grafana-operator/manage-dashboards-argocd.md

@@ -81,7 +81,7 @@ Replace the placeholders with your values:
 
 In your `grafana` directory, create a sub-folder called `dashboards`.
 
-This guide shows you how to creates three separate dashboards. For all dashboard configurations, replace the placeholders with your values:
+This guide shows you how to create three separate dashboards. For all dashboard configurations, replace the placeholders with your values:
 
 - _`<GRAFANA_CLOUD_STACK_NAME>`_: Name of your Grafana Cloud Stack
 - _`<GRAFANA_OPERATOR_NAMESPACE>`_: Namespace where the `grafana-operator` is deployed in your Kubernetes cluster

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/_index.md

@@ -0,0 +1,147 @@
+---
+title: Git Sync deployment scenarios
+menuTitle: Deployment scenarios
+description: Learn about common Git Sync deployment patterns and configurations for different organizational needs
+weight: 450
+keywords:
+  - git sync
+  - deployment patterns
+  - scenarios
+  - multi-environment
+  - teams
+---
+
+# Git Sync deployment scenarios
+
+This guide shows practical deployment scenarios for Grafana’s Git Sync. Learn how to configure bidirectional synchronization between Grafana and Git repositories for teams, environments, and regions.
+
+{{< admonition type="caution" >}}
+Git Sync is an experimental feature. It reflects Grafana’s approach to Observability as Code and might include limitations or breaking changes. For current status and known limitations, refer to the [Git Sync introduction](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync/).
+{{< /admonition >}}
+
+## Understand the relationship between key Git Sync components
+
+Before you explore the scenarios, understand how the key Git Sync components relate:
+
+- [Grafana instance](#grafana-instance)
+- [Git repository structure](#git-repository-structure)
+- [Git Sync repository resource](#git-sync-repository-resource)
+
+### Grafana instance
+
+A Grafana instance is a running Grafana server. Multiple instances can:
+
+- Connect to the same Git repository using different Repository configurations.
+- Sync from different branches of the same repository.
+- Sync from different paths within the same repository.
+- Sync from different repositories.
+
+### Git repository structure
+
+You can organize your Git repository in several ways:
+
+- Single branch, multiple paths: Use different directories for different purposes (for example, `dev/`, `prod/`, `team-a/`).
+- Multiple branches: Use different branches for different environments or teams (for example, `main`, `develop`, `team-a`).
+- Multiple repositories: Use separate repositories for different teams or environments.
+
+### Git Sync repository resource
+
+A repository resource is a Grafana configuration object that defines:
+
+- Which Git repository to sync with.
+- Which branch to use.
+- Which directory path to synchronize.
+- Sync behavior and workflows.
+
+Each repository resource creates bidirectional synchronization between a Grafana instance and a specific location in Git.
+
+## How does repository sync behave?
+
+With Git Sync you configure a repository resource to sync with your Grafana instance:
+
+1. Grafana monitors the specified Git location (repository, branch, and path).
+2. Grafana creates a folder in Dashboards (typically named after the repository).
+3. Grafana creates dashboards from dashboard JSON files in Git within this folder.
+4. Grafana commits dashboard changes made in the UI back to Git.
+5. Grafana pulls dashboard changes made in Git and updates dashboards in the UI.
+6. Synchronization occurs at regular intervals (configurable), or instantly if you use webhooks.
+
+You can find the provisioned dashboards organized in folders under **Dashboards**.
+
+## Example: Relationship between repository, branch, and path
+
+Here's a concrete example showing how the three parameters work together:
+
+**Configuration:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `team-platform/grafana/`
+
+**In Git (on branch `main`):**
+
+```
+your-org/grafana-manifests/
+├── .git/
+├── README.md
+├── team-platform/
+│   └── grafana/
+│       ├── cpu-metrics.json       ← Synced
+│       ├── memory-usage.json      ← Synced
+│       └── disk-io.json           ← Synced
+├── team-data/
+│   └── grafana/
+│       └── pipeline-stats.json    ← Not synced (different path)
+└── other-files.txt                 ← Not synced (outside path)
+```
+
+**In Grafana Dashboards view:**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── CPU Metrics Dashboard
+    ├── Memory Usage Dashboard
+    └── Disk I/O Dashboard
+```
+
+**Key points:**
+
+- Grafana only synchronizes files within the specified path (`team-platform/grafana/`).
+- Grafana ignores files in other paths or at the repository root.
+- The folder name in Grafana comes from the repository name.
+- Dashboard titles come from the JSON file content, not the filename.
+
+## Repository configuration flexibility
+
+Git Sync repositories support different combinations of repository URL, branch, and path:
+
+- Different Git repositories: Each environment or team can use its own repository.
+  - Instance A: `repository: your-org/grafana-prod`.
+  - Instance B: `repository: your-org/grafana-dev`.
+- Different branches: Use separate branches within the same repository.
+  - Instance A: `repository: your-org/grafana-manifests, branch: main`.
+  - Instance B: `repository: your-org/grafana-manifests, branch: develop`.
+- Different paths: Use different directory paths within the same repository.
+  - Instance A: `repository: your-org/grafana-manifests, branch: main, path: production/`.
+  - Instance B: `repository: your-org/grafana-manifests, branch: main, path: development/`.
+- Any combination: Mix and match based on your workflow requirements.
+
+## Scenarios
+
+Use these deployment scenarios to plan your Git Sync setup:
+
+- [Single instance](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/single-instance/)
+- [Git Sync for development and production environments](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/dev-prod/)
+- [Git Sync with regional replication](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/multi-region/)
+- [High availability](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/high-availability/)
+- [Git Sync in a shared Grafana instance](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/multi-team/)
+
+## Learn more
+
+Refer to the following documents to learn more:
+
+- [Git Sync introduction](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync/)
+- [Git Sync setup guide](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-setup/)
+- [Dashboard provisioning](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/provisioning/)
+- [Observability as Code](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/)

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/dev-prod.md

@@ -0,0 +1,147 @@
+---
+title: Git Sync for development and production environments
+menuTitle: Across environments
+description: Use separate Grafana instances for development and production with Git-controlled promotion
+weight: 20
+---
+
+# Git Sync for development and production environments
+
+Use separate Grafana instances for development and production. Each syncs with different Git locations to test dashboards before production.
+
+## Use it for
+
+- **Staged deployments**: You need to test dashboard changes before production deployment.
+- **Change control**: You require approvals before dashboards reach production.
+- **Quality assurance**: You verify dashboard functionality in a non-production environment.
+- **Risk mitigation**: You minimize the risk of breaking production dashboards.
+
+## Architecture
+
+```
+┌────────────────────────────────────────────────────────────┐
+│              GitHub Repository                             │
+│   Repository: your-org/grafana-manifests                 │
+│   Branch: main                                             │
+│                                                            │
+│   grafana-manifests/                                     │
+│   ├── dev/                                                │
+│   │   ├── dashboard-new.json    ← Development dashboards │
+│   │   └── dashboard-test.json                            │
+│   │                                                       │
+│   └── prod/                                               │
+│       ├── dashboard-stable.json  ← Production dashboards │
+│       └── dashboard-approved.json                        │
+└────────────────────────────────────────────────────────────┘
+           ↕                                 ↕
+    Git Sync (dev/)              Git Sync (prod/)
+           ↕                                 ↕
+┌─────────────────────┐          ┌─────────────────────┐
+│  Dev Grafana        │          │  Prod Grafana       │
+│                     │          │                     │
+│  Repository:        │          │  Repository:        │
+│  - path: dev/       │          │  - path: prod/      │
+│                     │          │                     │
+│  Creates folder:    │          │  Creates folder:    │
+│  "grafana-manifests"│         │  "grafana-manifests"│
+└─────────────────────┘          └─────────────────────┘
+```
+
+## Repository structure
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+├── dev/
+│   ├── dashboard-new.json
+│   └── dashboard-test.json
+└── prod/
+    ├── dashboard-stable.json
+    └── dashboard-approved.json
+```
+
+**In Grafana Dashboards view:**
+
+**Dev instance:**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── New Dashboard
+    └── Test Dashboard
+```
+
+**Prod instance:**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── Stable Dashboard
+    └── Approved Dashboard
+```
+
+- Both instances create a folder named "grafana-manifests" (from repository name)
+- Each instance only shows dashboards from its configured path (`dev/` or `prod/`)
+- Dashboards appear with their titles from the JSON files
+
+## Configuration parameters
+
+Development:
+
+- Repository: `your-org/grafana-manifests`
+- Branch: `main`
+- Path: `dev/`
+
+Production:
+
+- Repository: `your-org/grafana-manifests`
+- Branch: `main`
+- Path: `prod/`
+
+## How it works
+
+1. Developers create and modify dashboards in development.
+2. Git Sync commits changes to `dev/`.
+3. You review changes in Git.
+4. You promote approved dashboards from `dev/` to `prod/`.
+5. Production syncs from `prod/`.
+6. Production dashboards update.
+
+## Alternative: Use branches
+
+Instead of using different paths, you can configure instances to use different branches:
+
+**Development instance:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `develop`
+- **Path**: `grafana/`
+
+**Production instance:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+With this approach:
+
+- Development changes go to the `develop` branch
+- Use Git merge or pull request workflows to promote changes from `develop` to `main`
+- Production automatically syncs from the `main` branch
+
+## Alternative: Use separate repositories for stricter isolation
+
+For stricter isolation, use completely separate repositories:
+
+**Development instance:**
+
+- **Repository**: `your-org/grafana-manifests-dev`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+**Production instance:**
+
+- **Repository**: `your-org/grafana-manifests-prod`
+- **Branch**: `main`
+- **Path**: `grafana/`

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/high-availability.md

@@ -0,0 +1,217 @@
+---
+title: Git Sync for high availability environments
+menuTitle: High availability
+description: Run multiple Grafana instances serving traffic simultaneously, synchronized via Git Sync
+weight: 50
+---
+
+# Git Sync for high availability environments
+
+## Primary–replica scenario
+
+Use a primary Grafana instance and one or more replicas synchronized with the same Git location to enable failover.
+
+### Use it for
+
+- **Automatic failover**: You need service continuity when the primary instance fails.
+- **High availability**: Your organization requires guaranteed dashboard availability.
+- **Simple HA setup**: You want high availability without the complexity of active–active.
+- **Maintenance windows**: You perform updates while another instance serves traffic.
+- **Business continuity**: Dashboard access can't tolerate downtime.
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│           GitHub Repository                         │
+│   Repository: your-org/grafana-manifests          │
+│   Branch: main                                      │
+│                                                     │
+│   grafana-manifests/                              │
+│   └── shared/                                      │
+│       ├── dashboard-metrics.json                   │
+│       ├── dashboard-alerts.json                    │
+│       └── dashboard-logs.json                      │
+└─────────────────────────────────────────────────────┘
+              ↕                           ↕
+        Git Sync (shared/)        Git Sync (shared/)
+              ↕                           ↕
+┌────────────────────┐          ┌────────────────────┐
+│  Master Grafana    │          │  Replica Grafana   │
+│    (Active)        │          │    (Standby)       │
+│                    │          │                    │
+│  Repository:       │          │  Repository:       │
+│  - path: shared/   │          │  - path: shared/   │
+└────────────────────┘          └────────────────────┘
+         │                               │
+         └───────────┬───────────────────┘
+                     ↓
+          ┌──────────────────────┐
+          │  Reverse Proxy       │
+          │  (Failover)          │
+          └──────────────────────┘
+```
+
+### Repository structure
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+└── shared/
+    ├── dashboard-metrics.json
+    ├── dashboard-alerts.json
+    └── dashboard-logs.json
+```
+
+**In Grafana Dashboards view (both instances):**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── Metrics Dashboard
+    ├── Alerts Dashboard
+    └── Logs Dashboard
+```
+
+- Master and replica instances show identical folder structure.
+- Both sync from the same `shared/` path.
+- Reverse proxy routes traffic to master (active) instance.
+- If master fails, proxy automatically fails over to replica (standby).
+- Users see the same dashboards regardless of which instance is serving traffic.
+
+### Configuration parameters
+
+Both master and replica instances use identical parameters:
+
+**Master instance:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `shared/`
+
+**Replica instance:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `shared/`
+
+### How it works
+
+1. Both instances stay synchronized through Git.
+2. Reverse proxy routes traffic to primary.
+3. Users edit on primary. Git Sync commits changes.
+4. Both instances pull latest changes to keep replica in sync.
+5. On primary failure, proxy fails over to replica.
+
+### Failover considerations
+
+- Health checks and monitoring.
+- Continuous syncing to minimize data loss.
+- Plan failback (automatic or manual).
+
+## Load balancer scenario
+
+Run multiple active Grafana instances behind a load balancer. All instances sync from the same Git location.
+
+### Use it for
+
+- **High traffic**: Your deployment needs to handle significant user load.
+- **Load distribution**: You want to distribute user requests across instances.
+- **Maximum availability**: You need service continuity during maintenance or failures.
+- **Scalability**: You want to add instances as load increases.
+- **Performance**: Users need fast response times under heavy load.
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│           GitHub Repository                         │
+│   Repository: your-org/grafana-manifests          │
+│   Branch: main                                      │
+│                                                     │
+│   grafana-manifests/                              │
+│   └── shared/                                      │
+│       ├── dashboard-metrics.json                   │
+│       ├── dashboard-alerts.json                    │
+│       └── dashboard-logs.json                      │
+└─────────────────────────────────────────────────────┘
+              ↕                           ↕
+        Git Sync (shared/)        Git Sync (shared/)
+              ↕                           ↕
+┌────────────────────┐          ┌────────────────────┐
+│  Grafana Instance 1│          │  Grafana Instance 2│
+│    (Active)        │          │    (Active)        │
+│                    │          │                    │
+│  Repository:       │          │  Repository:       │
+│  - path: shared/   │          │  - path: shared/   │
+└────────────────────┘          └────────────────────┘
+         │                               │
+         └───────────┬───────────────────┘
+                     ↓
+          ┌──────────────────────┐
+          │  Load Balancer       │
+          │  (Round Robin)       │
+          └──────────────────────┘
+```
+
+### Repository structure
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+└── shared/
+    ├── dashboard-metrics.json
+    ├── dashboard-alerts.json
+    └── dashboard-logs.json
+```
+
+**In Grafana Dashboards view (all instances):**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── Metrics Dashboard
+    ├── Alerts Dashboard
+    └── Logs Dashboard
+```
+
+- All instances show identical folder structure.
+- All instances sync from the same `shared/` path.
+- Load balancer distributes requests across all active instances.
+- Any instance can serve read requests.
+- Any instance can accept dashboard modifications.
+- Changes propagate to all instances through Git.
+
+### Configuration parameters
+
+All instances use identical parameters:
+
+**Instance 1:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `shared/`
+
+**Instance 2:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `shared/`
+
+### How it works
+
+1. All instances stay synchronized through Git.
+2. Load balancer distributes incoming traffic across all active instances.
+3. Users can view dashboards from any instance.
+4. When a user modifies a dashboard on any instance, Git Sync commits the change.
+5. All other instances pull the updated dashboard during their next sync cycle, or instantly if webhooks are configured.
+6. If one instance fails, load balancer stops routing traffic to it and remaining instances continue serving.
+
+### Important considerations
+
+- **Eventually consistent**: Due to sync intervals, instances may briefly have different dashboard versions.
+- **Concurrent edits**: Multiple users editing the same dashboard on different instances can cause conflicts.
+- **Database sharing**: Instances should share the same backend database for user sessions, preferences, and annotations.
+- **Stateless design**: Design for stateless operation where possible to maximize load balancing effectiveness.

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/multi-region.md

@@ -0,0 +1,93 @@
+---
+title: Git Sync with regional replication
+menuTitle: Regional replication
+description: Synchronize multiple regional Grafana instances from a shared Git location
+weight: 30
+---
+
+# Git Sync with regional replication
+
+Deploy multiple Grafana instances across regions. Synchronize them with the same Git location to ensure consistent dashboards everywhere.
+
+## Use it for
+
+- **Geographic distribution**: You deploy Grafana close to users in different regions.
+- **Latency reduction**: Users need fast dashboard access from their location.
+- **Data sovereignty**: You keep dashboard data in specific regions.
+- **High availability**: You need dashboard availability across regions.
+- **Consistent experience**: All users see the same dashboards regardless of region.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│           GitHub Repository                         │
+│   Repository: your-org/grafana-manifests          │
+│   Branch: main                                      │
+│                                                     │
+│   grafana-manifests/                              │
+│   └── shared/                                      │
+│       ├── dashboard-global.json                    │
+│       ├── dashboard-metrics.json                   │
+│       └── dashboard-logs.json                      │
+└─────────────────────────────────────────────────────┘
+              ↕                           ↕
+       Git Sync (shared/)         Git Sync (shared/)
+              ↕                           ↕
+┌────────────────────┐          ┌────────────────────┐
+│  US Region         │          │  EU Region         │
+│  Grafana           │          │  Grafana           │
+│                    │          │                    │
+│  Repository:       │          │  Repository:       │
+│  - path: shared/   │          │  - path: shared/   │
+└────────────────────┘          └────────────────────┘
+```
+
+## Repository structure
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+└── shared/
+    ├── dashboard-global.json
+    ├── dashboard-metrics.json
+    └── dashboard-logs.json
+```
+
+**In Grafana Dashboards view (all regions):**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── Global Dashboard
+    ├── Metrics Dashboard
+    └── Logs Dashboard
+```
+
+- All regional instances (US, EU, etc.) show identical folder structure
+- Same folder name "grafana-manifests" in every region
+- Same dashboards synced from the `shared/` path appear everywhere
+- Users in any region see the exact same dashboards with the same titles
+
+## Configuration parameters
+
+All regions:
+
+- Repository: `your-org/grafana-manifests`
+- Branch: `main`
+- Path: `shared/`
+
+## How it works
+
+1. All regional instances pull dashboards from `shared/`.
+2. Any region’s change commits to Git.
+3. Other regions pull updates during the next sync (or via webhooks).
+4. Changes propagate across regions per sync interval.
+
+## Considerations
+
+- **Write conflicts**: If users in different regions modify the same dashboard simultaneously, Git uses last-write-wins.
+- **Primary region**: Consider designating one region as the primary location for making dashboard changes.
+- **Propagation time**: Changes propagate to all regions within the configured sync interval, or instantly if webhooks are configured.
+- **Network reliability**: Ensure all regions have reliable connectivity to the Git repository.

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/multi-team.md

@@ -0,0 +1,169 @@
+---
+title: Multiple team Git Sync
+menuTitle: Shared instance
+description: Use multiple Git repositories with one Grafana instance, one repository per team
+weight: 60
+---
+
+# Git Sync in a Grafana instance shared by multiple teams
+
+Use a single Grafana instance with multiple Repository resources, one per team. Each team manages its own dashboards while sharing Grafana.
+
+## Use it for
+
+- **Team autonomy**: Different teams manage their own dashboards independently.
+- **Organizational structure**: Dashboard organization aligns with team structure.
+- **Resource efficiency**: Multiple teams share Grafana infrastructure.
+- **Cost optimization**: You reduce infrastructure costs while maintaining team separation.
+- **Collaboration**: Teams can view each other’s dashboards while managing their own.
+
+## Architecture
+
+```
+┌─────────────────────────┐  ┌─────────────────────────┐
+│  Platform Team Repo     │  │  Data Team Repo         │
+│  platform-dashboards    │  │  data-dashboards        │
+│                         │  │                         │
+│  platform-dashboards/   │  │  data-dashboards/       │
+│  └── grafana/           │  │  └── grafana/           │
+│      ├── k8s.json       │  │      ├── pipeline.json  │
+│      └── infra.json     │  │      └── analytics.json │
+└─────────────────────────┘  └─────────────────────────┘
+           ↕                            ↕
+    Git Sync (grafana/)          Git Sync (grafana/)
+           ↕                            ↕
+        ┌──────────────────────────────────────┐
+        │       Grafana Instance               │
+        │                                      │
+        │  Repository 1:                       │
+        │  - repo: platform-dashboards         │
+        │  → Creates "platform-dashboards"     │
+        │                                      │
+        │  Repository 2:                       │
+        │  - repo: data-dashboards             │
+        │  → Creates "data-dashboards"         │
+        └──────────────────────────────────────┘
+```
+
+## Repository structure
+
+**In Git (separate repositories):**
+
+**Platform team repository:**
+
+```
+your-org/platform-dashboards
+└── grafana/
+    ├── dashboard-k8s.json
+    └── dashboard-infra.json
+```
+
+**Data team repository:**
+
+```
+your-org/data-dashboards
+└── grafana/
+    ├── dashboard-pipeline.json
+    └── dashboard-analytics.json
+```
+
+**In Grafana Dashboards view:**
+
+```
+Dashboards
+├── 📁 platform-dashboards/
+│   ├── Kubernetes Dashboard
+│   └── Infrastructure Dashboard
+└── 📁 data-dashboards/
+    ├── Pipeline Dashboard
+    └── Analytics Dashboard
+```
+
+- Two separate folders created (one per Repository resource).
+- Folder names derived from repository names.
+- Each team has complete control over their own repository.
+- Teams can independently manage permissions, branches, and workflows in their repos.
+- All teams can view each other's dashboards in Grafana but manage only their own.
+
+## Configuration parameters
+
+**Platform team repository:**
+
+- **Repository**: `your-org/platform-dashboards`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+**Data team repository:**
+
+- **Repository**: `your-org/data-dashboards`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+## How it works
+
+1. Each team has their own Git repository for complete autonomy.
+2. Each repository resource in Grafana creates a separate folder.
+3. Platform team dashboards sync from `your-org/platform-dashboards` repository.
+4. Data team dashboards sync from `your-org/data-dashboards` repository.
+5. Teams can independently manage their repository settings, access controls, and workflows.
+6. All teams can view each other's dashboards in Grafana but edit only their own.
+
+## Scale to more teams
+
+Adding additional teams is straightforward. For a third team, create a new repository and configure:
+
+- **Repository**: `your-org/security-dashboards`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+This creates a new "security-dashboards" folder in the same Grafana instance.
+
+## Alternative: Shared repository with different paths
+
+For teams that prefer sharing a single repository, use different paths to separate team dashboards:
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+├── team-platform/
+│   ├── dashboard-k8s.json
+│   └── dashboard-infra.json
+└── team-data/
+    ├── dashboard-pipeline.json
+    └── dashboard-analytics.json
+```
+
+**Configuration:**
+
+**Platform team:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `team-platform/`
+
+**Data team:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `team-data/`
+
+This approach provides simpler repository management but less isolation between teams.
+
+## Alternative: Different branches per team
+
+For teams wanting their own branch in a shared repository:
+
+**Platform team:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `team-platform`
+- **Path**: `grafana/`
+
+**Data team:**
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `team-data`
+- **Path**: `grafana/`
+
+This allows teams to use Git branch workflows for collaboration while sharing the same repository.

docs/sources/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios/single-instance.md

@@ -0,0 +1,86 @@
+---
+title: Single instance Git Sync
+menuTitle: Single instance
+description: Synchronize a single Grafana instance with a Git repository
+weight: 10
+---
+
+# Single instance Git Sync
+
+Use a single Grafana instance synchronized with a Git repository. This is the foundation for Git Sync and helps you understand bidirectional synchronization.
+
+## Use it for
+
+- **Getting started**: You want to learn how Git Sync works before implementing complex scenarios.
+- **Personal projects**: Individual developers manage their own dashboards.
+- **Small teams**: You have a simple setup without multiple environments or complex workflows.
+- **Development environments**: You need quick prototyping and testing.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│           GitHub Repository                         │
+│   Repository: your-org/grafana-manifests          │
+│   Branch: main                                      │
+│                                                     │
+│   grafana-manifests/                              │
+│   └── grafana/                                     │
+│       ├── dashboard-1.json                         │
+│       ├── dashboard-2.json                         │
+│       └── dashboard-3.json                         │
+└─────────────────────────────────────────────────────┘
+                        ↕
+              Git Sync (bidirectional)
+                        ↕
+        ┌─────────────────────────────┐
+        │    Grafana Instance         │
+        │                             │
+        │  Repository Resource:       │
+        │  - url: grafana-manifests  │
+        │  - branch: main             │
+        │  - path: grafana/           │
+        │                             │
+        │  Creates folder:            │
+        │  "grafana-manifests"       │
+        └─────────────────────────────┘
+```
+
+## Repository structure
+
+**In Git:**
+
+```
+your-org/grafana-manifests
+└── grafana/
+    ├── dashboard-1.json
+    ├── dashboard-2.json
+    └── dashboard-3.json
+```
+
+**In Grafana Dashboards view:**
+
+```
+Dashboards
+└── 📁 grafana-manifests/
+    ├── Dashboard 1
+    ├── Dashboard 2
+    └── Dashboard 3
+```
+
+- A folder named "grafana-manifests" (from repository name) contains all synced dashboards.
+- Each JSON file becomes a dashboard with its title displayed in the folder.
+- Users browse dashboards organized under this folder structure.
+
+## Configuration parameters
+
+Configure your Grafana instance to synchronize with:
+
+- **Repository**: `your-org/grafana-manifests`
+- **Branch**: `main`
+- **Path**: `grafana/`
+
+## How it works
+
+1. **From Grafana to Git**: When users create or modify dashboards in Grafana, Git Sync commits changes to the `grafana/` directory on the `main` branch.
+2. **From Git to Grafana**: When dashboard JSON files are added or modified in the `grafana/` directory, Git Sync pulls these changes into Grafana.

docs/sources/as-code/observability-as-code/provision-resources/git-sync-setup.md

@@ -367,5 +367,6 @@ To learn more about using Git Sync:
 
 - [Work with provisioned dashboards](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/provisioned-dashboards/)
 - [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/use-git-sync/)
+- [Git Sync deployment scenarios](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios)
 - [Export resources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/export-resources/)
 - [grafanactl documentation](https://grafana.github.io/grafanactl/)

docs/sources/as-code/observability-as-code/provision-resources/intro-git-sync.md

@@ -127,7 +127,13 @@ An instance can be in one of the following Git Sync states:
 
 ## Common use cases
 
-You can use Git Sync in the following scenarios.
+{{< admonition type="note" >}}
+
+Refer to [Git Sync deployment scenarios](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-deployment-scenarios) for sample scenarios, including architecture and configuration details.
+
+{{< /admonition >}}
+
+You can use Git Sync for the following use cases:
 
 ### Version control and auditing
 

docs/sources/as-code/observability-as-code/provision-resources/use-git-sync.md

@@ -14,7 +14,7 @@ labels:
     - cloud
 title: Manage provisioned repositories with Git Sync
 menuTitle: Manage repositories with Git Sync
-weight: 120
+weight: 400
 canonical: https://grafana.com/docs/grafana/latest/as-code/observability-as-code/provision-resources/use-git-sync/
 aliases:
   - ../../../observability-as-code/provision-resources/use-git-sync/ # /docs/grafana/next/observability-as-code/provision-resources/use-git-sync/

package.json

@@ -289,7 +289,7 @@
     "@grafana/google-sdk": "0.3.5",
     "@grafana/i18n": "workspace:*",
     "@grafana/lezer-logql": "0.2.9",
-    "@grafana/llm": "0.22.1",
+    "@grafana/llm": "1.0.1",
     "@grafana/monaco-logql": "^0.0.8",
     "@grafana/o11y-ds-frontend": "workspace:*",
     "@grafana/plugin-ui": "^0.11.1",

packages/grafana-api-clients/src/clients/rtkq/provisioning/v0alpha1/endpoints.gen.ts

@@ -1138,7 +1138,7 @@ export type JobResourceSummary = {
   delete?: number;
   /** Create or update (export) */
   error?: number;
-  /** Report errors for this resource type This may not be an exhaustive list and recommend looking at the logs for more info */
+  /** Report errors/warnings for this resource type This may not be an exhaustive list and recommend looking at the logs for more info */
   errors?: string[];
   group?: string;
   kind?: string;
@@ -1146,6 +1146,9 @@ export type JobResourceSummary = {
   noop?: number;
   total?: number;
   update?: number;
+  /** The error count */
+  warning?: number;
+  warnings?: string[];
   write?: number;
 };
 export type RepositoryUrLs = {
@@ -1176,6 +1179,7 @@ export type JobStatus = {
   summary?: JobResourceSummary[];
   /** URLs contains URLs for the reference branch or commit if applicable. */
   url?: RepositoryUrLs;
+  warnings?: string[];
 };
 export type Job = {
   /** APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources */

packages/grafana-ui/src/components/RadialGauge/RadialGauge.tsx

@@ -106,6 +106,11 @@ export function RadialGauge(props: RadialGaugeProps) {
   const gaugeId = useId();
   const styles = useStyles2(getStyles);
 
+  let effectiveTextMode = textMode;
+  if (effectiveTextMode === 'auto') {
+    effectiveTextMode = vizCount === 1 ? 'value' : 'value_and_name';
+  }
+
   const startAngle = shape === 'gauge' ? 250 : 0;
   const endAngle = shape === 'gauge' ? 110 : 360;
 
@@ -188,7 +193,7 @@ export function RadialGauge(props: RadialGaugeProps) {
     // These elements are only added for first value / bar
     if (barIndex === 0) {
       if (glowBar) {
-        defs.push(<GlowGradient key="glow-filter" id={glowFilterId} radius={dimensions.radius} />);
+        defs.push(<GlowGradient key="glow-filter" id={glowFilterId} barWidth={dimensions.barWidth} />);
       }
 
       if (glowCenter) {
@@ -198,14 +203,14 @@ export function RadialGauge(props: RadialGaugeProps) {
       graphics.push(
         <RadialText
           key="radial-text"
-          vizCount={vizCount}
-          textMode={textMode}
+          textMode={effectiveTextMode}
           displayValue={displayValue.display}
           dimensions={dimensions}
           theme={theme}
           valueManualFontSize={props.valueManualFontSize}
           nameManualFontSize={props.nameManualFontSize}
           shape={shape}
+          sparkline={displayValue.sparkline}
         />
       );
 
@@ -254,6 +259,7 @@ export function RadialGauge(props: RadialGaugeProps) {
             theme={theme}
             color={color}
             shape={shape}
+            textMode={effectiveTextMode}
           />
         );
       }

packages/grafana-ui/src/components/RadialGauge/RadialSparkline.tsx

@@ -1,11 +1,9 @@
-import { css } from '@emotion/css';
-
 import { FieldDisplay, GrafanaTheme2, FieldConfig } from '@grafana/data';
 import { GraphFieldConfig, GraphGradientMode, LineInterpolation } from '@grafana/schema';
 
 import { Sparkline } from '../Sparkline/Sparkline';
 
-import { RadialShape } from './RadialGauge';
+import { RadialShape, RadialTextMode } from './RadialGauge';
 import { GaugeDimensions } from './utils';
 
 interface RadialSparklineProps {
@@ -14,23 +12,22 @@ interface RadialSparklineProps {
   theme: GrafanaTheme2;
   color?: string;
   shape?: RadialShape;
+  textMode: Exclude<RadialTextMode, 'auto'>;
 }
-export function RadialSparkline({ sparkline, dimensions, theme, color, shape }: RadialSparklineProps) {
+export function RadialSparkline({ sparkline, dimensions, theme, color, shape, textMode }: RadialSparklineProps) {
+  const { radius, barWidth } = dimensions;
+
   if (!sparkline) {
     return null;
   }
 
-  const { radius, barWidth } = dimensions;
-
-  const height = radius / 4;
-  const widthFactor = shape === 'gauge' ? 1.6 : 1.4;
-  const width = radius * widthFactor - barWidth;
-  const topPos = shape === 'gauge' ? `${dimensions.gaugeBottomY - height}px` : `calc(50% + ${radius / 2.8}px)`;
-
-  const styles = css({
-    position: 'absolute',
-    top: topPos,
-  });
+  const showNameAndValue = textMode === 'value_and_name';
+  const height = radius / (showNameAndValue ? 4 : 3);
+  const width = radius * (shape === 'gauge' ? 1.6 : 1.4) - barWidth;
+  const topPos =
+    shape === 'gauge'
+      ? `${dimensions.gaugeBottomY - height}px`
+      : `calc(50% + ${radius / (showNameAndValue ? 3.3 : 4)}px)`;
 
   const config: FieldConfig<GraphFieldConfig> = {
     color: {
@@ -45,7 +42,7 @@ export function RadialSparkline({ sparkline, dimensions, theme, color, shape }:
   };
 
   return (
-    <div className={styles}>
+    <div style={{ position: 'absolute', top: topPos }}>
       <Sparkline height={height} width={width} sparkline={sparkline} theme={theme} config={config} />
     </div>
   );

packages/grafana-ui/src/components/RadialGauge/RadialText.tsx

@@ -1,6 +1,12 @@
 import { css } from '@emotion/css';
 
-import { DisplayValue, DisplayValueAlignmentFactors, formattedValueToString, GrafanaTheme2 } from '@grafana/data';
+import {
+  DisplayValue,
+  DisplayValueAlignmentFactors,
+  FieldSparkline,
+  formattedValueToString,
+  GrafanaTheme2,
+} from '@grafana/data';
 
 import { useStyles2 } from '../../themes/ThemeContext';
 import { calculateFontSize } from '../../utils/measureText';
@@ -8,21 +14,13 @@ import { calculateFontSize } from '../../utils/measureText';
 import { RadialShape, RadialTextMode } from './RadialGauge';
 import { GaugeDimensions } from './utils';
 
-// function toCartesian(centerX: number, centerY: number, radius: number, angleInDegrees: number) {
-//   let radian = ((angleInDegrees - 90) * Math.PI) / 180.0;
-//   return {
-//     x: centerX + radius * Math.cos(radian),
-//     y: centerY + radius * Math.sin(radian),
-//   };
-// }
-
 interface RadialTextProps {
   displayValue: DisplayValue;
   theme: GrafanaTheme2;
   dimensions: GaugeDimensions;
-  textMode: RadialTextMode;
-  vizCount: number;
+  textMode: Exclude<RadialTextMode, 'auto'>;
   shape: RadialShape;
+  sparkline?: FieldSparkline;
   alignmentFactors?: DisplayValueAlignmentFactors;
   valueManualFontSize?: number;
   nameManualFontSize?: number;
@@ -33,8 +31,8 @@ export function RadialText({
   theme,
   dimensions,
   textMode,
-  vizCount,
   shape,
+  sparkline,
   alignmentFactors,
   valueManualFontSize,
   nameManualFontSize,
@@ -46,10 +44,6 @@ export function RadialText({
     return null;
   }
 
-  if (textMode === 'auto') {
-    textMode = vizCount === 1 ? 'value' : 'value_and_name';
-  }
-
   const nameToAlignTo = (alignmentFactors ? alignmentFactors.title : displayValue.title) ?? '';
   const valueToAlignTo = formattedValueToString(alignmentFactors ? alignmentFactors : displayValue);
 
@@ -59,7 +53,7 @@ export function RadialText({
 
   // Not sure where this comes from but svg text is not using body line-height
   const lineHeight = 1.21;
-  const valueWidthToRadiusFactor = 0.85;
+  const valueWidthToRadiusFactor = 0.82;
   const nameToHeightFactor = 0.45;
   const largeRadiusScalingDecay = 0.86;
 
@@ -98,18 +92,23 @@ export function RadialText({
   const valueHeight = valueFontSize * lineHeight;
   const nameHeight = nameFontSize * lineHeight;
 
-  const valueY = showName ? centerY - nameHeight / 2 : centerY;
-  const valueNameSpacing = valueHeight / 3.5;
-  const nameY = showValue ? valueY + valueHeight / 2 + valueNameSpacing : centerY;
+  const valueY = showName ? centerY - nameHeight * 0.3 : centerY;
+  const nameY = showValue ? valueY + valueHeight * 0.7 : centerY;
   const nameColor = showValue ? theme.colors.text.secondary : theme.colors.text.primary;
   const suffixShift = (valueFontSize - unitFontSize * 1.2) / 2;
 
-  // For gauge shape we shift text up a bit
-  const valueDy = shape === 'gauge' ? -valueFontSize * 0.3 : 0;
-  const nameDy = shape === 'gauge' ? -nameFontSize * 0.7 : 0;
+  // adjust the text up on gauges and when sparklines are present
+  let yOffset = 0;
+  if (shape === 'gauge') {
+    // we render from the center of the gauge, so move up by half of half of the total height
+    yOffset -= (valueHeight + nameHeight) / 4;
+  }
+  if (sparkline) {
+    yOffset -= 8;
+  }
 
   return (
-    <g>
+    <g transform={`translate(0, ${yOffset})`}>
       {showValue && (
         <text
           x={centerX}
@@ -119,7 +118,6 @@ export function RadialText({
           className={styles.text}
           textAnchor="middle"
           dominantBaseline="middle"
-          dy={valueDy}
         >
           <tspan fontSize={unitFontSize}>{displayValue.prefix ?? ''}</tspan>
           <tspan>{displayValue.text}</tspan>
@@ -133,7 +131,6 @@ export function RadialText({
           fontSize={nameFontSize}
           x={centerX}
           y={nameY}
-          dy={nameDy}
           textAnchor="middle"
           dominantBaseline="middle"
           fill={nameColor}

packages/grafana-ui/src/components/RadialGauge/effects.tsx

@@ -4,11 +4,12 @@ import { GaugeDimensions } from './utils';
 
 export interface GlowGradientProps {
   id: string;
-  radius: number;
+  barWidth: number;
 }
 
-export function GlowGradient({ id, radius }: GlowGradientProps) {
-  const glowSize = 0.02 * radius;
+export function GlowGradient({ id, barWidth }: GlowGradientProps) {
+  // 0.75 is the minimum glow size, and it scales with bar width
+  const glowSize = 0.75 + barWidth * 0.08;
 
   return (
     <filter id={id} filterUnits="userSpaceOnUse">
@@ -82,7 +83,7 @@ export function MiddleCircleGlow({ dimensions, gaugeId, color }: CenterGlowProps
     <>
       <defs>
         <radialGradient id={gradientId} r={'50%'} fr={'0%'}>
-          <stop offset="0%" stopColor={color} stopOpacity={0.2} />
+          <stop offset="0%" stopColor={color} stopOpacity={0.15} />
           <stop offset="90%" stopColor={color} stopOpacity={0} />
         </radialGradient>
       </defs>

packages/grafana-ui/src/components/Sparkline/Sparkline.tsx

@@ -16,7 +16,7 @@ export interface SparklineProps extends Themeable2 {
   sparkline: FieldSparkline;
 }
 
-export const Sparkline: React.FC<SparklineProps> = memo((props) => {
+const SparklineFn: React.FC<SparklineProps> = memo((props) => {
   const { sparkline, config: fieldConfig, theme, width, height } = props;
 
   const { frame: alignedDataFrame, warning } = prepareSeries(sparkline, fieldConfig);
@@ -30,4 +30,14 @@ export const Sparkline: React.FC<SparklineProps> = memo((props) => {
   return <UPlotChart data={data} config={configBuilder} width={width} height={height} />;
 });
 
-Sparkline.displayName = 'Sparkline';
+SparklineFn.displayName = 'Sparkline';
+
+// we converted to function component above, but some apps extend Sparkline, so we need
+// to keep exporting a class component until those apps are all rolled out.
+// see https://github.com/grafana/app-observability-plugin/pull/2079
+// eslint-disable-next-line react-prefer-function-component/react-prefer-function-component
+export class Sparkline extends React.PureComponent<SparklineProps> {
+  render() {
+    return <SparklineFn {...this.props} />;
+  }
+}

pkg/apiserver/auditing/noop.go

@@ -0,0 +1,29 @@
+package auditing
+
+import (
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/audit"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+// NoopBackend is a no-op implementation of audit.Backend
+type NoopBackend struct{}
+
+func ProvideNoopBackend() audit.Backend { return &NoopBackend{} }
+
+func (b *NoopBackend) ProcessEvents(k8sEvents ...*auditinternal.Event) bool { return false }
+
+func (NoopBackend) Run(stopCh <-chan struct{}) error { return nil }
+
+func (NoopBackend) Shutdown() {}
+
+func (NoopBackend) String() string { return "" }
+
+// NoopPolicyRuleEvaluator is a no-op implementation of audit.PolicyRuleEvaluator
+type NoopPolicyRuleEvaluator struct{}
+
+func ProvideNoopPolicyRuleEvaluator() audit.PolicyRuleEvaluator { return &NoopPolicyRuleEvaluator{} }
+
+func (NoopPolicyRuleEvaluator) EvaluatePolicyRule(authorizer.Attributes) audit.RequestAuditConfig {
+	return audit.RequestAuditConfig{Level: auditinternal.LevelNone}
+}

pkg/registry/apis/datasource/legacy_store.go

@@ -61,20 +61,24 @@ func (s *legacyStorage) List(ctx context.Context, options *internalversion.ListO
 }
 
 func (s *legacyStorage) Get(ctx context.Context, name string, options *metav1.GetOptions) (runtime.Object, error) {
-	start := time.Now()
-	defer func() {
-		metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Get"), time.Since(start).Seconds())
-	}()
+	if s.dsConfigHandlerRequestsDuration != nil {
+		start := time.Now()
+		defer func() {
+			metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Get"), time.Since(start).Seconds())
+		}()
+	}
 
 	return s.datasources.GetDataSource(ctx, name)
 }
 
 // Create implements rest.Creater.
 func (s *legacyStorage) Create(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions) (runtime.Object, error) {
-	start := time.Now()
-	defer func() {
-		metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
-	}()
+	if s.dsConfigHandlerRequestsDuration != nil {
+		start := time.Now()
+		defer func() {
+			metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
+		}()
+	}
 
 	ds, ok := obj.(*v0alpha1.DataSource)
 	if !ok {
@@ -85,10 +89,12 @@ func (s *legacyStorage) Create(ctx context.Context, obj runtime.Object, createVa
 
 // Update implements rest.Updater.
 func (s *legacyStorage) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool, options *metav1.UpdateOptions) (runtime.Object, bool, error) {
-	start := time.Now()
-	defer func() {
-		metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
-	}()
+	if s.dsConfigHandlerRequestsDuration != nil {
+		start := time.Now()
+		defer func() {
+			metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
+		}()
+	}
 
 	old, err := s.Get(ctx, name, &metav1.GetOptions{})
 	if err != nil {
@@ -126,10 +132,12 @@ func (s *legacyStorage) Update(ctx context.Context, name string, objInfo rest.Up
 
 // Delete implements rest.GracefulDeleter.
 func (s *legacyStorage) Delete(ctx context.Context, name string, deleteValidation rest.ValidateObjectFunc, options *metav1.DeleteOptions) (runtime.Object, bool, error) {
-	start := time.Now()
-	defer func() {
-		metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
-	}()
+	if s.dsConfigHandlerRequestsDuration != nil {
+		start := time.Now()
+		defer func() {
+			metricutil.ObserveWithExemplar(ctx, s.dsConfigHandlerRequestsDuration.WithLabelValues("new", "Create"), time.Since(start).Seconds())
+		}()
+	}
 
 	err := s.datasources.DeleteDataSource(ctx, name)
 	return nil, false, err

pkg/registry/apis/datasource/register.go

@@ -3,6 +3,7 @@ package datasource
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"maps"
 
@@ -38,14 +39,14 @@ var (
 // DataSourceAPIBuilder is used just so wire has something unique to return
 type DataSourceAPIBuilder struct {
 	datasourceResourceInfo utils.ResourceInfo
-
-	pluginJSON           plugins.JSONData
-	client               PluginClient // will only ever be called with the same plugin id!
-	datasources          PluginDatasourceProvider
-	contextProvider      PluginContextWrapper
-	accessControl        accesscontrol.AccessControl
-	queryTypes           *queryV0.QueryTypeDefinitionList
-	configCrudUseNewApis bool
+	pluginJSON             plugins.JSONData
+	client                 PluginClient // will only ever be called with the same plugin id!
+	datasources            PluginDatasourceProvider
+	contextProvider        PluginContextWrapper
+	accessControl          accesscontrol.AccessControl
+	queryTypes             *queryV0.QueryTypeDefinitionList
+	configCrudUseNewApis   bool
+	dataSourceCRUDMetric   *prometheus.HistogramVec
 }
 
 func RegisterAPIService(
@@ -66,6 +67,16 @@ func RegisterAPIService(
 	var err error
 	var builder *DataSourceAPIBuilder
 
+	dataSourceCRUDMetric := metricutil.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: "grafana",
+		Name:      "ds_config_handler_requests_duration_seconds",
+		Help:      "Duration of requests handled by datasource configuration handlers",
+	}, []string{"code_path", "handler"})
+	regErr := reg.Register(dataSourceCRUDMetric)
+	if regErr != nil && !errors.As(regErr, &prometheus.AlreadyRegisteredError{}) {
+		return nil, regErr
+	}
+
 	pluginJSONs, err := getDatasourcePlugins(pluginSources)
 	if err != nil {
 		return nil, fmt.Errorf("error getting list of datasource plugins: %s", err)
@@ -91,6 +102,7 @@ func RegisterAPIService(
 		if err != nil {
 			return nil, err
 		}
+		builder.SetDataSourceCRUDMetrics(dataSourceCRUDMetric)
 
 		apiRegistrar.RegisterAPI(builder)
 	}
@@ -161,6 +173,10 @@ func (b *DataSourceAPIBuilder) GetGroupVersion() schema.GroupVersion {
 	return b.datasourceResourceInfo.GroupVersion()
 }
 
+func (b *DataSourceAPIBuilder) SetDataSourceCRUDMetrics(datasourceCRUDMetric *prometheus.HistogramVec) {
+	b.dataSourceCRUDMetric = datasourceCRUDMetric
+}
+
 func addKnownTypes(scheme *runtime.Scheme, gv schema.GroupVersion) {
 	scheme.AddKnownTypes(gv,
 		&datasourceV0.DataSource{},
@@ -218,13 +234,9 @@ func (b *DataSourceAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver
 
 	if b.configCrudUseNewApis {
 		legacyStore := &legacyStorage{
-			datasources:  b.datasources,
-			resourceInfo: &ds,
-			dsConfigHandlerRequestsDuration: metricutil.NewHistogramVec(prometheus.HistogramOpts{
-				Namespace: "grafana",
-				Name:      "ds_config_handler_requests_duration_seconds",
-				Help:      "Duration of requests handled by datasource configuration handlers",
-			}, []string{"code_path", "handler"}),
+			datasources:                     b.datasources,
+			resourceInfo:                    &ds,
+			dsConfigHandlerRequestsDuration: b.dataSourceCRUDMetric,
 		}
 		unified, err := grafanaregistry.NewRegistryStore(opts.Scheme, ds, opts.OptsGetter)
 		if err != nil {

pkg/registry/apis/iam/authorizer/parent_provider.go

@@ -0,0 +1,164 @@
+package authorizer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sync"
+
+	"github.com/grafana/authlib/authn"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+
+	dashboardv1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v1beta1"
+	folderv1 "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/auth"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
+)
+
+var (
+	ErrNoConfigProvider = errors.New("no config provider for group resource")
+	ErrNoVersionInfo    = errors.New("no version info for group resource")
+
+	Versions = map[schema.GroupResource]string{
+		{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}:                 folderv1.VERSION,
+		{Group: dashboardv1.GROUP, Resource: dashboardv1.DASHBOARD_RESOURCE}: dashboardv1.VERSION,
+	}
+)
+
+// ConfigProvider is a function that provides a rest.Config for a given context.
+type ConfigProvider func(ctx context.Context) (*rest.Config, error)
+
+// DynamicClientFactory is a function that creates a dynamic.Interface from a rest.Config.
+// This can be overridden in tests.
+type DynamicClientFactory func(config *rest.Config) (dynamic.Interface, error)
+
+// ParentProvider implementation that fetches the parent folder information from remote API servers.
+type ParentProviderImpl struct {
+	configProviders      map[schema.GroupResource]ConfigProvider
+	versions             map[schema.GroupResource]string
+	dynamicClientFactory DynamicClientFactory
+
+	// Cache of dynamic clients for each group resource
+	// This is used to avoid creating a new dynamic client for each request
+	// and to reuse the same client for the same group resource.
+	clients   map[schema.GroupResource]dynamic.Interface
+	clientsMu sync.Mutex
+}
+
+// DialConfig holds the configuration for dialing a remote API server.
+type DialConfig struct {
+	Host     string
+	Insecure bool
+	CAFile   string
+	Audience string
+}
+
+// NewLocalConfigProvider creates a map of ConfigProviders that return the same given config for local API servers.
+func NewLocalConfigProvider(
+	configProvider ConfigProvider,
+) map[schema.GroupResource]ConfigProvider {
+	return map[schema.GroupResource]ConfigProvider{
+		{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}:                 configProvider,
+		{Group: dashboardv1.GROUP, Resource: dashboardv1.DASHBOARD_RESOURCE}: configProvider,
+	}
+}
+
+// NewRemoteConfigProvider creates a map of ConfigProviders for remote API servers based on the given DialConfig.
+func NewRemoteConfigProvider(cfg map[schema.GroupResource]DialConfig, exchangeClient authn.TokenExchanger) map[schema.GroupResource]ConfigProvider {
+	configProviders := make(map[schema.GroupResource]ConfigProvider, len(cfg))
+	for gr, dialConfig := range cfg {
+		configProviders[gr] = func(ctx context.Context) (*rest.Config, error) {
+			return &rest.Config{
+				Host: dialConfig.Host,
+				WrapTransport: func(rt http.RoundTripper) http.RoundTripper {
+					return auth.NewRoundTripper(exchangeClient, rt, dialConfig.Audience)
+				},
+				TLSClientConfig: rest.TLSClientConfig{
+					Insecure: dialConfig.Insecure,
+					CAFile:   dialConfig.CAFile,
+				},
+				QPS:   50,
+				Burst: 100,
+			}, nil
+		}
+	}
+	return configProviders
+}
+
+// NewApiParentProvider creates a new ParentProviderImpl with the given config providers and version info.
+func NewApiParentProvider(
+	configProviders map[schema.GroupResource]ConfigProvider,
+	version map[schema.GroupResource]string,
+) *ParentProviderImpl {
+	return &ParentProviderImpl{
+		configProviders: configProviders,
+		versions:        version,
+		dynamicClientFactory: func(config *rest.Config) (dynamic.Interface, error) {
+			return dynamic.NewForConfig(config)
+		},
+		clients: make(map[schema.GroupResource]dynamic.Interface),
+	}
+}
+
+func (p *ParentProviderImpl) HasParent(gr schema.GroupResource) bool {
+	_, ok := p.configProviders[gr]
+	return ok
+}
+
+func (p *ParentProviderImpl) getClient(ctx context.Context, gr schema.GroupResource) (dynamic.Interface, error) {
+	p.clientsMu.Lock()
+	client, ok := p.clients[gr]
+	p.clientsMu.Unlock()
+
+	if ok {
+		return client, nil
+	}
+
+	provider, ok := p.configProviders[gr]
+	if !ok {
+		return nil, fmt.Errorf("%w: %s", ErrNoConfigProvider, gr.String())
+	}
+	restConfig, err := provider(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err = p.dynamicClientFactory(restConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	p.clientsMu.Lock()
+	p.clients[gr] = client
+	p.clientsMu.Unlock()
+
+	return client, nil
+}
+
+func (p *ParentProviderImpl) GetParent(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error) {
+	client, err := p.getClient(ctx, gr)
+	if err != nil {
+		return "", err
+	}
+
+	version, ok := p.versions[gr]
+	if !ok {
+		return "", fmt.Errorf("%w: %s", ErrNoVersionInfo, gr.String())
+	}
+	resourceClient := client.Resource(schema.GroupVersionResource{
+		Group:    gr.Group,
+		Resource: gr.Resource,
+		Version:  version,
+	}).Namespace(namespace)
+
+	unstructObj, err := resourceClient.Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		return "", err
+	}
+
+	return unstructObj.GetAnnotations()[utils.AnnoKeyFolder], nil
+}

pkg/registry/apis/iam/authorizer/parent_provider_test.go

@@ -0,0 +1,198 @@
+package authorizer
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+
+	folderv1 "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
+)
+
+var configProvider = func(ctx context.Context) (*rest.Config, error) {
+	return &rest.Config{}, nil
+}
+
+func TestParentProviderImpl_GetParent(t *testing.T) {
+	tests := []struct {
+		name            string
+		gr              schema.GroupResource
+		namespace       string
+		resourceName    string
+		parentFolder    string
+		setupFake       func(*fakeDynamicClient, *fakeResourceInterface)
+		configProviders map[schema.GroupResource]ConfigProvider
+		versions        map[schema.GroupResource]string
+		expectedError   string
+		expectedParent  string
+	}{
+		{
+			name:         "successfully get parent folder",
+			gr:           schema.GroupResource{Group: folderv1.GROUP, Resource: folderv1.RESOURCE},
+			namespace:    "org-1",
+			resourceName: "dash1",
+			parentFolder: "fold1",
+			setupFake: func(fakeClient *fakeDynamicClient, fakeResource *fakeResourceInterface) {
+				fakeClient.resourceInterface = fakeResource
+				fakeResource.getFunc = func(ctx context.Context, name string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+					obj := &unstructured.Unstructured{}
+					obj.SetAnnotations(map[string]string{utils.AnnoKeyFolder: "fold1"})
+					return obj, nil
+				}
+			},
+			configProviders: map[schema.GroupResource]ConfigProvider{
+				{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}: configProvider,
+			},
+			versions:       Versions,
+			expectedParent: "fold1",
+		},
+		{
+			name:         "resource without parent annotation returns empty",
+			gr:           schema.GroupResource{Group: folderv1.GROUP, Resource: folderv1.RESOURCE},
+			namespace:    "org-1",
+			resourceName: "dash1",
+			setupFake: func(fakeClient *fakeDynamicClient, fakeResource *fakeResourceInterface) {
+				fakeClient.resourceInterface = fakeResource
+				fakeResource.getFunc = func(ctx context.Context, name string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+					obj := &unstructured.Unstructured{}
+					obj.SetAnnotations(map[string]string{})
+					return obj, nil
+				}
+			},
+			configProviders: map[schema.GroupResource]ConfigProvider{
+				{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}: configProvider,
+			},
+			versions:       Versions,
+			expectedParent: "",
+		},
+		{
+			name:            "no config provider returns error",
+			gr:              schema.GroupResource{Group: "unknown.group", Resource: "unknown"},
+			namespace:       "org-1",
+			resourceName:    "resource-1",
+			configProviders: map[schema.GroupResource]ConfigProvider{},
+			versions:        Versions,
+			expectedError:   ErrNoConfigProvider.Error(),
+		},
+		{
+			name:         "config provider returns error",
+			gr:           schema.GroupResource{Group: folderv1.GROUP, Resource: folderv1.RESOURCE},
+			namespace:    "org-1",
+			resourceName: "resource-1",
+			configProviders: map[schema.GroupResource]ConfigProvider{
+				{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}: func(ctx context.Context) (*rest.Config, error) {
+					return nil, errors.New("config provider error")
+				},
+			},
+			versions:      Versions,
+			expectedError: "config provider error",
+		},
+		{
+			name:         "no version info returns error",
+			gr:           schema.GroupResource{Group: folderv1.GROUP, Resource: folderv1.RESOURCE},
+			namespace:    "org-1",
+			resourceName: "resource-1",
+			configProviders: map[schema.GroupResource]ConfigProvider{
+				{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}: func(ctx context.Context) (*rest.Config, error) {
+					return &rest.Config{}, nil
+				},
+			},
+			versions:      map[schema.GroupResource]string{},
+			expectedError: ErrNoVersionInfo.Error(),
+		},
+		{
+			name:         "resource get returns error",
+			gr:           schema.GroupResource{Group: folderv1.GROUP, Resource: folderv1.RESOURCE},
+			namespace:    "org-1",
+			resourceName: "resource-1",
+			setupFake: func(fakeClient *fakeDynamicClient, fakeResource *fakeResourceInterface) {
+				fakeClient.resourceInterface = fakeResource
+				fakeResource.getFunc = func(ctx context.Context, name string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+					return nil, errors.New("resource not found")
+				}
+			},
+			configProviders: map[schema.GroupResource]ConfigProvider{
+				{Group: folderv1.GROUP, Resource: folderv1.RESOURCE}: func(ctx context.Context) (*rest.Config, error) {
+					return &rest.Config{}, nil
+				},
+			},
+			versions:      Versions,
+			expectedError: "resource not found",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeClient := &fakeDynamicClient{}
+			fakeResource := &fakeResourceInterface{}
+			if tt.setupFake != nil {
+				tt.setupFake(fakeClient, fakeResource)
+			}
+
+			provider := &ParentProviderImpl{
+				configProviders: tt.configProviders,
+				versions:        tt.versions,
+				dynamicClientFactory: func(config *rest.Config) (dynamic.Interface, error) {
+					return fakeClient, nil
+				},
+				clients: make(map[schema.GroupResource]dynamic.Interface),
+			}
+
+			parent, err := provider.GetParent(context.Background(), tt.gr, tt.namespace, tt.resourceName)
+
+			if tt.expectedError != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedError)
+				assert.Empty(t, parent)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.expectedParent, parent)
+			}
+		})
+	}
+}
+
+// fakeDynamicClient is a fake implementation of dynamic.Interface
+type fakeDynamicClient struct {
+	resourceInterface dynamic.ResourceInterface
+}
+
+func (f *fakeDynamicClient) Resource(resource schema.GroupVersionResource) dynamic.NamespaceableResourceInterface {
+	return &fakeNamespaceableResourceInterface{
+		resourceInterface: f.resourceInterface,
+	}
+}
+
+// fakeNamespaceableResourceInterface is a fake implementation of dynamic.NamespaceableResourceInterface
+type fakeNamespaceableResourceInterface struct {
+	dynamic.NamespaceableResourceInterface
+	resourceInterface dynamic.ResourceInterface
+}
+
+func (f *fakeNamespaceableResourceInterface) Namespace(namespace string) dynamic.ResourceInterface {
+	if f.resourceInterface != nil {
+		return f.resourceInterface
+	}
+	return &fakeResourceInterface{}
+}
+
+// fakeResourceInterface is a fake implementation of dynamic.ResourceInterface
+type fakeResourceInterface struct {
+	dynamic.ResourceInterface
+	getFunc func(ctx context.Context, name string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error)
+}
+
+func (f *fakeResourceInterface) Get(ctx context.Context, name string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	if f.getFunc != nil {
+		return f.getFunc(ctx, name, opts, subresources...)
+	}
+	return &unstructured.Unstructured{}, nil
+}

pkg/registry/apis/iam/authorizer/resource_permissions.go

@@ -10,24 +10,44 @@ import (
 
 	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer/storewrapper"
 )
 
 // TODO: Logs, Metrics, Traces?
 
+// ParentProvider interface for fetching parent information of resources
+type ParentProvider interface {
+	// HasParent checks if the given GroupResource has a parent folder
+	HasParent(gr schema.GroupResource) bool
+	// GetParent fetches the parent folder name for the given resource
+	GetParent(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error)
+}
+
 // ResourcePermissionsAuthorizer
 type ResourcePermissionsAuthorizer struct {
-	accessClient types.AccessClient
+	accessClient   types.AccessClient
+	parentProvider ParentProvider
+	logger         log.Logger
 }
 
 var _ storewrapper.ResourceStorageAuthorizer = (*ResourcePermissionsAuthorizer)(nil)
 
-func NewResourcePermissionsAuthorizer(accessClient types.AccessClient) *ResourcePermissionsAuthorizer {
+func NewResourcePermissionsAuthorizer(
+	accessClient types.AccessClient,
+	parentProvider ParentProvider,
+) *ResourcePermissionsAuthorizer {
 	return &ResourcePermissionsAuthorizer{
-		accessClient: accessClient,
+		accessClient:   accessClient,
+		parentProvider: parentProvider,
+		logger:         log.New("iam.resource-permissions-authorizer"),
 	}
 }
 
+func isAccessPolicy(authInfo types.AuthInfo) bool {
+	return types.IsIdentityType(authInfo.GetIdentityType(), types.TypeAccessPolicy)
+}
+
 // AfterGet implements ResourceStorageAuthorizer.
 func (r *ResourcePermissionsAuthorizer) AfterGet(ctx context.Context, obj runtime.Object) error {
 	authInfo, ok := types.AuthInfoFrom(ctx)
@@ -37,9 +57,24 @@ func (r *ResourcePermissionsAuthorizer) AfterGet(ctx context.Context, obj runtim
 	switch o := obj.(type) {
 	case *iamv0.ResourcePermission:
 		target := o.Spec.Resource
+		targetGR := schema.GroupResource{Group: target.ApiGroup, Resource: target.Resource}
 
-		// TODO: Fetch the resource to retrieve its parent folder.
 		parent := ""
+		// Fetch the parent of the resource
+		// Access Policies have global scope, so no parent check needed
+		if !isAccessPolicy(authInfo) && r.parentProvider.HasParent(targetGR) {
+			p, err := r.parentProvider.GetParent(ctx, targetGR, o.Namespace, target.Name)
+			if err != nil {
+				r.logger.Error("after get: error fetching parent", "error", err.Error(),
+					"namespace", o.Namespace,
+					"group", target.ApiGroup,
+					"resource", target.Resource,
+					"name", target.Name,
+				)
+				return err
+			}
+			parent = p
+		}
 
 		checkReq := types.CheckRequest{
 			Namespace: o.Namespace,
@@ -72,9 +107,24 @@ func (r *ResourcePermissionsAuthorizer) beforeWrite(ctx context.Context, obj run
 	switch o := obj.(type) {
 	case *iamv0.ResourcePermission:
 		target := o.Spec.Resource
+		targetGR := schema.GroupResource{Group: target.ApiGroup, Resource: target.Resource}
 
-		// TODO: Fetch the resource to retrieve its parent folder.
 		parent := ""
+		// Fetch the parent of the resource
+		// Access Policies have global scope, so no parent check needed
+		if !isAccessPolicy(authInfo) && r.parentProvider.HasParent(targetGR) {
+			p, err := r.parentProvider.GetParent(ctx, targetGR, o.Namespace, target.Name)
+			if err != nil {
+				r.logger.Error("before write: error fetching parent", "error", err.Error(),
+					"namespace", o.Namespace,
+					"group", target.ApiGroup,
+					"resource", target.Resource,
+					"name", target.Name,
+				)
+				return err
+			}
+			parent = p
+		}
 
 		checkReq := types.CheckRequest{
 			Namespace: o.Namespace,
@@ -153,8 +203,29 @@ func (r *ResourcePermissionsAuthorizer) FilterList(ctx context.Context, list run
 				canViewFuncs[gr] = canView
 			}
 
-			// TODO : Fetch the resource to retrieve its parent folder.
+			target := item.Spec.Resource
+			targetGR := schema.GroupResource{Group: target.ApiGroup, Resource: target.Resource}
+
 			parent := ""
+			// Fetch the parent of the resource
+			// It's not efficient to do for every item in the list, but it's a good starting point.
+			// Access Policies have global scope, so no parent check needed
+			if !isAccessPolicy(authInfo) && r.parentProvider.HasParent(targetGR) {
+				p, err := r.parentProvider.GetParent(ctx, targetGR, item.Namespace, target.Name)
+				if err != nil {
+					// Skip item on error fetching parent
+					r.logger.Warn("filter list: error fetching parent, skipping item",
+						"error", err.Error(),
+						"namespace",
+						item.Namespace,
+						"group", target.ApiGroup,
+						"resource", target.Resource,
+						"name", target.Name,
+					)
+					continue
+				}
+				parent = p
+			}
 
 			allowed := canView(item.Spec.Resource.Name, parent)
 			if allowed {

pkg/registry/apis/iam/authorizer/resource_permissions_test.go

@@ -5,13 +5,15 @@ import (
 	"testing"
 
 	"github.com/go-jose/go-jose/v4/jwt"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
 	"github.com/grafana/authlib/authn"
 	"github.com/grafana/authlib/types"
 	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 var (
@@ -63,6 +65,7 @@ func TestResourcePermissions_AfterGet(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			parent := "fold-1"
 			checkFunc := func(id types.AuthInfo, req *types.CheckRequest, folder string) (types.CheckResponse, error) {
 				require.NotNil(t, id)
 				// Check is called with the user's identity
@@ -74,12 +77,18 @@ func TestResourcePermissions_AfterGet(t *testing.T) {
 				require.Equal(t, fold1.Spec.Resource.Resource, req.Resource)
 				require.Equal(t, fold1.Spec.Resource.Name, req.Name)
 				require.Equal(t, utils.VerbGetPermissions, req.Verb)
+				require.Equal(t, parent, folder)
 
 				return types.CheckResponse{Allowed: tt.shouldAllow}, nil
 			}
+			getParentFunc := func(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error) {
+				// For this test, we can return a fixed parent folder ID
+				return parent, nil
+			}
 
 			accessClient := &fakeAccessClient{checkFunc: checkFunc}
-			resPermAuthz := NewResourcePermissionsAuthorizer(accessClient)
+			fakeParentProvider := &fakeParentProvider{hasParent: true, getParentFunc: getParentFunc}
+			resPermAuthz := NewResourcePermissionsAuthorizer(accessClient, fakeParentProvider)
 			ctx := types.WithAuthInfo(context.Background(), user)
 
 			err := resPermAuthz.AfterGet(ctx, fold1)
@@ -89,6 +98,7 @@ func TestResourcePermissions_AfterGet(t *testing.T) {
 				require.Error(t, err, "expected error for denied access")
 			}
 			require.True(t, accessClient.checkCalled, "accessClient.Check should be called")
+			require.True(t, fakeParentProvider.getParentCalled, "parentProvider.GetParent should be called")
 		})
 	}
 }
@@ -121,23 +131,32 @@ func TestResourcePermissions_FilterList(t *testing.T) {
 			require.Equal(t, "dashboards", req.Resource)
 		}
 
-		// Return a checker that allows only specific resources: fold-1 and dash-2
+		// Return a checker that allows access to fold-1 and its content
 		return func(name, folder string) bool {
-			if name == "fold-1" || name == "dash-2" {
+			if name == "fold-1" || folder == "fold-1" {
 				return true
 			}
 			return false
 		}, &types.NoopZookie{}, nil
 	}
 
+	getParentFunc := func(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error) {
+		if name == "dash-2" {
+			return "fold-1", nil
+		}
+		return "", nil
+	}
+
 	accessClient := &fakeAccessClient{compileFunc: compileFunc}
-	resPermAuthz := NewResourcePermissionsAuthorizer(accessClient)
+	fakeParentProvider := &fakeParentProvider{hasParent: true, getParentFunc: getParentFunc}
+	resPermAuthz := NewResourcePermissionsAuthorizer(accessClient, fakeParentProvider)
 	ctx := types.WithAuthInfo(context.Background(), user)
 
 	obj, err := resPermAuthz.FilterList(ctx, list)
 	require.NoError(t, err)
 	require.NotNil(t, list)
 	require.True(t, accessClient.compileCalled, "accessClient.Compile should be called")
+	require.True(t, fakeParentProvider.getParentCalled, "parentProvider.GetParent should be called")
 
 	filtered, ok := obj.(*iamv0.ResourcePermissionList)
 	require.True(t, ok, "response should be of type ResourcePermissionList")
@@ -165,6 +184,7 @@ func TestResourcePermissions_beforeWrite(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			parent := "fold-1"
 			checkFunc := func(id types.AuthInfo, req *types.CheckRequest, folder string) (types.CheckResponse, error) {
 				require.NotNil(t, id)
 				// Check is called with the user's identity
@@ -176,12 +196,18 @@ func TestResourcePermissions_beforeWrite(t *testing.T) {
 				require.Equal(t, fold1.Spec.Resource.Resource, req.Resource)
 				require.Equal(t, fold1.Spec.Resource.Name, req.Name)
 				require.Equal(t, utils.VerbSetPermissions, req.Verb)
+				require.Equal(t, parent, folder)
 
 				return types.CheckResponse{Allowed: tt.shouldAllow}, nil
 			}
 
+			getParentFunc := func(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error) {
+				return parent, nil
+			}
+
 			accessClient := &fakeAccessClient{checkFunc: checkFunc}
-			resPermAuthz := NewResourcePermissionsAuthorizer(accessClient)
+			fakeParentProvider := &fakeParentProvider{hasParent: true, getParentFunc: getParentFunc}
+			resPermAuthz := NewResourcePermissionsAuthorizer(accessClient, fakeParentProvider)
 			ctx := types.WithAuthInfo(context.Background(), user)
 
 			err := resPermAuthz.beforeWrite(ctx, fold1)
@@ -191,6 +217,7 @@ func TestResourcePermissions_beforeWrite(t *testing.T) {
 				require.Error(t, err, "expected error for denied delete")
 			}
 			require.True(t, accessClient.checkCalled, "accessClient.Check should be called")
+			require.True(t, fakeParentProvider.getParentCalled, "parentProvider.GetParent should be called")
 		})
 	}
 }
@@ -214,3 +241,18 @@ func (m *fakeAccessClient) Compile(ctx context.Context, id types.AuthInfo, req t
 }
 
 var _ types.AccessClient = (*fakeAccessClient)(nil)
+
+type fakeParentProvider struct {
+	hasParent       bool
+	getParentCalled bool
+	getParentFunc   func(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error)
+}
+
+func (f *fakeParentProvider) HasParent(gr schema.GroupResource) bool {
+	return f.hasParent
+}
+
+func (f *fakeParentProvider) GetParent(ctx context.Context, gr schema.GroupResource, namespace, name string) (string, error) {
+	f.getParentCalled = true
+	return f.getParentFunc(ctx, gr, namespace, name)
+}

pkg/registry/apis/iam/models.go

@@ -7,6 +7,7 @@ import (
 	"github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/infra/log"
+	iamauthorizer "github.com/grafana/grafana/pkg/registry/apis/iam/authorizer"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/externalgroupmapping"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/serviceaccount"
@@ -60,6 +61,10 @@ type IdentityAccessManagementAPIBuilder struct {
 	roleBindingsStorage         RoleBindingStorageBackend
 	externalGroupMappingStorage ExternalGroupMappingStorageBackend
 
+	// Required for resource permissions authorization
+	// fetches resources parent folders
+	resourceParentProvider iamauthorizer.ParentProvider
+
 	// Access Control
 	authorizer authorizer.Authorizer
 	// legacyAccessClient is used for the identity apis, we need to migrate to the access client

pkg/registry/apis/iam/register.go

@@ -41,6 +41,7 @@ import (
 	"github.com/grafana/grafana/pkg/registry/apis/iam/teambinding"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/user"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/apiserver"
 	gfauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer/storewrapper"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
@@ -80,6 +81,7 @@ func RegisterAPIService(
 	orgService org.Service,
 	userService legacyuser.Service,
 	teamService teamservice.Service,
+	restConfig apiserver.RestConfigProvider,
 ) (*IdentityAccessManagementAPIBuilder, error) {
 	dbProvider := legacysql.NewDatabaseProvider(sql)
 	store := legacy.NewLegacySQLStores(dbProvider)
@@ -90,6 +92,11 @@ func RegisterAPIService(
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	enableAuthnMutation := features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthnMutation)
 
+	resourceParentProvider := iamauthorizer.NewApiParentProvider(
+		iamauthorizer.NewLocalConfigProvider(restConfig.GetRestConfig),
+		iamauthorizer.Versions,
+	)
+
 	builder := &IdentityAccessManagementAPIBuilder{
 		store:                       store,
 		userLegacyStore:             user.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
@@ -104,6 +111,7 @@ func RegisterAPIService(
 		externalGroupMappingStorage: externalGroupMappingStorageBackend,
 		teamGroupsHandler:           teamGroupsHandlerImpl,
 		sso:                         ssoService,
+		resourceParentProvider:      resourceParentProvider,
 		authorizer:                  authorizer,
 		legacyAccessClient:          legacyAccessClient,
 		accessClient:                accessClient,
@@ -142,6 +150,12 @@ func NewAPIService(
 	resourceAuthorizer := gfauthorizer.NewResourceAuthorizer(accessClient)
 	coreRoleAuthorizer := iamauthorizer.NewCoreRoleAuthorizer(accessClient)
 
+	// TODO: in a follow up PR, make this configurable
+	resourceParentProvider := iamauthorizer.NewApiParentProvider(
+		iamauthorizer.NewRemoteConfigProvider(map[schema.GroupResource]iamauthorizer.DialConfig{}, nil),
+		iamauthorizer.Versions,
+	)
+
 	return &IdentityAccessManagementAPIBuilder{
 		store:                      store,
 		display:                    user.NewLegacyDisplayREST(store),
@@ -152,6 +166,7 @@ func NewAPIService(
 		logger:                     log.New("iam.apis"),
 		features:                   features,
 		accessClient:               accessClient,
+		resourceParentProvider:     resourceParentProvider,
 		zClient:                    zClient,
 		zTickets:                   make(chan bool, MaxConcurrentZanzanaWrites),
 		reg:                        reg,
@@ -444,7 +459,7 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateResourcePermissionsAPIGroup(
 		return fmt.Errorf("expected RegistryStoreDualWrite, got %T", dw)
 	}
 
-	authzWrapper := storewrapper.New(regStoreDW, iamauthorizer.NewResourcePermissionsAuthorizer(b.accessClient))
+	authzWrapper := storewrapper.New(regStoreDW, iamauthorizer.NewResourcePermissionsAuthorizer(b.accessClient, b.resourceParentProvider))
 
 	storage[iamv0.ResourcePermissionInfo.StoragePath()] = authzWrapper
 	return nil

pkg/registry/apis/provisioning/controller/health.go

@@ -26,6 +26,18 @@ type StatusPatcher interface {
 	Patch(ctx context.Context, repo *provisioning.Repository, patchOperations ...map[string]interface{}) error
 }
 
+// HealthCheckerInterface defines the interface for health checking operations
+//
+//go:generate mockery --name=HealthCheckerInterface --structname=MockHealthChecker
+type HealthCheckerInterface interface {
+	ShouldCheckHealth(repo *provisioning.Repository) bool
+	RefreshHealth(ctx context.Context, repo repository.Repository) (*provisioning.TestResults, provisioning.HealthStatus, error)
+	RefreshHealthWithPatchOps(ctx context.Context, repo repository.Repository) (*provisioning.TestResults, provisioning.HealthStatus, []map[string]interface{}, error)
+	RefreshTimestamp(ctx context.Context, repo *provisioning.Repository) error
+	RecordFailure(ctx context.Context, failureType provisioning.HealthFailureType, err error, repo *provisioning.Repository) error
+	HasRecentFailure(healthStatus provisioning.HealthStatus, failureType provisioning.HealthFailureType) bool
+}
+
 // HealthChecker provides unified health checking for repositories
 type HealthChecker struct {
 	statusPatcher StatusPatcher
@@ -162,6 +174,33 @@ func (hc *HealthChecker) RefreshHealth(ctx context.Context, repo repository.Repo
 	return testResults, newHealthStatus, nil
 }
 
+// RefreshHealthWithPatchOps performs a health check on an existing repository
+// and returns the test results, health status, and patch operations to apply.
+// This method does NOT apply the patch itself, allowing the caller to batch
+// multiple status updates together to avoid race conditions.
+func (hc *HealthChecker) RefreshHealthWithPatchOps(ctx context.Context, repo repository.Repository) (*provisioning.TestResults, provisioning.HealthStatus, []map[string]interface{}, error) {
+	cfg := repo.Config()
+
+	// Use health checker to perform comprehensive health check with existing status
+	testResults, newHealthStatus, err := hc.refreshHealth(ctx, repo, cfg.Status.Health)
+	if err != nil {
+		return nil, provisioning.HealthStatus{}, nil, fmt.Errorf("health check failed: %w", err)
+	}
+
+	var patchOps []map[string]interface{}
+
+	// Only return patch operation if health status actually changed
+	if hc.hasHealthStatusChanged(cfg.Status.Health, newHealthStatus) {
+		patchOps = append(patchOps, map[string]interface{}{
+			"op":    "replace",
+			"path":  "/status/health",
+			"value": newHealthStatus,
+		})
+	}
+
+	return testResults, newHealthStatus, patchOps, nil
+}
+
 // RefreshTimestamp updates the health status timestamp without changing other fields
 func (hc *HealthChecker) RefreshTimestamp(ctx context.Context, repo *provisioning.Repository) error {
 	// Update the timestamp on the existing health status

pkg/registry/apis/provisioning/controller/health_test.go

@@ -532,6 +532,136 @@ func TestRefreshHealth(t *testing.T) {
 	}
 }
 
+func TestRefreshHealthWithPatchOps(t *testing.T) {
+	tests := []struct {
+		name              string
+		testResult        *provisioning.TestResults
+		testError         error
+		existingStatus    provisioning.HealthStatus
+		expectError       bool
+		expectedHealth    bool
+		expectPatchOps    bool
+		expectedPatchPath string
+	}{
+		{
+			name: "successful health check with status change",
+			testResult: &provisioning.TestResults{
+				Success: true,
+				Code:    200,
+			},
+			testError: nil,
+			existingStatus: provisioning.HealthStatus{
+				Healthy: false,
+				Error:   provisioning.HealthFailureHealth,
+				Checked: time.Now().Add(-time.Hour).UnixMilli(),
+			},
+			expectError:       false,
+			expectedHealth:    true,
+			expectPatchOps:    true,
+			expectedPatchPath: "/status/health",
+		},
+		{
+			name: "failed health check with status change",
+			testResult: &provisioning.TestResults{
+				Success: false,
+				Code:    500,
+				Errors: []provisioning.ErrorDetails{
+					{Detail: "connection failed"},
+				},
+			},
+			testError: nil,
+			existingStatus: provisioning.HealthStatus{
+				Healthy: true,
+				Checked: time.Now().Add(-time.Hour).UnixMilli(),
+			},
+			expectError:       false,
+			expectedHealth:    false,
+			expectPatchOps:    true,
+			expectedPatchPath: "/status/health",
+		},
+		{
+			name: "no status change - no patch ops returned",
+			testResult: &provisioning.TestResults{
+				Success: true,
+				Code:    200,
+			},
+			testError: nil,
+			existingStatus: provisioning.HealthStatus{
+				Healthy: true,
+				Checked: time.Now().Add(-15 * time.Second).UnixMilli(),
+			},
+			expectError:    false,
+			expectedHealth: true,
+			expectPatchOps: false,
+		},
+		{
+			name:       "test repository error",
+			testResult: nil,
+			testError:  errors.New("repository test failed"),
+			existingStatus: provisioning.HealthStatus{
+				Healthy: true,
+				Checked: time.Now().Add(-time.Hour).UnixMilli(),
+			},
+			expectError:    true,
+			expectedHealth: false,
+			expectPatchOps: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create mock repository
+			mockRepo := &mockRepository{
+				config: &provisioning.Repository{
+					Spec: provisioning.RepositorySpec{
+						Title: "Test Repository",
+						Type:  provisioning.LocalRepositoryType,
+					},
+					Status: provisioning.RepositoryStatus{
+						Health: tt.existingStatus,
+					},
+				},
+				testResult: tt.testResult,
+				testError:  tt.testError,
+			}
+
+			// Create health checker with validator and tester
+			validator := repository.NewValidator(30*time.Second, []provisioning.SyncTargetType{provisioning.SyncTargetTypeFolder, provisioning.SyncTargetTypeInstance}, true)
+			hc := NewHealthChecker(nil, prometheus.NewPedanticRegistry(), repository.NewSimpleRepositoryTester(validator))
+
+			// Call RefreshHealthWithPatchOps
+			testResults, healthStatus, patchOps, err := hc.RefreshHealthWithPatchOps(context.Background(), mockRepo)
+
+			// Verify error
+			if tt.expectError {
+				assert.Error(t, err)
+				assert.Nil(t, testResults)
+				return
+			}
+			assert.NoError(t, err)
+
+			// Verify health status
+			assert.Equal(t, tt.expectedHealth, healthStatus.Healthy)
+
+			// Verify patch operations
+			if tt.expectPatchOps {
+				assert.NotEmpty(t, patchOps, "expected patch operations to be returned")
+				assert.Len(t, patchOps, 1)
+				assert.Equal(t, "replace", patchOps[0]["op"])
+				assert.Equal(t, tt.expectedPatchPath, patchOps[0]["path"])
+				assert.Equal(t, healthStatus, patchOps[0]["value"])
+			} else {
+				assert.Empty(t, patchOps, "expected no patch operations to be returned")
+			}
+
+			// Verify test results
+			if tt.testResult != nil {
+				assert.Equal(t, tt.testResult, testResults)
+			}
+		})
+	}
+}
+
 func TestHasHealthStatusChanged(t *testing.T) {
 	tests := []struct {
 		name     string

pkg/registry/apis/provisioning/controller/mocks/HealthCheckerInterface.go

@@ -0,0 +1,187 @@
+// Code generated by mockery v2.53.4. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+
+	repository "github.com/grafana/grafana/apps/provisioning/pkg/repository"
+
+	v0alpha1 "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+// MockHealthChecker is an autogenerated mock type for the HealthCheckerInterface type
+type MockHealthChecker struct {
+	mock.Mock
+}
+
+// HasRecentFailure provides a mock function with given fields: healthStatus, failureType
+func (_m *MockHealthChecker) HasRecentFailure(healthStatus v0alpha1.HealthStatus, failureType v0alpha1.HealthFailureType) bool {
+	ret := _m.Called(healthStatus, failureType)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HasRecentFailure")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(v0alpha1.HealthStatus, v0alpha1.HealthFailureType) bool); ok {
+		r0 = rf(healthStatus, failureType)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// RecordFailure provides a mock function with given fields: ctx, failureType, err, repo
+func (_m *MockHealthChecker) RecordFailure(ctx context.Context, failureType v0alpha1.HealthFailureType, err error, repo *v0alpha1.Repository) error {
+	ret := _m.Called(ctx, failureType, err, repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RecordFailure")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, v0alpha1.HealthFailureType, error, *v0alpha1.Repository) error); ok {
+		r0 = rf(ctx, failureType, err, repo)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// RefreshHealth provides a mock function with given fields: ctx, repo
+func (_m *MockHealthChecker) RefreshHealth(ctx context.Context, repo repository.Repository) (*v0alpha1.TestResults, v0alpha1.HealthStatus, error) {
+	ret := _m.Called(ctx, repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RefreshHealth")
+	}
+
+	var r0 *v0alpha1.TestResults
+	var r1 v0alpha1.HealthStatus
+	var r2 error
+	if rf, ok := ret.Get(0).(func(context.Context, repository.Repository) (*v0alpha1.TestResults, v0alpha1.HealthStatus, error)); ok {
+		return rf(ctx, repo)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, repository.Repository) *v0alpha1.TestResults); ok {
+		r0 = rf(ctx, repo)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*v0alpha1.TestResults)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, repository.Repository) v0alpha1.HealthStatus); ok {
+		r1 = rf(ctx, repo)
+	} else {
+		r1 = ret.Get(1).(v0alpha1.HealthStatus)
+	}
+
+	if rf, ok := ret.Get(2).(func(context.Context, repository.Repository) error); ok {
+		r2 = rf(ctx, repo)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
+}
+
+// RefreshHealthWithPatchOps provides a mock function with given fields: ctx, repo
+func (_m *MockHealthChecker) RefreshHealthWithPatchOps(ctx context.Context, repo repository.Repository) (*v0alpha1.TestResults, v0alpha1.HealthStatus, []map[string]interface{}, error) {
+	ret := _m.Called(ctx, repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RefreshHealthWithPatchOps")
+	}
+
+	var r0 *v0alpha1.TestResults
+	var r1 v0alpha1.HealthStatus
+	var r2 []map[string]interface{}
+	var r3 error
+	if rf, ok := ret.Get(0).(func(context.Context, repository.Repository) (*v0alpha1.TestResults, v0alpha1.HealthStatus, []map[string]interface{}, error)); ok {
+		return rf(ctx, repo)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, repository.Repository) *v0alpha1.TestResults); ok {
+		r0 = rf(ctx, repo)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*v0alpha1.TestResults)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, repository.Repository) v0alpha1.HealthStatus); ok {
+		r1 = rf(ctx, repo)
+	} else {
+		r1 = ret.Get(1).(v0alpha1.HealthStatus)
+	}
+
+	if rf, ok := ret.Get(2).(func(context.Context, repository.Repository) []map[string]interface{}); ok {
+		r2 = rf(ctx, repo)
+	} else {
+		if ret.Get(2) != nil {
+			r2 = ret.Get(2).([]map[string]interface{})
+		}
+	}
+
+	if rf, ok := ret.Get(3).(func(context.Context, repository.Repository) error); ok {
+		r3 = rf(ctx, repo)
+	} else {
+		r3 = ret.Error(3)
+	}
+
+	return r0, r1, r2, r3
+}
+
+// RefreshTimestamp provides a mock function with given fields: ctx, repo
+func (_m *MockHealthChecker) RefreshTimestamp(ctx context.Context, repo *v0alpha1.Repository) error {
+	ret := _m.Called(ctx, repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RefreshTimestamp")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, *v0alpha1.Repository) error); ok {
+		r0 = rf(ctx, repo)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// ShouldCheckHealth provides a mock function with given fields: repo
+func (_m *MockHealthChecker) ShouldCheckHealth(repo *v0alpha1.Repository) bool {
+	ret := _m.Called(repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ShouldCheckHealth")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(*v0alpha1.Repository) bool); ok {
+		r0 = rf(repo)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// NewMockHealthChecker creates a new instance of MockHealthChecker. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockHealthChecker(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockHealthChecker {
+	mock := &MockHealthChecker{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

pkg/registry/apis/provisioning/controller/mocks/StatusPatcher.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v2.52.4. DO NOT EDIT.
+// Code generated by mockery v2.53.4. DO NOT EDIT.
 
 package mocks
 

pkg/registry/apis/provisioning/controller/repository.go

@@ -561,11 +561,16 @@ func (rc *RepositoryController) process(item *queueItem) error {
 	}
 
 	// Handle health checks using the health checker
-	_, healthStatus, err := rc.healthChecker.RefreshHealth(ctx, repo)
+	_, healthStatus, healthPatchOps, err := rc.healthChecker.RefreshHealthWithPatchOps(ctx, repo)
 	if err != nil {
 		return fmt.Errorf("update health status: %w", err)
 	}
 
+	// Add health patch operations first
+	if len(healthPatchOps) > 0 {
+		patchOperations = append(patchOperations, healthPatchOps...)
+	}
+
 	// determine the sync strategy and sync status to apply
 	syncOptions := rc.determineSyncStrategy(ctx, obj, repo, shouldResync, healthStatus)
 	patchOperations = append(patchOperations, rc.determineSyncStatusOps(obj, syncOptions, healthStatus)...)

pkg/registry/apis/provisioning/controller/repository_test.go

@@ -350,6 +350,161 @@ type mockJobsQueueStore struct {
 	*jobs.MockStore
 }
 
+func TestRepositoryController_process_UnhealthyRepositoryStatusUpdate(t *testing.T) {
+	testCases := []struct {
+		name                     string
+		repo                     *provisioning.Repository
+		healthStatus             provisioning.HealthStatus
+		hasHealthStatusChanged   bool
+		expectedUnhealthyMessage bool
+		description              string
+	}{
+		{
+			name: "unhealthy repository should set unhealthy message in sync status",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-repo",
+					Namespace:  "default",
+					Generation: 1,
+				},
+				Spec: provisioning.RepositorySpec{
+					Sync: provisioning.SyncOptions{
+						Enabled:         true,
+						IntervalSeconds: 300,
+					},
+				},
+				Status: provisioning.RepositoryStatus{
+					ObservedGeneration: 1,
+					Health: provisioning.HealthStatus{
+						Healthy: true,
+						Checked: time.Now().Add(-10 * time.Minute).UnixMilli(),
+					},
+					Sync: provisioning.SyncStatus{
+						State:    provisioning.JobStateSuccess,
+						Finished: time.Now().Add(-1 * time.Minute).UnixMilli(),
+						Message:  []string{},
+					},
+				},
+			},
+			healthStatus: provisioning.HealthStatus{
+				Healthy: false,
+				Error:   provisioning.HealthFailureHealth,
+				Checked: time.Now().UnixMilli(),
+				Message: []string{"connection failed"},
+			},
+			hasHealthStatusChanged:   true,
+			expectedUnhealthyMessage: true,
+			description:              "should set unhealthy message when repository becomes unhealthy",
+		},
+		{
+			name: "unhealthy repository should not duplicate unhealthy message",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-repo",
+					Namespace:  "default",
+					Generation: 1,
+				},
+				Spec: provisioning.RepositorySpec{
+					Sync: provisioning.SyncOptions{
+						Enabled:         true,
+						IntervalSeconds: 300,
+					},
+				},
+				Status: provisioning.RepositoryStatus{
+					ObservedGeneration: 1,
+					Health: provisioning.HealthStatus{
+						Healthy: false,
+						Checked: time.Now().Add(-2 * time.Minute).UnixMilli(),
+					},
+					Sync: provisioning.SyncStatus{
+						State:    provisioning.JobStateError,
+						Finished: time.Now().Add(-1 * time.Minute).UnixMilli(),
+						Message:  []string{"Repository is unhealthy"},
+					},
+				},
+			},
+			healthStatus: provisioning.HealthStatus{
+				Healthy: false,
+				Error:   provisioning.HealthFailureHealth,
+				Checked: time.Now().UnixMilli(),
+				Message: []string{"connection failed"},
+			},
+			hasHealthStatusChanged:   false,
+			expectedUnhealthyMessage: false,
+			description:              "should not set unhealthy message when it already exists",
+		},
+		{
+			name: "healthy repository should clear unhealthy message",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-repo",
+					Namespace:  "default",
+					Generation: 1,
+				},
+				Spec: provisioning.RepositorySpec{
+					Sync: provisioning.SyncOptions{
+						Enabled:         true,
+						IntervalSeconds: 300,
+					},
+				},
+				Status: provisioning.RepositoryStatus{
+					ObservedGeneration: 1,
+					Health: provisioning.HealthStatus{
+						Healthy: false,
+						Checked: time.Now().Add(-2 * time.Minute).UnixMilli(),
+					},
+					Sync: provisioning.SyncStatus{
+						State:    provisioning.JobStateError,
+						Finished: time.Now().Add(-1 * time.Minute).UnixMilli(),
+						Message:  []string{"Repository is unhealthy"},
+					},
+				},
+			},
+			healthStatus: provisioning.HealthStatus{
+				Healthy: true,
+				Checked: time.Now().UnixMilli(),
+				Message: []string{},
+			},
+			hasHealthStatusChanged:   true,
+			expectedUnhealthyMessage: false,
+			description:              "should clear unhealthy message when repository becomes healthy",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create controller
+			rc := &RepositoryController{}
+
+			// Determine sync status ops (this is a pure function, no mocks needed)
+			syncOps := rc.determineSyncStatusOps(tc.repo, nil, tc.healthStatus)
+
+			// Verify expectations
+			hasUnhealthyOp := false
+			hasClearUnhealthyOp := false
+			for _, op := range syncOps {
+				if path, ok := op["path"].(string); ok {
+					if path == "/status/sync/message" {
+						if messages, ok := op["value"].([]string); ok {
+							if len(messages) > 0 && messages[0] == "Repository is unhealthy" {
+								hasUnhealthyOp = true
+							} else if len(messages) == 0 {
+								hasClearUnhealthyOp = true
+							}
+						}
+					}
+				}
+			}
+
+			if tc.expectedUnhealthyMessage {
+				assert.True(t, hasUnhealthyOp, tc.description+": expected unhealthy message operation")
+			} else if len(tc.repo.Status.Sync.Message) > 0 && tc.healthStatus.Healthy {
+				assert.True(t, hasClearUnhealthyOp, tc.description+": expected clear unhealthy message operation")
+			}
+		})
+	}
+}
+
 func TestRepositoryController_shouldResync_StaleSyncStatus(t *testing.T) {
 	testCases := []struct {
 		name           string

pkg/registry/apis/provisioning/jobs/progress.go

@@ -35,12 +35,13 @@ func maybeNotifyProgress(threshold time.Duration, fn ProgressFn) ProgressFn {
 
 // FIXME: ProgressRecorder should be initialized in the queue
 type JobResourceResult struct {
-	Name   string
-	Group  string
-	Kind   string
-	Path   string
-	Action repository.FileAction
-	Error  error
+	Name    string
+	Group   string
+	Kind    string
+	Path    string
+	Action  repository.FileAction
+	Error   error
+	Warning error
 }
 
 type jobProgressRecorder struct {
@@ -193,6 +194,10 @@ func (r *jobProgressRecorder) updateSummary(result JobResourceResult) {
 		errorMsg := fmt.Sprintf("%s (file: %s, name: %s, action: %s)", result.Error.Error(), result.Path, result.Name, result.Action)
 		summary.Errors = append(summary.Errors, errorMsg)
 		summary.Error++
+	} else if result.Warning != nil {
+		warningMsg := fmt.Sprintf("%s (file: %s, name: %s, action: %s)", result.Warning.Error(), result.Path, result.Name, result.Action)
+		summary.Warnings = append(summary.Warnings, warningMsg)
+		summary.Warning++
 	} else {
 		switch result.Action {
 		case repository.FileActionDeleted:
@@ -266,8 +271,17 @@ func (r *jobProgressRecorder) Complete(ctx context.Context, err error) provision
 		jobStatus.Message = err.Error()
 	}
 
-	jobStatus.Summary = r.summary()
+	summaries := r.summary()
+	jobStatus.Summary = summaries
 	jobStatus.Errors = r.errors
+
+	// Extract warnings from summaries
+	warnings := make([]string, 0)
+	for _, summary := range summaries {
+		warnings = append(warnings, summary.Warnings...)
+	}
+	jobStatus.Warnings = warnings
+
 	jobStatus.URLs = r.refURLs
 
 	tooManyErrors := r.maxErrors > 0 && r.errorCount >= r.maxErrors
@@ -283,6 +297,9 @@ func (r *jobProgressRecorder) Complete(ctx context.Context, err error) provision
 			jobStatus.Message = "completed with errors"
 			jobStatus.State = provisioning.JobStateWarning
 		}
+	} else if len(jobStatus.Warnings) > 0 {
+		jobStatus.State = provisioning.JobStateWarning
+		jobStatus.Message = "completed with warnings"
 	}
 
 	// Override message if progress have a more explicit message

pkg/registry/apis/provisioning/jobs/progress_test.go

@@ -2,9 +2,11 @@ package jobs
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -83,3 +85,167 @@ func TestJobProgressRecorderCompleteIncludesRefURLs(t *testing.T) {
 	assert.Equal(t, provisioning.JobStateSuccess, finalStatus.State)
 	assert.Equal(t, "completed successfully", finalStatus.Message)
 }
+
+func TestJobProgressRecorderWarningStatus(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record a result with a warning
+	warningErr := errors.New("deprecated API used")
+	result := JobResourceResult{
+		Name:    "test-resource",
+		Group:   "test.grafana.app",
+		Kind:    "Dashboard",
+		Path:    "dashboards/test.json",
+		Action:  repository.FileActionUpdated,
+		Warning: warningErr,
+	}
+	recorder.Record(ctx, result)
+
+	// Record another result with a different warning
+	warningErr2 := errors.New("missing optional field")
+	result2 := JobResourceResult{
+		Name:    "test-resource-2",
+		Group:   "test.grafana.app",
+		Kind:    "Dashboard",
+		Path:    "dashboards/test2.json",
+		Action:  repository.FileActionCreated,
+		Warning: warningErr2,
+	}
+	recorder.Record(ctx, result2)
+
+	// Record a result with a warning from a different resource type
+	warningErr3 := errors.New("validation warning")
+	result3 := JobResourceResult{
+		Name:    "test-resource-3",
+		Group:   "test.grafana.app",
+		Kind:    "DataSource",
+		Path:    "datasources/test.yaml",
+		Action:  repository.FileActionCreated,
+		Warning: warningErr3,
+	}
+	recorder.Record(ctx, result3)
+
+	// Verify warnings are stored in summaries
+	recorder.mu.RLock()
+	require.Len(t, recorder.summaries, 2) // Dashboard and DataSource
+	dashboardSummary := recorder.summaries["test.grafana.app:Dashboard"]
+	require.NotNil(t, dashboardSummary)
+	assert.Equal(t, int64(2), dashboardSummary.Warning)
+	assert.Len(t, dashboardSummary.Warnings, 2)
+	assert.Contains(t, dashboardSummary.Warnings[0], "deprecated API used")
+	assert.Contains(t, dashboardSummary.Warnings[1], "missing optional field")
+
+	datasourceSummary := recorder.summaries["test.grafana.app:DataSource"]
+	require.NotNil(t, datasourceSummary)
+	assert.Equal(t, int64(1), datasourceSummary.Warning)
+	assert.Len(t, datasourceSummary.Warnings, 1)
+	assert.Contains(t, datasourceSummary.Warnings[0], "validation warning")
+	recorder.mu.RUnlock()
+
+	// Complete the job
+	finalStatus := recorder.Complete(ctx, nil)
+
+	// Verify the final status includes warnings
+	require.NotNil(t, finalStatus.Warnings)
+	assert.Len(t, finalStatus.Warnings, 3)
+	assert.Contains(t, finalStatus.Warnings[0], "deprecated API used")
+	assert.Contains(t, finalStatus.Warnings[1], "missing optional field")
+	assert.Contains(t, finalStatus.Warnings[2], "validation warning")
+
+	// Verify the state is set to Warning
+	assert.Equal(t, provisioning.JobStateWarning, finalStatus.State)
+	assert.Equal(t, "completed with warnings", finalStatus.Message)
+
+	// Verify summaries are included
+	require.Len(t, finalStatus.Summary, 2)
+
+	// Verify no errors were recorded
+	assert.Empty(t, finalStatus.Errors)
+}
+
+func TestJobProgressRecorderWarningWithErrors(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record a result with an error (errors take precedence)
+	errorErr := errors.New("failed to process")
+	result := JobResourceResult{
+		Name:   "test-resource",
+		Group:  "test.grafana.app",
+		Kind:   "Dashboard",
+		Path:   "dashboards/test.json",
+		Action: repository.FileActionUpdated,
+		Error:  errorErr,
+	}
+	recorder.Record(ctx, result)
+
+	// Record a result with only a warning
+	warningErr := errors.New("deprecated API used")
+	result2 := JobResourceResult{
+		Name:    "test-resource-2",
+		Group:   "test.grafana.app",
+		Kind:    "Dashboard",
+		Path:    "dashboards/test2.json",
+		Action:  repository.FileActionCreated,
+		Warning: warningErr,
+	}
+	recorder.Record(ctx, result2)
+
+	// Complete the job
+	finalStatus := recorder.Complete(ctx, nil)
+
+	// When there are errors, the state should be Warning (not Error unless too many)
+	// and warnings should still be included
+	assert.Equal(t, provisioning.JobStateWarning, finalStatus.State)
+	assert.Equal(t, "completed with errors", finalStatus.Message)
+	assert.Len(t, finalStatus.Errors, 1)
+	assert.Contains(t, finalStatus.Errors[0], "failed to process")
+
+	// Warnings should still be extracted from summaries
+	require.NotNil(t, finalStatus.Warnings)
+	assert.Len(t, finalStatus.Warnings, 1)
+	assert.Contains(t, finalStatus.Warnings[0], "deprecated API used")
+}
+
+func TestJobProgressRecorderWarningOnlyNoErrors(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record only warnings, no errors
+	warningErr := errors.New("deprecated API used")
+	result := JobResourceResult{
+		Name:    "test-resource",
+		Group:   "test.grafana.app",
+		Kind:    "Dashboard",
+		Path:    "dashboards/test.json",
+		Action:  repository.FileActionUpdated,
+		Warning: warningErr,
+	}
+	recorder.Record(ctx, result)
+
+	// Complete the job
+	finalStatus := recorder.Complete(ctx, nil)
+
+	// Verify the state is Warning (not Error) when only warnings exist
+	assert.Equal(t, provisioning.JobStateWarning, finalStatus.State)
+	assert.Equal(t, "completed with warnings", finalStatus.Message)
+	assert.Empty(t, finalStatus.Errors)
+	require.NotNil(t, finalStatus.Warnings)
+	assert.Len(t, finalStatus.Warnings, 1)
+}

pkg/registry/apis/service/register.go

@@ -38,6 +38,7 @@ func RegisterAPIService(features featuremgmt.FeatureToggles, apiregistration bui
 }
 
 func (b *ServiceAPIBuilder) GetAuthorizer() authorizer.Authorizer {
+	//nolint:staticcheck // not yet migrated to Resource Authorizer
 	return roleauthorizer.NewRoleAuthorizer()
 }
 

pkg/registry/apis/wireset.go

@@ -3,6 +3,7 @@ package apiregistry
 import (
 	"github.com/google/wire"
 
+	"github.com/grafana/grafana/pkg/apiserver/auditing"
 	"github.com/grafana/grafana/pkg/registry/apis/collections"
 	dashboardinternal "github.com/grafana/grafana/pkg/registry/apis/dashboard"
 	"github.com/grafana/grafana/pkg/registry/apis/datasource"
@@ -33,6 +34,10 @@ var WireSetExts = wire.NewSet(
 
 	externalgroupmapping.ProvideNoopTeamGroupsREST,
 	wire.Bind(new(externalgroupmapping.TeamGroupsHandler), new(*externalgroupmapping.NoopTeamGroupsREST)),
+
+	// Auditing Options
+	auditing.ProvideNoopBackend,
+	auditing.ProvideNoopPolicyRuleEvaluator,
 )
 
 var provisioningExtras = wire.NewSet(

pkg/registry/apps/correlations/register.go

@@ -5,6 +5,7 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	restclient "k8s.io/client-go/rest"
 
 	"github.com/grafana/grafana-app-sdk/app"
@@ -16,6 +17,7 @@ import (
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/apiserver/rest"
 	"github.com/grafana/grafana/pkg/services/apiserver/appinstaller"
+	roleauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/correlations"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -60,6 +62,11 @@ func RegisterAppInstaller(
 	return installer, nil
 }
 
+func (a *AppInstaller) GetAuthorizer() authorizer.Authorizer {
+	//nolint:staticcheck // not yet migrated to Resource Authorizer
+	return roleauthorizer.NewRoleAuthorizer()
+}
+
 func (a *AppInstaller) GetLegacyStorage(requested schema.GroupVersionResource) rest.Storage {
 	kind := correlationsV0.CorrelationKind()
 	gvr := schema.GroupVersionResource{

pkg/registry/apps/playlist/register.go

@@ -6,17 +6,20 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	restclient "k8s.io/client-go/rest"
 
 	"github.com/grafana/grafana-app-sdk/app"
 	appsdkapiserver "github.com/grafana/grafana-app-sdk/k8s/apiserver"
 	"github.com/grafana/grafana-app-sdk/simple"
+
 	"github.com/grafana/grafana/apps/playlist/pkg/apis"
 	playlistv0alpha1 "github.com/grafana/grafana/apps/playlist/pkg/apis/playlist/v0alpha1"
 	playlistapp "github.com/grafana/grafana/apps/playlist/pkg/app"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
 	"github.com/grafana/grafana/pkg/services/apiserver/appinstaller"
+	roleauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	playlistsvc "github.com/grafana/grafana/pkg/services/playlist"
@@ -63,6 +66,11 @@ func RegisterAppInstaller(
 	return installer, nil
 }
 
+func (p *PlaylistAppInstaller) GetAuthorizer() authorizer.Authorizer {
+	//nolint:staticcheck // not yet migrated to Resource Authorizer
+	return roleauthorizer.NewRoleAuthorizer()
+}
+
 // GetLegacyStorage returns the legacy storage for the playlist app.
 func (p *PlaylistAppInstaller) GetLegacyStorage(requested schema.GroupVersionResource) grafanarest.Storage {
 	gvr := playlistv0alpha1.PlaylistKind().GroupVersionResource()

pkg/registry/apps/quotas/register.go

@@ -3,12 +3,14 @@ package quotas
 import (
 	"github.com/grafana/grafana/apps/quotas/pkg/apis"
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	restclient "k8s.io/client-go/rest"
 
 	"github.com/grafana/grafana-app-sdk/app"
 	appsdkapiserver "github.com/grafana/grafana-app-sdk/k8s/apiserver"
 	"github.com/grafana/grafana-app-sdk/simple"
 	quotasapp "github.com/grafana/grafana/apps/quotas/pkg/app"
+	roleauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/setting"
 )
@@ -22,6 +24,11 @@ type QuotasAppInstaller struct {
 	cfg *setting.Cfg
 }
 
+func (a *QuotasAppInstaller) GetAuthorizer() authorizer.Authorizer {
+	//nolint:staticcheck // not yet migrated to Resource Authorizer
+	return roleauthorizer.NewRoleAuthorizer()
+}
+
 func RegisterAppInstaller(
 	cfg *setting.Cfg,
 	features featuremgmt.FeatureToggles,

pkg/server/wire_gen.go

@@ -14,6 +14,7 @@ import (
 	"github.com/grafana/grafana/pkg/api"
 	"github.com/grafana/grafana/pkg/api/avatar"
 	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/apiserver/auditing"
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/configprovider"
 	"github.com/grafana/grafana/pkg/expr"
@@ -831,7 +832,9 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	}
 	v2 := appregistry.ProvideAppInstallers(featureToggles, playlistAppInstaller, appInstaller, shortURLAppInstaller, alertingRulesAppInstaller, correlationsAppInstaller, alertingNotificationsAppInstaller, logsDrilldownAppInstaller, annotationAppInstaller, exampleAppInstaller, advisorAppInstaller, alertingHistorianAppInstaller, quotasAppInstaller)
 	builderMetrics := builder.ProvideBuilderMetrics(registerer)
-	apiserverService, err := apiserver.ProvideService(cfg, featureToggles, routeRegisterImpl, tracingService, serverLockService, sqlStore, kvStore, middlewareHandler, scopedPluginDatasourceProvider, plugincontextProvider, pluginstoreService, dualwriteService, resourceClient, inlineSecureValueSupport, eventualRestConfigProvider, v, eventualRestConfigProvider, registerer, aggregatorRunner, v2, builderMetrics)
+	backend := auditing.ProvideNoopBackend()
+	policyRuleEvaluator := auditing.ProvideNoopPolicyRuleEvaluator()
+	apiserverService, err := apiserver.ProvideService(cfg, featureToggles, routeRegisterImpl, tracingService, serverLockService, sqlStore, kvStore, middlewareHandler, scopedPluginDatasourceProvider, plugincontextProvider, pluginstoreService, dualwriteService, resourceClient, inlineSecureValueSupport, eventualRestConfigProvider, v, eventualRestConfigProvider, registerer, aggregatorRunner, v2, builderMetrics, backend, policyRuleEvaluator)
 	if err != nil {
 		return nil, err
 	}
@@ -879,7 +882,7 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient)
 	storageBackendImpl := noopstorage.ProvideStorageBackend()
 	noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
-	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, storageBackendImpl, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService)
+	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, storageBackendImpl, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -1489,7 +1492,9 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	}
 	v2 := appregistry.ProvideAppInstallers(featureToggles, playlistAppInstaller, appInstaller, shortURLAppInstaller, alertingRulesAppInstaller, correlationsAppInstaller, alertingNotificationsAppInstaller, logsDrilldownAppInstaller, annotationAppInstaller, exampleAppInstaller, advisorAppInstaller, alertingHistorianAppInstaller, quotasAppInstaller)
 	builderMetrics := builder.ProvideBuilderMetrics(registerer)
-	apiserverService, err := apiserver.ProvideService(cfg, featureToggles, routeRegisterImpl, tracingService, serverLockService, sqlStore, kvStore, middlewareHandler, scopedPluginDatasourceProvider, plugincontextProvider, pluginstoreService, dualwriteService, resourceClient, inlineSecureValueSupport, eventualRestConfigProvider, v, eventualRestConfigProvider, registerer, aggregatorRunner, v2, builderMetrics)
+	backend := auditing.ProvideNoopBackend()
+	policyRuleEvaluator := auditing.ProvideNoopPolicyRuleEvaluator()
+	apiserverService, err := apiserver.ProvideService(cfg, featureToggles, routeRegisterImpl, tracingService, serverLockService, sqlStore, kvStore, middlewareHandler, scopedPluginDatasourceProvider, plugincontextProvider, pluginstoreService, dualwriteService, resourceClient, inlineSecureValueSupport, eventualRestConfigProvider, v, eventualRestConfigProvider, registerer, aggregatorRunner, v2, builderMetrics, backend, policyRuleEvaluator)
 	if err != nil {
 		return nil, err
 	}
@@ -1537,7 +1542,7 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	folderAPIBuilder := folders.RegisterAPIService(cfg, featureToggles, apiserverService, folderimplService, folderPermissionsService, accessControl, acimplService, accessClient, registerer, resourceClient, zanzanaClient)
 	storageBackendImpl := noopstorage.ProvideStorageBackend()
 	noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
-	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, storageBackendImpl, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService)
+	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, storageBackendImpl, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}

pkg/services/apiserver/appinstaller/installer.go

@@ -114,6 +114,8 @@ func RegisterAuthorizers(
 				registrar.Register(gv, authorizer)
 				logger.Debug("Registered authorizer", "group", gv.Group, "version", gv.Version, "app")
 			}
+		} else {
+			panic("authorizer cannot be nil for api group: " + installer.GroupVersions()[0].Group)
 		}
 	}
 }

pkg/services/apiserver/appinstaller/installer_test.go

@@ -15,6 +15,7 @@ func TestRegisterAuthorizers(t *testing.T) {
 		name              string
 		appInstallers     []appsdkapiserver.AppInstaller
 		expectedRegisters int
+		expectedPanic     bool
 	}{
 		{
 			name:              "empty installers list",
@@ -30,7 +31,7 @@ func TestRegisterAuthorizers(t *testing.T) {
 					},
 				},
 			},
-			expectedRegisters: 0,
+			expectedPanic: true,
 		},
 		{
 			name: "single installer with authorizer provider",
@@ -46,6 +47,20 @@ func TestRegisterAuthorizers(t *testing.T) {
 			},
 			expectedRegisters: 1,
 		},
+		{
+			name: "single installer with invalid authorizer provider",
+			appInstallers: []appsdkapiserver.AppInstaller{
+				&mockAppInstallerWithAuth{
+					mockAppInstaller: &mockAppInstaller{
+						groupVersions: []schema.GroupVersion{
+							{Group: "test.example.com", Version: "v1"},
+						},
+					},
+					mockAuthorizer: nil,
+				},
+			},
+			expectedPanic: true,
+		},
 		{
 			name: "installer with multiple group versions",
 			appInstallers: []appsdkapiserver.AppInstaller{
@@ -63,7 +78,7 @@ func TestRegisterAuthorizers(t *testing.T) {
 			expectedRegisters: 3,
 		},
 		{
-			name: "multiple installers with mixed authorizer support",
+			name: "multiple installers with authorizer support",
 			appInstallers: []appsdkapiserver.AppInstaller{
 				&mockAppInstallerWithAuth{
 					mockAppInstaller: &mockAppInstaller{
@@ -73,11 +88,6 @@ func TestRegisterAuthorizers(t *testing.T) {
 					},
 					mockAuthorizer: &mockAuthorizer{},
 				},
-				&mockAppInstaller{
-					groupVersions: []schema.GroupVersion{
-						{Group: "other.example.com", Version: "v1"},
-					},
-				},
 				&mockAppInstallerWithAuth{
 					mockAppInstaller: &mockAppInstaller{
 						groupVersions: []schema.GroupVersion{
@@ -88,7 +98,7 @@ func TestRegisterAuthorizers(t *testing.T) {
 					mockAuthorizer: &mockAuthorizer{},
 				},
 			},
-			expectedRegisters: 3, // 1 from first installer + 2 from third installer
+			expectedRegisters: 3, // 1 from first installer + 2 from second installer
 		},
 	}
 
@@ -96,6 +106,13 @@ func TestRegisterAuthorizers(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 			registrar := &mockAuthorizerRegistrar{}
+			if tt.expectedPanic {
+				defer func() {
+					if r := recover(); r == nil {
+						t.Errorf("%s case did not panic as expected", t.Name())
+					}
+				}()
+			}
 			RegisterAuthorizers(ctx, tt.appInstallers, registrar)
 			require.Equal(t, tt.expectedRegisters, len(registrar.registrations))
 		})

pkg/services/apiserver/auth/authorizer/authorizer.go

@@ -38,12 +38,12 @@ func NewGrafanaBuiltInSTAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
 
 	// Individual services may have explicit implementations
 	apis := make(map[string]authorizer.Authorizer)
+	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
 	authorizers = append(authorizers, &authorizerForAPI{apis})
 
-	// org role is last -- and will return allow for verbs that match expectations
-	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
-	// NOTE: role authorizer is now used by some api groups as their specific authorizer
-	// but there are still some apis not directly registered in the embedded delegate that benefit from including it here
+	// org role authorizer is last -- and will return allow for verbs that match expectations
+	// it is only helpful here for remote APIs in some cloud use-cases.
+	//nolint:staticcheck // remove once build handler chains are untangled between local and remote APIs handling
 	authorizers = append(authorizers, NewRoleAuthorizer())
 	return &GrafanaAuthorizer{
 		apis: apis,

pkg/services/apiserver/auth/authorizer/role.go

@@ -19,6 +19,7 @@ var orgRoleNoneAsViewerAPIGroups = []string{
 
 type roleAuthorizer struct{}
 
+// Deprecated: NewRoleAuthorizer exists for apps that were launched with simplistic authorization requirements. Consider using NewResourceAuthorizer instead.
 func NewRoleAuthorizer() *roleAuthorizer {
 	return &roleAuthorizer{}
 }

pkg/services/apiserver/service.go

@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apiserver/pkg/audit"
 	genericapifilters "k8s.io/apiserver/pkg/endpoints/filters"
 	"k8s.io/apiserver/pkg/endpoints/responsewriter"
 	genericapiserver "k8s.io/apiserver/pkg/server"
@@ -113,6 +114,9 @@ type service struct {
 	appInstallers                     []appsdkapiserver.AppInstaller
 	builderMetrics                    *builder.BuilderMetrics
 	dualWriterMetrics                 *grafanarest.DualWriterMetrics
+
+	auditBackend             audit.Backend
+	auditPolicyRuleEvaluator audit.PolicyRuleEvaluator
 }
 
 func ProvideService(
@@ -137,6 +141,8 @@ func ProvideService(
 	aggregatorRunner aggregatorrunner.AggregatorRunner,
 	appInstallers []appsdkapiserver.AppInstaller,
 	builderMetrics *builder.BuilderMetrics,
+	auditBackend audit.Backend,
+	auditPolicyRuleEvaluator audit.PolicyRuleEvaluator,
 ) (*service, error) {
 	scheme := builder.ProvideScheme()
 	codecs := builder.ProvideCodecFactory(scheme)
@@ -167,6 +173,8 @@ func ProvideService(
 		appInstallers:                     appInstallers,
 		builderMetrics:                    builderMetrics,
 		dualWriterMetrics:                 grafanarest.NewDualWriterMetrics(reg),
+		auditBackend:                      auditBackend,
+		auditPolicyRuleEvaluator:          auditPolicyRuleEvaluator,
 	}
 	// This will be used when running as a dskit service
 	s.NamedService = services.NewBasicService(s.start, s.running, nil).WithName(modules.GrafanaAPIServer)
@@ -355,6 +363,10 @@ func (s *service) start(ctx context.Context) error {
 		appinstaller.BuildOpenAPIDefGetter(s.appInstallers),
 	}
 
+	// Auditing Options
+	serverConfig.AuditBackend = s.auditBackend
+	serverConfig.AuditPolicyRuleEvaluator = s.auditPolicyRuleEvaluator
+
 	// Add OpenAPI specs for each group+version (existing builders)
 	err = builder.SetupConfig(
 		s.scheme,

pkg/services/ngalert/api/api_ruler.go

@@ -412,11 +412,16 @@ func (srv RulerSrv) RoutePostNameRulesConfig(c *contextmodel.ReqContext, ruleGro
 		deletePermanently = true
 	}
 
-	namespace, err := srv.store.GetNamespaceByUID(c.Req.Context(), namespaceUID, c.GetOrgID(), c.SignedInUser)
+	f, err := srv.store.GetNamespaceByUID(c.Req.Context(), namespaceUID, c.GetOrgID(), c.SignedInUser)
 	if err != nil {
 		return toNamespaceErrorResponse(err)
 	}
 
+	namespace := ngmodels.NewNamespace(f)
+	if err := namespace.ValidateForRuleStorage(); err != nil {
+		return ErrResp(http.StatusBadRequest, fmt.Errorf("%w: %s", ngmodels.ErrAlertRuleFailedValidation, err), "")
+	}
+
 	if err := srv.checkGroupLimits(ruleGroupConfig); err != nil {
 		return ErrResp(http.StatusBadRequest, err, "")
 	}
@@ -841,10 +846,14 @@ func (srv RulerSrv) RouteUpdateNamespaceRules(c *contextmodel.ReqContext, body a
 		return ErrResp(http.StatusBadRequest, errors.New("missing request body"), "")
 	}
 
-	namespace, err := srv.store.GetNamespaceByUID(c.Req.Context(), namespaceUID, c.GetOrgID(), c.SignedInUser)
+	f, err := srv.store.GetNamespaceByUID(c.Req.Context(), namespaceUID, c.GetOrgID(), c.SignedInUser)
 	if err != nil {
 		return toNamespaceErrorResponse(err)
 	}
+	namespace := ngmodels.NewNamespace(f)
+	if err := namespace.ValidateForRuleStorage(); err != nil {
+		return ErrResp(http.StatusBadRequest, fmt.Errorf("%w: %s", ngmodels.ErrAlertRuleFailedValidation, err), "")
+	}
 
 	ruleGroups, _, err := srv.searchAuthorizedAlertRules(c.Req.Context(), authorizedRuleGroupQuery{
 		User:          c.SignedInUser,

pkg/services/ngalert/api/api_ruler_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/infra/log"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -1288,4 +1289,64 @@ func TestRouteUpdateNamespaceRules(t *testing.T) {
 		updatedRules := getRecordedUpdatedRules(ruleStore)
 		require.Empty(t, updatedRules)
 	})
+
+	t.Run("should reject update when folder is managed by ManagerKindRepo", func(t *testing.T) {
+		ruleStore := fakes.NewRuleStore(t)
+		provisioningStore := fakes.NewFakeProvisioningStore()
+
+		// Create a managed folder
+		managedFolder := randFolder()
+		managedFolder.ManagedBy = utils.ManagerKindRepo
+		ruleStore.Folders[orgID] = append(ruleStore.Folders[orgID], managedFolder)
+
+		// Create some rules in the managed folder
+		ruleGen := models.RuleGen.With(
+			models.RuleGen.WithOrgID(orgID),
+			models.RuleGen.WithNamespaceUID(managedFolder.UID),
+		)
+		rules := ruleGen.GenerateManyRef(2)
+		ruleStore.PutRule(context.Background(), rules...)
+
+		permissions := createPermissionsForRules(rules, orgID)
+		requestCtx := createRequestContextWithPerms(orgID, permissions, nil)
+
+		svc := createServiceWithProvenanceStore(ruleStore, provisioningStore)
+		response := svc.RouteUpdateNamespaceRules(requestCtx, apimodels.UpdateNamespaceRulesRequest{
+			IsPaused: util.Pointer(true),
+		}, managedFolder.UID)
+
+		require.Equal(t, http.StatusBadRequest, response.Status())
+		require.Contains(t, string(response.Body()), "cannot store rules in folder managed by Git Sync")
+
+		// Verify no rules were updated
+		updatedRules := getRecordedUpdatedRules(ruleStore)
+		require.Empty(t, updatedRules)
+	})
+}
+
+func TestRoutePostNameRulesConfig(t *testing.T) {
+	t.Run("should reject creation when folder is managed by ManagerKindRepo", func(t *testing.T) {
+		orgID := rand.Int63()
+		ruleStore := fakes.NewRuleStore(t)
+
+		// Create a managed folder
+		managedFolder := randFolder()
+		managedFolder.ManagedBy = utils.ManagerKindRepo
+		ruleStore.Folders[orgID] = append(ruleStore.Folders[orgID], managedFolder)
+
+		permissions := map[int64]map[string][]string{
+			orgID: {
+				dashboards.ScopeFoldersProvider.GetResourceScopeUID(managedFolder.UID): {dashboards.ActionFoldersRead},
+			},
+		}
+		requestCtx := createRequestContextWithPerms(orgID, permissions, nil)
+
+		svc := createService(ruleStore, nil)
+		response := svc.RoutePostNameRulesConfig(requestCtx, apimodels.PostableRuleGroupConfig{
+			Name: "test-group",
+		}, managedFolder.UID)
+
+		require.Equal(t, http.StatusBadRequest, response.Status())
+		require.Contains(t, string(response.Body()), "cannot store rules in folder managed by Git Sync")
+	})
 }

pkg/services/ngalert/api/prometheus/api_prometheus.go

@@ -296,7 +296,7 @@ func (srv PrometheusSrv) RouteGetRuleStatuses(c *contextmodel.ReqContext) respon
 	allowedNamespaces := map[string]string{}
 	for namespaceUID, folder := range namespaceMap {
 		// only add namespaces that the user has access to rules in
-		hasAccess, err := srv.authz.HasAccessInFolder(c.Req.Context(), c.SignedInUser, ngmodels.Namespace(*folder.ToFolderReference()))
+		hasAccess, err := srv.authz.HasAccessInFolder(c.Req.Context(), c.SignedInUser, ngmodels.NewNamespace(folder))
 		if err != nil {
 			ruleResponse.Status = "error"
 			ruleResponse.Error = fmt.Sprintf("failed to get namespaces visible to the user: %s", err.Error())

pkg/services/ngalert/eval/eval.go

@@ -204,7 +204,7 @@ func IsNonRetryableError(err error) bool {
 	return false
 }
 
-// HasErrors returns true when Results contains at least one element and all elements are errors
+// IsError returns true when Results contains at least one element and all elements are errors
 func (evalResults Results) IsError() bool {
 	for _, r := range evalResults {
 		if r.State != Error {

pkg/services/ngalert/models/alert_rule.go

@@ -24,6 +24,7 @@ import (
 
 	alertingModels "github.com/grafana/alerting/models"
 
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/services/quota"
 	"github.com/grafana/grafana/pkg/setting"
@@ -397,6 +398,20 @@ type Namespaced interface {
 
 type Namespace folder.FolderReference
 
+func NewNamespace(f *folder.Folder) Namespace {
+	return Namespace(*f.ToFolderReference())
+}
+
+func (n Namespace) ValidateForRuleStorage() error {
+	if n.UID == "" {
+		return fmt.Errorf("cannot store rules in folder without UID")
+	}
+	if n.ManagedBy == utils.ManagerKindRepo {
+		return fmt.Errorf("cannot store rules in folder managed by Git Sync")
+	}
+	return nil
+}
+
 func (n Namespace) GetNamespaceUID() string {
 	return n.UID
 }

pkg/services/ngalert/provisioning/alert_rules.go

@@ -114,7 +114,7 @@ func (service *AlertRuleService) ListAlertRules(ctx context.Context, user identi
 		}
 		folderUIDs := make([]string, 0, len(folders))
 		for _, f := range folders {
-			access, err := service.authz.HasAccessInFolder(ctx, user, models.Namespace(*f.ToFolderReference()))
+			access, err := service.authz.HasAccessInFolder(ctx, user, models.NewNamespace(f))
 			if err != nil {
 				return nil, nil, "", err
 			}
@@ -407,6 +407,9 @@ func (service *AlertRuleService) UpdateRuleGroup(ctx context.Context, user ident
 	if err := models.ValidateRuleGroupInterval(intervalSeconds, service.baseIntervalSeconds); err != nil {
 		return err
 	}
+	if err := service.ensureNamespace(ctx, user, user.GetOrgID(), namespaceUID); err != nil {
+		return err
+	}
 	return service.xact.InTransaction(ctx, func(ctx context.Context) error {
 		query := &models.ListAlertRulesQuery{
 			OrgID:         user.GetOrgID(),
@@ -471,6 +474,10 @@ func (service *AlertRuleService) ReplaceRuleGroup(ctx context.Context, user iden
 		return err
 	}
 
+	if err := service.ensureNamespace(ctx, user, user.GetOrgID(), group.FolderUID); err != nil {
+		return err
+	}
+
 	// If the rule group is reserved for no-group rules, we cannot have multiple rules in it.
 	if models.IsNoGroupRuleGroup(group.Title) && len(group.Rules) > 1 {
 		return fmt.Errorf("rule group %s is reserved for no-group rules and cannot be used for rule groups with multiple rules", group.Title)
@@ -1025,6 +1032,7 @@ func (service *AlertRuleService) checkGroupLimits(group models.AlertRuleGroup) e
 
 // ensureNamespace ensures that the rule has a valid namespace UID.
 // If the rule does not have a namespace UID or the namespace (folder) does not exist it will return an error.
+// If the folder is managed by a manager, it will also return an error.
 func (service *AlertRuleService) ensureNamespace(ctx context.Context, user identity.Requester, orgID int64, namespaceUID string) error {
 	if namespaceUID == "" {
 		return fmt.Errorf("%w: folderUID must be set", models.ErrAlertRuleFailedValidation)
@@ -1037,18 +1045,23 @@ func (service *AlertRuleService) ensureNamespace(ctx context.Context, user ident
 	}
 
 	// ensure the namespace exists
-	_, err := service.folderService.Get(ctx, &folder.GetFolderQuery{
+	f, err := service.folderService.Get(ctx, &folder.GetFolderQuery{
 		OrgID:        orgID,
 		UID:          &namespaceUID,
 		SignedInUser: user,
 	})
-	if err != nil {
+	if err != nil || f == nil {
 		if errors.Is(err, dashboards.ErrFolderNotFound) {
 			return fmt.Errorf("%w: folder does not exist", models.ErrAlertRuleFailedValidation)
 		}
 		return err
 	}
 
+	// check if the folder is managed by a manager
+	if err := models.NewNamespace(f).ValidateForRuleStorage(); err != nil {
+		return fmt.Errorf("%w: %s", models.ErrAlertRuleFailedValidation, err)
+	}
+
 	return nil
 }
 

pkg/services/ngalert/provisioning/alert_rules_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/expr"
 	"github.com/grafana/grafana/pkg/infra/db"
@@ -867,6 +868,27 @@ func TestIntegrationAlertRuleService(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, int64(120), rule.IntervalSeconds)
 	})
+
+	t.Run("UpdateRuleGroup should reject when folder is managed by a manager", func(t *testing.T) {
+		service, _, _, ac := initService(t)
+		ac.CanWriteAllRulesFunc = func(ctx context.Context, user identity.Requester) (bool, error) {
+			return true, nil
+		}
+
+		managedFolderUID := "managed-folder-update-group"
+		fs := foldertest.NewFakeService()
+		fs.AddFolder(&folder.Folder{
+			OrgID:     orgID,
+			UID:       managedFolderUID,
+			Title:     "Managed Folder",
+			ManagedBy: utils.ManagerKindRepo,
+		})
+		service.folderService = fs
+
+		err := service.UpdateRuleGroup(context.Background(), u, managedFolderUID, "some-group", 120)
+		require.ErrorIs(t, err, models.ErrAlertRuleFailedValidation)
+		require.ErrorContains(t, err, "cannot store rules in folder managed by Git Sync")
+	})
 }
 
 func TestIntegrationCreateAlertRule(t *testing.T) {
@@ -1166,6 +1188,30 @@ func TestIntegrationCreateAlertRule(t *testing.T) {
 		require.NoError(t, err)
 		require.True(t, models.IsNoGroupRuleGroup(retrievedRule.RuleGroup), "Rule should be considered NoGroup rule")
 	})
+
+	t.Run("should reject creation when folder is managed by a manager", func(t *testing.T) {
+		service, _, _, ac := initService(t)
+		ac.CanWriteAllRulesFunc = func(ctx context.Context, user identity.Requester) (bool, error) {
+			return true, nil
+		}
+
+		managedFolderUID := "managed-folder"
+		fs := foldertest.NewFakeService()
+		fs.AddFolder(&folder.Folder{
+			OrgID:     orgID,
+			UID:       managedFolderUID,
+			Title:     "Managed Folder",
+			ManagedBy: utils.ManagerKindRepo,
+		})
+		service.folderService = fs
+
+		rule := dummyRule("test-managed-folder", orgID)
+		rule.NamespaceUID = managedFolderUID
+
+		_, err := service.CreateAlertRule(context.Background(), u, rule, models.ProvenanceNone)
+		require.ErrorIs(t, err, models.ErrAlertRuleFailedValidation)
+		require.ErrorContains(t, err, "cannot store rules in folder managed by Git Sync")
+	})
 }
 
 func TestUpdateAlertRule(t *testing.T) {
@@ -1316,6 +1362,36 @@ func TestUpdateAlertRule(t *testing.T) {
 		require.Equal(t, "nogroup-update-new", updated.Title)
 		require.Equal(t, originalInterval, updated.IntervalSeconds)
 	})
+
+	t.Run("should reject update when folder is managed by a manager", func(t *testing.T) {
+		service, ruleStore, provenanceStore, ac := initService(t)
+		ac.CanWriteAllRulesFunc = func(ctx context.Context, user identity.Requester) (bool, error) {
+			return true, nil
+		}
+
+		managedFolderUID := "managed-folder-update"
+		fs := foldertest.NewFakeService()
+		fs.AddFolder(&folder.Folder{
+			OrgID:     orgID,
+			UID:       managedFolderUID,
+			Title:     "Managed Folder",
+			ManagedBy: utils.ManagerKindRepo,
+		})
+		service.folderService = fs
+
+		// Create an existing rule
+		existingRule := dummyRule("test-managed-folder-update", orgID)
+		existingRule.NamespaceUID = managedFolderUID
+		_, err := ruleStore.InsertAlertRules(context.Background(), models.NewUserUID(u), []models.InsertRule{{AlertRule: existingRule}})
+		require.NoError(t, err)
+		require.NoError(t, provenanceStore.SetProvenance(context.Background(), &existingRule, orgID, models.ProvenanceNone))
+
+		// Try to update the rule
+		existingRule.Title = "Updated Title"
+		_, err = service.UpdateAlertRule(context.Background(), u, existingRule, models.ProvenanceNone)
+		require.ErrorIs(t, err, models.ErrAlertRuleFailedValidation)
+		require.ErrorContains(t, err, "cannot store rules in folder managed by Git Sync")
+	})
 }
 
 func TestDeleteAlertRule(t *testing.T) {
@@ -2054,6 +2130,33 @@ func TestReplaceGroup(t *testing.T) {
 		require.Error(t, err)
 		require.ErrorContains(t, err, "cannot move rule out of this group")
 	})
+
+	t.Run("should reject replace when folder is managed by a manager", func(t *testing.T) {
+		service, _, _, ac := initService(t)
+		ac.CanWriteAllRulesFunc = func(ctx context.Context, user identity.Requester) (bool, error) {
+			return true, nil
+		}
+
+		managedFolderUID := "managed-folder-replace"
+		fs := foldertest.NewFakeService()
+		fs.AddFolder(&folder.Folder{
+			OrgID:     orgID,
+			UID:       managedFolderUID,
+			Title:     "Managed Folder",
+			ManagedBy: utils.ManagerKindRepo,
+		})
+		service.folderService = fs
+
+		group := models.AlertRuleGroup{
+			Title:     "test-group",
+			FolderUID: managedFolderUID,
+			Interval:  60,
+		}
+
+		err := service.ReplaceRuleGroup(context.Background(), u, group, models.ProvenanceNone, "")
+		require.ErrorIs(t, err, models.ErrAlertRuleFailedValidation)
+		require.ErrorContains(t, err, "cannot store rules in folder managed by Git Sync")
+	})
 }
 
 func TestDeleteRuleGroup(t *testing.T) {

pkg/services/ngalert/state/historian/loki.go

@@ -530,7 +530,7 @@ func (h *RemoteLokiBackend) getFolderUIDsForFilter(ctx context.Context, query mo
 	uids := make([]string, 0, len(folders))
 	// now keep only UIDs of folder in which user can read rules.
 	for _, f := range folders {
-		hasAccess, err := h.ac.HasAccessInFolder(ctx, query.SignedInUser, models.Namespace(*f.ToFolderReference()))
+		hasAccess, err := h.ac.HasAccessInFolder(ctx, query.SignedInUser, models.NewNamespace(f))
 		if err != nil {
 			return nil, err
 		}

pkg/services/sqlstore/migrations/annotation_mig.go

@@ -261,8 +261,8 @@ func RunDashboardUIDMigrations(sess *xorm.Session, driverName string, logger log
 	logger.Info("Starting batched dashboard_uid migration for annotations (newest first)", "batchSize", batchSize)
 	updateSQL := `UPDATE annotation
 		SET dashboard_uid = (SELECT uid FROM dashboard WHERE dashboard.id = annotation.dashboard_id)
-		WHERE dashboard_uid IS NULL 
-		  AND dashboard_id != 0 
+		WHERE dashboard_uid IS NULL
+		  AND dashboard_id != 0
 		  AND EXISTS (SELECT 1 FROM dashboard WHERE dashboard.id = annotation.dashboard_id)
 		  AND annotation.id IN (
 			SELECT id FROM annotation
@@ -285,19 +285,19 @@ func RunDashboardUIDMigrations(sess *xorm.Session, driverName string, logger log
 			LIMIT $1
 		 )`
 	case MySQL:
-		updateSQL = `UPDATE annotation
-		INNER JOIN dashboard ON annotation.dashboard_id = dashboard.id
-		SET annotation.dashboard_uid = dashboard.uid
-		WHERE annotation.dashboard_uid IS NULL 
-		  AND annotation.dashboard_id != 0
-		  AND annotation.id IN (
-			SELECT id FROM (
-				SELECT id FROM annotation
-				WHERE dashboard_uid IS NULL AND dashboard_id != 0
-				ORDER BY id DESC
-				LIMIT ?
-			) AS batch
-		  )`
+		updateSQL = `UPDATE annotation AS a
+		JOIN dashboard AS d ON a.dashboard_id = d.id
+		JOIN (
+		  SELECT id
+		  FROM annotation
+		  WHERE dashboard_uid IS NULL
+		  AND dashboard_id != 0
+		  ORDER BY id DESC
+		  LIMIT ?
+		) AS batch ON batch.id = a.id
+		SET a.dashboard_uid = d.uid
+		  WHERE a.dashboard_uid IS NULL
+		  AND a.dashboard_id != 0`
 	}
 
 	updatedTotal := int64(0)

pkg/storage/unified/sql/db/migrations/resource_mig.go

@@ -2,8 +2,11 @@ package migrations
 
 import (
 	"fmt"
+	"strings"
 
+	"github.com/bwmarrin/snowflake"
 	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
+	"github.com/grafana/grafana/pkg/util/xorm"
 )
 
 func initResourceTables(mg *migrator.Migrator) string {
@@ -204,5 +207,142 @@ func initResourceTables(mg *migrator.Migrator) string {
 		Name: "IDX_resource_history_key_path",
 	}))
 
+	mg.AddMigration("resource_history key_path backfill", &ResourceHistoryKeyPathBackfillMigration{})
+
 	return marker
 }
+
+type ResourceHistoryKeyPathBackfillMigration struct {
+	migrator.MigrationBase
+}
+
+func (m *ResourceHistoryKeyPathBackfillMigration) SQL(_ migrator.Dialect) string {
+	return "resource_history key_path backfill code migration"
+}
+
+func (m *ResourceHistoryKeyPathBackfillMigration) Exec(sess *xorm.Session, mg *migrator.Migrator) error {
+	rows, err := getResourceHistoryRows(sess, mg, resourceHistoryRow{})
+	if err != nil {
+		return err
+	}
+
+	for len(rows) > 0 {
+		if err := updateResourceHistoryKeyPath(sess, rows); err != nil {
+			return err
+		}
+
+		rows, err = getResourceHistoryRows(sess, mg, rows[len(rows)-1])
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func updateResourceHistoryKeyPath(sess *xorm.Session, rows []resourceHistoryRow) error {
+	if len(rows) == 0 {
+		return nil
+	}
+
+	updates := []resourceHistoryRow{}
+
+	for _, row := range rows {
+		if row.KeyPath == "" {
+			row.KeyPath = parseKeyPath(row)
+			updates = append(updates, row)
+		}
+	}
+
+	if len(updates) == 0 {
+		return nil
+	}
+
+	guids := ""
+	setCases := "CASE"
+	for _, row := range updates {
+		guids += fmt.Sprintf("'%s',", row.GUID)
+		setCases += fmt.Sprintf(" WHEN guid = '%s' THEN '%s'", row.GUID, row.KeyPath)
+	}
+
+	guids = strings.TrimRight(guids, ",")
+	setCases += " ELSE key_path END "
+
+	// the query will look like this
+	// UPDATE resource_history
+	// SET key_path = CASE
+	//   WHEN guid = '1402de51-669b-4206-8a6c-005a00eee6e3' then 'unified/data/folder.grafana.app/folders/default/cf6lylpvls000c/1998492888241012800~created~'
+	//   WHEN guid = '8842cc56-f22b-45e1-82b1-99759cd443b3' then 'unified/data/dashboard.grafana.app/dashboards/default/adzvfhp/1998492902577144677~created~cf6lylpvls000c'
+	//   ELSE key_path END
+	// WHERE guid IN ('1402de51-669b-4206-8a6c-005a00eee6e3', '8842cc56-f22b-45e1-82b1-99759cd443b3')
+	// AND key_path = '';
+	sql := fmt.Sprintf(`
+	UPDATE resource_history
+	SET key_path = %s
+	WHERE guid IN (%s)
+	AND key_path = '';
+	`, setCases, guids)
+
+	if _, err := sess.Exec(sql); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func parseKeyPath(row resourceHistoryRow) string {
+	var action string
+	switch row.Action {
+	case 1:
+		action = "created"
+	case 2:
+		action = "updated"
+	case 3:
+		action = "deleted"
+	}
+	return fmt.Sprintf("unified/data/%s/%s/%s/%s/%d~%s~%s", row.Group, row.Resource, row.Namespace, row.Name, snowflakeFromRv(row.ResourceVersion), action, row.Folder)
+}
+
+func snowflakeFromRv(rv int64) int64 {
+	return (((rv / 1000) - snowflake.Epoch) << (snowflake.NodeBits + snowflake.StepBits)) + (rv % 1000)
+}
+
+type resourceHistoryRow struct {
+	GUID            string `xorm:"guid"`
+	Group           string `xorm:"group"`
+	Resource        string `xorm:"resource"`
+	Namespace       string `xorm:"namespace"`
+	Name            string `xorm:"name"`
+	ResourceVersion int64  `xorm:"resource_version"`
+	Action          int64  `xorm:"action"`
+	Folder          string `xorm:"folder"`
+	KeyPath         string `xorm:"key_path"`
+}
+
+func getResourceHistoryRows(sess *xorm.Session, mg *migrator.Migrator, continueRow resourceHistoryRow) ([]resourceHistoryRow, error) {
+	var rows []resourceHistoryRow
+	cols := fmt.Sprintf(
+		"%s, %s, %s, %s, %s, %s, %s, %s, %s",
+		mg.Dialect.Quote("guid"),
+		mg.Dialect.Quote("group"),
+		mg.Dialect.Quote("resource"),
+		mg.Dialect.Quote("namespace"),
+		mg.Dialect.Quote("name"),
+		mg.Dialect.Quote("resource_version"),
+		mg.Dialect.Quote("action"),
+		mg.Dialect.Quote("folder"),
+		mg.Dialect.Quote("key_path"))
+	sql := fmt.Sprintf(`
+		SELECT %s
+		FROM resource_history
+		WHERE (resource_version > %d OR (resource_version = %d AND guid > '%s'))
+		AND key_path = ''
+		ORDER BY resource_version ASC, guid ASC
+		LIMIT 1000;
+	`, cols, continueRow.ResourceVersion, continueRow.ResourceVersion, continueRow.GUID)
+	if err := sess.SQL(sql).Find(&rows); err != nil {
+		return nil, err
+	}
+
+	return rows, nil
+}

pkg/tests/apis/iam/resource_permissions_integration_test.go

@@ -0,0 +1,625 @@
+package identity
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
+	"github.com/grafana/grafana/pkg/apiserver/rest"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/tests/apis"
+	"github.com/grafana/grafana/pkg/tests/testinfra"
+	"github.com/grafana/grafana/pkg/util/testutil"
+)
+
+var gvrResourcePermissions = schema.GroupVersionResource{
+	Group:    "iam.grafana.app",
+	Version:  "v0alpha1",
+	Resource: "resourcepermissions",
+}
+
+var gvrFolders = schema.GroupVersionResource{
+	Group:    "folder.grafana.app",
+	Version:  "v1beta1",
+	Resource: "folders",
+}
+
+var gvrDashboards = schema.GroupVersionResource{
+	Group:    "dashboard.grafana.app",
+	Version:  "v1beta1",
+	Resource: "dashboards",
+}
+
+type permission struct {
+	kind string
+	name string
+	verb string
+}
+
+func newPermission(kind, name, verb string) permission {
+	return permission{
+		kind: kind,
+		name: name,
+		verb: verb,
+	}
+}
+
+func (p permission) ToMap() map[string]interface{} {
+	return map[string]interface{}{
+		"kind": p.kind,
+		"name": p.name,
+		"verb": p.verb,
+	}
+}
+
+func newPermissionMaps(permissions ...permission) []map[string]interface{} {
+	permissionsMaps := make([]map[string]interface{}, len(permissions))
+	for i, permission := range permissions {
+		permissionsMaps[i] = permission.ToMap()
+	}
+	return permissionsMaps
+}
+
+type k8sTestClients struct {
+	rpAdmin  *apis.K8sResourceClient
+	rpEditor *apis.K8sResourceClient
+	rpViewer *apis.K8sResourceClient
+}
+
+func newk8sTestHelperClients(helper *apis.K8sTestHelper) *k8sTestClients {
+	return &k8sTestClients{
+		rpAdmin: helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.OrgID),
+			GVR:       gvrResourcePermissions,
+		}),
+		rpEditor: helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Editor,
+			Namespace: helper.Namespacer(helper.Org1.OrgID),
+			GVR:       gvrResourcePermissions,
+		}),
+		rpViewer: helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Viewer,
+			Namespace: helper.Namespacer(helper.Org1.OrgID),
+			GVR:       gvrResourcePermissions,
+		}),
+	}
+}
+
+func TestIntegrationResourcePermissions(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+
+	modes := []rest.DualWriterMode{rest.Mode0, rest.Mode1, rest.Mode2, rest.Mode3}
+	for _, mode := range modes {
+		if mode >= rest.Mode3 {
+			t.Skip("Skipping ResourcePermission tests for Mode3+ because default permissions are not written through the new APIs")
+			continue
+		}
+		t.Run(fmt.Sprintf("ResourcePermission CRUD with dual writer mode %d", mode), func(t *testing.T) {
+			// Turn off authorization cache so permission changes apply right away in tests
+			t.Setenv("GF_AUTHORIZATION_CACHE_TTL", "0s")
+
+			helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+				AppModeProduction:    false,
+				DisableAnonymous:     true,
+				APIServerStorageType: "unified",
+				UnifiedStorageConfig: map[string]setting.UnifiedStorageConfig{
+					"resourcepermissions.iam.grafana.app": {
+						DualWriterMode: mode,
+					},
+					"folders.folder.grafana.app": {
+						DualWriterMode: mode,
+					},
+					"dashboards.dashboard.grafana.app": {
+						DualWriterMode: mode,
+					},
+				},
+				EnableFeatureToggles: []string{
+					featuremgmt.FlagKubernetesAuthzResourcePermissionApis,
+					// Prevents nested folders from having default permissions
+					featuremgmt.FlagKubernetesDashboards,
+				},
+			})
+
+			// Work around the default permissions applied on root folders
+			// so we can test the ResourcePermission APIs without the default permissions interfering
+			parentFolder := createRootFolderWithoutDefaultPermissions(t, helper)
+			parentUID := parentFolder.GetName()
+
+			clients := newk8sTestHelperClients(helper)
+			doResourcePermissionCRUDTests(t, helper, clients, parentUID)
+			doResourcePermissionAuthzTests(t, helper, clients, parentUID)
+			doResourcePermissionHierarchyTests(t, helper, clients, parentUID)
+			doResourcePermissionListFilteringTests(t, helper, clients, parentUID)
+			// TODO: Add tests for External JWT authentication
+			// doResourcePermissionAccessPolicyTests(t, helper)
+		})
+	}
+}
+
+func doResourcePermissionCRUDTests(t *testing.T, helper *apis.K8sTestHelper, clients *k8sTestClients, parentUID string) {
+	t.Run("should create/get/update/delete ResourcePermission using the new APIs", func(t *testing.T) {
+		ctx := context.Background()
+
+		// Create ResourcePermission for the folder
+		permission := newPermission("ServiceAccount", helper.Org1.ViewerServiceAccount.UID, "view")
+		toCreate := createResourcePermissionObject(parentUID, gvrFolders.Group, gvrFolders.Resource, permission)
+
+		created, err := clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, created)
+
+		createdName := created.GetName()
+		require.NotEmpty(t, createdName)
+
+		// Verify spec
+		spec := created.Object["spec"].(map[string]interface{})
+		resource := spec["resource"].(map[string]interface{})
+		require.Equal(t, gvrFolders.Group, resource["apiGroup"])
+		require.Equal(t, gvrFolders.Resource, resource["resource"])
+		require.Equal(t, parentUID, resource["name"])
+
+		// Get the ResourcePermission
+		fetched, err := clients.rpAdmin.Resource.Get(ctx, createdName, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, fetched)
+		require.Equal(t, createdName, fetched.GetName())
+
+		// Update the ResourcePermission
+		fetched.Object["spec"].(map[string]interface{})["permissions"] = newPermissionMaps(
+			newPermission("User", helper.Org1.Viewer.Identity.GetIdentifier(), "edit"),
+		)
+		updated, err := clients.rpAdmin.Resource.Update(ctx, fetched, metav1.UpdateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, updated)
+
+		updatedSpec := updated.Object["spec"].(map[string]interface{})
+		permissions := updatedSpec["permissions"].([]interface{})
+		require.Len(t, permissions, 1)
+		perm := permissions[0].(map[string]interface{})
+		require.Equal(t, helper.Org1.Viewer.Identity.GetIdentifier(), perm["name"])
+		require.Equal(t, "edit", perm["verb"])
+
+		// Delete should work
+		err = clients.rpAdmin.Resource.Delete(ctx, createdName, metav1.DeleteOptions{})
+		require.NoError(t, err)
+
+		_, err = clients.rpAdmin.Resource.Get(ctx, createdName, metav1.GetOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(404), statusErr.ErrStatus.Code)
+	})
+
+	t.Run("should return 404 for non-existent ResourcePermission", func(t *testing.T) {
+		ctx := context.Background()
+
+		_, err := clients.rpAdmin.Resource.Get(ctx, "folder.grafana.app-folders-unknown", metav1.GetOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(404), statusErr.ErrStatus.Code)
+	})
+}
+
+func doResourcePermissionAuthzTests(t *testing.T, helper *apis.K8sTestHelper, clients *k8sTestClients, parentUID string) {
+	t.Run("admin can create/update/delete ResourcePermission", func(t *testing.T) {
+		ctx := context.Background()
+
+		folder := createTestFolder(t, helper, helper.Org1.Admin, "test-folder-admin", parentUID)
+		folderUID := folder.GetName()
+
+		permission := newPermission("User", helper.Org1.Admin.Identity.GetIdentifier(), "admin")
+
+		toCreate := createResourcePermissionObject(folderUID, gvrFolders.Group, gvrFolders.Resource, permission)
+		created, err := clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, created)
+
+		createdName := created.GetName()
+
+		// Get the created object
+		fetched, err := clients.rpAdmin.Resource.Get(ctx, createdName, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, fetched)
+
+		// Update should work
+		permission = newPermission("Team", helper.Org1.Staff.UID, "edit")
+		fetched.Object["spec"].(map[string]interface{})["permissions"] = []interface{}{permission.ToMap()}
+
+		_, err = clients.rpAdmin.Resource.Update(ctx, fetched, metav1.UpdateOptions{})
+		require.NoError(t, err)
+
+		// Delete should work
+		err = clients.rpAdmin.Resource.Delete(ctx, createdName, metav1.DeleteOptions{})
+		require.NoError(t, err)
+	})
+
+	t.Run("editor cannot create ResourcePermission (insufficient permissions)", func(t *testing.T) {
+		ctx := context.Background()
+
+		folder := createTestFolder(t, helper, helper.Org1.Admin, "test-folder-editor-deny", parentUID)
+		folderUID := folder.GetName()
+
+		permission := newPermission("User", helper.Org1.Editor.Identity.GetIdentifier(), "admin")
+		toCreate := createResourcePermissionObject(folderUID, gvrFolders.Group, gvrFolders.Resource, permission)
+		_, err := clients.rpEditor.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+	})
+
+	t.Run("viewer cannot create ResourcePermission (insufficient permissions)", func(t *testing.T) {
+		ctx := context.Background()
+
+		folder := createTestFolder(t, helper, helper.Org1.Admin, "test-folder-viewer-deny", parentUID)
+		folderUID := folder.GetName()
+
+		permission := newPermission("User", helper.Org1.Viewer.Identity.GetIdentifier(), "admin")
+		toCreate := createResourcePermissionObject(folderUID, gvrFolders.Group, gvrFolders.Resource, permission)
+		_, err := clients.rpViewer.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+	})
+
+	t.Run("viewer can update ResourcePermission of folder they can admin", func(t *testing.T) {
+		ctx := context.Background()
+
+		folder := createTestFolder(t, helper, helper.Org1.Admin, "test-folder-viewer-admin", parentUID)
+		folderUID := folder.GetName()
+
+		// Grant admin permissions to the viewer
+		permission := newPermission("User", helper.Org1.Viewer.Identity.GetIdentifier(), "admin")
+		toCreate := createResourcePermissionObject(folderUID, gvrFolders.Group, gvrFolders.Resource, permission)
+		_, err := clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// As a Viewer we should now be able to get and update the ResourcePermission of the folder
+		fetched, err := clients.rpViewer.Resource.Get(ctx, "folder.grafana.app-folders-"+folderUID, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, fetched)
+
+		// Update the ResourcePermission to grant editor permissions
+		fetched.Object["spec"].(map[string]interface{})["permissions"] = newPermissionMaps(
+			newPermission("BasicRole", "Editor", "edit"),
+			newPermission("User", helper.Org1.Viewer.Identity.GetIdentifier(), "admin"),
+		)
+
+		_, err = clients.rpViewer.Resource.Update(ctx, fetched, metav1.UpdateOptions{})
+		require.NoError(t, err)
+	})
+}
+
+func doResourcePermissionHierarchyTests(t *testing.T, helper *apis.K8sTestHelper, clients *k8sTestClients, parentUID string) {
+	permission := newPermission("BasicRole", "Editor", "admin")
+
+	t.Run("should respect folder hierarchy for folder permissions", func(t *testing.T) {
+		ctx := context.Background()
+
+		sub1 := createTestFolder(t, helper, helper.Org1.Admin, "sub1-folder-hierarchy", parentUID)
+		sub1UID := sub1.GetName()
+
+		sub2 := createTestFolder(t, helper, helper.Org1.Admin, "sub2-folder-hierarchy", sub1UID)
+		sub2UID := sub2.GetName()
+
+		toCreate := createResourcePermissionObject(sub2UID, gvrFolders.Group, gvrFolders.Resource, permission)
+		_, err := clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		t.Run("editor can update ResourcePermission of sub2", func(t *testing.T) {
+			fetched, err := clients.rpEditor.Resource.Get(ctx, "folder.grafana.app-folders-"+sub2UID, metav1.GetOptions{})
+			require.NoError(t, err)
+
+			fetched.Object["spec"].(map[string]interface{})["permissions"] = newPermissionMaps(
+				newPermission("BasicRole", "Editor", "admin"),
+				newPermission("User", helper.Org1.Viewer.Identity.GetIdentifier(), "edit"),
+			)
+			_, err = clients.rpEditor.Resource.Update(ctx, fetched, metav1.UpdateOptions{})
+			require.NoError(t, err)
+		})
+		t.Run("editor cannot create ResourcePermission of sub1", func(t *testing.T) {
+			toCreate := createResourcePermissionObject(sub1UID, gvrFolders.Group, gvrFolders.Resource, permission)
+			_, err := clients.rpEditor.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+			require.Error(t, err)
+			var statusErr *errors.StatusError
+			require.ErrorAs(t, err, &statusErr)
+			require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+		})
+
+		// Delete the ResourcePermission of sub2
+		err = clients.rpAdmin.Resource.Delete(ctx, "folder.grafana.app-folders-"+sub2UID, metav1.DeleteOptions{})
+		require.NoError(t, err)
+
+		// Create a new ResourcePermission for sub2
+		toCreate = createResourcePermissionObject(sub1UID, gvrFolders.Group, gvrFolders.Resource, permission)
+		_, err = clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		t.Run("editor can create ResourcePermission of sub2 with parent folder permission", func(t *testing.T) {
+			toCreate := createResourcePermissionObject(sub2UID, gvrFolders.Group, gvrFolders.Resource, permission)
+
+			_, err = clients.rpEditor.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+			require.NoError(t, err)
+
+			fetched, err := clients.rpEditor.Resource.Get(ctx, "folder.grafana.app-folders-"+sub2UID, metav1.GetOptions{})
+			require.NoError(t, err)
+			require.NotNil(t, fetched)
+
+			permissions := fetched.Object["spec"].(map[string]interface{})["permissions"]
+			require.Len(t, permissions, 1)
+		})
+	})
+
+	t.Run("should respect folder hierarchy for dashboard permissions", func(t *testing.T) {
+		ctx := context.Background()
+
+		// Create folder and a nested dashboard
+		folder := createTestFolder(t, helper, helper.Org1.Admin, "sub1-dashboard-hierarchy", parentUID)
+		folderUID := folder.GetName()
+
+		dashboard := createTestDashboard(t, helper, helper.Org1.Admin, "sub2-dashboard", folderUID)
+		dashboardUID := dashboard.GetName()
+
+		// Verify dashboard has parent folder annotation
+		annotations := dashboard.GetAnnotations()
+		require.Equal(t, folderUID, annotations[utils.AnnoKeyFolder])
+
+		t.Run("editor cannot create ResourcePermission of dashboard without parent folder permission", func(t *testing.T) {
+			toCreate := createResourcePermissionObject(dashboardUID, gvrDashboards.Group, gvrDashboards.Resource, permission)
+			_, err := clients.rpEditor.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+			require.Error(t, err)
+			var statusErr *errors.StatusError
+			require.ErrorAs(t, err, &statusErr)
+			require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+		})
+
+		// Admin creates ResourcePermission for parent folder
+		toCreate := createResourcePermissionObject(folderUID, gvrFolders.Group, gvrFolders.Resource, permission)
+		created, err := clients.rpAdmin.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, created)
+
+		t.Run("editor can create ResourcePermission of dashboard with parent folder permission", func(t *testing.T) {
+			toCreate := createResourcePermissionObject(dashboardUID, gvrDashboards.Group, gvrDashboards.Resource, permission)
+			_, err := clients.rpEditor.Resource.Create(ctx, toCreate, metav1.CreateOptions{})
+			require.NoError(t, err)
+
+			fetched, err := clients.rpEditor.Resource.Get(ctx, "dashboard.grafana.app-dashboards-"+dashboardUID, metav1.GetOptions{})
+			require.NoError(t, err)
+			require.NotNil(t, fetched)
+
+			permissions := fetched.Object["spec"].(map[string]interface{})["permissions"]
+			require.Len(t, permissions, 1)
+		})
+	})
+}
+
+func doResourcePermissionListFilteringTests(t *testing.T, helper *apis.K8sTestHelper, clients *k8sTestClients, parentUID string) {
+	viewerCanAdmin := newPermission("BasicRole", "Viewer", "admin")
+	viewerCanView := newPermission("BasicRole", "Viewer", "view")
+	editorCanAdmin := newPermission("BasicRole", "Editor", "admin")
+
+	ctx := context.Background()
+
+	// Create two folders
+	editorFolder := createTestFolder(t, helper, helper.Org1.Admin, "editor-only-folder", parentUID)
+	editorFolderUID := editorFolder.GetName()
+
+	viewerFolder := createTestFolder(t, helper, helper.Org1.Admin, "viewer-only-folder", parentUID)
+	viewerFolderUID := viewerFolder.GetName()
+
+	dashboardViewerCanAdmin := createTestDashboard(t, helper, helper.Org1.Admin, "dashboard-in-editor-folder-viewer-can-admin", editorFolderUID)
+	dashboardViewerCanAdminUID := dashboardViewerCanAdmin.GetName()
+	dashboardViewerCanView := createTestDashboard(t, helper, helper.Org1.Admin, "dashboard-in-editor-folder-viewer-can-view", editorFolderUID)
+	dashboardViewerCanViewUID := dashboardViewerCanView.GetName()
+
+	// Grant admin permissions to the viewer on folder2 and dashboard1
+	rp1 := createResourcePermissionObject(viewerFolderUID, gvrFolders.Group, gvrFolders.Resource, viewerCanAdmin)
+	_, err := clients.rpAdmin.Resource.Create(ctx, rp1, metav1.CreateOptions{})
+	require.NoError(t, err)
+	rp2 := createResourcePermissionObject(dashboardViewerCanAdminUID, gvrDashboards.Group, gvrDashboards.Resource, viewerCanAdmin)
+	_, err = clients.rpAdmin.Resource.Create(ctx, rp2, metav1.CreateOptions{})
+	require.NoError(t, err)
+	// Grant admin permissions to the editor on folder1
+	rp3 := createResourcePermissionObject(editorFolderUID, gvrFolders.Group, gvrFolders.Resource, editorCanAdmin)
+	_, err = clients.rpAdmin.Resource.Create(ctx, rp3, metav1.CreateOptions{})
+	require.NoError(t, err)
+	// Grant view permissions to the viewer on dashboard2
+	rp4 := createResourcePermissionObject(dashboardViewerCanViewUID, gvrDashboards.Group, gvrDashboards.Resource, viewerCanView)
+	_, err = clients.rpAdmin.Resource.Create(ctx, rp4, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	t.Run("Admin can list all ResourcePermissions", func(t *testing.T) {
+		// Admin can list all ResourcePermissions
+		list, err := clients.rpAdmin.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, list)
+
+		// Check that all expected items are present (there may be more from other tests)
+		itemNames := getNamesFromList(list)
+		require.Contains(t, itemNames, rp1.GetName(), "Admin should see viewer folder permission")
+		require.Contains(t, itemNames, rp2.GetName(), "Admin should see dashboard viewer can admin permission")
+		require.Contains(t, itemNames, rp3.GetName(), "Admin should see editor folder permission")
+		require.Contains(t, itemNames, rp4.GetName(), "Admin should see dashboard viewer can view permission")
+	})
+
+	t.Run("Viewer can list ResourcePermissions of folder2 and dashboard1", func(t *testing.T) {
+		list, err := clients.rpViewer.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, list)
+
+		itemNames := getNamesFromList(list)
+		// Viewer should see permissions for resources they can admin
+		require.Contains(t, itemNames, rp1.GetName(), "Viewer should see viewer folder permission")
+		require.Contains(t, itemNames, rp2.GetName(), "Viewer should see dashboard viewer can admin permission")
+
+		// Viewer should NOT see permissions for resources they cannot admin
+		require.NotContains(t, itemNames, rp3.GetName(), "Viewer should NOT see editor folder permission")
+		require.NotContains(t, itemNames, rp4.GetName(), "Viewer should NOT see dashboard viewer can view permission")
+	})
+	t.Run("Editor can list ResourcePermissions of folder1 and its nested dashboards", func(t *testing.T) {
+		list, err := clients.rpEditor.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, list)
+
+		itemNames := getNamesFromList(list)
+		// Editor has admin on editorFolder, so they should see:
+		// - rp3 (editorFolder permission)
+		// - rp2 (dashboard in editorFolder with admin permission)
+		// - rp4 (dashboard in editorFolder with view permission)
+		require.Contains(t, itemNames, rp2.GetName(), "Editor should see dashboard admin permission in their folder")
+		require.Contains(t, itemNames, rp3.GetName(), "Editor should see their folder permission")
+		require.Contains(t, itemNames, rp4.GetName(), "Editor should see dashboard view permission in their folder")
+
+		// Editor should NOT see permissions for viewerFolder
+		require.NotContains(t, itemNames, rp1.GetName(), "Editor should NOT see viewer-only folder permission")
+	})
+}
+
+// Helper functions
+
+func createTestFolder(t *testing.T, helper *apis.K8sTestHelper, user apis.User, title string, parentUID string) *unstructured.Unstructured {
+	t.Helper()
+	ctx := context.Background()
+
+	folderClient := helper.GetResourceClient(apis.ResourceClientArgs{
+		User:      user,
+		Namespace: helper.Namespacer(user.Identity.GetOrgID()),
+		GVR:       gvrFolders,
+	})
+	metadata := map[string]interface{}{
+		"generateName": "test-folder-",
+		"namespace":    helper.Namespacer(user.Identity.GetOrgID()),
+	}
+
+	if parentUID != "" {
+		metadata["annotations"] = map[string]interface{}{
+			utils.AnnoKeyFolder: parentUID,
+		}
+	}
+
+	folder := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "folder.grafana.app/v1beta1",
+			"kind":       "Folder",
+			"metadata":   metadata,
+			"spec": map[string]interface{}{
+				"title": title,
+			},
+		},
+	}
+
+	created, err := folderClient.Resource.Create(ctx, folder, metav1.CreateOptions{})
+	require.NoError(t, err)
+	require.NotNil(t, created)
+	return created
+}
+
+// Helper function to delete default permissions
+func deleteDefaultPermissions(t *testing.T, client *apis.K8sResourceClient, resourceName string) {
+	ctx := context.Background()
+	// Delete the resource permission
+	err := client.Resource.Delete(ctx, resourceName, metav1.DeleteOptions{})
+	require.NoError(t, err)
+	// Check if the resource permission is deleted
+	_, err = client.Resource.Get(ctx, resourceName, metav1.GetOptions{})
+	require.Error(t, err)
+	var statusErr *errors.StatusError
+	require.ErrorAs(t, err, &statusErr)
+	require.Equal(t, int32(404), statusErr.ErrStatus.Code)
+}
+
+// Helper function to create a root folder without default permissions
+func createRootFolderWithoutDefaultPermissions(t *testing.T, helper *apis.K8sTestHelper) *unstructured.Unstructured {
+	t.Helper()
+
+	// Create folder as admin
+	folder := createTestFolder(t, helper, helper.Org1.Admin, "root-without-permissions", "")
+	folderUID := folder.GetName()
+
+	// Delete default permissions
+	rpClient := helper.GetResourceClient(apis.ResourceClientArgs{
+		User:      helper.Org1.Admin,
+		Namespace: helper.Namespacer(helper.Org1.OrgID),
+		GVR:       gvrResourcePermissions,
+	})
+
+	// It would be better to create the folder without default permissions, but this is a workaround for the time being
+	deleteDefaultPermissions(t, rpClient, "folder.grafana.app-folders-"+folderUID)
+
+	return folder
+}
+
+func createTestDashboard(t *testing.T, helper *apis.K8sTestHelper, user apis.User, title, folderUID string) *unstructured.Unstructured {
+	t.Helper()
+	ctx := context.Background()
+
+	dashboardClient := helper.GetResourceClient(apis.ResourceClientArgs{
+		User:      user,
+		Namespace: helper.Namespacer(user.Identity.GetOrgID()),
+		GVR:       gvrDashboards,
+	})
+
+	dashboard := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "dashboard.grafana.app/v1beta1",
+			"kind":       "Dashboard",
+			"metadata": map[string]interface{}{
+				"generateName": "test-dashboard-",
+				"namespace":    helper.Namespacer(user.Identity.GetOrgID()),
+				"annotations": map[string]interface{}{
+					utils.AnnoKeyFolder: folderUID,
+				},
+			},
+			"spec": map[string]interface{}{
+				"title": title,
+			},
+		},
+	}
+
+	created, err := dashboardClient.Resource.Create(ctx, dashboard, metav1.CreateOptions{})
+	require.NoError(t, err)
+	require.NotNil(t, created)
+	return created
+}
+
+func createResourcePermissionObject(resourceName, apiGroup, resource string, permissions ...permission) *unstructured.Unstructured {
+	permissionMaps := newPermissionMaps(permissions...)
+	return &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": iamv0.GROUP + "/" + iamv0.VERSION,
+			"kind":       "ResourcePermission",
+			"metadata": map[string]interface{}{
+				"name": apiGroup + "-" + resource + "-" + resourceName,
+			},
+			"spec": map[string]interface{}{
+				"resource": map[string]interface{}{
+					"apiGroup": apiGroup,
+					"resource": resource,
+					"name":     resourceName,
+				},
+				"permissions": permissionMaps,
+			},
+		},
+	}
+}
+
+func getNamesFromList(list *unstructured.UnstructuredList) []string {
+	names := make([]string, len(list.Items))
+	for i, item := range list.Items {
+		names[i] = item.GetName()
+	}
+	return names
+}

pkg/tests/apis/openapi_snapshots/provisioning.grafana.app-v0alpha1.json

@@ -3696,7 +3696,7 @@
             "format": "int64"
           },
           "errors": {
-            "description": "Report errors for this resource type This may not be an exhaustive list and recommend looking at the logs for more info",
+            "description": "Report errors/warnings for this resource type This may not be an exhaustive list and recommend looking at the logs for more info",
             "type": "array",
             "items": {
               "type": "string",
@@ -3722,6 +3722,18 @@
             "type": "integer",
             "format": "int64"
           },
+          "warning": {
+            "description": "The error count",
+            "type": "integer",
+            "format": "int64"
+          },
+          "warnings": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "default": ""
+            }
+          },
           "write": {
             "type": "integer",
             "format": "int64"
@@ -3849,6 +3861,13 @@
                 "$ref": "#/components/schemas/com.github.grafana.grafana.apps.provisioning.pkg.apis.provisioning.v0alpha1.RepositoryURLs"
               }
             ]
+          },
+          "warnings": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "default": ""
+            }
           }
         }
       },

public/app/core/utils/navBarItem-translations.ts

@@ -1,5 +1,4 @@
 import { t } from '@grafana/i18n';
-import { config } from '@grafana/runtime';
 // Maps the ID of the nav item to a translated phrase to later pass to <Trans />
 // Because the navigation content is dynamic (defined in the backend), we can not use
 // the normal inline message definition method.
@@ -49,9 +48,7 @@ export function getNavTitle(navId: string | undefined) {
     case 'dashboards/recently-deleted':
       return t('nav.recently-deleted.title', 'Recently deleted');
     case 'dashboards/new':
-      return config.featureToggles.dashboardTemplates
-        ? t('nav.new-dashboard.empty-title', 'Empty dashboard')
-        : t('nav.new-dashboard.title', 'New dashboard');
+      return t('nav.new-dashboard.title', 'New dashboard');
     case 'dashboards/folder/new':
       return t('nav.new-folder.title', 'New folder');
     case 'dashboards/import':

public/app/features/browse-dashboards/BrowseDashboardsPage.tsx

@@ -27,6 +27,7 @@ import { BrowseFilters } from './components/BrowseFilters';
 import { BrowseView } from './components/BrowseView';
 import CreateNewButton from './components/CreateNewButton';
 import { FolderActionsButton } from './components/FolderActionsButton';
+import { RecentlyViewedDashboards } from './components/RecentlyViewedDashboards';
 import { SearchView } from './components/SearchView';
 import { getFolderPermissions } from './permissions';
 import { useHasSelection } from './state/hooks';
@@ -178,6 +179,8 @@ const BrowseDashboardsPage = memo(({ queryParams }: { queryParams: Record<string
     >
       <Page.Contents className={styles.pageContents}>
         <ProvisionedFolderPreviewBanner queryParams={queryParams} />
+        {/* only show recently viewed dashboards when in root */}
+        {!folderUID && <RecentlyViewedDashboards />}
         <div>
           <FilterInput
             placeholder={getSearchPlaceholder(searchState.includePanels)}

public/app/features/browse-dashboards/components/RecentlyViewedDashboards.tsx

@@ -0,0 +1,77 @@
+import { css } from '@emotion/css';
+import { useAsync } from 'react-use';
+
+import { GrafanaTheme2 } from '@grafana/data';
+import { t, Trans } from '@grafana/i18n';
+import { evaluateBooleanFlag } from '@grafana/runtime/internal';
+import { CollapsableSection, Link, Spinner, Text, useStyles2 } from '@grafana/ui';
+
+import { getRecentlyViewedDashboards } from './utils';
+
+const MAX_RECENT = 5;
+
+export function RecentlyViewedDashboards() {
+  const styles = useStyles2(getStyles);
+
+  const { value: recentDashboards = [], loading } = useAsync(async () => {
+    if (!evaluateBooleanFlag('recentlyViewedDashboards', false)) {
+      return [];
+    }
+    return getRecentlyViewedDashboards(MAX_RECENT);
+  }, []);
+
+  if (!evaluateBooleanFlag('recentlyViewedDashboards', false)) {
+    return null;
+  }
+
+  return (
+    <CollapsableSection
+      headerDataTestId="browseDashboardsRecentlyViewedTitle"
+      label={
+        <Text variant="h5" element="h3">
+          <Trans i18nKey="browse-dashboards.recently-viewed.title">Recently viewed</Trans>
+        </Text>
+      }
+      isOpen={true}
+      className={styles.title}
+      contentClassName={styles.content}
+    >
+      {/* placeholder */}
+      {loading && <Spinner />}
+      {/* TODO: Better empty state https://github.com/grafana/grafana/issues/114804 */}
+      {!loading && recentDashboards.length === 0 && (
+        <Text>{t('browse-dashboards.recently-viewed.empty', 'Nothing viewed yet')}</Text>
+      )}
+
+      {/* TODO: implement actual card content */}
+      {!loading && recentDashboards.length > 0 && (
+        <>
+          {recentDashboards.map((dash) => (
+            <div key={dash.uid}>
+              <Link href={dash.url}>{dash.name}</Link>
+            </div>
+          ))}
+        </>
+      )}
+    </CollapsableSection>
+  );
+}
+
+const getStyles = (theme: GrafanaTheme2) => {
+  const accent = theme.visualization.getColorByName('purple'); // or your own hex
+
+  return {
+    title: css({
+      background: `linear-gradient(90deg, ${accent} 0%, #e478eaff 100%)`,
+      WebkitTextFillColor: 'transparent',
+      backgroundClip: 'text',
+      color: 'transparent',
+      '& button svg': {
+        color: accent,
+      },
+    }),
+    content: css({
+      paddingTop: theme.spacing(0),
+    }),
+  };
+};

public/app/features/browse-dashboards/components/utils.ts

@@ -1,6 +1,9 @@
 import { config } from '@grafana/runtime';
 import { contextSrv } from 'app/core/services/context_srv';
+import impressionSrv from 'app/core/services/impression_srv';
 import { ResourceRef } from 'app/features/provisioning/components/BulkActions/useBulkActionJob';
+import { getGrafanaSearcher } from 'app/features/search/service/searcher';
+import { DashboardQueryResult } from 'app/features/search/service/types';
 
 import { DashboardTreeSelection, DashboardViewItemWithUIItems, BrowseDashboardsPermissions } from '../types';
 
@@ -60,3 +63,36 @@ export function canSelectItems(permissions: BrowseDashboardsPermissions) {
   const canSelectDashboards = canEditDashboards || canDeleteDashboards;
   return Boolean(canSelectFolders || canSelectDashboards);
 }
+
+/**
+ * Returns dashboard search results ordered the same way the user opened them.
+ */
+export async function getRecentlyViewedDashboards(maxItems = 5): Promise<DashboardQueryResult[]> {
+  try {
+    const recentlyOpened = (await impressionSrv.getDashboardOpened()).slice(0, maxItems);
+    if (!recentlyOpened.length) {
+      return [];
+    }
+
+    const searchResults = await getGrafanaSearcher().search({
+      kind: ['dashboard'],
+      limit: recentlyOpened.length,
+      uid: recentlyOpened,
+    });
+
+    const dashboards = searchResults.view.toArray();
+    // Keep dashboards in the same order the user opened them.
+    // When a UID is missing from the search response
+    // push it to the end instead of letting indexOf return -1
+    const order = (uid: string) => {
+      const idx = recentlyOpened.indexOf(uid);
+      return idx === -1 ? recentlyOpened.length : idx;
+    };
+
+    dashboards.sort((a, b) => order(a.uid) - order(b.uid));
+    return dashboards;
+  } catch (error) {
+    console.error('Failed to load recently viewed dashboards', error);
+    return [];
+  }
+}

public/app/features/commandPalette/actions/dashboardActions.ts

@@ -4,7 +4,7 @@ import { useEffect, useRef, useState } from 'react';
 import { t } from '@grafana/i18n';
 import { config } from '@grafana/runtime';
 import { contextSrv } from 'app/core/services/context_srv';
-import impressionSrv from 'app/core/services/impression_srv';
+import { getRecentlyViewedDashboards } from 'app/features/browse-dashboards/components/utils';
 import { getGrafanaSearcher } from 'app/features/search/service/searcher';
 
 import { CommandPaletteAction } from '../types';
@@ -20,20 +20,7 @@ export async function getRecentDashboardActions(): Promise<CommandPaletteAction[
     return [];
   }
 
-  const recentUids = (await impressionSrv.getDashboardOpened()).slice(0, MAX_RECENT_DASHBOARDS);
-  const resultsDataFrame = await getGrafanaSearcher().search({
-    kind: ['dashboard'],
-    limit: MAX_RECENT_DASHBOARDS,
-    uid: recentUids,
-  });
-
-  // Search results are alphabetical, so reorder them according to recently viewed
-  const recentResults = resultsDataFrame.view.toArray();
-  recentResults.sort((resultA, resultB) => {
-    const orderA = recentUids.indexOf(resultA.uid);
-    const orderB = recentUids.indexOf(resultB.uid);
-    return orderA - orderB;
-  });
+  const recentResults = await getRecentlyViewedDashboards(MAX_RECENT_DASHBOARDS);
 
   const recentDashboardActions: CommandPaletteAction[] = recentResults.map((item) => {
     const { url, name } = item; // items are backed by DataFrameView, so must hold the url in a closure

public/app/features/dashboard-scene/edit-pane/DashboardEditableElement.tsx

@@ -59,9 +59,9 @@ export class DashboardEditableElement implements EditableDashboardElement {
     };
   }
 
-  public getOutlineChildren(): SceneObject[] {
+  public getOutlineChildren(isEditing: boolean): SceneObject[] {
     const { $variables, body } = this.dashboard.state;
-    return [$variables!, ...body.getOutlineChildren()];
+    return isEditing ? [$variables!, ...body.getOutlineChildren()] : body.getOutlineChildren();
   }
 
   public useEditPaneOptions = useEditPaneOptions.bind(this, this.dashboard);

public/app/features/dashboard-scene/edit-pane/DashboardOutline.tsx

@@ -51,7 +51,7 @@ function DashboardOutlineNode({ sceneObject, editPane, isEditing, depth, index }
 
   const noTitleText = t('dashboard.outline.tree-item.no-title', '<no title>');
 
-  const children = editableElement.getOutlineChildren?.() ?? [];
+  const children = editableElement.getOutlineChildren?.(isEditing) ?? [];
   const elementInfo = editableElement.getEditableElementInfo();
   const instanceName = elementInfo.instanceName === '' ? noTitleText : elementInfo.instanceName;
   const outlineRename = useOutlineRename(editableElement, isEditing);

public/app/features/dashboard-scene/saving/DashboardSceneChangeTracker.ts

@@ -206,6 +206,10 @@ export class DashboardSceneChangeTracker {
     }
 
     this._changesWorker!.onmessage = (e: MessageEvent<DashboardChangeInfo>) => {
+      if (!this._dashboard.state.isEditing) {
+        return;
+      }
+
       this.updateIsDirty(!!e.data.hasChanges);
     };
 

public/app/features/dashboard-scene/scene/DashboardControls.tsx

@@ -17,7 +17,7 @@ import {
   SceneObjectUrlValues,
   CancelActivationHandler,
 } from '@grafana/scenes';
-import { Box, Button, Stack, useStyles2 } from '@grafana/ui';
+import { Box, Button, useStyles2 } from '@grafana/ui';
 import { playlistSrv } from 'app/features/playlist/PlaylistSrv';
 
 import { PanelEditControls } from '../panel-edit/PanelEditControls';
@@ -38,7 +38,6 @@ export interface DashboardControlsState extends SceneObjectState {
   refreshPicker: SceneRefreshPicker;
   hideTimeControls?: boolean;
   hideVariableControls?: boolean;
-  hideAnnotationControls?: boolean;
   hideLinksControls?: boolean;
   // Hides the dashboard-controls dropdown menu
   hideDashboardControls?: boolean;
@@ -52,13 +51,7 @@ export class DashboardControls extends SceneObjectBase<DashboardControlsState> {
   });
 
   protected _urlSync = new SceneObjectUrlSyncConfig(this, {
-    keys: [
-      '_dash.hideTimePicker',
-      '_dash.hideVariables',
-      '_dash.hideAnnotations',
-      '_dash.hideLinks',
-      '_dash.hideDashboardControls',
-    ],
+    keys: ['_dash.hideTimePicker', '_dash.hideVariables', '_dash.hideLinks', '_dash.hideDashboardControls'],
   });
 
   /**
@@ -70,8 +63,7 @@ export class DashboardControls extends SceneObjectBase<DashboardControlsState> {
   }
 
   updateFromUrl(values: SceneObjectUrlValues) {
-    const { hideTimeControls, hideVariableControls, hideLinksControls, hideDashboardControls, hideAnnotationControls } =
-      this.state;
+    const { hideTimeControls, hideVariableControls, hideLinksControls, hideDashboardControls } = this.state;
     const isEnabledViaUrl = (key: string) => values[key] === 'true' || values[key] === '';
 
     // Only allow hiding, never "unhiding" from url
@@ -85,10 +77,6 @@ export class DashboardControls extends SceneObjectBase<DashboardControlsState> {
       this.setState({ hideVariableControls: true });
     }
 
-    if (!hideAnnotationControls && isEnabledViaUrl('_dash.hideAnnotations')) {
-      this.setState({ hideAnnotationControls: true });
-    }
-
     if (!hideLinksControls && isEnabledViaUrl('_dash.hideLinks')) {
       this.setState({ hideLinksControls: true });
     }
@@ -138,12 +126,11 @@ export class DashboardControls extends SceneObjectBase<DashboardControlsState> {
     const hasAnnotations = sceneGraph.getDataLayers(this).some((d) => d.state.isEnabled && !d.state.isHidden);
     const hasLinks = getDashboardSceneFor(this).state.links?.length > 0;
     const hideLinks = this.state.hideLinksControls || !hasLinks;
-    const hideVariables = this.state.hideVariableControls || !hasVariables;
-    const hideAnnotationControls = this.state.hideAnnotationControls || !hasAnnotations;
+    const hideVariables = this.state.hideVariableControls || (!hasAnnotations && !hasVariables);
     const hideTimePicker = this.state.hideTimeControls;
     const hideDashboardControls = this.state.hideDashboardControls || !hasDashboardControls(dashboard);
 
-    return !(hideVariables && hideLinks && hideTimePicker && hideDashboardControls && hideAnnotationControls);
+    return !(hideVariables && hideLinks && hideTimePicker && hideDashboardControls);
   }
 }
 
@@ -153,7 +140,6 @@ function DashboardControlsRenderer({ model }: SceneComponentProps<DashboardContr
     timePicker,
     hideTimeControls,
     hideVariableControls,
-    hideAnnotationControls,
     hideLinksControls,
     hideDashboardControls,
   } = model.useState();
@@ -173,32 +159,27 @@ function DashboardControlsRenderer({ model }: SceneComponentProps<DashboardContr
       data-testid={selectors.pages.Dashboard.Controls}
       className={cx(styles.controls, editPanel && styles.controlsPanelEdit)}
     >
-      {/* Right controls */}
       <div className={cx(styles.rightControls, editPanel && styles.rightControlsWrap)}>
-        {/* Time controls */}
         {!hideTimeControls && (
-          <Stack gap={1} justifyContent={'flex-end'}>
+          <div className={styles.fixedControls}>
             <timePicker.Component model={timePicker} />
             <refreshPicker.Component model={refreshPicker} />
-          </Stack>
+          </div>
         )}
-
-        {/* Actions (edit, play, share, etc.) */}
         {config.featureToggles.dashboardNewLayouts && (
-          <Stack gap={1} justifyContent={'flex-end'}>
+          <div className={styles.fixedControls}>
             <DashboardControlActions dashboard={dashboard} />
-          </Stack>
+          </div>
         )}
       </div>
-
-      {/* Left controls */}
-      <div className={styles.leftControls}>
-        {/* Variables */}
-        {!hideVariableControls && <VariableControls dashboard={dashboard} />}
-        {!hideAnnotationControls && <DashboardDataLayerControls dashboard={dashboard} />}
-        {!hideLinksControls && !editPanel && <DashboardLinksControls links={links} dashboard={dashboard} />}
-        {!hideDashboardControls && hasDashboardControls && <DashboardControlsButton dashboard={dashboard} />}
-      </div>
+      {!hideVariableControls && (
+        <>
+          <VariableControls dashboard={dashboard} />
+          <DashboardDataLayerControls dashboard={dashboard} />
+        </>
+      )}
+      {!hideLinksControls && !editPanel && <DashboardLinksControls links={links} dashboard={dashboard} />}
+      {!hideDashboardControls && hasDashboardControls && <DashboardControlsButton dashboard={dashboard} />}
       {editPanel && <PanelEditControls panelEditor={editPanel} />}
       {showDebugger && <SceneDebugger scene={model} key={'scene-debugger'} />}
     </div>
@@ -256,14 +237,13 @@ function getStyles(theme: GrafanaTheme2) {
     controls: css({
       gap: theme.spacing(1),
       padding: theme.spacing(2, 2, 1, 2),
-      display: 'flex',
-      flexDirection: 'row-reverse',
+      flexDirection: 'row',
       flexWrap: 'nowrap',
       position: 'relative',
       width: '100%',
       marginLeft: 'auto',
       [theme.breakpoints.down('sm')]: {
-        flexDirection: 'column',
+        flexDirection: 'column-reverse',
         alignItems: 'stretch',
       },
       '&:hover .dashboard-canvas-add-button': {
@@ -280,36 +260,32 @@ function getStyles(theme: GrafanaTheme2) {
       background: 'unset',
       position: 'unset',
     }),
-    leftControls: css({
+    rightControls: css({
       display: 'flex',
       gap: theme.spacing(1),
+      float: 'right',
       alignItems: 'flex-start',
-      justifyContent: 'flex-start',
-      flex: 1,
       flexWrap: 'wrap',
       maxWidth: '100%',
       minWidth: 0,
     }),
-    rightControls: css({
-      display: 'inline-flex',
-      gap: theme.spacing(1),
-      alignItems: 'flex-start',
+    fixedControls: css({
+      display: 'flex',
       justifyContent: 'flex-end',
-      flexWrap: 'nowrap',
-      flexShrink: 0,
-      maxWidth: '100%',
-      minWidth: 0,
-      [theme.breakpoints.down('sm')]: {
-        flexWrap: 'wrap',
-      },
-    }),
-    rightControlsWrap: css({
-      flexWrap: 'wrap',
+      gap: theme.spacing(1),
+      marginBottom: theme.spacing(1),
+      order: 2,
       marginLeft: 'auto',
+      flexShrink: 0,
+      alignSelf: 'flex-start',
     }),
     dashboardControlsButton: css({
       order: 2,
       marginLeft: 'auto',
     }),
+    rightControlsWrap: css({
+      flexWrap: 'wrap',
+      marginLeft: 'auto',
+    }),
   };
 }

public/app/features/dashboard-scene/scene/DashboardDataLayerControls.tsx

@@ -1,4 +1,8 @@
+import { css } from '@emotion/css';
+
+import { GrafanaTheme2 } from '@grafana/data';
 import { SceneDataLayerProvider, sceneGraph } from '@grafana/scenes';
+import { useStyles2 } from '@grafana/ui';
 
 import { isDashboardDataLayerSetState } from './DashboardDataLayerSet';
 import { DashboardScene } from './DashboardScene';
@@ -12,12 +16,15 @@ export function DashboardDataLayerControls({ dashboard }: { dashboard: Dashboard
   // It is possible to render the controls for the annotation data layers in separate places using the `placement` property.
   // In case it's not specified, we are rendering the controls here (default).
   const isDefaultPlacement = (layer: SceneDataLayerProvider) => layer.state.placement === undefined;
+  const styles = useStyles2(getStyles);
 
   if (isDashboardDataLayerSetState(state)) {
     return (
       <>
         {state.annotationLayers.filter(isDefaultPlacement).map((layer) => (
-          <DataLayerControl key={layer.state.key} layer={layer} />
+          <div key={layer.state.key} className={styles.container}>
+            <DataLayerControl layer={layer} />
+          </div>
         ))}
       </>
     );
@@ -25,3 +32,13 @@ export function DashboardDataLayerControls({ dashboard }: { dashboard: Dashboard
 
   return null;
 }
+
+const getStyles = (theme: GrafanaTheme2) => ({
+  container: css({
+    display: 'inline-flex',
+    alignItems: 'center',
+    verticalAlign: 'middle',
+    marginBottom: theme.spacing(1),
+    marginRight: theme.spacing(1),
+  }),
+});

public/app/features/dashboard-scene/scene/DashboardLinkRenderer.tsx

@@ -63,6 +63,7 @@ function getStyles(theme: GrafanaTheme2) {
       display: 'inline-flex',
       alignItems: 'center',
       verticalAlign: 'middle',
+      marginBottom: theme.spacing(1),
     }),
   };
 }

public/app/features/dashboard-scene/scene/DashboardLinksControls.tsx

@@ -1,5 +1,9 @@
+import { css } from '@emotion/css';
+
+import { GrafanaTheme2 } from '@grafana/data';
 import { sceneGraph } from '@grafana/scenes';
 import { DashboardLink } from '@grafana/schema';
+import { useStyles2 } from '@grafana/ui';
 
 import { DashboardLinkRenderer } from './DashboardLinkRenderer';
 import { DashboardScene } from './DashboardScene';
@@ -12,18 +16,29 @@ export interface Props {
 export function DashboardLinksControls({ links, dashboard }: Props) {
   sceneGraph.getTimeRange(dashboard).useState();
   const uid = dashboard.state.uid;
+  const styles = useStyles2(getStyles);
 
   if (!links || !uid) {
     return null;
   }
 
   return (
-    <>
+    <div className={styles.linksContainer}>
       {links
         .filter((link) => link.placement === undefined)
         .map((link: DashboardLink, index: number) => (
           <DashboardLinkRenderer link={link} dashboardUID={uid} key={`${link.title}-$${index}`} />
         ))}
-    </>
+    </div>
   );
 }
+
+function getStyles(theme: GrafanaTheme2) {
+  return {
+    linksContainer: css({
+      display: 'inline-flex',
+      gap: theme.spacing(1),
+      marginRight: theme.spacing(1),
+    }),
+  };
+}

public/app/features/dashboard-scene/scene/DashboardScene.tsx

@@ -1,6 +1,6 @@
 import * as H from 'history';
 
-import { CoreApp, DataQueryRequest, NavIndex, NavModelItem, locationUtil } from '@grafana/data';
+import { CoreApp, DataQueryRequest, locationUtil, NavIndex, NavModelItem } from '@grafana/data';
 import { t } from '@grafana/i18n';
 import { config, locationService, RefreshEvent } from '@grafana/runtime';
 import {
@@ -32,7 +32,7 @@ import { PanelModel } from 'app/features/dashboard/state/PanelModel';
 import { dashboardWatcher } from 'app/features/live/dashboard/dashboardWatcher';
 import { DashboardJson } from 'app/features/manage-dashboards/types';
 import { VariablesChanged } from 'app/features/variables/types';
-import { DashboardMeta, KioskMode, SaveDashboardResponseDTO, DashboardDTO } from 'app/types/dashboard';
+import { DashboardDTO, DashboardMeta, KioskMode, SaveDashboardResponseDTO } from 'app/types/dashboard';
 import { ShowConfirmModalEvent } from 'app/types/events';
 
 import {
@@ -271,7 +271,7 @@ export class DashboardScene extends SceneObjectBase<DashboardSceneState> impleme
 
   public onEnterEditMode = () => {
     // Save this state
-    this._initialState = sceneUtils.cloneSceneObjectState(this.state);
+    this._initialState = sceneUtils.cloneSceneObjectState(this.state, { isDirty: false });
     this._initialUrlState = locationService.getLocation();
 
     // Switch to edit mode
@@ -323,17 +323,46 @@ export class DashboardScene extends SceneObjectBase<DashboardSceneState> impleme
       return;
     }
 
-    appEvents.publish(
-      new ShowConfirmModalEvent({
-        title: t('dashboard-scene.dashboard-scene.title.discard-changes-to-dashboard', 'Discard changes to dashboard?'),
-        text: `You have unsaved changes to this dashboard. Are you sure you want to discard them?`,
-        icon: 'trash-alt',
-        yesText: 'Discard',
-        onConfirm: () => {
-          this.exitEditModeConfirmed();
-        },
-      })
-    );
+    if (config.featureToggles.dashboardNewLayouts) {
+      appEvents.publish(
+        new ShowConfirmModalEvent({
+          title: t('dashboard-scene.dashboard-scene.modal.title.unsaved-changes', 'Unsaved changes'),
+          text: t(
+            'dashboard-scene.dashboard-scene.modal.text.save-changes-question',
+            'Do you want to save your changes?'
+          ),
+          icon: 'trash-alt',
+          altActionText: t('dashboard-scene.dashboard-scene.modal.save', 'Save'),
+          noText: t('dashboard-scene.dashboard-scene.modal.cancel', 'Cancel'),
+          yesText: t('dashboard-scene.dashboard-scene.modal.discard', 'Discard'),
+          yesButtonVariant: 'destructive',
+          onAltAction: () => {
+            this.openSaveDrawer({});
+          },
+          onConfirm: () => {
+            this.exitEditModeConfirmed();
+          },
+        })
+      );
+    } else {
+      appEvents.publish(
+        new ShowConfirmModalEvent({
+          title: t(
+            'dashboard-scene.dashboard-scene.title.discard-changes-to-dashboard',
+            'Discard changes to dashboard?'
+          ),
+          icon: 'trash-alt',
+          text: t(
+            'dashboard-scene.dashboard-scene.title.unsaved-changes-question',
+            'You have unsaved changes to this dashboard. Are you sure you want to discard them?'
+          ),
+          yesText: t('dashboard-scene.dashboard-scene.modal.discard', 'Discard'),
+          onConfirm: () => {
+            this.exitEditModeConfirmed();
+          },
+        })
+      );
+    }
   }
 
   private exitEditModeConfirmed(restoreInitialState = true) {

public/app/features/dashboard-scene/scene/VariableControls.tsx

@@ -173,6 +173,8 @@ const getStyles = (theme: GrafanaTheme2) => ({
       borderTopLeftRadius: 'unset',
       borderBottomLeftRadius: 'unset',
     }),
+    marginBottom: theme.spacing(1),
+    marginRight: theme.spacing(1),
   }),
   verticalContainer: css({
     display: 'flex',

public/app/features/dashboard-scene/scene/VariableControlsAddButton.tsx

@@ -1,7 +1,9 @@
+import { css } from '@emotion/css';
 import { PointerEventHandler, useCallback } from 'react';
 
+import { GrafanaTheme2 } from '@grafana/data';
 import { Trans } from '@grafana/i18n';
-import { Button } from '@grafana/ui';
+import { Button, useStyles2 } from '@grafana/ui';
 
 import { openAddVariablePane } from '../settings/variables/VariableAddEditableElement';
 import { DashboardInteractions } from '../utils/interactions';
@@ -9,6 +11,7 @@ import { DashboardInteractions } from '../utils/interactions';
 import { DashboardScene } from './DashboardScene';
 
 export function AddVariableButton({ dashboard }: { dashboard: DashboardScene }) {
+  const styles = useStyles2(getStyles);
   const { editview, editPanel, isEditing, viewPanel } = dashboard.useState();
 
   const handlePointerDown: PointerEventHandler = useCallback(
@@ -30,10 +33,22 @@ export function AddVariableButton({ dashboard }: { dashboard: DashboardScene })
   }
 
   return (
-    <div className="dashboard-canvas-add-button">
-      <Button icon="plus" variant="primary" fill="text" onPointerDown={handlePointerDown}>
-        <Trans i18nKey="dashboard-scene.variable-controls.add-variable">Add variable</Trans>
-      </Button>
+    <div className={styles.addButton}>
+      <div className="dashboard-canvas-add-button">
+        <Button icon="plus" variant="primary" fill="text" onPointerDown={handlePointerDown}>
+          <Trans i18nKey="dashboard-scene.variable-controls.add-variable">Add variable</Trans>
+        </Button>
+      </div>
     </div>
   );
 }
+
+const getStyles = (theme: GrafanaTheme2) => ({
+  addButton: css({
+    display: 'inline-flex',
+    alignItems: 'center',
+    verticalAlign: 'middle',
+    marginBottom: theme.spacing(1),
+    marginRight: theme.spacing(1),
+  }),
+});

public/app/features/dashboard-scene/scene/types/EditableDashboardElement.ts

@@ -74,7 +74,7 @@ export interface EditableDashboardElement {
   /**
    * Container objects can have children
    */
-  getOutlineChildren?(): SceneObject[];
+  getOutlineChildren?(isEditing?: boolean): SceneObject[];
 }
 
 export interface EditableDashboardElementInfo {

public/app/features/dashboard-scene/serialization/sceneVariablesSetToVariables.test.ts

@@ -380,6 +380,35 @@ describe('sceneVariablesSetToVariables', () => {
     `);
   });
 
+  it('should handle Custom variable when sceneVariablesSetToVariables should keep options', () => {
+    const variable = new CustomVariable({
+      name: 'test',
+      label: 'test-label',
+      description: 'test-desc',
+      hide: VariableHide.inControlsMenu,
+      value: ['test'],
+      text: ['test'],
+      query: 'test,test1,test2',
+      options: [
+        { label: 'test', value: 'test' },
+        { label: 'test1', value: 'test1' },
+        { label: 'test2', value: 'test2' },
+      ],
+      includeAll: true,
+      allValue: 'test-all',
+      isMulti: true,
+    });
+
+    const set = new SceneVariableSet({
+      variables: [variable],
+    });
+    const keepQueryOptions = true;
+    const result = sceneVariablesSetToVariables(set, keepQueryOptions);
+    expect(result).toHaveLength(1);
+    expect(result[0].options).not.toEqual([]);
+    expect(result[0].options?.length).toEqual(3);
+  });
+
   it('should handle ConstantVariable', () => {
     const variable = new ConstantVariable({
       name: 'test',

public/app/features/dashboard-scene/serialization/sceneVariablesSetToVariables.ts

@@ -102,6 +102,10 @@ export function sceneVariablesSetToVariables(set: SceneVariables, keepQueryOptio
       }
       variables.push(variableObj);
     } else if (sceneUtils.isCustomVariable(variable)) {
+      let options: VariableOption[] = [];
+      if (keepQueryOptions) {
+        options = variableValueOptionsToVariableOptions(variable.state);
+      }
       const customVariable: VariableModel = {
         ...commonProperties,
         current: {
@@ -110,7 +114,7 @@ export function sceneVariablesSetToVariables(set: SceneVariables, keepQueryOptio
           // @ts-expect-error
           value: variable.state.value,
         },
-        options: [],
+        options,
         query: variable.state.query,
         multi: variable.state.isMulti,
         allValue: variable.state.allValue,

public/app/features/dashboard-scene/serialization/transformToV2TypesUtils.ts

@@ -119,6 +119,16 @@ export function colorIdEnumToColorIdV2(colorId: FieldColorModeIdV1 | string): Fi
       return 'continuous-greens';
     case FieldColorModeIdV1.ContinuousPurples:
       return 'continuous-purples';
+    case FieldColorModeIdV1.ContinuousViridis:
+      return 'continuous-viridis';
+    case FieldColorModeIdV1.ContinuousMagma:
+      return 'continuous-magma';
+    case FieldColorModeIdV1.ContinuousPlasma:
+      return 'continuous-plasma';
+    case FieldColorModeIdV1.ContinuousInferno:
+      return 'continuous-inferno';
+    case FieldColorModeIdV1.ContinuousCividis:
+      return 'continuous-cividis';
     case FieldColorModeIdV1.Fixed:
       return 'fixed';
     case FieldColorModeIdV1.Shades:

public/app/features/dashboard/api/ResponseTransformers.ts

@@ -1268,6 +1268,16 @@ function colorIdToEnumv1(colorId: FieldColorModeId): FieldColorModeIdV1 {
       return FieldColorModeIdV1.ContinuousGreens;
     case 'continuous-purples':
       return FieldColorModeIdV1.ContinuousPurples;
+    case 'continuous-viridis':
+      return FieldColorModeIdV1.ContinuousViridis;
+    case 'continuous-magma':
+      return FieldColorModeIdV1.ContinuousMagma;
+    case 'continuous-plasma':
+      return FieldColorModeIdV1.ContinuousPlasma;
+    case 'continuous-inferno':
+      return FieldColorModeIdV1.ContinuousInferno;
+    case 'continuous-cividis':
+      return FieldColorModeIdV1.ContinuousCividis;
     case 'fixed':
       return FieldColorModeIdV1.Fixed;
     case 'shades':

public/app/features/dashboard/components/SubMenu/DashboardLinksDashboard.tsx

@@ -181,6 +181,7 @@ function getStyles(theme: GrafanaTheme2) {
       display: 'inline-flex',
       alignItems: 'center',
       verticalAlign: 'middle',
+      marginBottom: theme.spacing(1),
     }),
   };
 }

public/app/features/dashboard/dashgrid/DashboardLibrary/BasicProvisionedDashboardsEmptyPage.tsx

@@ -39,6 +39,17 @@ export const BasicProvisionedDashboardsEmptyPage = ({ datasourceUid }: Props) =>
     }
 
     const dashboards = await fetchProvisionedDashboards(ds.type);
+
+    if (dashboards.length > 0) {
+      DashboardLibraryInteractions.loaded({
+        numberOfItems: dashboards.length,
+        contentKinds: [CONTENT_KINDS.DATASOURCE_DASHBOARD],
+        datasourceTypes: [ds.type],
+        sourceEntryPoint: SOURCE_ENTRY_POINTS.DATASOURCE_PAGE,
+        eventLocation: EVENT_LOCATIONS.EMPTY_DASHBOARD,
+      });
+    }
+
     return dashboards;
   }, [datasourceUid]);
 

public/app/features/explore/Logs/Logs.tsx

@@ -789,7 +789,6 @@ const UnthemedLogs: React.FunctionComponent<Props> = (props: Props) => {
           logOptionsStorageKey={SETTING_KEY_ROOT}
           timeZone={timeZone}
           displayedFields={displayedFields}
-          onPermalinkClick={onPermalinkClick}
           onClickShowField={showField}
           onClickHideField={hideField}
         />

public/app/features/explore/Logs/LogsTableWrap.tsx

@@ -19,7 +19,7 @@ import { t } from '@grafana/i18n';
 import { reportInteraction } from '@grafana/runtime';
 import { getDragStyles, InlineField, Select, useStyles2 } from '@grafana/ui';
 import {
-  getSidebarWidth,
+  getFieldSelectorWidth,
   LogsTableFieldSelector,
   MIN_WIDTH,
 } from 'app/features/logs/components/fieldSelector/FieldSelector';
@@ -279,7 +279,7 @@ export function LogsTableWrap(props: Props) {
     // The panel state is updated when the user interacts with the multi-select sidebar
   }, [currentDataFrame, getColumnsFromProps]);
 
-  const [sidebarWidth, setSidebarWidth] = useState(getSidebarWidth(SETTING_KEY_ROOT));
+  const [sidebarWidth, setSidebarWidth] = useState(getFieldSelectorWidth(SETTING_KEY_ROOT));
   const tableWidth = props.width - sidebarWidth;
 
   const styles = useStyles2(getStyles, height, sidebarWidth);

public/app/features/logs/components/fieldSelector/FieldSelector.tsx

@@ -35,7 +35,7 @@ export const LogListFieldSelector = ({ containerElement, dataFrames, logs }: Log
   const { displayedFields, onClickShowField, onClickHideField, setDisplayedFields, logOptionsStorageKey } =
     useLogListContext();
   const [sidebarHeight, setSidebarHeight] = useState(220);
-  const [sidebarWidth, setSidebarWidth] = useState(getSidebarWidth(logOptionsStorageKey));
+  const [sidebarWidth, setSidebarWidth] = useState(getFieldSelectorWidth(logOptionsStorageKey));
   const dragStyles = useStyles2(getDragStyles);
 
   useLayoutEffect(() => {
@@ -74,7 +74,7 @@ export const LogListFieldSelector = ({ containerElement, dataFrames, logs }: Log
   }, [setSidebarWidthWrapper]);
 
   const expand = useCallback(() => {
-    const width = getSidebarWidth(logOptionsStorageKey);
+    const width = getFieldSelectorWidth(logOptionsStorageKey);
     setSidebarWidthWrapper(width < 2 * MIN_WIDTH ? DEFAULT_WIDTH : width);
     reportInteraction('logs_field_selector_expand_clicked', {
       mode: 'logs',
@@ -205,7 +205,7 @@ export const LogsTableFieldSelector = ({
   }, [setSidebarWidthWrapper]);
 
   const expand = useCallback(() => {
-    const width = getSidebarWidth(SETTING_KEY_ROOT);
+    const width = getFieldSelectorWidth(SETTING_KEY_ROOT);
     setSidebarWidthWrapper(width < 2 * MIN_WIDTH ? DEFAULT_WIDTH : width);
     reportInteraction('logs_field_selector_expand_clicked', {
       mode: 'table',
@@ -436,7 +436,7 @@ function getSuggestedFields(logs: LogListModel[], displayedFields: string[], def
   return suggestedFields;
 }
 
-export function getSidebarWidth(logOptionsStorageKey?: string): number {
+export function getFieldSelectorWidth(logOptionsStorageKey?: string): number {
   const width =
     (logOptionsStorageKey
       ? parseInt(store.get(`${logOptionsStorageKey}.fieldSelector.width`) ?? DEFAULT_WIDTH, 10)
@@ -445,7 +445,7 @@ export function getSidebarWidth(logOptionsStorageKey?: string): number {
   return width < MIN_WIDTH ? MIN_WIDTH : width;
 }
 
-export function getSidebarState(logOptionsStorageKey?: string): boolean | undefined {
+export function getFieldSelectorState(logOptionsStorageKey?: string): boolean | undefined {
   if (!logOptionsStorageKey) {
     return undefined;
   }

public/app/features/logs/components/panel/LogDetailsContext.tsx

@@ -3,7 +3,7 @@ import { createContext, ReactNode, useCallback, useContext, useEffect, useState
 
 import { LogRowModel, store } from '@grafana/data';
 
-import { getSidebarWidth } from '../fieldSelector/FieldSelector';
+import { getFieldSelectorWidth } from '../fieldSelector/FieldSelector';
 
 import { LogLineDetailsMode } from './LogLineDetails';
 import { LogListModel } from './processing';
@@ -56,6 +56,7 @@ export interface Props {
   logs: LogRowModel[];
   logOptionsStorageKey?: string;
   showControls: boolean;
+  showFieldSelector?: boolean;
 }
 
 export const LogDetailsContextProvider = ({
@@ -68,12 +69,13 @@ export const LogDetailsContextProvider = ({
     : getDefaultDetailsMode(containerElement),
   logs,
   showControls,
+  showFieldSelector,
 }: Props) => {
   const [showDetails, setShowDetails] = useState<LogListModel[]>([]);
 
   const [currentLog, setCurrentLog] = useState<LogListModel | undefined>(undefined);
   const [detailsWidth, setDetailsWidthState] = useState(
-    getDetailsWidth(containerElement, logOptionsStorageKey, undefined, detailsModeProp, showControls)
+    getDetailsWidth(containerElement, logOptionsStorageKey, undefined, detailsModeProp, showControls, showFieldSelector)
   );
   const [detailsMode, setDetailsMode] = useState<LogLineDetailsMode>(
     detailsModeProp ?? getDefaultDetailsMode(containerElement)
@@ -101,8 +103,10 @@ export const LogDetailsContextProvider = ({
 
   // Sync log details inline and sidebar width
   useEffect(() => {
-    setDetailsWidthState(getDetailsWidth(containerElement, logOptionsStorageKey, undefined, detailsMode, showControls));
-  }, [containerElement, detailsMode, logOptionsStorageKey, showControls]);
+    setDetailsWidthState(
+      getDetailsWidth(containerElement, logOptionsStorageKey, undefined, detailsMode, showControls, showFieldSelector)
+    );
+  }, [containerElement, detailsMode, logOptionsStorageKey, showControls, showFieldSelector]);
 
   // Sync log details width
   useEffect(() => {
@@ -111,13 +115,20 @@ export const LogDetailsContextProvider = ({
     }
     const handleResize = debounce(() => {
       setDetailsWidthState((detailsWidth) =>
-        getDetailsWidth(containerElement, logOptionsStorageKey, detailsWidth, detailsMode, showControls)
+        getDetailsWidth(
+          containerElement,
+          logOptionsStorageKey,
+          detailsWidth,
+          detailsMode,
+          showControls,
+          showFieldSelector
+        )
       );
     }, 50);
     const observer = new ResizeObserver(() => handleResize());
     observer.observe(containerElement);
     return () => observer.disconnect();
-  }, [containerElement, detailsMode, logOptionsStorageKey, showControls, showDetails]);
+  }, [containerElement, detailsMode, logOptionsStorageKey, showControls, showDetails, showFieldSelector]);
 
   const closeDetails = useCallback(() => {
     showDetails.forEach((log) => removeDetailsScrollPosition(log));
@@ -158,7 +169,10 @@ export const LogDetailsContextProvider = ({
         return;
       }
 
-      const maxWidth = containerElement.clientWidth - getSidebarWidth(logOptionsStorageKey) - LOG_LIST_MIN_WIDTH;
+      const maxWidth =
+        containerElement.clientWidth -
+        (showFieldSelector ? getFieldSelectorWidth(logOptionsStorageKey) : 0) -
+        LOG_LIST_MIN_WIDTH;
       if (width > maxWidth) {
         return;
       }
@@ -166,7 +180,7 @@ export const LogDetailsContextProvider = ({
       store.set(`${logOptionsStorageKey}.detailsWidth`, width);
       setDetailsWidthState(width);
     },
-    [containerElement, logOptionsStorageKey]
+    [containerElement, logOptionsStorageKey, showFieldSelector]
   );
 
   return (
@@ -196,12 +210,14 @@ export function getDetailsWidth(
   logOptionsStorageKey?: string,
   currentWidth?: number,
   detailsMode: LogLineDetailsMode = 'sidebar',
-  showControls?: boolean
+  showControls?: boolean,
+  showFieldSelector?: boolean
 ) {
   if (!containerElement) {
     return 0;
   }
-  const availableWidth = containerElement.clientWidth - getSidebarWidth(logOptionsStorageKey);
+  const availableWidth =
+    containerElement.clientWidth - (showFieldSelector ? getFieldSelectorWidth(logOptionsStorageKey) : 0);
   if (detailsMode === 'inline') {
     return availableWidth - getScrollbarWidth() - (showControls ? LOG_LIST_CONTROLS_WIDTH : 0);
   }

public/app/features/logs/components/panel/LogLineDetails.test.tsx

@@ -20,6 +20,7 @@ import { setPluginLinksHook } from '@grafana/runtime';
 import { createTempoDatasource } from 'app/plugins/datasource/tempo/test/mocks';
 
 import { LOG_LINE_BODY_FIELD_NAME } from '../LogDetailsBody';
+import { getFieldSelectorWidth } from '../fieldSelector/FieldSelector';
 import { createLogLine } from '../mocks/logRow';
 
 import { emptyContextData, LogDetailsContext, LogDetailsContextData } from './LogDetailsContext';
@@ -27,6 +28,10 @@ import { LogLineDetails, Props } from './LogLineDetails';
 import { LogListContext, LogListContextData } from './LogListContext';
 import { defaultValue } from './__mocks__/LogListContext';
 
+jest.mock('../fieldSelector/FieldSelector');
+
+jest.mocked(getFieldSelectorWidth).mockReturnValue(220);
+
 jest.mock('@grafana/assistant', () => {
   return {
     ...jest.requireActual('@grafana/assistant'),
@@ -79,6 +84,7 @@ const setup = (
     },
     timeZone: 'browser',
     showControls: true,
+    showFieldSelector: true,
     ...(propOverrides || {}),
   };
 
@@ -775,4 +781,24 @@ describe('LogLineDetails', () => {
     expect(screen.getByText('value')).toBeInTheDocument();
     expect(screen.getByText('Open service overview for label')).toBeInTheDocument();
   });
+
+  describe('Width regressions', () => {
+    test('should consider Fields Selector width when enabled', () => {
+      jest.mocked(getFieldSelectorWidth).mockClear();
+
+      setup({ showFieldSelector: true }, { labels: { key1: 'label1', key2: 'label2' } });
+      expect(screen.getByText('Log line')).toBeInTheDocument();
+      expect(screen.getByText('Fields')).toBeInTheDocument();
+      expect(getFieldSelectorWidth).toHaveBeenCalled();
+    });
+
+    test('should not consider Fields Selector width when disabled', () => {
+      jest.mocked(getFieldSelectorWidth).mockClear();
+
+      setup({ showFieldSelector: false }, { labels: { key1: 'label1', key2: 'label2' } });
+      expect(screen.getByText('Log line')).toBeInTheDocument();
+      expect(screen.getByText('Fields')).toBeInTheDocument();
+      expect(getFieldSelectorWidth).not.toHaveBeenCalled();
+    });
+  });
 });

public/app/features/logs/components/panel/LogLineDetails.tsx

@@ -7,7 +7,7 @@ import { t } from '@grafana/i18n';
 import { reportInteraction } from '@grafana/runtime';
 import { getDragStyles, Icon, Tab, TabsBar, useStyles2 } from '@grafana/ui';
 
-import { getSidebarWidth } from '../fieldSelector/FieldSelector';
+import { getFieldSelectorWidth } from '../fieldSelector/FieldSelector';
 
 import { getDetailsScrollPosition, saveDetailsScrollPosition, useLogDetailsContext } from './LogDetailsContext';
 import { LogLineDetailsComponent } from './LogLineDetailsComponent';
@@ -22,12 +22,13 @@ export interface Props {
   timeRange: TimeRange;
   timeZone: string;
   showControls: boolean;
+  showFieldSelector: boolean | undefined;
 }
 
 export type LogLineDetailsMode = 'inline' | 'sidebar';
 
 export const LogLineDetails = memo(
-  ({ containerElement, focusLogLine, logs, timeRange, timeZone, showControls }: Props) => {
+  ({ containerElement, focusLogLine, logs, timeRange, timeZone, showControls, showFieldSelector }: Props) => {
     const { noInteractions, logOptionsStorageKey } = useLogListContext();
     const { detailsWidth, setDetailsWidth } = useLogDetailsContext();
     const styles = useStyles2(getStyles, 'sidebar', showControls);
@@ -48,7 +49,10 @@ export const LogLineDetails = memo(
       }
     }, [noInteractions]);
 
-    const maxWidth = containerElement.clientWidth - getSidebarWidth(logOptionsStorageKey) - LOG_LIST_MIN_WIDTH;
+    const maxWidth =
+      containerElement.clientWidth -
+      (showFieldSelector ? getFieldSelectorWidth(logOptionsStorageKey) : 0) -
+      LOG_LIST_MIN_WIDTH;
 
     return (
       <Resizable

public/app/features/logs/components/panel/LogList.tsx

@@ -219,6 +219,7 @@ export const LogList = ({
         logs={logs}
         logOptionsStorageKey={logOptionsStorageKey}
         showControls={showControls}
+        showFieldSelector={showFieldSelector}
       >
         <LogListSearchContextProvider>
           <LogListComponent
@@ -458,6 +459,7 @@ const LogListComponent = ({
           timeRange={timeRange}
           timeZone={timeZone}
           showControls={showControls}
+          showFieldSelector={showFieldSelector}
         />
       )}
       <div className={styles.logListWrapper} ref={wrapperRef}>