chore: separate resource service into search and storage

- continue cleanup and separation

docs/sources/administration/plugin-management/plugin-sign.md

@@ -25,7 +25,7 @@ Plugin signature verification, also known as _signing_, is a security measure to
 
 Learn more at [plugin policies](https://grafana.com/legal/plugins/).
 
-## How does verifiction work?
+## How does verification work?
 
 At startup, Grafana verifies the signatures of every plugin in the plugin directory.
 

docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md

@@ -66,7 +66,6 @@ Most [generally available](https://grafana.com/docs/release-life-cycle/#general-
 | `sharingDashboardImage`               | Enables image sharing functionality for dashboards                                                                                                            | Yes                |
 | `tabularNumbers`                      | Use fixed-width numbers globally in the UI                                                                                                                    |                    |
 | `azureResourcePickerUpdates`          | Enables the updated Azure Monitor resource picker                                                                                                             | Yes                |
-| `tempoSearchBackendMigration`         | Run search queries through the tempo backend                                                                                                                  |                    |
 | `opentsdbBackendMigration`            | Run queries through the data source backend                                                                                                                   |                    |
 
 ## Public preview feature toggles

eslint-suppressions.json

@@ -1021,11 +1021,6 @@
       "count": 2
     }
   },
-  "public/app/core/actions/index.ts": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 4
-    }
-  },
   "public/app/core/components/AccessControl/PermissionList.tsx": {
     "no-restricted-syntax": {
       "count": 1
@@ -2610,11 +2605,6 @@
       "count": 2
     }
   },
-  "public/app/features/explore/hooks/useStateSync/index.ts": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 1
-    }
-  },
   "public/app/features/explore/spec/helper/setup.tsx": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1
@@ -4030,11 +4020,6 @@
       "count": 1
     }
   },
-  "public/app/plugins/datasource/parca/webpack.config.ts": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 1
-    }
-  },
   "public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx": {
     "no-restricted-syntax": {
       "count": 1
@@ -4103,7 +4088,7 @@
       "count": 1
     },
     "@typescript-eslint/no-explicit-any": {
-      "count": 2
+      "count": 1
     }
   },
   "public/app/plugins/datasource/tempo/resultTransformer.ts": {

eslint.config.js

@@ -585,6 +585,8 @@ module.exports = [
       // FIXME: Remove once all enterprise issues are fixed -
       // we don't have a suppressions file/approach for enterprise code yet
       ...enterpriseIgnores,
+      // Ignore decoupled plugin webpack configs
+      'public/app/**/webpack.config.ts',
     ],
     rules: {
       'no-barrel-files/no-barrel-files': 'error',

packages/grafana-api-clients/src/clients/rtkq/dashboard/v0alpha1/endpoints.gen.ts

@@ -246,6 +246,8 @@ const injectedRtkApi = api
             facetLimit: queryArg.facetLimit,
             tags: queryArg.tags,
             libraryPanel: queryArg.libraryPanel,
+            panelType: queryArg.panelType,
+            dataSourceType: queryArg.dataSourceType,
             permission: queryArg.permission,
             sort: queryArg.sort,
             limit: queryArg.limit,
@@ -674,6 +676,10 @@ export type SearchDashboardsAndFoldersApiArg = {
   tags?: string[];
   /** find dashboards that reference a given libraryPanel */
   libraryPanel?: string;
+  /** find dashboards using panels of a given plugin type */
+  panelType?: string;
+  /** find dashboards using datasources of a given plugin type */
+  dataSourceType?: string;
   /** permission needed for the resource (view, edit, admin) */
   permission?: 'view' | 'edit' | 'admin';
   /** sortable field */

packages/grafana-data/src/types/featureToggles.gen.ts

@@ -657,10 +657,6 @@ export interface FeatureToggles {
   */
   rolePickerDrawer?: boolean;
   /**
-  * Enable unified storage search
-  */
-  unifiedStorageSearch?: boolean;
-  /**
   * Enable sprinkles on unified storage search
   */
   unifiedStorageSearchSprinkles?: boolean;
@@ -957,7 +953,8 @@ export interface FeatureToggles {
   */
   alertingBulkActionsInUI?: boolean;
   /**
-  * Registers AuthZ /apis endpoint
+  * Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead
+  * @deprecated
   */
   kubernetesAuthzApis?: boolean;
   /**
@@ -973,6 +970,18 @@ export interface FeatureToggles {
   */
   kubernetesAuthzZanzanaSync?: boolean;
   /**
+  * Registers AuthZ Core Roles /apis endpoint
+  */
+  kubernetesAuthzCoreRolesApi?: boolean;
+  /**
+  * Registers AuthZ Roles /apis endpoint
+  */
+  kubernetesAuthzRolesApi?: boolean;
+  /**
+  * Registers AuthZ Role Bindings /apis endpoint
+  */
+  kubernetesAuthzRoleBindingsApi?: boolean;
+  /**
   * Enables create, delete, and update mutations for resources owned by IAM identity
   */
   kubernetesAuthnMutation?: boolean;
@@ -1124,11 +1133,6 @@ export interface FeatureToggles {
   */
   pluginContainers?: boolean;
   /**
-  * Run search queries through the tempo backend
-  * @default false
-  */
-  tempoSearchBackendMigration?: boolean;
-  /**
   * Prioritize loading plugins from the CDN before other sources
   * @default false
   */

packages/grafana-data/src/types/icon.ts

@@ -52,6 +52,7 @@ export const availableIconsIndex = {
   bookmark: true,
   'book-open': true,
   'brackets-curly': true,
+  brain: true,
   'browser-alt': true,
   bug: true,
   building: true,

packages/grafana-ui/src/components/InteractiveTable/InteractiveTable.tsx

@@ -153,6 +153,10 @@ interface BaseProps<TableData extends object> {
    * Optional way to set how the table is sorted from the beginning. Must be memoized.
    */
   initialSortBy?: Array<SortingRule<TableData>>;
+  /**
+   * Disable the ability to remove sorting on columns (none -> asc -> desc -> asc)
+   */
+  disableSortRemove?: boolean;
 }
 
 interface WithExpandableRow<TableData extends object> extends BaseProps<TableData> {
@@ -191,6 +195,7 @@ export function InteractiveTable<TableData extends object>({
   showExpandAll = false,
   fetchData,
   initialSortBy = [],
+  disableSortRemove,
 }: Props<TableData>) {
   const styles = useStyles2(getStyles);
   const tableColumns = useMemo(() => {
@@ -222,6 +227,7 @@ export function InteractiveTable<TableData extends object>({
       disableMultiSort: true,
       // If fetchData is provided, we disable client-side sorting
       manualSortBy: Boolean(fetchData),
+      disableSortRemove,
       getRowId,
       initialState: {
         hiddenColumns: [

packages/grafana-ui/src/components/InteractiveTable/types.ts

@@ -26,4 +26,8 @@ export interface Column<TableData extends object> {
    * If the provided function returns `false` the column will be hidden.
    */
   visible?: (data: TableData[]) => boolean;
+  /**
+   * Determines starting sort direction when the column header is clicked.
+   */
+  sortDescFirst?: boolean;
 }

packages/grafana-ui/src/components/InteractiveTable/utils.ts

@@ -33,6 +33,7 @@ export function getColumns<K extends object>(
       disableSortBy: !Boolean(column.sortType),
       width: column.disableGrow ? 0 : undefined,
       visible: column.visible,
+      ...(column.sortDescFirst !== undefined && { sortDescFirst: column.sortDescFirst }),
       ...(column.cell && { Cell: column.cell }),
     })),
   ];

pkg/apiserver/registry/generic/storage.go

@@ -1,26 +1,55 @@
 package generic
 
 import (
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/registry/generic"
 	"k8s.io/apiserver/pkg/registry/generic/registry"
+	"k8s.io/apiserver/pkg/storage"
 
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 )
 
+// SelectableFieldsOptions allows customizing field selector behavior for a resource.
+type SelectableFieldsOptions struct {
+	// GetAttrs returns labels and fields for the object.
+	// If nil, the default GetAttrs is used which only exposes metadata.name.
+	GetAttrs func(obj runtime.Object) (labels.Set, fields.Set, error)
+}
+
 func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter) (*registry.Store, error) {
+	return NewRegistryStoreWithSelectableFields(scheme, resourceInfo, optsGetter, SelectableFieldsOptions{})
+}
+
+// NewRegistryStoreWithSelectableFields creates a registry store with custom selectable fields support.
+// Use this when you need to filter resources by custom fields like spec.connection.name.
+func NewRegistryStoreWithSelectableFields(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter, fieldOpts SelectableFieldsOptions) (*registry.Store, error) {
 	gv := resourceInfo.GroupVersion()
 	gv.Version = runtime.APIVersionInternal
 	strategy := NewStrategy(scheme, gv)
 	if resourceInfo.IsClusterScoped() {
 		strategy = strategy.WithClusterScope()
 	}
+
+	// Use custom GetAttrs if provided, otherwise use default
+	var attrFunc storage.AttrFunc
+	var predicateFunc func(label labels.Selector, field fields.Selector) storage.SelectionPredicate
+	if fieldOpts.GetAttrs != nil {
+		attrFunc = fieldOpts.GetAttrs
+		// Pass nil predicateFunc to use default behavior with custom attrFunc
+		predicateFunc = nil
+	} else {
+		attrFunc = GetAttrs
+		predicateFunc = Matcher
+	}
+
 	store := &registry.Store{
 		NewFunc:                   resourceInfo.NewFunc,
 		NewListFunc:               resourceInfo.NewListFunc,
 		KeyRootFunc:               KeyRootFunc(resourceInfo.GroupResource()),
 		KeyFunc:                   NamespaceKeyFunc(resourceInfo.GroupResource()),
-		PredicateFunc:             Matcher,
+		PredicateFunc:             predicateFunc,
 		DefaultQualifiedResource:  resourceInfo.GroupResource(),
 		SingularQualifiedResource: resourceInfo.SingularGroupResource(),
 		TableConvertor:            resourceInfo.TableConverter(),
@@ -28,7 +57,7 @@ func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, o
 		UpdateStrategy:            strategy,
 		DeleteStrategy:            strategy,
 	}
-	options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: GetAttrs}
+	options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: attrFunc}
 	if err := store.CompleteWithOptions(options); err != nil {
 		return nil, err
 	}

pkg/build/e2e/README.md

@@ -0,0 +1,20 @@
+## Build artifacts
+
+Put the resulting tar in your `grafana` OSS path:
+```sh
+go -C grafana run ./pkg/build/cmd artifacts -a targz:enterprise:linux/amd64 --alpine-base=alpine:3.22 --tag-format='{{ .version }}-{{ .buildID }}-{{ .arch }}' --grafana-dir="${PWD}/grafana" --enterprise-dir="${PWD}/grafana-enterprise"
+```
+
+Also build the e2e test runner:
+```sh
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o ./e2e-runner ./e2e/
+```
+
+And then `chmod +x ./e2e-runner`.
+
+## Running tests
+
+Reporting tests with Image Renderer:
+```sh
+go run ./pkg/build/e2e --suite=e2e/extensions/enterprise/smtp-suite --license=e2e/extensions/enterprise/license.jwt --image-renderer
+```

pkg/build/e2e/main.go

@@ -138,6 +138,10 @@ func run(ctx context.Context, cmd *cli.Command) error {
 	}
 
 	if code != 0 {
+		if stdout, _ := c.Stdout(ctx); len(stdout) > 0 {
+			log.Printf("e2e test suite stdout:\n%s", stdout)
+		}
+
 		return fmt.Errorf("e2e tests failed with exit code %d", code)
 	}
 

pkg/build/e2e/run.go

@@ -8,10 +8,10 @@ import (
 
 func RunSuite(d *dagger.Client, svc *dagger.Service, src *dagger.Directory, cache *dagger.CacheVolume, suite, runnerFlags string) *dagger.Container {
 	command := fmt.Sprintf(
-		"./e2e-runner cypress --start-grafana=false --cypress-video"+
+		"./e2e-runner cypress --browser=electron --start-grafana=false --cypress-video"+
 			" --grafana-base-url http://grafana:3001 --suite %s %s", suite, runnerFlags)
 
-	return WithYarnCache(WithGrafanaFrontend(d.Container().From("cypress/included:13.1.0"), src), cache).
+	return WithYarnCache(WithGrafanaFrontend(d.Container().From("cypress/included:14.3.2"), src), cache).
 		WithWorkdir("/src").
 		WithServiceBinding("grafana", svc).
 		WithExec([]string{"yarn", "install", "--immutable"}).

pkg/build/e2e/service.go

@@ -99,13 +99,15 @@ func GrafanaService(ctx context.Context, d *dagger.Client, opts GrafanaServiceOp
 	}
 
 	if opts.StartImageRenderer {
-		container = container.WithEnvVariable("START_IMAGE_RENDERER", "true").
-			WithExec([]string{"apt-get", "update"}).
-			WithExec([]string{"apt-get", "install", "-y", "ca-certificates"})
+		imageRendererSvc := d.Container().From("grafana/grafana-image-renderer:" + opts.ImageRendererVersion).
+			WithExposedPort(8081).
+			AsService()
 
-		if opts.ImageRendererVersion != "" {
-			container = container.WithEnvVariable("IMAGE_RENDERER_VERSION", opts.ImageRendererVersion)
-		}
+		container = container.WithServiceBinding("image-renderer", imageRendererSvc).
+			WithExec([]string{"apt-get", "update"}).
+			WithExec([]string{"apt-get", "install", "-y", "ca-certificates"}).
+			WithEnvVariable("GF_RENDERING_CALLBACK_URL", "http://grafana:3001/").
+			WithEnvVariable("GF_RENDERING_SERVER_URL", "http://image-renderer:8081/render")
 	}
 
 	// We add all GF_ environment variables to allow for overriding Grafana configuration.

pkg/cmd/grafana-cli/commands/datamigrations/to_unified_storage.go

@@ -74,7 +74,7 @@ func ToUnifiedStorage(c utils.CommandLine, cfg *setting.Cfg, sqlStore db.DB) err
 		return err
 	}
 
-	grpcClient, err := newUnifiedClient(cfg, sqlStore, featureToggles)
+	grpcClient, err := newUnifiedMigratorClient(cfg, sqlStore, featureToggles)
 	if err != nil {
 		return err
 	}
@@ -92,7 +92,7 @@ func ToUnifiedStorage(c utils.CommandLine, cfg *setting.Cfg, sqlStore db.DB) err
 	return runInteractiveMigration(ctx, cfg, opts, dashboardAccess, grpcClient, start)
 }
 
-func runNonInteractiveMigration(ctx context.Context, opts legacy.MigrateOptions, dashboardAccess legacy.MigrationDashboardAccessor, grpcClient resource.ResourceClient, start time.Time) error {
+func runNonInteractiveMigration(ctx context.Context, opts legacy.MigrateOptions, dashboardAccess legacy.MigrationDashboardAccessor, grpcClient resource.MigratorClient, start time.Time) error {
 	migrator := migrations.ProvideUnifiedMigrator(dashboardAccess, grpcClient)
 
 	opts.WithHistory = true // always include history in non-interactive mode
@@ -109,7 +109,7 @@ func runNonInteractiveMigration(ctx context.Context, opts legacy.MigrateOptions,
 	return nil
 }
 
-func runInteractiveMigration(ctx context.Context, cfg *setting.Cfg, opts legacy.MigrateOptions, dashboardAccess legacy.MigrationDashboardAccessor, grpcClient resource.ResourceClient, start time.Time) error {
+func runInteractiveMigration(ctx context.Context, cfg *setting.Cfg, opts legacy.MigrateOptions, dashboardAccess legacy.MigrationDashboardAccessor, grpcClient resource.MigratorClient, start time.Time) error {
 	yes, err := promptYesNo(fmt.Sprintf("Count legacy resources for namespace: %s?", opts.Namespace))
 	if err != nil {
 		return err
@@ -225,7 +225,7 @@ func promptYesNo(prompt string) (bool, error) {
 	}
 }
 
-func newUnifiedClient(cfg *setting.Cfg, sqlStore db.DB, featureToggles featuremgmt.FeatureToggles) (resource.ResourceClient, error) {
+func newUnifiedMigratorClient(cfg *setting.Cfg, sqlStore db.DB, featureToggles featuremgmt.FeatureToggles) (resource.MigratorClient, error) {
 	return unified.ProvideUnifiedStorageClient(&unified.Options{
 		Cfg:      cfg,
 		Features: featureToggles,

pkg/modules/dependencies.go

@@ -10,6 +10,7 @@ const (
 	SearchServerRing        string = "search-server-ring"
 	SearchServerDistributor string = "search-server-distributor"
 	StorageServer           string = "storage-server"
+	SearchServer            string = "search-server"
 	ZanzanaServer           string = "zanzana-server"
 	InstrumentationServer   string = "instrumentation-server"
 	FrontendServer          string = "frontend-server"
@@ -21,6 +22,7 @@ var dependencyMap = map[string][]string{
 	SearchServerRing:        {InstrumentationServer, MemberlistKV},
 	GrafanaAPIServer:        {InstrumentationServer},
 	StorageServer:           {InstrumentationServer, SearchServerRing},
+	SearchServer:            {InstrumentationServer, SearchServerRing},
 	ZanzanaServer:           {InstrumentationServer},
 	SearchServerDistributor: {InstrumentationServer, MemberlistKV, SearchServerRing},
 	Core:                    {},

pkg/registry/apis/dashboard/legacy/client.go

@@ -11,91 +11,59 @@ import (
 )
 
 var (
-	_ resource.ResourceClient = (*directResourceClient)(nil)
+	_ resource.StorageClient = (*DirectStorageClient)(nil)
 )
 
-// The direct client passes requests directly to the server using the *same* context
-func NewDirectResourceClient(server resource.ResourceServer) resource.ResourceClient {
-	return &directResourceClient{server}
+// NewDirectStorageClient creates a client that passes requests directly to the server using the *same* context
+func NewDirectStorageClient(server resource.ResourceServer) *DirectStorageClient {
+	return &DirectStorageClient{server}
 }
 
-type directResourceClient struct {
+type DirectStorageClient struct {
 	server resource.ResourceServer
 }
 
 // Create implements ResourceClient.
-func (d *directResourceClient) Create(ctx context.Context, in *resourcepb.CreateRequest, opts ...grpc.CallOption) (*resourcepb.CreateResponse, error) {
+func (d *DirectStorageClient) Create(ctx context.Context, in *resourcepb.CreateRequest, _ ...grpc.CallOption) (*resourcepb.CreateResponse, error) {
 	return d.server.Create(ctx, in)
 }
 
 // Delete implements ResourceClient.
-func (d *directResourceClient) Delete(ctx context.Context, in *resourcepb.DeleteRequest, opts ...grpc.CallOption) (*resourcepb.DeleteResponse, error) {
+func (d *DirectStorageClient) Delete(ctx context.Context, in *resourcepb.DeleteRequest, _ ...grpc.CallOption) (*resourcepb.DeleteResponse, error) {
 	return d.server.Delete(ctx, in)
 }
 
 // GetBlob implements ResourceClient.
-func (d *directResourceClient) GetBlob(ctx context.Context, in *resourcepb.GetBlobRequest, opts ...grpc.CallOption) (*resourcepb.GetBlobResponse, error) {
+func (d *DirectStorageClient) GetBlob(ctx context.Context, in *resourcepb.GetBlobRequest, _ ...grpc.CallOption) (*resourcepb.GetBlobResponse, error) {
 	return d.server.GetBlob(ctx, in)
 }
 
-// GetStats implements ResourceClient.
-func (d *directResourceClient) GetStats(ctx context.Context, in *resourcepb.ResourceStatsRequest, opts ...grpc.CallOption) (*resourcepb.ResourceStatsResponse, error) {
-	return d.server.GetStats(ctx, in)
-}
-
 // IsHealthy implements ResourceClient.
-func (d *directResourceClient) IsHealthy(ctx context.Context, in *resourcepb.HealthCheckRequest, opts ...grpc.CallOption) (*resourcepb.HealthCheckResponse, error) {
+func (d *DirectStorageClient) IsHealthy(ctx context.Context, in *resourcepb.HealthCheckRequest, _ ...grpc.CallOption) (*resourcepb.HealthCheckResponse, error) {
 	return d.server.IsHealthy(ctx, in)
 }
 
 // List implements ResourceClient.
-func (d *directResourceClient) List(ctx context.Context, in *resourcepb.ListRequest, opts ...grpc.CallOption) (*resourcepb.ListResponse, error) {
+func (d *DirectStorageClient) List(ctx context.Context, in *resourcepb.ListRequest, _ ...grpc.CallOption) (*resourcepb.ListResponse, error) {
 	return d.server.List(ctx, in)
 }
 
-func (d *directResourceClient) ListManagedObjects(ctx context.Context, in *resourcepb.ListManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.ListManagedObjectsResponse, error) {
-	return d.server.ListManagedObjects(ctx, in)
-}
-
-func (d *directResourceClient) CountManagedObjects(ctx context.Context, in *resourcepb.CountManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.CountManagedObjectsResponse, error) {
-	return d.server.CountManagedObjects(ctx, in)
-}
-
 // PutBlob implements ResourceClient.
-func (d *directResourceClient) PutBlob(ctx context.Context, in *resourcepb.PutBlobRequest, opts ...grpc.CallOption) (*resourcepb.PutBlobResponse, error) {
+func (d *DirectStorageClient) PutBlob(ctx context.Context, in *resourcepb.PutBlobRequest, _ ...grpc.CallOption) (*resourcepb.PutBlobResponse, error) {
 	return d.server.PutBlob(ctx, in)
 }
 
 // Read implements ResourceClient.
-func (d *directResourceClient) Read(ctx context.Context, in *resourcepb.ReadRequest, opts ...grpc.CallOption) (*resourcepb.ReadResponse, error) {
+func (d *DirectStorageClient) Read(ctx context.Context, in *resourcepb.ReadRequest, _ ...grpc.CallOption) (*resourcepb.ReadResponse, error) {
 	return d.server.Read(ctx, in)
 }
 
-// Search implements ResourceClient.
-func (d *directResourceClient) Search(ctx context.Context, in *resourcepb.ResourceSearchRequest, opts ...grpc.CallOption) (*resourcepb.ResourceSearchResponse, error) {
-	return d.server.Search(ctx, in)
-}
-
 // Update implements ResourceClient.
-func (d *directResourceClient) Update(ctx context.Context, in *resourcepb.UpdateRequest, opts ...grpc.CallOption) (*resourcepb.UpdateResponse, error) {
+func (d *DirectStorageClient) Update(ctx context.Context, in *resourcepb.UpdateRequest, _ ...grpc.CallOption) (*resourcepb.UpdateResponse, error) {
 	return d.server.Update(ctx, in)
 }
 
 // Watch implements ResourceClient.
-func (d *directResourceClient) Watch(ctx context.Context, in *resourcepb.WatchRequest, opts ...grpc.CallOption) (resourcepb.ResourceStore_WatchClient, error) {
+func (d *DirectStorageClient) Watch(_ context.Context, _ *resourcepb.WatchRequest, _ ...grpc.CallOption) (resourcepb.ResourceStore_WatchClient, error) {
 	return nil, fmt.Errorf("watch not supported with direct resource client")
 }
-
-// BulkProcess implements resource.ResourceClient.
-func (d *directResourceClient) BulkProcess(ctx context.Context, opts ...grpc.CallOption) (resourcepb.BulkStore_BulkProcessClient, error) {
-	return nil, fmt.Errorf("BulkProcess not supported with direct resource client")
-}
-
-// RebuildIndexes implements resource.ResourceClient.
-func (b *directResourceClient) RebuildIndexes(ctx context.Context, req *resourcepb.RebuildIndexesRequest, opts ...grpc.CallOption) (*resourcepb.RebuildIndexesResponse, error) {
-	return nil, fmt.Errorf("not implemented")
-}
-
-func (b *directResourceClient) GetQuotaUsage(ctx context.Context, req *resourcepb.QuotaUsageRequest, opts ...grpc.CallOption) (*resourcepb.QuotaUsageResponse, error) {
-	return nil, fmt.Errorf("not implemented")
-}

pkg/registry/apis/dashboard/legacy_storage.go

@@ -11,6 +11,7 @@ import (
 	"k8s.io/apiserver/pkg/registry/rest"
 
 	"github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
@@ -40,7 +41,7 @@ func (s *DashboardStorage) NewStore(dash utils.ResourceInfo, scheme *runtime.Sch
 	if err != nil {
 		return nil, err
 	}
-	client := legacy.NewDirectResourceClient(server) // same context
+	client := legacy.NewDirectStorageClient(server) // same context
 	optsGetter := apistore.NewRESTOptionsGetterForClient(client, nil,
 		defaultOpts.StorageConfig.Config, nil,
 	)

pkg/registry/apis/dashboard/search.go

@@ -142,6 +142,24 @@ func (s *SearchHandler) GetAPIRoutes(defs map[string]common.OpenAPIDefinition) *
 										Schema:      spec.StringProperty(),
 									},
 								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "panelType",
+										In:          "query",
+										Description: "find dashboards using panels of a given plugin type",
+										Required:    false,
+										Schema:      spec.StringProperty(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "dataSourceType",
+										In:          "query",
+										Description: "find dashboards using datasources of a given plugin type",
+										Required:    false,
+										Schema:      spec.StringProperty(),
+									},
+								},
 								{
 									ParameterProps: spec3.ParameterProps{
 										Name:        "permission",
@@ -430,14 +448,11 @@ func convertHttpSearchRequestToResourceSearchRequest(queryParams url.Values, use
 		}
 	}
 
-	// The facet term fields
+	// Apply facet terms
 	if facets, ok := queryParams["facet"]; ok {
 		if queryParams.Has("facetLimit") {
 			if parsed, err := strconv.Atoi(queryParams.Get("facetLimit")); err == nil && parsed > 0 {
-				facetLimit = parsed
-				if facetLimit > 1000 {
-					facetLimit = 1000
-				}
+				facetLimit = min(parsed, 1000)
 			}
 		}
 		searchRequest.Facet = make(map[string]*resourcepb.ResourceSearchRequest_Facet)
@@ -449,21 +464,35 @@ func convertHttpSearchRequestToResourceSearchRequest(queryParams url.Values, use
 		}
 	}
 
-	// The tags filter
-	if tags, ok := queryParams["tag"]; ok {
+	if v, ok := queryParams["tag"]; ok {
 		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
 			Key:      "tags",
 			Operator: "=",
-			Values:   tags,
+			Values:   v,
 		})
 	}
 
-	// The libraryPanel filter
-	if libraryPanel, ok := queryParams["libraryPanel"]; ok {
+	if v, ok := queryParams["panelType"]; ok {
+		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
+			Key:      resource.SEARCH_FIELD_PREFIX + builders.DASHBOARD_PANEL_TYPES,
+			Operator: "=",
+			Values:   v,
+		})
+	}
+
+	if v, ok := queryParams["dataSourceType"]; ok {
+		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
+			Key:      resource.SEARCH_FIELD_PREFIX + builders.DASHBOARD_DS_TYPES,
+			Operator: "=",
+			Values:   v,
+		})
+	}
+
+	if v, ok := queryParams["libraryPanel"]; ok {
 		searchRequest.Options.Fields = append(searchRequest.Options.Fields, &resourcepb.Requirement{
 			Key:      builders.DASHBOARD_LIBRARY_PANEL_REFERENCE,
 			Operator: "=",
-			Values:   libraryPanel,
+			Values:   v,
 		})
 	}
 

pkg/registry/apis/folders/register.go

@@ -37,7 +37,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/storage/unified/apistore"
-	"github.com/grafana/grafana/pkg/storage/unified/resource"
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
@@ -74,7 +73,7 @@ func RegisterAPIService(cfg *setting.Cfg,
 	acService accesscontrol.Service,
 	accessClient authlib.AccessClient,
 	registerer prometheus.Registerer,
-	unified resource.ResourceClient,
+	unified resourcepb.ResourceIndexClient,
 	zanzanaClient zanzana.Client,
 ) *FolderAPIBuilder {
 	builder := &FolderAPIBuilder{
@@ -93,7 +92,7 @@ func RegisterAPIService(cfg *setting.Cfg,
 	return builder
 }
 
-func NewAPIService(ac authlib.AccessClient, searcher resource.ResourceClient, features featuremgmt.FeatureToggles, zanzanaClient zanzana.Client, resourcePermissionsSvc *dynamic.NamespaceableResourceInterface) *FolderAPIBuilder {
+func NewAPIService(ac authlib.AccessClient, searcher resourcepb.ResourceIndexClient, features featuremgmt.FeatureToggles, zanzanaClient zanzana.Client, resourcePermissionsSvc *dynamic.NamespaceableResourceInterface) *FolderAPIBuilder {
 	return &FolderAPIBuilder{
 		features:               features,
 		accessClient:           ac,

pkg/registry/apis/iam/register.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"maps"
 	"strings"
+	"time"
 
+	"github.com/open-feature/go-sdk/openfeature"
 	"github.com/prometheus/client_golang/prometheus"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -209,8 +211,16 @@ func (b *IdentityAccessManagementAPIBuilder) GetGroupVersion() schema.GroupVersi
 }
 
 func (b *IdentityAccessManagementAPIBuilder) InstallSchema(scheme *runtime.Scheme) error {
-	//nolint:staticcheck // not yet migrated to OpenFeature
-	if b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis) {
+	client := openfeature.NewDefaultClient()
+	ctx, cancelFn := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancelFn()
+
+	// Check if any of the AuthZ APIs are enabled
+	enableCoreRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzCoreRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRoleBindingsApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRoleBindingsApi, false, openfeature.TransactionContext(ctx))
+
+	if enableCoreRolesApi || enableRolesApi || enableRoleBindingsApi {
 		if err := iamv0.AddAuthZKnownTypes(scheme); err != nil {
 			return err
 		}
@@ -244,10 +254,16 @@ func (b *IdentityAccessManagementAPIBuilder) AllowedV0Alpha1Resources() []string
 func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupInfo, opts builder.APIGroupOptions) error {
 	storage := map[string]rest.Storage{}
 
+	client := openfeature.NewDefaultClient()
+	ctx, cancelFn := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancelFn()
+
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	enableZanzanaSync := b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzZanzanaSync)
-	//nolint:staticcheck // not yet migrated to OpenFeature
-	enableAuthzApis := b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzApis)
+
+	enableCoreRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzCoreRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRolesApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRolesApi, false, openfeature.TransactionContext(ctx))
+	enableRoleBindingsApi := client.Boolean(ctx, featuremgmt.FlagKubernetesAuthzRoleBindingsApi, false, openfeature.TransactionContext(ctx))
 
 	// teams + users must have shorter names because they are often used as part of another name
 	opts.StorageOptsRegister(iamv0.TeamResourceInfo.GroupResource(), apistore.StorageOptions{
@@ -283,17 +299,21 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 		return err
 	}
 
-	if enableAuthzApis {
+	if enableCoreRolesApi {
 		// v0alpha1
 		if err := b.UpdateCoreRolesAPIGroup(apiGroupInfo, opts, storage, enableZanzanaSync); err != nil {
 			return err
 		}
+	}
 
+	if enableRolesApi {
 		// Role registration is delegated to the RoleApiInstaller
 		if err := b.roleApiInstaller.RegisterStorage(apiGroupInfo, &opts, storage); err != nil {
 			return err
 		}
+	}
 
+	if enableRoleBindingsApi {
 		if err := b.UpdateRoleBindingsAPIGroup(apiGroupInfo, opts, storage, enableZanzanaSync); err != nil {
 			return err
 		}
@@ -722,7 +742,7 @@ func NewLocalStore(resourceInfo utils.ResourceInfo, scheme *runtime.Scheme, defa
 		return nil, err
 	}
 
-	client := resource.NewLocalResourceClient(server)
+	client := resource.NewLocalResourceClient(server, nil)
 	optsGetter := apistore.NewRESTOptionsGetterForClient(client, nil, defaultOpts.StorageConfig.Config, nil)
 
 	store, err := grafanaregistry.NewRegistryStore(scheme, resourceInfo, optsGetter)

pkg/registry/apis/ofrep/register.go

@@ -44,7 +44,7 @@ var groupVersion = schema.GroupVersion{
 }
 
 type APIBuilder struct {
-	providerType    setting.OpenFeatureProviderType
+	providerType    string
 	url             *url.URL
 	insecure        bool
 	caFile          string
@@ -52,7 +52,7 @@ type APIBuilder struct {
 	logger          log.Logger
 }
 
-func NewAPIBuilder(providerType setting.OpenFeatureProviderType, url *url.URL, insecure bool, caFile string, staticEvaluator featuremgmt.StaticFlagEvaluator) *APIBuilder {
+func NewAPIBuilder(providerType string, url *url.URL, insecure bool, caFile string, staticEvaluator featuremgmt.StaticFlagEvaluator) *APIBuilder {
 	return &APIBuilder{
 		providerType:    providerType,
 		url:             url,

pkg/registry/apis/provisioning/jobs/job_progress_recorder_mock.go

@@ -71,6 +71,98 @@ func (_c *MockJobProgressRecorder_Complete_Call) RunAndReturn(run func(context.C
 	return _c
 }
 
+// HasDirPathFailedDeletion provides a mock function with given fields: folderPath
+func (_m *MockJobProgressRecorder) HasDirPathFailedDeletion(folderPath string) bool {
+	ret := _m.Called(folderPath)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HasDirPathFailedDeletion")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = rf(folderPath)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// MockJobProgressRecorder_HasDirPathFailedDeletion_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HasDirPathFailedDeletion'
+type MockJobProgressRecorder_HasDirPathFailedDeletion_Call struct {
+	*mock.Call
+}
+
+// HasDirPathFailedDeletion is a helper method to define mock.On call
+//   - folderPath string
+func (_e *MockJobProgressRecorder_Expecter) HasDirPathFailedDeletion(folderPath interface{}) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	return &MockJobProgressRecorder_HasDirPathFailedDeletion_Call{Call: _e.mock.On("HasDirPathFailedDeletion", folderPath)}
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) Run(run func(folderPath string)) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) Return(_a0 bool) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedDeletion_Call) RunAndReturn(run func(string) bool) *MockJobProgressRecorder_HasDirPathFailedDeletion_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// HasDirPathFailedCreation provides a mock function with given fields: path
+func (_m *MockJobProgressRecorder) HasDirPathFailedCreation(path string) bool {
+	ret := _m.Called(path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HasDirPathFailedCreation")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// MockJobProgressRecorder_HasDirPathFailedCreation_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HasDirPathFailedCreation'
+type MockJobProgressRecorder_HasDirPathFailedCreation_Call struct {
+	*mock.Call
+}
+
+// HasDirPathFailedCreation is a helper method to define mock.On call
+//   - path string
+func (_e *MockJobProgressRecorder_Expecter) HasDirPathFailedCreation(path interface{}) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	return &MockJobProgressRecorder_HasDirPathFailedCreation_Call{Call: _e.mock.On("HasDirPathFailedCreation", path)}
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) Run(run func(path string)) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) Return(_a0 bool) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockJobProgressRecorder_HasDirPathFailedCreation_Call) RunAndReturn(run func(string) bool) *MockJobProgressRecorder_HasDirPathFailedCreation_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Record provides a mock function with given fields: ctx, result
 func (_m *MockJobProgressRecorder) Record(ctx context.Context, result JobResourceResult) {
 	_m.Called(ctx, result)

pkg/registry/apis/provisioning/jobs/progress.go

@@ -2,6 +2,7 @@ package jobs
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sync"
 	"time"
@@ -9,6 +10,8 @@ import (
 	"github.com/grafana/grafana-app-sdk/logging"
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/apps/provisioning/pkg/safepath"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
 )
 
 // maybeNotifyProgress will only notify if a certain amount of time has passed
@@ -58,6 +61,8 @@ type jobProgressRecorder struct {
 	notifyImmediatelyFn ProgressFn
 	maybeNotifyFn       ProgressFn
 	summaries           map[string]*provisioning.JobResourceSummary
+	failedCreations     []string // Tracks folder paths that failed to be created
+	failedDeletions     []string // Tracks resource paths that failed to be deleted
 }
 
 func newJobProgressRecorder(ProgressFn ProgressFn) JobProgressRecorder {
@@ -84,10 +89,26 @@ func (r *jobProgressRecorder) Record(ctx context.Context, result JobResourceResu
 	if result.Error != nil {
 		shouldLogError = true
 		logErr = result.Error
-		if len(r.errors) < 20 {
-			r.errors = append(r.errors, result.Error.Error())
+
+		// Don't count ignored actions as errors in error count or error list
+		if result.Action != repository.FileActionIgnored {
+			if len(r.errors) < 20 {
+				r.errors = append(r.errors, result.Error.Error())
+			}
+			r.errorCount++
+		}
+
+		// Automatically track failed operations based on error type and action
+		// Check if this is a PathCreationError (folder creation failure)
+		var pathErr *resources.PathCreationError
+		if errors.As(result.Error, &pathErr) {
+			r.failedCreations = append(r.failedCreations, pathErr.Path)
+		}
+
+		// Track failed deletions, any deletion will stop the deletion of the parent folder (as it won't be empty)
+		if result.Action == repository.FileActionDeleted {
+			r.failedDeletions = append(r.failedDeletions, result.Path)
 		}
-		r.errorCount++
 	}
 
 	r.updateSummary(result)
@@ -112,6 +133,8 @@ func (r *jobProgressRecorder) ResetResults() {
 	r.errorCount = 0
 	r.errors = nil
 	r.summaries = make(map[string]*provisioning.JobResourceSummary)
+	r.failedCreations = nil
+	r.failedDeletions = nil
 }
 
 func (r *jobProgressRecorder) SetMessage(ctx context.Context, msg string) {
@@ -309,3 +332,29 @@ func (r *jobProgressRecorder) Complete(ctx context.Context, err error) provision
 
 	return jobStatus
 }
+
+// HasDirPathFailedCreation checks if a path is nested under any failed folder creation
+func (r *jobProgressRecorder) HasDirPathFailedCreation(path string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	for _, failedCreation := range r.failedCreations {
+		if safepath.InDir(path, failedCreation) {
+			return true
+		}
+	}
+	return false
+}
+
+// HasDirPathFailedDeletion checks if any resource deletions failed under a folder path
+func (r *jobProgressRecorder) HasDirPathFailedDeletion(folderPath string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	for _, failedDeletion := range r.failedDeletions {
+		if safepath.InDir(failedDeletion, folderPath) {
+			return true
+		}
+	}
+	return false
+}

pkg/registry/apis/provisioning/jobs/progress_test.go

@@ -7,6 +7,7 @@ import (
 
 	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -252,3 +253,221 @@ func TestJobProgressRecorderWarningOnlyNoErrors(t *testing.T) {
 	require.NotNil(t, finalStatus.Warnings)
 	assert.Len(t, finalStatus.Warnings, 1)
 }
+
+func TestJobProgressRecorderFolderFailureTracking(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record a folder creation failure with PathCreationError
+	pathErr := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr,
+	})
+
+	// Record another PathCreationError for a different folder
+	pathErr2 := &resources.PathCreationError{
+		Path: "folder2/subfolder/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr2,
+	})
+
+	// Record a deletion failure
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder3/file1.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Record another deletion failure
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder4/subfolder/file2.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Verify failed creations are tracked
+	recorder.mu.RLock()
+	assert.Len(t, recorder.failedCreations, 2)
+	assert.Contains(t, recorder.failedCreations, "folder1/")
+	assert.Contains(t, recorder.failedCreations, "folder2/subfolder/")
+
+	// Verify failed deletions are tracked
+	assert.Len(t, recorder.failedDeletions, 2)
+	assert.Contains(t, recorder.failedDeletions, "folder3/file1.json")
+	assert.Contains(t, recorder.failedDeletions, "folder4/subfolder/file2.json")
+	recorder.mu.RUnlock()
+}
+
+func TestJobProgressRecorderHasDirPathFailedCreation(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add failed creations via Record
+	pathErr1 := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr1,
+	})
+
+	pathErr2 := &resources.PathCreationError{
+		Path: "folder2/subfolder/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr2,
+	})
+
+	// Test nested paths
+	assert.True(t, recorder.HasDirPathFailedCreation("folder1/file.json"))
+	assert.True(t, recorder.HasDirPathFailedCreation("folder1/nested/file.json"))
+	assert.True(t, recorder.HasDirPathFailedCreation("folder2/subfolder/file.json"))
+
+	// Test non-nested paths
+	assert.False(t, recorder.HasDirPathFailedCreation("folder2/file2.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("folder2/othersubfolder/inside.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("other/file.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("folder3/file.json"))
+	assert.False(t, recorder.HasDirPathFailedCreation("file.json"))
+}
+
+func TestJobProgressRecorderHasDirPathFailedDeletion(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add failed deletions via Record
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file1.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/subfolder/file2.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder3/nested/deep/file3.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Test folder paths with failed deletions
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder1/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder2/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder2/subfolder/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/nested/"))
+	assert.True(t, recorder.HasDirPathFailedDeletion("folder3/nested/deep/"))
+
+	// Test folder paths without failed deletions
+	assert.False(t, recorder.HasDirPathFailedDeletion("other/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("different/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder2/othersubfolder/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder2/subfolder/othersubfolder/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder3/nested/anotherdeep/"))
+	assert.False(t, recorder.HasDirPathFailedDeletion("folder3/nested/deep/insidedeep/"))
+}
+
+func TestJobProgressRecorderResetResults(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Add some data via Record
+	pathErr := &resources.PathCreationError{
+		Path: "folder1/",
+		Err:  assert.AnError,
+	}
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file.json",
+		Action: repository.FileActionCreated,
+		Error:  pathErr,
+	})
+
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/file.json",
+		Action: repository.FileActionDeleted,
+		Error:  assert.AnError,
+	})
+
+	// Verify data is stored
+	recorder.mu.RLock()
+	assert.Len(t, recorder.failedCreations, 1)
+	assert.Len(t, recorder.failedDeletions, 1)
+	recorder.mu.RUnlock()
+
+	// Reset results
+	recorder.ResetResults()
+
+	// Verify data is cleared
+	recorder.mu.RLock()
+	assert.Nil(t, recorder.failedCreations)
+	assert.Nil(t, recorder.failedDeletions)
+	recorder.mu.RUnlock()
+}
+
+func TestJobProgressRecorderIgnoredActionsDontCountAsErrors(t *testing.T) {
+	ctx := context.Background()
+
+	// Create a progress recorder
+	mockProgressFn := func(ctx context.Context, status provisioning.JobStatus) error {
+		return nil
+	}
+	recorder := newJobProgressRecorder(mockProgressFn).(*jobProgressRecorder)
+
+	// Record an ignored action with error
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder1/file1.json",
+		Action: repository.FileActionIgnored,
+		Error:  assert.AnError,
+	})
+
+	// Record a real error for comparison
+	recorder.Record(ctx, JobResourceResult{
+		Path:   "folder2/file2.json",
+		Action: repository.FileActionCreated,
+		Error:  assert.AnError,
+	})
+
+	// Verify error count doesn't include ignored actions
+	recorder.mu.RLock()
+	assert.Equal(t, 1, recorder.errorCount, "ignored actions should not be counted as errors")
+	assert.Len(t, recorder.errors, 1, "ignored action errors should not be in error list")
+	recorder.mu.RUnlock()
+}

pkg/registry/apis/provisioning/jobs/queue.go

@@ -29,6 +29,10 @@ type JobProgressRecorder interface {
 	StrictMaxErrors(maxErrors int)
 	SetRefURLs(ctx context.Context, refURLs *provisioning.RepositoryURLs)
 	Complete(ctx context.Context, err error) provisioning.JobStatus
+	// HasDirPathFailedCreation checks if a path has any folder creations that failed
+	HasDirPathFailedCreation(path string) bool
+	// HasDirPathFailedDeletion checks if a folderPath has any folder deletions that failed
+	HasDirPathFailedDeletion(folderPath string) bool
 }
 
 // Worker is a worker that can process a job

pkg/registry/apis/provisioning/jobs/sync/full.go

@@ -75,11 +75,47 @@ func FullSync(
 	return applyChanges(ctx, changes, clients, repositoryResources, progress, tracer, maxSyncWorkers, metrics)
 }
 
+// shouldSkipChange checks if a change should be skipped based on previous failures on parent/child folders.
+// If there is a previous failure on the path, we don't need to process the change as it will fail anyway.
+func shouldSkipChange(ctx context.Context, change ResourceFileChange, progress jobs.JobProgressRecorder, tracer tracing.Tracer) bool {
+	if change.Action != repository.FileActionDeleted && progress.HasDirPathFailedCreation(change.Path) {
+		skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.skip_nested_resource")
+		skipSpan.SetAttributes(attribute.String("path", change.Path))
+		progress.Record(skipCtx, jobs.JobResourceResult{
+			Path:    change.Path,
+			Action:  repository.FileActionIgnored,
+			Warning: fmt.Errorf("resource was not processed because the parent folder could not be created"),
+		})
+		skipSpan.End()
+		return true
+	}
+
+	if change.Action == repository.FileActionDeleted && safepath.IsDir(change.Path) && progress.HasDirPathFailedDeletion(change.Path) {
+		skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.skip_folder_with_failed_deletions")
+		skipSpan.SetAttributes(attribute.String("path", change.Path))
+		progress.Record(skipCtx, jobs.JobResourceResult{
+			Path:    change.Path,
+			Action:  repository.FileActionIgnored,
+			Group:   resources.FolderKind.Group,
+			Kind:    resources.FolderKind.Kind,
+			Warning: fmt.Errorf("folder was not processed because children resources in its path could not be deleted"),
+		})
+		skipSpan.End()
+		return true
+	}
+
+	return false
+}
+
 func applyChange(ctx context.Context, change ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer) {
 	if ctx.Err() != nil {
 		return
 	}
 
+	if shouldSkipChange(ctx, change, progress, tracer) {
+		return
+	}
+
 	if change.Action == repository.FileActionDeleted {
 		deleteCtx, deleteSpan := tracer.Start(ctx, "provisioning.sync.full.apply_changes.delete")
 		result := jobs.JobResourceResult{
@@ -138,6 +174,7 @@ func applyChange(ctx context.Context, change ResourceFileChange, clients resourc
 			ensureFolderSpan.RecordError(err)
 			ensureFolderSpan.End()
 			progress.Record(ctx, result)
+
 			return
 		}
 
@@ -253,8 +290,6 @@ func applyChanges(ctx context.Context, changes []ResourceFileChange, clients res
 }
 
 func applyFoldersSerially(ctx context.Context, folders []ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer) error {
-	logger := logging.FromContext(ctx)
-
 	for _, folder := range folders {
 		if ctx.Err() != nil {
 			return ctx.Err()
@@ -264,23 +299,9 @@ func applyFoldersSerially(ctx context.Context, folders []ResourceFileChange, cli
 			return err
 		}
 
-		folderCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
-
-		applyChange(folderCtx, folder, clients, repositoryResources, progress, tracer)
-
-		if folderCtx.Err() == context.DeadlineExceeded {
-			logger.Error("operation timed out after 15 seconds", "path", folder.Path, "action", folder.Action)
-
-			recordCtx, recordCancel := context.WithTimeout(context.Background(), 15*time.Second)
-			progress.Record(recordCtx, jobs.JobResourceResult{
-				Path:   folder.Path,
-				Action: folder.Action,
-				Error:  fmt.Errorf("operation timed out after 15 seconds"),
-			})
-			recordCancel()
-		}
-
-		cancel()
+		wrapWithTimeout(ctx, 15*time.Second, func(timeoutCtx context.Context) {
+			applyChange(timeoutCtx, folder, clients, repositoryResources, progress, tracer)
+		})
 	}
 
 	return nil
@@ -318,7 +339,9 @@ loop:
 			defer wg.Done()
 			defer func() { <-sem }()
 
-			applyChangeWithTimeout(ctx, change, clients, repositoryResources, progress, tracer, logger)
+			wrapWithTimeout(ctx, 15*time.Second, func(timeoutCtx context.Context) {
+				applyChange(timeoutCtx, change, clients, repositoryResources, progress, tracer)
+			})
 		}(change)
 	}
 
@@ -331,21 +354,10 @@ loop:
 	return ctx.Err()
 }
 
-func applyChangeWithTimeout(ctx context.Context, change ResourceFileChange, clients resources.ResourceClients, repositoryResources resources.RepositoryResources, progress jobs.JobProgressRecorder, tracer tracing.Tracer, logger logging.Logger) {
-	changeCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+// wrapWithTimeout wraps a function call with a timeout context
+func wrapWithTimeout(ctx context.Context, timeout time.Duration, fn func(context.Context)) {
+	timeoutCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	applyChange(changeCtx, change, clients, repositoryResources, progress, tracer)
-
-	if changeCtx.Err() == context.DeadlineExceeded {
-		logger.Error("operation timed out after 15 seconds", "path", change.Path, "action", change.Action)
-
-		recordCtx, recordCancel := context.WithTimeout(context.Background(), 15*time.Second)
-		progress.Record(recordCtx, jobs.JobResourceResult{
-			Path:   change.Path,
-			Action: change.Action,
-			Error:  fmt.Errorf("operation timed out after 15 seconds"),
-		})
-		recordCancel()
-	}
+	fn(timeoutCtx)
 }

pkg/registry/apis/provisioning/jobs/sync/full_hierarchical_test.go

@@ -0,0 +1,432 @@
+package sync
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+	k8testing "k8s.io/client-go/testing"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/jobs"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+)
+
+/*
+TestFullSync_HierarchicalErrorHandling tests the hierarchical error handling behavior:
+
+FOLDER CREATION FAILURES:
+- When a folder fails to be created with PathCreationError, all nested resources are skipped
+- Nested resources are recorded with FileActionIgnored and error "folder was not processed because children resources in its path could not be deleted"
+- Only the folder creation error counts toward error limits
+- Nested resource skips do NOT count toward error limits
+
+FOLDER DELETION FAILURES:
+- When a file deletion fails, it's tracked in failedDeletions
+- When cleaning up folders, we check HasDirPathFailedDeletion()
+- If children failed to delete, folder deletion is skipped with FileActionIgnored
+- This prevents orphaning resources that still exist
+
+DELETIONS NOT AFFECTED BY CREATION FAILURES:
+- If a folder creation fails, deletion operations for resources in that folder still proceed
+- This is because the resource might already exist from a previous sync
+- Only creations/updates/renames are affected by failed folder creation
+
+AUTOMATIC TRACKING:
+- Record() automatically detects PathCreationError and adds to failedCreations
+- Record() automatically detects deletion failures and adds to failedDeletions
+- No manual calls to AddFailedCreation/AddFailedDeletion needed
+*/
+func TestFullSync_HierarchicalErrorHandling(t *testing.T) { // nolint:gocyclo
+	tests := []struct {
+		name          string
+		setupMocks    func(*repository.MockRepository, *resources.MockRepositoryResources, *resources.MockResourceClients, *jobs.MockJobProgressRecorder, *dynamicfake.FakeDynamicClient)
+		changes       []ResourceFileChange
+		description   string
+		expectError   bool
+		errorContains string
+	}{
+		{
+			name:        "folder creation fails, nested file skipped",
+			description: "When folder1/ fails to create, folder1/file.json should be skipped with FileActionIgnored",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First, check if nested under failed creation - not yet
+				progress.On("HasDirPathFailedCreation", "folder1/file.json").Return(false).Once()
+
+				// WriteResourceFromFile fails with PathCreationError for folder1/
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				// File will be recorded with error, triggering automatic tracking of folder1/ failure
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file.json" && r.Error != nil && r.Action == repository.FileActionCreated
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder creation fails, multiple nested resources skipped",
+			description: "When folder1/ fails to create, all nested resources (subfolder, files) are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/file2.json", Action: repository.FileActionCreated},
+				{Path: "folder1/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First file triggers folder creation failure
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// Subsequent files in same folder are skipped
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/file2.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file3.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "file deletion failure tracked",
+			description: "When a file deletion fails, it's automatically tracked in failedDeletions",
+			changes: []ResourceFileChange{
+				{
+					Path:   "folder1/file.json",
+					Action: repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{
+						Name:     "file1",
+						Group:    "dashboard.grafana.app",
+						Resource: "dashboards",
+					},
+				},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				// File deletion fails
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				// File deletion recorded with error, automatically tracked in failedDeletions
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "deletion proceeds despite creation failure",
+			description: "When folder1/ fails to create, deletion of folder1/file2.json still proceeds (resource might exist from previous sync)",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{
+					Path:   "folder1/file2.json",
+					Action: repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{
+						Name:     "file2",
+						Group:    "dashboard.grafana.app",
+						Resource: "dashboards",
+					},
+				},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				// Creation fails
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// Deletion proceeds (NOT checking HasDirPathFailedCreation for deletions)
+				// Note: deletion will fail because resource doesn't exist, but that's fine for this test
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				// Record deletion attempt (will have error since resource doesn't exist, but that's ok)
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" &&
+						r.Action == repository.FileActionDeleted
+					// Not checking r.Error because resource doesn't exist in fake client
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multi-level nesting - all skipped",
+			description: "When level1/ fails, level1/level2/level3/file.json is also skipped",
+			changes: []ResourceFileChange{
+				{Path: "level1/file1.json", Action: repository.FileActionCreated},
+				{Path: "level1/level2/file2.json", Action: repository.FileActionCreated},
+				{Path: "level1/level2/level3/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// First file triggers level1/ failure
+				progress.On("HasDirPathFailedCreation", "level1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "level1/file1.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "level1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				// All nested files are skipped
+				for _, path := range []string{"level1/level2/file2.json", "level1/level2/level3/file3.json"} {
+					progress.On("HasDirPathFailedCreation", path).Return(true).Once()
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "mixed success and failure",
+			description: "When success/ works and failure/ fails, only failure/* are skipped",
+			changes: []ResourceFileChange{
+				{Path: "success/file1.json", Action: repository.FileActionCreated},
+				{Path: "failure/file2.json", Action: repository.FileActionCreated},
+				{Path: "failure/nested/file3.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				// Success path works
+				progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "").
+					Return("resource1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/file1.json" && r.Error == nil
+				})).Return().Once()
+
+				// Failure path fails
+				progress.On("HasDirPathFailedCreation", "failure/file2.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "failure/file2.json", "").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/file2.json" && r.Error != nil
+				})).Return().Once()
+
+				// Nested file in failure path is skipped
+				progress.On("HasDirPathFailedCreation", "failure/nested/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/nested/file3.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder creation fails with explicit folder in changes",
+			description: "When folder1/ is explicitly in changes and fails to create, all nested resources (subfolders and files) are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/", Action: repository.FileActionCreated},
+				{Path: "folder1/file1.json", Action: repository.FileActionCreated},
+				{Path: "folder1/subfolder/file2.json", Action: repository.FileActionCreated},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, _ *dynamicfake.FakeDynamicClient) {
+				progress.On("HasDirPathFailedCreation", "folder1/").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "folder1/").Return("", folderErr).Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/").Return(true).Once()
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(true).Once()
+				progress.On("HasDirPathFailedCreation", "folder1/subfolder/file2.json").Return(true).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/subfolder/file2.json" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "folder deletion prevented when child deletion fails",
+			description: "When a file deletion fails, folder deletion is skipped with FileActionIgnored to prevent orphaning resources",
+			changes: []ResourceFileChange{
+				{
+					Path:     "folder1/file1.json",
+					Action:   repository.FileActionDeleted,
+					Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"},
+				},
+				{Path: "folder1/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "folder1", Group: "folder.grafana.app", Resource: "Folder"}},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedDeletion", "folder1/").Return(true).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multiple folder deletion failures",
+			description: "When multiple independent folders have child deletion failures, all folder deletions are skipped",
+			changes: []ResourceFileChange{
+				{Path: "folder1/file1.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "folder1/", Action: repository.FileActionDeleted},
+				{Path: "folder2/file2.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file2", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "folder2/", Action: repository.FileActionDeleted},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				for _, path := range []string{"folder1/file1.json", "folder2/file2.json"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Error != nil
+					})).Return().Once()
+				}
+
+				progress.On("HasDirPathFailedDeletion", "folder1/").Return(true).Once()
+				progress.On("HasDirPathFailedDeletion", "folder2/").Return(true).Once()
+
+				for _, path := range []string{"folder1/", "folder2/"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "nested subfolder deletion failure",
+			description: "When a file deletion fails in a nested subfolder, both the subfolder and parent folder deletions are skipped",
+			changes: []ResourceFileChange{
+				{Path: "parent/subfolder/file.json", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "file1", Group: "dashboard.grafana.app", Resource: "dashboards"}},
+				{Path: "parent/subfolder/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "subfolder", Group: "folder.grafana.app", Resource: "Folder"}},
+				{Path: "parent/", Action: repository.FileActionDeleted, Existing: &provisioning.ResourceListItem{Name: "parent", Group: "folder.grafana.app", Resource: "Folder"}},
+			},
+			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, dynamicClient *dynamicfake.FakeDynamicClient) {
+				gvk := schema.GroupVersionKind{Group: "dashboard.grafana.app", Kind: "Dashboard", Version: "v1"}
+				gvr := schema.GroupVersionResource{Group: "dashboard.grafana.app", Resource: "dashboards", Version: "v1"}
+				clients.On("ForResource", mock.Anything, mock.MatchedBy(func(gvr schema.GroupVersionResource) bool {
+					return gvr.Group == "dashboard.grafana.app"
+				})).Return(dynamicClient.Resource(gvr), gvk, nil)
+
+				dynamicClient.PrependReactor("delete", "dashboards", func(action k8testing.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("permission denied")
+				})
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "parent/subfolder/file.json" && r.Error != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedDeletion", "parent/subfolder/").Return(true).Once()
+				progress.On("HasDirPathFailedDeletion", "parent/").Return(true).Once()
+
+				for _, path := range []string{"parent/subfolder/", "parent/"} {
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scheme := runtime.NewScheme()
+			dynamicClient := dynamicfake.NewSimpleDynamicClient(scheme)
+
+			repo := repository.NewMockRepository(t)
+			repoResources := resources.NewMockRepositoryResources(t)
+			clients := resources.NewMockResourceClients(t)
+			progress := jobs.NewMockJobProgressRecorder(t)
+			compareFn := NewMockCompareFn(t)
+
+			repo.On("Config").Return(&provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{Name: "test-repo"},
+				Spec:       provisioning.RepositorySpec{Title: "Test Repo"},
+			})
+
+			tt.setupMocks(repo, repoResources, clients, progress, dynamicClient)
+
+			compareFn.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tt.changes, nil)
+			progress.On("SetTotal", mock.Anything, len(tt.changes)).Return()
+			progress.On("TooManyErrors").Return(nil).Maybe()
+
+			err := FullSync(context.Background(), repo, compareFn.Execute, clients, "ref", repoResources, progress, tracing.NewNoopTracerService(), 10, jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+
+			if tt.expectError {
+				require.Error(t, err)
+				if tt.errorContains != "" {
+					require.Contains(t, err.Error(), tt.errorContains)
+				}
+			} else {
+				require.NoError(t, err)
+			}
+
+			progress.AssertExpectations(t)
+			repoResources.AssertExpectations(t)
+		})
+	}
+}

pkg/registry/apis/provisioning/jobs/sync/full_test.go

@@ -213,6 +213,10 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 					return nil
 				})
 
+				progress.On("HasDirPathFailedCreation", mock.MatchedBy(func(path string) bool {
+					return path == "dashboards/one.json" || path == "dashboards/two.json" || path == "dashboards/three.json"
+				})).Return(false).Maybe()
+
 				repoResources.On("WriteResourceFromFile", mock.Anything, mock.MatchedBy(func(path string) bool {
 					return path == "dashboards/one.json" || path == "dashboards/two.json" || path == "dashboards/three.json"
 				}), "").Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil).Maybe()
@@ -235,6 +239,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -259,6 +264,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write error"))
@@ -285,6 +291,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -309,6 +316,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write error"))
@@ -335,6 +343,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "one/two/three/").Return(false)
 
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "one/two/three/").Return("some-folder", nil)
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
@@ -357,6 +366,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "one/two/three/").Return(false)
 
 				repoResources.On(
 					"EnsureFolderPathExist",
@@ -581,6 +591,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedDeletion", "to-be-deleted/").Return(false)
 
 				scheme := runtime.NewScheme()
 				require.NoError(t, metav1.AddMetaToScheme(scheme))
@@ -640,6 +651,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedDeletion", "to-be-deleted/").Return(false)
 
 				scheme := runtime.NewScheme()
 				require.NoError(t, metav1.AddMetaToScheme(scheme))
@@ -695,6 +707,7 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 			},
 			setupMocks: func(repo *repository.MockRepository, repoResources *resources.MockRepositoryResources, clients *resources.MockResourceClients, progress *jobs.MockJobProgressRecorder, compareFn *MockCompareFn) {
 				progress.On("TooManyErrors").Return(nil)
+				progress.On("HasDirPathFailedCreation", "dashboards/slow.json").Return(false)
 
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/slow.json", "").
 					Run(func(args mock.Arguments) {
@@ -708,19 +721,13 @@ func TestFullSync_ApplyChanges(t *testing.T) { //nolint:gocyclo
 					}).
 					Return("", schema.GroupVersionKind{}, context.DeadlineExceeded)
 
+				// applyChange records the error from WriteResourceFromFile
 				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
 					return result.Action == repository.FileActionCreated &&
 						result.Path == "dashboards/slow.json" &&
 						result.Error != nil &&
 						result.Error.Error() == "writing resource from file dashboards/slow.json: context deadline exceeded"
 				})).Return().Once()
-
-				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
-					return result.Action == repository.FileActionCreated &&
-						result.Path == "dashboards/slow.json" &&
-						result.Error != nil &&
-						result.Error.Error() == "operation timed out after 15 seconds"
-				})).Return().Once()
 			},
 		},
 	}

pkg/registry/apis/provisioning/jobs/sync/incremental.go

@@ -60,7 +60,7 @@ func IncrementalSync(ctx context.Context, repo repository.Versioned, previousRef
 	if len(affectedFolders) > 0 {
 		cleanupStart := time.Now()
 		span.AddEvent("checking if impacted folders should be deleted", trace.WithAttributes(attribute.Int("affected_folders", len(affectedFolders))))
-		err := cleanupOrphanedFolders(ctx, repo, affectedFolders, repositoryResources, tracer)
+		err := cleanupOrphanedFolders(ctx, repo, affectedFolders, repositoryResources, tracer, progress)
 		metrics.RecordIncrementalSyncPhase(jobs.IncrementalSyncPhaseCleanup, time.Since(cleanupStart))
 		if err != nil {
 			return tracing.Error(span, fmt.Errorf("cleanup orphaned folders: %w", err))
@@ -85,6 +85,20 @@ func applyIncrementalChanges(ctx context.Context, diff []repository.VersionedFil
 			return nil, tracing.Error(span, err)
 		}
 
+		// Check if this resource is nested under a failed folder creation
+		// This only applies to creation/update/rename operations, not deletions
+		if change.Action != repository.FileActionDeleted && progress.HasDirPathFailedCreation(change.Path) {
+			// Skip this resource since its parent folder failed to be created
+			skipCtx, skipSpan := tracer.Start(ctx, "provisioning.sync.incremental.skip_nested_resource")
+			progress.Record(skipCtx, jobs.JobResourceResult{
+				Path:    change.Path,
+				Action:  repository.FileActionIgnored,
+				Warning: fmt.Errorf("resource was not processed because the parent folder could not be created"),
+			})
+			skipSpan.End()
+			continue
+		}
+
 		if err := resources.IsPathSupported(change.Path); err != nil {
 			ensureFolderCtx, ensureFolderSpan := tracer.Start(ctx, "provisioning.sync.incremental.ensure_folder_path_exist")
 			// Maintain the safe segment for empty folders
@@ -98,7 +112,15 @@ func applyIncrementalChanges(ctx context.Context, diff []repository.VersionedFil
 				if err != nil {
 					ensureFolderSpan.RecordError(err)
 					ensureFolderSpan.End()
-					return nil, tracing.Error(span, fmt.Errorf("unable to create empty file folder: %w", err))
+
+					progress.Record(ensureFolderCtx, jobs.JobResourceResult{
+						Path:   change.Path,
+						Action: repository.FileActionIgnored,
+						Group:  resources.FolderKind.Group,
+						Kind:   resources.FolderKind.Kind,
+						Error:  err,
+					})
+					continue
 				}
 
 				progress.Record(ensureFolderCtx, jobs.JobResourceResult{
@@ -185,6 +207,7 @@ func cleanupOrphanedFolders(
 	affectedFolders map[string]string,
 	repositoryResources resources.RepositoryResources,
 	tracer tracing.Tracer,
+	progress jobs.JobProgressRecorder,
 ) error {
 	ctx, span := tracer.Start(ctx, "provisioning.sync.incremental.cleanup_orphaned_folders")
 	defer span.End()
@@ -198,6 +221,12 @@ func cleanupOrphanedFolders(
 	for path, folderName := range affectedFolders {
 		span.SetAttributes(attribute.String("folder", folderName))
 
+		// Check if any resources under this folder failed to delete
+		if progress.HasDirPathFailedDeletion(path) {
+			span.AddEvent("skipping orphaned folder cleanup: a child resource in its path failed to be deleted")
+			continue
+		}
+
 		// if we can no longer find the folder in git, then we can delete it from grafana
 		_, err := readerRepo.Read(ctx, path, "")
 		if err != nil && (errors.Is(err, repository.ErrFileNotFound) || apierrors.IsNotFound(err)) {

pkg/registry/apis/provisioning/jobs/sync/incremental_hierarchical_test.go

@@ -0,0 +1,623 @@
+package sync
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/jobs"
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+)
+
+/*
+TestIncrementalSync_HierarchicalErrorHandling tests the hierarchical error handling behavior:
+
+FOLDER CREATION FAILURES:
+- When EnsureFolderPathExist fails with PathCreationError, the path is tracked
+- Subsequent resources under that path are skipped with FileActionIgnored
+- Only the initial folder creation error counts toward error limits
+- WriteResourceFromFile can also return PathCreationError for implicit folder creation
+
+FOLDER DELETION FAILURES (cleanupOrphanedFolders):
+- When RemoveResourceFromFile fails, path is tracked in failedDeletions
+- In cleanupOrphanedFolders, HasDirPathFailedDeletion() is checked before RemoveFolder
+- If children failed to delete, folder cleanup is skipped with a span event
+
+DELETIONS NOT AFFECTED BY CREATION FAILURES:
+- HasDirPathFailedCreation is NOT checked for FileActionDeleted
+- Deletions proceed even if their parent folder failed to be created
+- This handles cleanup of resources that exist from previous syncs
+
+RENAME OPERATIONS:
+- RenameResourceFile can return PathCreationError for the destination folder
+- Renames are affected by failed destination folder creation
+- Renames are NOT skipped due to source folder creation failures
+
+AUTOMATIC TRACKING:
+- Record() automatically detects PathCreationError via errors.As() and adds to failedCreations
+- Record() automatically detects FileActionDeleted with error and adds to failedDeletions
+- No manual tracking calls needed
+*/
+func TestIncrementalSync_HierarchicalErrorHandling(t *testing.T) { // nolint:gocyclo
+	tests := []struct {
+		name          string
+		setupMocks    func(*repository.MockVersioned, *resources.MockRepositoryResources, *jobs.MockJobProgressRecorder)
+		changes       []repository.VersionedFileChange
+		previousRef   string
+		currentRef    string
+		description   string
+		expectError   bool
+		errorContains string
+	}{
+		{
+			name:        "folder creation fails, nested file skipped",
+			description: "When unsupported/ fails to create via EnsureFolderPathExist, nested file is skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "unsupported/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "unsupported/nested/file2.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file triggers folder creation which fails
+				progress.On("HasDirPathFailedCreation", "unsupported/file.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "unsupported/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/").Return("", folderErr).Once()
+
+				// First file recorded with error (note: error is from folder creation, but recorded against file)
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "unsupported/file.txt" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Error != nil
+				})).Return().Once()
+
+				// Second file is skipped because parent folder failed
+				progress.On("HasDirPathFailedCreation", "unsupported/nested/file2.txt").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "unsupported/nested/file2.txt" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil &&
+						r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "WriteResourceFromFile returns PathCreationError, nested resources skipped",
+			description: "When WriteResourceFromFile implicitly creates a folder and fails, nested resources are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "folder1/file1.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/file2.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/nested/file3.json", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file write fails with PathCreationError
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file1.json", "new-ref").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				// First file recorded with error, automatically tracked
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" &&
+						r.Action == repository.FileActionCreated &&
+						r.Error != nil
+				})).Return().Once()
+
+				// Subsequent files are skipped
+				progress.On("HasDirPathFailedCreation", "folder1/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "folder1/nested/file3.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/nested/file3.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "file deletion fails, folder cleanup skipped",
+			description: "When RemoveResourceFromFile fails, cleanupOrphanedFolders skips folder removal",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionDeleted, Path: "dashboards/file1.json", PreviousRef: "old-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// File deletion fails (deletions don't check HasDirPathFailedCreation)
+				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/file1.json", "old-ref").
+					Return("dashboard-1", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard"}, fmt.Errorf("permission denied")).Once()
+
+				// Error recorded, automatically tracked in failedDeletions
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "dashboards/file1.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error != nil
+				})).Return().Once()
+
+				// During cleanup, folder deletion is skipped
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(true).Once()
+
+				// Note: RemoveFolder should NOT be called (verified via AssertNotCalled in test)
+			},
+		},
+		{
+			name:        "deletion proceeds despite creation failure",
+			description: "When folder1/ creation fails, deletion of folder1/old.json still proceeds",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "folder1/new.json", Ref: "new-ref"},
+				{Action: repository.FileActionDeleted, Path: "folder1/old.json", PreviousRef: "old-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Creation fails
+				progress.On("HasDirPathFailedCreation", "folder1/new.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/new.json", "new-ref").
+					Return("", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/new.json" && r.Error != nil
+				})).Return().Once()
+
+				// Deletion proceeds (NOT checking HasDirPathFailedCreation for deletions)
+				repoResources.On("RemoveResourceFromFile", mock.Anything, "folder1/old.json", "old-ref").
+					Return("old-resource", "", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/old.json" &&
+						r.Action == repository.FileActionDeleted &&
+						r.Error == nil // Deletion succeeds!
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "multi-level nesting cascade",
+			description: "When level1/ fails, level1/level2/level3/file.json is also skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "level1/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "level1/level2/file.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "level1/level2/level3/file.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// First file triggers level1/ failure
+				progress.On("HasDirPathFailedCreation", "level1/file.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "level1/").Return("", folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "level1/file.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				// All nested files are skipped
+				for _, path := range []string{"level1/level2/file.txt", "level1/level2/level3/file.txt"} {
+					progress.On("HasDirPathFailedCreation", path).Return(true).Once()
+					progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+						return r.Path == path && r.Action == repository.FileActionIgnored
+					})).Return().Once()
+				}
+			},
+		},
+		{
+			name:        "mixed success and failure",
+			description: "When success/ works and failure/ fails, only failure/* are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionCreated, Path: "success/file1.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "success/nested/file2.json", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "failure/file3.txt", Ref: "new-ref"},
+				{Action: repository.FileActionCreated, Path: "failure/nested/file4.txt", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Success path works
+				progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "new-ref").
+					Return("resource-1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/file1.json" && r.Error == nil
+				})).Return().Once()
+
+				progress.On("HasDirPathFailedCreation", "success/nested/file2.json").Return(false).Once()
+				repoResources.On("WriteResourceFromFile", mock.Anything, "success/nested/file2.json", "new-ref").
+					Return("resource-2", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "success/nested/file2.json" && r.Error == nil
+				})).Return().Once()
+
+				// Failure path fails
+				progress.On("HasDirPathFailedCreation", "failure/file3.txt").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+				repoResources.On("EnsureFolderPathExist", mock.Anything, "failure/").Return("", folderErr).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/file3.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+
+				// Nested file in failure path is skipped
+				progress.On("HasDirPathFailedCreation", "failure/nested/file4.txt").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "failure/nested/file4.txt" && r.Action == repository.FileActionIgnored
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "rename with failed destination folder",
+			description: "When RenameResourceFile fails with PathCreationError for destination, rename is skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{
+					Action:       repository.FileActionRenamed,
+					Path:         "newfolder/file.json",
+					PreviousPath: "oldfolder/file.json",
+					Ref:          "new-ref",
+					PreviousRef:  "old-ref",
+				},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Rename fails with PathCreationError for destination folder
+				progress.On("HasDirPathFailedCreation", "newfolder/file.json").Return(false).Once()
+				folderErr := &resources.PathCreationError{Path: "newfolder/", Err: fmt.Errorf("permission denied")}
+				repoResources.On("RenameResourceFile", mock.Anything, "oldfolder/file.json", "old-ref", "newfolder/file.json", "new-ref").
+					Return("", "", schema.GroupVersionKind{}, folderErr).Once()
+
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "newfolder/file.json" &&
+						r.Action == repository.FileActionRenamed &&
+						r.Error != nil
+				})).Return().Once()
+			},
+		},
+		{
+			name:        "renamed file still checked, subsequent nested resources skipped",
+			description: "After rename fails for folder1/file.json, other folder1/* files are skipped",
+			previousRef: "old-ref",
+			currentRef:  "new-ref",
+			changes: []repository.VersionedFileChange{
+				{Action: repository.FileActionRenamed, Path: "folder1/file1.json", PreviousPath: "old/file1.json", Ref: "new-ref", PreviousRef: "old-ref"},
+				{Action: repository.FileActionCreated, Path: "folder1/file2.json", Ref: "new-ref"},
+			},
+			setupMocks: func(repo *repository.MockVersioned, repoResources *resources.MockRepositoryResources, progress *jobs.MockJobProgressRecorder) {
+				// Rename is NOT skipped for creation failures (it's checking the destination path)
+				progress.On("HasDirPathFailedCreation", "folder1/file1.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file1.json" &&
+						r.Action == repository.FileActionIgnored &&
+						r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+				})).Return().Once()
+
+				// Second file also skipped
+				progress.On("HasDirPathFailedCreation", "folder1/file2.json").Return(true).Once()
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+					return r.Path == "folder1/file2.json" && r.Action == repository.FileActionIgnored && r.Warning != nil
+				})).Return().Once()
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runHierarchicalErrorHandlingTest(t, tt)
+		})
+	}
+}
+
+type compositeRepoForTest struct {
+	*repository.MockVersioned
+	*repository.MockReader
+}
+
+func runHierarchicalErrorHandlingTest(t *testing.T, tt struct {
+	name          string
+	setupMocks    func(*repository.MockVersioned, *resources.MockRepositoryResources, *jobs.MockJobProgressRecorder)
+	changes       []repository.VersionedFileChange
+	previousRef   string
+	currentRef    string
+	description   string
+	expectError   bool
+	errorContains string
+}) {
+	var repo repository.Versioned
+	mockVersioned := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	// For tests that need cleanup (folder deletion), use composite repo
+	if tt.name == "file deletion fails, folder cleanup skipped" {
+		mockReader := repository.NewMockReader(t)
+		repo = &compositeRepoForTest{
+			MockVersioned: mockVersioned,
+			MockReader:    mockReader,
+		}
+	} else {
+		repo = mockVersioned
+	}
+
+	mockVersioned.On("CompareFiles", mock.Anything, tt.previousRef, tt.currentRef).Return(tt.changes, nil)
+	progress.On("SetTotal", mock.Anything, len(tt.changes)).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	tt.setupMocks(mockVersioned, repoResources, progress)
+
+	err := IncrementalSync(context.Background(), repo, tt.previousRef, tt.currentRef, repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+
+	if tt.expectError {
+		require.Error(t, err)
+		if tt.errorContains != "" {
+			require.Contains(t, err.Error(), tt.errorContains)
+		}
+	} else {
+		require.NoError(t, err)
+	}
+
+	progress.AssertExpectations(t)
+	repoResources.AssertExpectations(t)
+	// For deletion tests, verify RemoveFolder was NOT called
+	if tt.name == "file deletion fails, folder cleanup skipped" {
+		repoResources.AssertNotCalled(t, "RemoveFolder", mock.Anything, mock.Anything)
+	}
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_FailedFolderCreation tests nested resource skipping
+func TestIncrementalSync_HierarchicalErrorHandling_FailedFolderCreation(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "unsupported/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "unsupported/subfolder/file2.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "unsupported/file3.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "other/file.json", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 4).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	folderErr := &resources.PathCreationError{Path: "unsupported/", Err: fmt.Errorf("permission denied")}
+	// First check is before it fails.
+	progress.On("HasDirPathFailedCreation", "unsupported/file.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/").Return("", folderErr).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/file.txt" && r.Action == repository.FileActionIgnored && r.Error != nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "unsupported/subfolder/file2.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/subfolder/file2.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "unsupported/file3.json").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "unsupported/file3.json" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "other/file.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "other/file.json", "new-ref").
+		Return("test-resource", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "other/file.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_FailedFileDeletion tests folder cleanup prevention
+func TestIncrementalSync_HierarchicalErrorHandling_FailedFileDeletion(t *testing.T) {
+	mockVersioned := repository.NewMockVersioned(t)
+	mockReader := repository.NewMockReader(t)
+	repo := &compositeRepoForTest{MockVersioned: mockVersioned, MockReader: mockReader}
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionDeleted, Path: "dashboards/file1.json", PreviousRef: "old-ref"},
+	}
+
+	mockVersioned.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 1).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	// Deletions don't check HasDirPathFailedCreation, they go straight to removal
+	repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/file1.json", "old-ref").
+		Return("dashboard-1", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard"}, fmt.Errorf("permission denied")).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "dashboards/file1.json" && r.Action == repository.FileActionDeleted &&
+			r.Error != nil && r.Error.Error() == "removing resource from file dashboards/file1.json: permission denied"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedDeletion", "dashboards/").Return(true).Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+	repoResources.AssertNotCalled(t, "RemoveFolder", mock.Anything, mock.Anything)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_DeletionNotAffectedByCreationFailure tests deletions proceed despite creation failures
+func TestIncrementalSync_HierarchicalErrorHandling_DeletionNotAffectedByCreationFailure(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "folder1/file.json", Ref: "new-ref"},
+		{Action: repository.FileActionDeleted, Path: "folder1/old.json", PreviousRef: "old-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 2).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	// Creation fails
+	progress.On("HasDirPathFailedCreation", "folder1/file.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "folder1/file.json", "new-ref").
+		Return("", schema.GroupVersionKind{}, &resources.PathCreationError{Path: "folder1/", Err: fmt.Errorf("permission denied")}).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "folder1/file.json" && r.Error != nil
+	})).Return().Once()
+
+	// Deletion should NOT be skipped (not checking HasDirPathFailedCreation for deletions)
+	// Deletions don't check HasDirPathFailedCreation, they go straight to removal
+	repoResources.On("RemoveResourceFromFile", mock.Anything, "folder1/old.json", "old-ref").
+		Return("old-resource", "", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "folder1/old.json" && r.Action == repository.FileActionDeleted && r.Error == nil
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_MultiLevelNesting tests multi-level cascade
+func TestIncrementalSync_HierarchicalErrorHandling_MultiLevelNesting(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "level1/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "level1/level2/file.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "level1/level2/level3/file.txt", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 3).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	folderErr := &resources.PathCreationError{Path: "level1/", Err: fmt.Errorf("permission denied")}
+	// First check is before it fails.
+	progress.On("HasDirPathFailedCreation", "level1/file.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "level1/").Return("", folderErr).Once()
+
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/file.txt" && r.Action == repository.FileActionIgnored && r.Error != nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "level1/level2/file.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/level2/file.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "level1/level2/level3/file.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "level1/level2/level3/file.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_MixedSuccessAndFailure tests partial failures
+func TestIncrementalSync_HierarchicalErrorHandling_MixedSuccessAndFailure(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionCreated, Path: "success/file1.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "success/nested/file2.json", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "failure/file3.txt", Ref: "new-ref"},
+		{Action: repository.FileActionCreated, Path: "failure/nested/file4.txt", Ref: "new-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 4).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	progress.On("HasDirPathFailedCreation", "success/file1.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "success/file1.json", "new-ref").
+		Return("resource-1", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "success/file1.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "success/nested/file2.json").Return(false).Once()
+	repoResources.On("WriteResourceFromFile", mock.Anything, "success/nested/file2.json", "new-ref").
+		Return("resource-2", schema.GroupVersionKind{Kind: "Dashboard"}, nil).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "success/nested/file2.json" && r.Action == repository.FileActionCreated && r.Error == nil
+	})).Return().Once()
+
+	folderErr := &resources.PathCreationError{Path: "failure/", Err: fmt.Errorf("disk full")}
+	progress.On("HasDirPathFailedCreation", "failure/file3.txt").Return(false).Once()
+	repoResources.On("EnsureFolderPathExist", mock.Anything, "failure/").Return("", folderErr).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "failure/file3.txt" && r.Action == repository.FileActionIgnored
+	})).Return().Once()
+
+	progress.On("HasDirPathFailedCreation", "failure/nested/file4.txt").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "failure/nested/file4.txt" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+	repoResources.AssertExpectations(t)
+}
+
+// TestIncrementalSync_HierarchicalErrorHandling_RenameWithFailedFolderCreation tests rename operations affected by folder failures
+func TestIncrementalSync_HierarchicalErrorHandling_RenameWithFailedFolderCreation(t *testing.T) {
+	repo := repository.NewMockVersioned(t)
+	repoResources := resources.NewMockRepositoryResources(t)
+	progress := jobs.NewMockJobProgressRecorder(t)
+
+	changes := []repository.VersionedFileChange{
+		{Action: repository.FileActionRenamed, Path: "newfolder/file.json", PreviousPath: "oldfolder/file.json", Ref: "new-ref", PreviousRef: "old-ref"},
+	}
+
+	repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
+	progress.On("SetTotal", mock.Anything, 1).Return()
+	progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+	progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+	progress.On("TooManyErrors").Return(nil).Maybe()
+
+	progress.On("HasDirPathFailedCreation", "newfolder/file.json").Return(true).Once()
+	progress.On("Record", mock.Anything, mock.MatchedBy(func(r jobs.JobResourceResult) bool {
+		return r.Path == "newfolder/file.json" && r.Action == repository.FileActionIgnored &&
+			r.Warning != nil && r.Warning.Error() == "resource was not processed because the parent folder could not be created"
+	})).Return().Once()
+
+	err := IncrementalSync(context.Background(), repo, "old-ref", "new-ref", repoResources, progress, tracing.NewNoopTracerService(), jobs.RegisterJobMetrics(prometheus.NewPedanticRegistry()))
+	require.NoError(t, err)
+	progress.AssertExpectations(t)
+}

pkg/registry/apis/provisioning/jobs/sync/incremental_test.go

@@ -92,6 +92,10 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation checks
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
+				progress.On("HasDirPathFailedCreation", "alerts/alert.yaml").Return(false)
+
 				// Mock successful resource writes
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "new-ref").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -127,6 +131,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "unsupported/path/file.txt").Return(false)
+
 				// Mock folder creation
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/path/").
 					Return("test-folder", nil)
@@ -161,6 +168,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", ".unsupported/path/file.txt").Return(false)
+
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
 					Action: repository.FileActionIgnored,
 					Path:   ".unsupported/path/file.txt",
@@ -222,6 +232,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/new.json").Return(false)
+
 				// Mock resource rename
 				repoResources.On("RenameResourceFile", mock.Anything, "dashboards/old.json", "old-ref", "dashboards/new.json", "new-ref").
 					Return("renamed-dashboard", "", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
@@ -254,6 +267,10 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/ignored.json").Return(false)
+
 				progress.On("Record", mock.Anything, jobs.JobResourceResult{
 					Action: repository.FileActionIgnored,
 					Path:   "dashboards/ignored.json",
@@ -277,16 +294,28 @@ func TestIncrementalSync(t *testing.T) {
 				repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
+				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
+
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "unsupported/path/file.txt").Return(false)
 
 				// Mock folder creation error
 				repoResources.On("EnsureFolderPathExist", mock.Anything, "unsupported/path/").
 					Return("", fmt.Errorf("failed to create folder"))
 
+				// Mock progress recording with error
+				progress.On("Record", mock.Anything, mock.MatchedBy(func(result jobs.JobResourceResult) bool {
+					return result.Action == repository.FileActionIgnored &&
+						result.Path == "unsupported/path/file.txt" &&
+						result.Error != nil &&
+						result.Error.Error() == "failed to create folder"
+				})).Return()
+
 				progress.On("TooManyErrors").Return(nil)
 			},
 			previousRef:   "old-ref",
 			currentRef:    "new-ref",
-			expectedError: "unable to create empty file folder: failed to create folder",
+			expectedCalls: 1,
 		},
 		{
 			name: "error writing resource",
@@ -303,6 +332,9 @@ func TestIncrementalSync(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 
+				// Mock HasDirPathFailedCreation check
+				progress.On("HasDirPathFailedCreation", "dashboards/test.json").Return(false)
+
 				// Mock resource write error
 				repoResources.On("WriteResourceFromFile", mock.Anything, "dashboards/test.json", "new-ref").
 					Return("test-dashboard", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, fmt.Errorf("write failed"))
@@ -372,7 +404,8 @@ func TestIncrementalSync(t *testing.T) {
 				repo.On("CompareFiles", mock.Anything, "old-ref", "new-ref").Return(changes, nil)
 				progress.On("SetTotal", mock.Anything, 1).Return()
 				progress.On("SetMessage", mock.Anything, "replicating versioned changes").Return()
-				// Mock too many errors
+
+				// Mock too many errors - this is checked before processing files, so HasDirPathFailedCreation won't be called
 				progress.On("TooManyErrors").Return(fmt.Errorf("too many errors occurred"))
 			},
 			previousRef:   "old-ref",
@@ -428,6 +461,9 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/old.json", "old-ref").
 					Return("old-dashboard", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
 
+				// Mock HasDirPathFailedDeletion check for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+
 				// if the folder is not found in git, there should be a call to remove the folder from grafana
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
@@ -453,6 +489,10 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				progress.On("SetMessage", mock.Anything, "versioned changes replicated").Return()
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "dashboards/old.json", "old-ref").
 					Return("old-dashboard", "folder-uid", schema.GroupVersionKind{Kind: "Dashboard", Group: "dashboards"}, nil)
+
+				// Mock HasDirPathFailedDeletion check for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+
 				// if the folder still exists in git, there should not be a call to delete it from grafana
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return(&repository.FileInfo{}, nil)
@@ -485,6 +525,13 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 				repoResources.On("RemoveResourceFromFile", mock.Anything, "alerts/old-alert.yaml", "old-ref").
 					Return("old-alert", "folder-uid-2", schema.GroupVersionKind{Kind: "Alert", Group: "alerts"}, nil)
 
+				progress.On("Record", mock.Anything, mock.Anything).Return()
+				progress.On("TooManyErrors").Return(nil)
+
+				// Mock HasDirPathFailedDeletion checks for cleanup
+				progress.On("HasDirPathFailedDeletion", "dashboards/").Return(false)
+				progress.On("HasDirPathFailedDeletion", "alerts/").Return(false)
+
 				// both not found in git, both should be deleted
 				repo.MockReader.On("Read", mock.Anything, "dashboards/", "").
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
@@ -492,9 +539,6 @@ func TestIncrementalSync_CleanupOrphanedFolders(t *testing.T) {
 					Return((*repository.FileInfo)(nil), repository.ErrFileNotFound)
 				repoResources.On("RemoveFolder", mock.Anything, "folder-uid-1").Return(nil)
 				repoResources.On("RemoveFolder", mock.Anything, "folder-uid-2").Return(nil)
-
-				progress.On("Record", mock.Anything, mock.Anything).Return()
-				progress.On("TooManyErrors").Return(nil)
 			},
 		},
 	}

pkg/registry/apis/provisioning/register.go

@@ -559,6 +559,22 @@ func (b *APIBuilder) InstallSchema(scheme *runtime.Scheme) error {
 		return err
 	}
 
+	// Register custom field label conversion for Repository to enable field selectors like spec.connection.name
+	err = scheme.AddFieldLabelConversionFunc(
+		provisioning.SchemeGroupVersion.WithKind("Repository"),
+		func(label, value string) (string, string, error) {
+			switch label {
+			case "metadata.name", "metadata.namespace", "spec.connection.name":
+				return label, value, nil
+			default:
+				return "", "", fmt.Errorf("field label not supported for Repository: %s", label)
+			}
+		},
+	)
+	if err != nil {
+		return err
+	}
+
 	metav1.AddToGroupVersion(scheme, provisioning.SchemeGroupVersion)
 	// Only 1 version (for now?)
 	return scheme.SetVersionPriority(provisioning.SchemeGroupVersion)
@@ -569,10 +585,19 @@ func (b *APIBuilder) AllowedV0Alpha1Resources() []string {
 }
 
 func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupInfo, opts builder.APIGroupOptions) error {
-	repositoryStorage, err := grafanaregistry.NewRegistryStore(opts.Scheme, provisioning.RepositoryResourceInfo, opts.OptsGetter)
+	// Create repository storage with custom field selectors (e.g., spec.connection.name)
+	repositoryStorage, err := grafanaregistry.NewRegistryStoreWithSelectableFields(
+		opts.Scheme,
+		provisioning.RepositoryResourceInfo,
+		opts.OptsGetter,
+		grafanaregistry.SelectableFieldsOptions{
+			GetAttrs: RepositoryGetAttrs,
+		},
+	)
 	if err != nil {
 		return fmt.Errorf("failed to create repository storage: %w", err)
 	}
+
 	repositoryStatusStorage := grafanaregistry.NewRegistryStatusStore(opts.Scheme, repositoryStorage)
 	b.store = repositoryStorage
 

pkg/registry/apis/provisioning/repository_fields.go

@@ -0,0 +1,44 @@
+package provisioning
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/registry/generic"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+// RepositoryToSelectableFields returns a field set that can be used for field selectors.
+// This includes standard metadata fields plus custom fields like spec.connection.name.
+func RepositoryToSelectableFields(obj *provisioning.Repository) fields.Set {
+	objectMetaFields := generic.ObjectMetaFieldsSet(&obj.ObjectMeta, true)
+
+	// Add custom selectable fields
+	specificFields := fields.Set{
+		"spec.connection.name": getConnectionName(obj),
+	}
+
+	return generic.MergeFieldsSets(objectMetaFields, specificFields)
+}
+
+// getConnectionName safely extracts the connection name from a Repository.
+// Returns empty string if no connection is configured.
+func getConnectionName(obj *provisioning.Repository) string {
+	if obj == nil || obj.Spec.Connection == nil {
+		return ""
+	}
+	return obj.Spec.Connection.Name
+}
+
+// RepositoryGetAttrs returns labels and fields of a Repository object.
+// This is used by the storage layer for filtering.
+func RepositoryGetAttrs(obj runtime.Object) (labels.Set, fields.Set, error) {
+	repo, ok := obj.(*provisioning.Repository)
+	if !ok {
+		return nil, nil, fmt.Errorf("given object is not a Repository")
+	}
+	return labels.Set(repo.Labels), RepositoryToSelectableFields(repo), nil
+}

pkg/registry/apis/provisioning/repository_fields_test.go

@@ -0,0 +1,184 @@
+package provisioning
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+)
+
+func TestGetConnectionName(t *testing.T) {
+	tests := []struct {
+		name     string
+		repo     *provisioning.Repository
+		expected string
+	}{
+		{
+			name:     "nil repository returns empty string",
+			repo:     nil,
+			expected: "",
+		},
+		{
+			name: "repository without connection returns empty string",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+				},
+			},
+			expected: "",
+		},
+		{
+			name: "repository with connection returns connection name",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "my-connection",
+					},
+				},
+			},
+			expected: "my-connection",
+		},
+		{
+			name: "repository with empty connection name returns empty string",
+			repo: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Title: "test-repo",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "",
+					},
+				},
+			},
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getConnectionName(tt.repo)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestRepositoryToSelectableFields(t *testing.T) {
+	tests := []struct {
+		name           string
+		repo           *provisioning.Repository
+		expectedFields map[string]string
+	}{
+		{
+			name: "includes metadata.name and metadata.namespace",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-repo",
+					Namespace: "default",
+				},
+				Spec: provisioning.RepositorySpec{
+					Title: "Test Repository",
+				},
+			},
+			expectedFields: map[string]string{
+				"metadata.name":        "test-repo",
+				"metadata.namespace":   "default",
+				"spec.connection.name": "",
+			},
+		},
+		{
+			name: "includes spec.connection.name when set",
+			repo: &provisioning.Repository{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "repo-with-connection",
+					Namespace: "org-1",
+				},
+				Spec: provisioning.RepositorySpec{
+					Title: "Repo With Connection",
+					Connection: &provisioning.ConnectionInfo{
+						Name: "github-connection",
+					},
+				},
+			},
+			expectedFields: map[string]string{
+				"metadata.name":        "repo-with-connection",
+				"metadata.namespace":   "org-1",
+				"spec.connection.name": "github-connection",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fields := RepositoryToSelectableFields(tt.repo)
+
+			for key, expectedValue := range tt.expectedFields {
+				actualValue, exists := fields[key]
+				assert.True(t, exists, "field %s should exist", key)
+				assert.Equal(t, expectedValue, actualValue, "field %s should have correct value", key)
+			}
+		})
+	}
+}
+
+func TestRepositoryGetAttrs(t *testing.T) {
+	t.Run("returns error for non-Repository object", func(t *testing.T) {
+		// Pass a different runtime.Object type instead of a Repository
+		connection := &provisioning.Connection{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "not-a-repository",
+			},
+		}
+		_, _, err := RepositoryGetAttrs(connection)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not a Repository")
+	})
+
+	t.Run("returns labels and fields for valid Repository", func(t *testing.T) {
+		repo := &provisioning.Repository{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-repo",
+				Namespace: "default",
+				Labels: map[string]string{
+					"app": "grafana",
+					"env": "test",
+				},
+			},
+			Spec: provisioning.RepositorySpec{
+				Title: "Test Repository",
+				Connection: &provisioning.ConnectionInfo{
+					Name: "my-connection",
+				},
+			},
+		}
+
+		labels, fields, err := RepositoryGetAttrs(repo)
+		require.NoError(t, err)
+
+		// Check labels
+		assert.Equal(t, "grafana", labels["app"])
+		assert.Equal(t, "test", labels["env"])
+
+		// Check fields
+		assert.Equal(t, "test-repo", fields["metadata.name"])
+		assert.Equal(t, "default", fields["metadata.namespace"])
+		assert.Equal(t, "my-connection", fields["spec.connection.name"])
+	})
+
+	t.Run("returns empty connection name when not set", func(t *testing.T) {
+		repo := &provisioning.Repository{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-repo",
+				Namespace: "default",
+			},
+			Spec: provisioning.RepositorySpec{
+				Title: "Test Repository",
+			},
+		}
+
+		_, fields, err := RepositoryGetAttrs(repo)
+		require.NoError(t, err)
+		assert.Equal(t, "", fields["spec.connection.name"])
+	})
+}

pkg/registry/apis/provisioning/resources/folders.go

@@ -20,6 +20,21 @@ import (
 
 const MaxNumberOfFolders = 10000
 
+// PathCreationError represents an error that occurred while creating a folder path.
+// It contains the path that failed and the underlying error.
+type PathCreationError struct {
+	Path string
+	Err  error
+}
+
+func (e *PathCreationError) Unwrap() error {
+	return e.Err
+}
+
+func (e *PathCreationError) Error() string {
+	return fmt.Sprintf("failed to create path %s: %v", e.Path, e.Err)
+}
+
 type FolderManager struct {
 	repo   repository.ReaderWriter
 	tree   FolderTree
@@ -73,7 +88,11 @@ func (fm *FolderManager) EnsureFolderPathExist(ctx context.Context, filePath str
 		}
 
 		if err := fm.EnsureFolderExists(ctx, f, parent); err != nil {
-			return fmt.Errorf("ensure folder exists: %w", err)
+			// Wrap in PathCreationError to indicate which path failed
+			return &PathCreationError{
+				Path: f.Path,
+				Err:  fmt.Errorf("ensure folder exists: %w", err),
+			}
 		}
 
 		fm.tree.Add(f, parent)

pkg/registry/apis/provisioning/resources/folders_test.go

@@ -0,0 +1,68 @@
+package resources_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/grafana/grafana/pkg/registry/apis/provisioning/resources"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPathCreationError(t *testing.T) {
+	t.Run("Error method returns formatted message", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		expectedMsg := "failed to create path grafana/folder-1: underlying error"
+		require.Equal(t, expectedMsg, pathErr.Error())
+	})
+
+	t.Run("Unwrap returns underlying error", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		unwrapped := pathErr.Unwrap()
+		require.Equal(t, underlyingErr, unwrapped)
+		require.EqualError(t, unwrapped, "underlying error")
+	})
+
+	t.Run("errors.Is finds underlying error", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		require.True(t, errors.Is(pathErr, underlyingErr))
+		require.False(t, errors.Is(pathErr, fmt.Errorf("different error")))
+	})
+
+	t.Run("errors.As extracts PathCreationError", func(t *testing.T) {
+		underlyingErr := fmt.Errorf("underlying error")
+		pathErr := &resources.PathCreationError{
+			Path: "grafana/folder-1",
+			Err:  underlyingErr,
+		}
+
+		var extractedErr *resources.PathCreationError
+		require.True(t, errors.As(pathErr, &extractedErr))
+		require.NotNil(t, extractedErr)
+		require.Equal(t, "grafana/folder-1", extractedErr.Path)
+		require.Equal(t, underlyingErr, extractedErr.Err)
+	})
+
+	t.Run("errors.As returns false for non-PathCreationError", func(t *testing.T) {
+		regularErr := fmt.Errorf("regular error")
+
+		var extractedErr *resources.PathCreationError
+		require.False(t, errors.As(regularErr, &extractedErr))
+		require.Nil(t, extractedErr)
+	})
+}

pkg/server/module_server.go

@@ -205,6 +205,14 @@ func (s *ModuleServer) Run() error {
 		return sql.ProvideUnifiedStorageGrpcService(s.cfg, s.features, nil, s.log, s.registerer, docBuilders, s.storageMetrics, s.indexMetrics, s.searchServerRing, s.MemberlistKVConfig, s.httpServerRouter, s.storageBackend)
 	})
 
+	m.RegisterModule(modules.SearchServer, func() (services.Service, error) {
+		docBuilders, err := InitializeDocumentBuilders(s.cfg)
+		if err != nil {
+			return nil, err
+		}
+		return sql.ProvideUnifiedSearchGrpcService(s.cfg, s.features, nil, s.log, s.registerer, docBuilders, s.indexMetrics, s.searchServerRing, s.MemberlistKVConfig, s.storageBackend)
+	})
+
 	m.RegisterModule(modules.ZanzanaServer, func() (services.Service, error) {
 		return authz.ProvideZanzanaService(s.cfg, s.features, s.registerer)
 	})

pkg/server/search_server_distributor_test.go

@@ -372,7 +372,7 @@ func initModuleServerForTest(
 	return testModuleServer{server: ms, grpcAddress: cfg.GRPCServer.Address, httpPort: cfg.HTTPPort, healthClient: healthClient, id: cfg.InstanceID}
 }
 
-func createBaselineServer(t *testing.T, dbType, dbConnStr string, testNamespaces []string) resource.ResourceServer {
+func createBaselineServer(t *testing.T, dbType, dbConnStr string, testNamespaces []string) resource.SearchServer {
 	cfg := setting.NewCfg()
 	section, err := cfg.Raw.NewSection("database")
 	require.NoError(t, err)
@@ -391,17 +391,20 @@ func createBaselineServer(t *testing.T, dbType, dbConnStr string, testNamespaces
 	require.NoError(t, err)
 	searchOpts, err := search.NewSearchOptions(features, cfg, docBuilders, nil, nil)
 	require.NoError(t, err)
-	server, err := sql.NewResourceServer(sql.ServerOptions{
-		DB:             nil,
-		Cfg:            cfg,
-		Tracer:         tracer,
-		Reg:            nil,
-		AccessClient:   nil,
-		SearchOptions:  searchOpts,
-		StorageMetrics: nil,
-		IndexMetrics:   nil,
-		Features:       features,
-		QOSQueue:       nil,
+	searchServer, err := sql.NewSearchServer(sql.SearchServerOptions{
+		DB:            nil,
+		Cfg:           cfg,
+		Tracer:        tracer,
+		Reg:           nil,
+		AccessClient:  nil,
+		SearchOptions: searchOpts,
+		IndexMetrics:  nil,
+	})
+	require.NoError(t, err)
+	storageServer, err := sql.NewStorageServer(sql.StorageServerOptions{
+		Cfg:      cfg,
+		Tracer:   tracer,
+		Features: features,
 	})
 	require.NoError(t, err)
 
@@ -417,12 +420,12 @@ func createBaselineServer(t *testing.T, dbType, dbConnStr string, testNamespaces
 
 	for _, ns := range testNamespaces {
 		for range rand.Intn(maxPlaylistPerNamespace) + 1 {
-			_, err = server.Create(ctx, generatePlaylistPayload(ns))
+			_, err = storageServer.Create(ctx, generatePlaylistPayload(ns))
 			require.NoError(t, err)
 		}
 	}
 
-	return server
+	return searchServer
 }
 
 var counter int

pkg/server/wire_gen.go

@@ -513,6 +513,11 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	if err != nil {
 		return nil, err
 	}
+	storageMetrics := resource.ProvideStorageMetrics(registerer)
+	storageBackend, err := sql.ProvideStorageBackend(cfg, sqlStore, tracer, registerer, storageMetrics)
+	if err != nil {
+		return nil, err
+	}
 	options := &unified.Options{
 		Cfg:          cfg,
 		Features:     featureToggles,
@@ -522,8 +527,8 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 		Authzc:       accessClient,
 		Docs:         documentBuilderSupplier,
 		SecureValues: inlineSecureValueSupport,
+		Backend:      storageBackend,
 	}
-	storageMetrics := resource.ProvideStorageMetrics(registerer)
 	bleveIndexMetrics := resource.ProvideIndexMetrics(registerer)
 	resourceClient, err := unified.ProvideUnifiedStorageClient(options, storageMetrics, bleveIndexMetrics)
 	if err != nil {
@@ -1173,6 +1178,11 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	if err != nil {
 		return nil, err
 	}
+	storageMetrics := resource.ProvideStorageMetrics(registerer)
+	storageBackend, err := sql.ProvideStorageBackend(cfg, sqlStore, tracer, registerer, storageMetrics)
+	if err != nil {
+		return nil, err
+	}
 	options := &unified.Options{
 		Cfg:          cfg,
 		Features:     featureToggles,
@@ -1182,8 +1192,8 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 		Authzc:       accessClient,
 		Docs:         documentBuilderSupplier,
 		SecureValues: inlineSecureValueSupport,
+		Backend:      storageBackend,
 	}
-	storageMetrics := resource.ProvideStorageMetrics(registerer)
 	bleveIndexMetrics := resource.ProvideIndexMetrics(registerer)
 	resourceClient, err := unified.ProvideUnifiedStorageClient(options, storageMetrics, bleveIndexMetrics)
 	if err != nil {
@@ -1748,7 +1758,14 @@ func InitializeModuleServer(cfg *setting.Cfg, opts Options, apiOpts api.ServerOp
 	hooksService := hooks.ProvideService()
 	ossLicensingService := licensing.ProvideService(cfg, hooksService)
 	moduleRegisterer := ProvideNoopModuleRegisterer()
-	storageBackend, err := sql.ProvideStorageBackend(cfg)
+	ossMigrations := migrations.ProvideOSSMigrations(featureToggles)
+	inProcBus := bus.ProvideBus(tracingService)
+	sqlStore, err := sqlstore.ProvideService(cfg, featureToggles, ossMigrations, inProcBus, tracingService)
+	if err != nil {
+		return nil, err
+	}
+	tracer := otelTracer()
+	storageBackend, err := sql.ProvideStorageBackend(cfg, sqlStore, tracer, registerer, storageMetrics)
 	if err != nil {
 		return nil, err
 	}

pkg/server/wireexts_oss.go

@@ -6,6 +6,9 @@ package server
 
 import (
 	"github.com/google/wire"
+	"github.com/grafana/grafana/pkg/bus"
+	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
 
 	"github.com/grafana/grafana/pkg/configprovider"
 	"github.com/grafana/grafana/pkg/infra/metrics"
@@ -65,6 +68,7 @@ import (
 	"github.com/grafana/grafana/pkg/storage/legacysql"
 	"github.com/grafana/grafana/pkg/storage/unified"
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
+	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 	search2 "github.com/grafana/grafana/pkg/storage/unified/search"
 	"github.com/grafana/grafana/pkg/storage/unified/search/builders"
 	"github.com/grafana/grafana/pkg/storage/unified/sql"
@@ -145,8 +149,10 @@ var wireExtsBasicSet = wire.NewSet(
 	sandbox.ProvideService,
 	wire.Bind(new(sandbox.Sandbox), new(*sandbox.Service)),
 	wire.Struct(new(unified.Options), "*"),
-	unified.ProvideUnifiedStorageClient,
 	sql.ProvideStorageBackend,
+	unified.ProvideUnifiedStorageClient,
+	wire.Bind(new(resourcepb.ResourceIndexClient), new(resource.ResourceClient)),
+	wire.Bind(new(resource.MigratorClient), new(resource.ResourceClient)),
 	builder.ProvideDefaultBuildHandlerChainFuncFromBuilders,
 	aggregatorrunner.ProvideNoopAggregatorConfigurator,
 	apisregistry.WireSetExts,
@@ -195,6 +201,16 @@ var wireExtsModuleServerSet = wire.NewSet(
 	tracing.ProvideTracingConfig,
 	tracing.ProvideService,
 	wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)),
+	otelTracer,
+	// Bus
+	bus.ProvideBus,
+	wire.Bind(new(bus.Bus), new(*bus.InProcBus)),
+	// Database migrations
+	migrations.ProvideOSSMigrations,
+	wire.Bind(new(registry.DatabaseMigrator), new(*migrations.OSSMigrations)),
+	// Database
+	sqlstore.ProvideService,
+	wire.Bind(new(db.DB), new(*sqlstore.SQLStore)),
 	// Unified storage
 	resource.ProvideStorageMetrics,
 	resource.ProvideIndexMetrics,

pkg/services/featuremgmt/openfeature.go

@@ -20,7 +20,7 @@ const (
 // OpenFeatureConfig holds configuration for initializing OpenFeature
 type OpenFeatureConfig struct {
 	// ProviderType is either "static", "features-service", or "ofrep"
-	ProviderType setting.OpenFeatureProviderType
+	ProviderType string
 	// URL is the remote provider's URL (required for features-service + OFREP providers)
 	URL *url.URL
 	// HTTPClient is a pre-configured HTTP client (optional, used by features-service + OFREP providers)
@@ -98,7 +98,7 @@ func InitOpenFeatureWithCfg(cfg *setting.Cfg) error {
 }
 
 func createProvider(
-	providerType setting.OpenFeatureProviderType,
+	providerType string,
 	u *url.URL,
 	staticFlags map[string]bool,
 	httpClient *http.Client,

pkg/services/featuremgmt/registry.go

@@ -1087,13 +1087,6 @@ var (
 			Stage:       FeatureStageExperimental,
 			Owner:       identityAccessTeam,
 		},
-		{
-			Name:         "unifiedStorageSearch",
-			Description:  "Enable unified storage search",
-			Stage:        FeatureStageExperimental,
-			Owner:        grafanaSearchAndStorageSquad,
-			HideFromDocs: true,
-		},
 		{
 			Name:         "unifiedStorageSearchSprinkles",
 			Description:  "Enable sprinkles on unified storage search",
@@ -1585,8 +1578,8 @@ var (
 		},
 		{
 			Name:         "kubernetesAuthzApis",
-			Description:  "Registers AuthZ /apis endpoint",
-			Stage:        FeatureStageExperimental,
+			Description:  "Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead",
+			Stage:        FeatureStageDeprecated,
 			Owner:        identityAccessTeam,
 			HideFromDocs: true,
 		},
@@ -1611,6 +1604,27 @@ var (
 			Owner:        identityAccessTeam,
 			HideFromDocs: true,
 		},
+		{
+			Name:         "kubernetesAuthzCoreRolesApi",
+			Description:  "Registers AuthZ Core Roles /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
+		{
+			Name:         "kubernetesAuthzRolesApi",
+			Description:  "Registers AuthZ Roles /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
+		{
+			Name:         "kubernetesAuthzRoleBindingsApi",
+			Description:  "Registers AuthZ Role Bindings /apis endpoint",
+			Stage:        FeatureStageExperimental,
+			Owner:        identityAccessTeam,
+			HideFromDocs: true,
+		},
 		{
 			Name:         "kubernetesAuthnMutation",
 			Description:  "Enables create, delete, and update mutations for resources owned by IAM identity",
@@ -1859,14 +1873,6 @@ var (
 			Expression:      "false",
 			RequiresRestart: true,
 		},
-		{
-			Name:            "tempoSearchBackendMigration",
-			Description:     "Run search queries through the tempo backend",
-			Stage:           FeatureStageGeneralAvailability,
-			Owner:           grafanaOSSBigTent,
-			Expression:      "false",
-			RequiresRestart: true,
-		},
 		{
 			Name:         "cdnPluginsLoadFirst",
 			Description:  "Prioritize loading plugins from the CDN before other sources",

pkg/services/featuremgmt/toggles_gen.csv

@@ -150,7 +150,6 @@ alertingQueryAndExpressionsStepMode,GA,@grafana/alerting-squad,false,false,true
 improvedExternalSessionHandling,GA,@grafana/identity-access-team,false,false,false
 useSessionStorageForRedirection,GA,@grafana/identity-access-team,false,false,false
 rolePickerDrawer,experimental,@grafana/identity-access-team,false,false,false
-unifiedStorageSearch,experimental,@grafana/search-and-storage,false,false,false
 unifiedStorageSearchSprinkles,experimental,@grafana/search-and-storage,false,false,false
 managedDualWriter,experimental,@grafana/search-and-storage,false,false,false
 pluginsSriChecks,GA,@grafana/plugins-platform-backend,false,false,false
@@ -217,10 +216,13 @@ pluginsAutoUpdate,experimental,@grafana/plugins-platform-backend,false,false,fal
 alertingListViewV2PreviewToggle,privatePreview,@grafana/alerting-squad,false,false,true
 alertRuleUseFiredAtForStartsAt,experimental,@grafana/alerting-squad,false,false,false
 alertingBulkActionsInUI,GA,@grafana/alerting-squad,false,false,true
-kubernetesAuthzApis,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzApis,deprecated,@grafana/identity-access-team,false,false,false
 kubernetesAuthZHandlerRedirect,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthzResourcePermissionApis,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthzZanzanaSync,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzCoreRolesApi,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzRolesApi,experimental,@grafana/identity-access-team,false,false,false
+kubernetesAuthzRoleBindingsApi,experimental,@grafana/identity-access-team,false,false,false
 kubernetesAuthnMutation,experimental,@grafana/identity-access-team,false,false,false
 kubernetesExternalGroupMapping,experimental,@grafana/identity-access-team,false,false,false
 restoreDashboards,experimental,@grafana/grafana-search-navigate-organise,false,false,false
@@ -253,7 +255,6 @@ graphiteBackendMode,privatePreview,@grafana/partner-datasources,false,false,fals
 azureResourcePickerUpdates,GA,@grafana/partner-datasources,false,false,true
 prometheusTypeMigration,experimental,@grafana/partner-datasources,false,true,false
 pluginContainers,privatePreview,@grafana/plugins-platform-backend,false,true,false
-tempoSearchBackendMigration,GA,@grafana/oss-big-tent,false,true,false
 cdnPluginsLoadFirst,experimental,@grafana/plugins-platform-backend,false,false,false
 cdnPluginsUrls,experimental,@grafana/plugins-platform-backend,false,false,false
 pluginInstallAPISync,experimental,@grafana/plugins-platform-backend,false,false,false

pkg/services/featuremgmt/toggles_gen.go

@@ -455,10 +455,6 @@ const (
 	// Enables the new role picker drawer design
 	FlagRolePickerDrawer = "rolePickerDrawer"
 
-	// FlagUnifiedStorageSearch
-	// Enable unified storage search
-	FlagUnifiedStorageSearch = "unifiedStorageSearch"
-
 	// FlagUnifiedStorageSearchSprinkles
 	// Enable sprinkles on unified storage search
 	FlagUnifiedStorageSearchSprinkles = "unifiedStorageSearchSprinkles"
@@ -631,7 +627,7 @@ const (
 	FlagAlertRuleUseFiredAtForStartsAt = "alertRuleUseFiredAtForStartsAt"
 
 	// FlagKubernetesAuthzApis
-	// Registers AuthZ /apis endpoint
+	// Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead
 	FlagKubernetesAuthzApis = "kubernetesAuthzApis"
 
 	// FlagKubernetesAuthZHandlerRedirect
@@ -646,6 +642,18 @@ const (
 	// Enable sync of Zanzana authorization store on AuthZ CRD mutations
 	FlagKubernetesAuthzZanzanaSync = "kubernetesAuthzZanzanaSync"
 
+	// FlagKubernetesAuthzCoreRolesApi
+	// Registers AuthZ Core Roles /apis endpoint
+	FlagKubernetesAuthzCoreRolesApi = "kubernetesAuthzCoreRolesApi"
+
+	// FlagKubernetesAuthzRolesApi
+	// Registers AuthZ Roles /apis endpoint
+	FlagKubernetesAuthzRolesApi = "kubernetesAuthzRolesApi"
+
+	// FlagKubernetesAuthzRoleBindingsApi
+	// Registers AuthZ Role Bindings /apis endpoint
+	FlagKubernetesAuthzRoleBindingsApi = "kubernetesAuthzRoleBindingsApi"
+
 	// FlagKubernetesAuthnMutation
 	// Enables create, delete, and update mutations for resources owned by IAM identity
 	FlagKubernetesAuthnMutation = "kubernetesAuthnMutation"
@@ -730,10 +738,6 @@ const (
 	// Enables running plugins in containers
 	FlagPluginContainers = "pluginContainers"
 
-	// FlagTempoSearchBackendMigration
-	// Run search queries through the tempo backend
-	FlagTempoSearchBackendMigration = "tempoSearchBackendMigration"
-
 	// FlagCdnPluginsLoadFirst
 	// Prioritize loading plugins from the CDN before other sources
 	FlagCdnPluginsLoadFirst = "cdnPluginsLoadFirst"

pkg/services/featuremgmt/toggles_gen.json

@@ -1951,11 +1951,27 @@
     {
       "metadata": {
         "name": "kubernetesAuthzApis",
-        "resourceVersion": "1764664939750",
-        "creationTimestamp": "2025-06-18T07:43:01Z"
+        "resourceVersion": "1767954559317",
+        "creationTimestamp": "2025-06-18T07:43:01Z",
+        "annotations": {
+          "grafana.app/updatedTimestamp": "2026-01-09 10:29:19.317164 +0000 UTC"
+        }
       },
       "spec": {
-        "description": "Registers AuthZ /apis endpoint",
+        "description": "Deprecated: Use kubernetesAuthzCoreRolesApi, kubernetesAuthzRolesApi, and kubernetesAuthzRoleBindingsApi instead",
+        "stage": "deprecated",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzCoreRolesApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Core Roles /apis endpoint",
         "stage": "experimental",
         "codeowner": "@grafana/identity-access-team",
         "hideFromDocs": true
@@ -1975,6 +1991,32 @@
         "hideFromDocs": true
       }
     },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzRoleBindingsApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Role Bindings /apis endpoint",
+        "stage": "experimental",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
+    {
+      "metadata": {
+        "name": "kubernetesAuthzRolesApi",
+        "resourceVersion": "1767954459090",
+        "creationTimestamp": "2026-01-09T10:27:39Z"
+      },
+      "spec": {
+        "description": "Registers AuthZ Roles /apis endpoint",
+        "stage": "experimental",
+        "codeowner": "@grafana/identity-access-team",
+        "hideFromDocs": true
+      }
+    },
     {
       "metadata": {
         "name": "kubernetesAuthzZanzanaSync",
@@ -3655,7 +3697,8 @@
       "metadata": {
         "name": "unifiedStorageSearch",
         "resourceVersion": "1764664939750",
-        "creationTimestamp": "2024-09-30T19:46:14Z"
+        "creationTimestamp": "2024-09-30T19:46:14Z",
+        "deletionTimestamp": "2026-01-12T10:02:12Z"
       },
       "spec": {
         "description": "Enable unified storage search",

pkg/services/store/kind/dashboard/ds_lookup.go

@@ -100,6 +100,9 @@ func (d *DsLookup) ByRef(ref *DataSourceRef) *DataSourceRef {
 	if ref == nil {
 		return d.defaultDS
 	}
+	if ref.UID == "default" && ref.Type == "" {
+		return d.defaultDS
+	}
 
 	key := ""
 	if ref.UID != "" {
@@ -117,7 +120,13 @@ func (d *DsLookup) ByRef(ref *DataSourceRef) *DataSourceRef {
 		return ds
 	}
 
-	return d.byName[key]
+	ds, ok = d.byName[key]
+	if ok {
+		return ds
+	}
+
+	// With nothing was found (or configured), use the original reference
+	return ref
 }
 
 func (d *DsLookup) ByType(dsType string) []DataSourceRef {

pkg/services/store/kind/dashboard/testdata/panel-with-library-panel-field-info.json

@@ -4,8 +4,8 @@
   "tags": null,
   "datasource": [
     {
-      "uid": "default.uid",
-      "type": "default.type"
+      "uid": "000000001",
+      "type": "graphite"
     }
   ],
   "panels": [
@@ -16,8 +16,8 @@
       "libraryPanel": "dfkljg98345dkf",
       "datasource": [
         {
-          "uid": "default.uid",
-          "type": "default.type"
+          "uid": "000000001",
+          "type": "graphite"
         }
       ]
     }

pkg/services/store/kind/dashboard/types.go

@@ -1,5 +1,7 @@
 package dashboard
 
+import "iter"
+
 type PanelSummaryInfo struct {
 	ID            int64           `json:"id"`
 	Title         string          `json:"title"`
@@ -30,3 +32,20 @@ type DashboardSummaryInfo struct {
 	Refresh       string             `json:"refresh,omitempty"`
 	ReadOnly      bool               `json:"readOnly,omitempty"` // editable = false
 }
+
+func (d *DashboardSummaryInfo) PanelIterator() iter.Seq[PanelSummaryInfo] {
+	return func(yield func(PanelSummaryInfo) bool) {
+		for _, p := range d.Panels {
+			if len(p.Collapsed) > 0 {
+				for _, c := range p.Collapsed {
+					if !yield(c) { // NOTE, rows can only be one level deep!
+						return
+					}
+				}
+			}
+			if !yield(p) {
+				return
+			}
+		}
+	}
+}

pkg/setting/setting_openfeature.go

@@ -5,17 +5,15 @@ import (
 	"net/url"
 )
 
-type OpenFeatureProviderType string
-
 const (
-	StaticProviderType          OpenFeatureProviderType = "static"
-	FeaturesServiceProviderType OpenFeatureProviderType = "features-service"
-	OFREPProviderType           OpenFeatureProviderType = "ofrep"
+	StaticProviderType          = "static"
+	FeaturesServiceProviderType = "features-service"
+	OFREPProviderType           = "ofrep"
 )
 
 type OpenFeatureSettings struct {
 	APIEnabled   bool
-	ProviderType OpenFeatureProviderType
+	ProviderType string
 	URL          *url.URL
 	TargetingKey string
 	ContextAttrs map[string]string
@@ -26,27 +24,7 @@ func (cfg *Cfg) readOpenFeatureSettings() error {
 
 	config := cfg.Raw.Section("feature_toggles.openfeature")
 	cfg.OpenFeature.APIEnabled = config.Key("enable_api").MustBool(true)
-
-	providerType := config.Key("provider").Validate(func(in string) string {
-		if in == "" {
-			return string(StaticProviderType)
-		}
-
-		switch in {
-		case string(StaticProviderType):
-			return string(StaticProviderType)
-		case string(FeaturesServiceProviderType):
-			return string(FeaturesServiceProviderType)
-		case string(OFREPProviderType):
-			return string(OFREPProviderType)
-		default:
-			cfg.Logger.Warn("invalid provider type", "provider", in)
-			cfg.Logger.Info("using static provider for openfeature")
-			return string(StaticProviderType)
-		}
-	})
-
-	cfg.OpenFeature.ProviderType = OpenFeatureProviderType(providerType)
+	cfg.OpenFeature.ProviderType = config.Key("provider").MustString(StaticProviderType)
 	strURL := config.Key("url").MustString("")
 
 	defaultTargetingKey := "default"

pkg/storage/unified/README.md

@@ -236,7 +236,6 @@ kubernetesDashboards = true
 kubernetesFolders = true
 unifiedStorage = true
 unifiedStorageHistoryPruner = true
-unifiedStorageSearch = true
 unifiedStorageSearchPermissionFiltering = false
 unifiedStorageSearchSprinkles = false
 

pkg/storage/unified/apistore/restoptions.go

@@ -26,7 +26,7 @@ var _ generic.RESTOptionsGetter = (*RESTOptionsGetter)(nil)
 type StorageOptionsRegister func(gr schema.GroupResource, opts StorageOptions)
 
 type RESTOptionsGetter struct {
-	client         resource.ResourceClient
+	client         resource.StorageClient
 	secrets        secret.InlineSecureValueSupport
 	original       storagebackend.Config
 	configProvider RestConfigProvider
@@ -36,7 +36,7 @@ type RESTOptionsGetter struct {
 }
 
 func NewRESTOptionsGetterForClient(
-	client resource.ResourceClient,
+	client resource.StorageClient,
 	secrets secret.InlineSecureValueSupport,
 	original storagebackend.Config,
 	configProvider RestConfigProvider,
@@ -79,7 +79,7 @@ func NewRESTOptionsGetterMemory(originalStorageConfig storagebackend.Config, sec
 	}
 
 	return NewRESTOptionsGetterForClient(
-		resource.NewLocalResourceClient(server),
+		resource.NewLocalResourceClient(server, nil),
 		secrets,
 		originalStorageConfig,
 		nil,
@@ -118,7 +118,7 @@ func NewRESTOptionsGetterForFileXX(path string,
 	}
 
 	return NewRESTOptionsGetterForClient(
-		resource.NewLocalResourceClient(server),
+		resource.NewLocalResourceClient(server, nil),
 		nil, // secrets
 		originalStorageConfig,
 		nil,

pkg/storage/unified/apistore/store.go

@@ -88,7 +88,7 @@ type Storage struct {
 	trigger      storage.IndexerFuncs
 	indexers     *cache.Indexers
 
-	store          resource.ResourceClient
+	store          resource.StorageClient
 	getKey         func(string) (*resourcepb.ResourceKey, error)
 	snowflake      *snowflake.Node    // used to enforce internal ids
 	configProvider RestConfigProvider // used for provisioning
@@ -112,7 +112,7 @@ type RestConfigProvider interface {
 // NewStorage instantiates a new Storage.
 func NewStorage(
 	config *storagebackend.ConfigForResource,
-	store resource.ResourceClient,
+	store resource.StorageClient,
 	keyFunc func(obj runtime.Object) (string, error),
 	keyParser func(key string) (*resourcepb.ResourceKey, error),
 	newFunc func() runtime.Object,

pkg/storage/unified/apistore/watcher_test.go

@@ -156,7 +156,7 @@ func testSetup(t testing.TB, opts ...setupOption) (context.Context, storage.Inte
 	default:
 		t.Fatalf("unsupported storage type: %s", setupOpts.storageType)
 	}
-	client := resource.NewLocalResourceClient(server)
+	client := resource.NewLocalResourceClient(server, nil)
 
 	config := storagebackend.NewDefaultConfig(setupOpts.prefix, setupOpts.codec)
 	store, destroyFunc, err := apistore.NewStorage(

pkg/storage/unified/client.go

@@ -21,6 +21,7 @@ import (
 	"github.com/grafana/dskit/grpcclient"
 	"github.com/grafana/dskit/middleware"
 	"github.com/grafana/dskit/services"
+
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
 	infraDB "github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/tracing"
@@ -45,6 +46,7 @@ type Options struct {
 	Authzc       types.AccessClient
 	Docs         resource.DocumentBuilderSupplier
 	SecureValues secrets.InlineSecureValueSupport
+	Backend      resource.StorageBackend // Shared backend to avoid duplicate metrics registration
 }
 
 type clientMetrics struct {
@@ -66,7 +68,7 @@ func ProvideUnifiedStorageClient(opts *Options,
 		BlobStoreURL:            apiserverCfg.Key("blob_url").MustString(""),
 		BlobThresholdBytes:      apiserverCfg.Key("blob_threshold_bytes").MustInt(options.BlobThresholdDefault),
 		GrpcClientKeepaliveTime: apiserverCfg.Key("grpc_client_keepalive_time").MustDuration(0),
-	}, opts.Cfg, opts.Features, opts.DB, opts.Tracer, opts.Reg, opts.Authzc, opts.Docs, storageMetrics, indexMetrics, opts.SecureValues)
+	}, opts.Cfg, opts.Features, opts.DB, opts.Tracer, opts.Reg, opts.Authzc, opts.Docs, storageMetrics, indexMetrics, opts.SecureValues, opts.Backend)
 	if err == nil {
 		// Decide whether to disable SQL fallback stats per resource in Mode 5.
 		// Otherwise we would still try to query the legacy SQL database in Mode 5.
@@ -102,6 +104,7 @@ func newClient(opts options.StorageOptions,
 	storageMetrics *resource.StorageMetrics,
 	indexMetrics *resource.BleveIndexMetrics,
 	secure secrets.InlineSecureValueSupport,
+	backend resource.StorageBackend,
 ) (resource.ResourceClient, error) {
 	ctx := context.Background()
 
@@ -135,7 +138,7 @@ func newClient(opts options.StorageOptions,
 		if err != nil {
 			return nil, err
 		}
-		return resource.NewLocalResourceClient(server), nil
+		return resource.NewLocalResourceClient(server, nil), nil
 
 	case options.StorageTypeUnifiedGrpc:
 		if opts.Address == "" {
@@ -168,24 +171,14 @@ func newClient(opts options.StorageOptions,
 		return resource.NewResourceClient(conn, indexConn, cfg, features, tracer)
 
 	default:
+		// Create search options for the search server
 		searchOptions, err := search.NewSearchOptions(features, cfg, docs, indexMetrics, nil)
 		if err != nil {
 			return nil, err
 		}
 
-		serverOptions := sql.ServerOptions{
-			DB:             db,
-			Cfg:            cfg,
-			Tracer:         tracer,
-			Reg:            reg,
-			AccessClient:   authzc,
-			SearchOptions:  searchOptions,
-			StorageMetrics: storageMetrics,
-			IndexMetrics:   indexMetrics,
-			Features:       features,
-			SecureValues:   secure,
-		}
-
+		// Setup QOS queue if enabled
+		var qosQueue sql.QOSEnqueueDequeuer
 		if cfg.QOSEnabled {
 			qosReg := prometheus.WrapRegistererWithPrefix("resource_server_qos_", reg)
 			queue := scheduler.NewQueue(&scheduler.QueueOptions{
@@ -196,7 +189,7 @@ func newClient(opts options.StorageOptions,
 			if err := services.StartAndAwaitRunning(ctx, queue); err != nil {
 				return nil, fmt.Errorf("failed to start queue: %w", err)
 			}
-			scheduler, err := scheduler.NewScheduler(queue, &scheduler.Config{
+			sched, err := scheduler.NewScheduler(queue, &scheduler.Config{
 				NumWorkers: cfg.QOSNumberWorker,
 				Logger:     cfg.Logger,
 			})
@@ -204,31 +197,59 @@ func newClient(opts options.StorageOptions,
 				return nil, fmt.Errorf("failed to create scheduler: %w", err)
 			}
 
-			err = services.StartAndAwaitRunning(ctx, scheduler)
+			err = services.StartAndAwaitRunning(ctx, sched)
 			if err != nil {
 				return nil, fmt.Errorf("failed to start scheduler: %w", err)
 			}
-			serverOptions.QOSQueue = queue
+			qosQueue = queue
 		}
 
-		// only enable if an overrides file path is provided
+		// Setup overrides service if enabled
+		var overridesSvc *resource.OverridesService
 		if cfg.OverridesFilePath != "" {
-			overridesSvc, err := resource.NewOverridesService(ctx, cfg.Logger, reg, tracer, resource.ReloadOptions{
+			overridesSvc, err = resource.NewOverridesService(ctx, cfg.Logger, reg, tracer, resource.ReloadOptions{
 				FilePath:     cfg.OverridesFilePath,
 				ReloadPeriod: cfg.OverridesReloadInterval,
 			})
 			if err != nil {
 				return nil, err
 			}
-
-			serverOptions.OverridesService = overridesSvc
 		}
 
-		server, err := sql.NewResourceServer(serverOptions)
+		// Create the search server with shared backend
+		searchServer, err := sql.NewSearchServer(sql.SearchServerOptions{
+			Backend:       backend, // Use shared backend to avoid duplicate metrics registration
+			DB:            db,
+			Cfg:           cfg,
+			Tracer:        tracer,
+			Reg:           reg,
+			AccessClient:  authzc,
+			SearchOptions: searchOptions,
+			IndexMetrics:  indexMetrics,
+		})
 		if err != nil {
 			return nil, err
 		}
-		return resource.NewLocalResourceClient(server), nil
+
+		// Create the storage server with shared backend
+		storageServer, err := sql.NewStorageServer(sql.StorageServerOptions{
+			Backend:          backend, // Use shared backend to avoid duplicate metrics registration
+			DB:               db,
+			Cfg:              cfg,
+			Tracer:           tracer,
+			Reg:              reg,
+			AccessClient:     authzc,
+			StorageMetrics:   storageMetrics,
+			Features:         features,
+			QOSQueue:         qosQueue,
+			SecureValues:     secure,
+			OverridesService: overridesSvc,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return resource.NewLocalResourceClient(storageServer, searchServer), nil
 	}
 }
 

pkg/storage/unified/migrations/migrator.go

@@ -48,7 +48,7 @@ func buildCollectionSettings(opts legacy.MigrateOptions) resource.BulkSettings {
 }
 
 type resourceClientStreamProvider struct {
-	client resource.ResourceClient
+	client resource.MigratorClient
 }
 
 func (r *resourceClientStreamProvider) createStream(ctx context.Context, opts legacy.MigrateOptions) (resourcepb.BulkStore_BulkProcessClient, error) {
@@ -71,7 +71,7 @@ func (b *bulkStoreClientStreamProvider) createStream(ctx context.Context, opts l
 // This can migrate Folders, Dashboards and LibraryPanels
 func ProvideUnifiedMigrator(
 	dashboardAccess legacy.MigrationDashboardAccessor,
-	client resource.ResourceClient,
+	client resource.MigratorClient,
 ) UnifiedMigrator {
 	return newUnifiedMigrator(
 		dashboardAccess,

pkg/storage/unified/resource/client.go

@@ -31,13 +31,31 @@ import (
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
-//go:generate mockery --name ResourceClient --structname MockResourceClient --inpackage --filename client_mock.go --with-expecter
-type ResourceClient interface {
-	resourcepb.ResourceStoreClient
+// SearchClient is used to interact with unified search
+type SearchClient interface {
 	resourcepb.ResourceIndexClient
 	resourcepb.ManagedObjectIndexClient
-	resourcepb.BulkStoreClient
+}
+
+// StorageClient is used to interact with unified storage
+type StorageClient interface {
+	resourcepb.ResourceStoreClient
 	resourcepb.BlobStoreClient
+}
+
+// MigratorClient is used to perform migrations to unified storage
+type MigratorClient interface {
+	resourcepb.BulkStoreClient
+	GetStats(ctx context.Context, in *resourcepb.ResourceStatsRequest, opts ...grpc.CallOption) (*resourcepb.ResourceStatsResponse, error)
+}
+
+// ResourceClient combines all resource-related clients and should be avoided in favor of more specific interfaces when possible
+//
+//go:generate mockery --name ResourceClient --structname MockResourceClient --inpackage --filename client_mock.go --with-expecter
+type ResourceClient interface {
+	StorageClient
+	SearchClient
+	MigratorClient
 	resourcepb.DiagnosticsClient
 	resourcepb.QuotasClient
 }
@@ -92,16 +110,15 @@ func NewLegacyResourceClient(channel grpc.ClientConnInterface, indexChannel grpc
 	return newResourceClient(cc, cci)
 }
 
-func NewLocalResourceClient(server ResourceServer) ResourceClient {
+func NewLocalResourceClient(server ResourceServer, searchServer SearchServer) ResourceClient {
 	// scenario: local in-proc
 	channel := &inprocgrpc.Channel{}
+	indexChannel := &inprocgrpc.Channel{}
 	tracer := otel.Tracer("github.com/grafana/grafana/pkg/storage/unified/resource")
 
 	grpcAuthInt := grpcutils.NewUnsafeAuthenticator(tracer)
 	for _, desc := range []*grpc.ServiceDesc{
 		&resourcepb.ResourceStore_ServiceDesc,
-		&resourcepb.ResourceIndex_ServiceDesc,
-		&resourcepb.ManagedObjectIndex_ServiceDesc,
 		&resourcepb.BlobStore_ServiceDesc,
 		&resourcepb.BulkStore_ServiceDesc,
 		&resourcepb.Diagnostics_ServiceDesc,
@@ -117,13 +134,31 @@ func NewLocalResourceClient(server ResourceServer) ResourceClient {
 		)
 	}
 
+	// Register search services on the index channel if searchServer is provided
+	if searchServer != nil {
+		for _, desc := range []*grpc.ServiceDesc{
+			&resourcepb.ResourceIndex_ServiceDesc,
+			&resourcepb.ManagedObjectIndex_ServiceDesc,
+		} {
+			indexChannel.RegisterService(
+				grpchan.InterceptServer(
+					desc,
+					grpcAuth.UnaryServerInterceptor(grpcAuthInt),
+					grpcAuth.StreamServerInterceptor(grpcAuthInt),
+				),
+				searchServer,
+			)
+		}
+	}
+
 	clientInt := authnlib.NewGrpcClientInterceptor(
 		ProvideInProcExchanger(),
 		authnlib.WithClientInterceptorIDTokenExtractor(idTokenExtractor),
 	)
 
 	cc := grpchan.InterceptClientConn(channel, clientInt.UnaryClientInterceptor, clientInt.StreamClientInterceptor)
-	return newResourceClient(cc, cc)
+	cci := grpchan.InterceptClientConn(indexChannel, clientInt.UnaryClientInterceptor, clientInt.StreamClientInterceptor)
+	return newResourceClient(cc, cci)
 }
 
 type RemoteResourceClientConfig struct {

pkg/storage/unified/resource/search.go

@@ -127,7 +127,10 @@ type SearchBackend interface {
 	GetOpenIndexes() []NamespacedResource
 }
 
-// This supports indexing+search regardless of implementation
+var _ SearchServer = &searchSupport{}
+
+// This supports indexing+search regardless of implementation.
+// Implements SearchServer interface.
 type searchSupport struct {
 	log          log.Logger
 	storage      StorageBackend
@@ -160,6 +163,10 @@ var (
 	_ resourcepb.ManagedObjectIndexServer = (*searchSupport)(nil)
 )
 
+func NewSearchServer(opts SearchOptions, storage StorageBackend, access types.AccessClient, blob BlobSupport, indexMetrics *BleveIndexMetrics, ownsIndexFn func(key NamespacedResource) (bool, error)) (SearchServer, error) {
+	return newSearchSupport(opts, storage, access, blob, indexMetrics, ownsIndexFn)
+}
+
 func newSearchSupport(opts SearchOptions, storage StorageBackend, access types.AccessClient, blob BlobSupport, indexMetrics *BleveIndexMetrics, ownsIndexFn func(key NamespacedResource) (bool, error)) (support *searchSupport, err error) {
 	// No backend search support
 	if opts.Backend == nil {
@@ -598,6 +605,22 @@ func (s *searchSupport) buildIndexes(ctx context.Context) (int, error) {
 	return totalBatchesIndexed, nil
 }
 
+func (s *searchSupport) Init(ctx context.Context) error {
+	return s.init(ctx)
+}
+
+func (s *searchSupport) Stop(_ context.Context) error {
+	s.stop()
+	return nil
+}
+
+// IsHealthy implements resourcepb.DiagnosticsServer
+func (s *searchSupport) IsHealthy(ctx context.Context, req *resourcepb.HealthCheckRequest) (*resourcepb.HealthCheckResponse, error) {
+	return &resourcepb.HealthCheckResponse{
+		Status: resourcepb.HealthCheckResponse_SERVING,
+	}, nil
+}
+
 func (s *searchSupport) init(ctx context.Context) error {
 	origCtx := ctx
 
@@ -863,7 +886,7 @@ func newRebuildRequest(key NamespacedResource, minBuildTime, lastImportTime time
 
 func (s *searchSupport) getOrCreateIndex(ctx context.Context, stats *SearchStats, key NamespacedResource, reason string) (ResourceIndex, error) {
 	if s == nil || s.search == nil {
-		return nil, fmt.Errorf("search is not configured properly (missing unifiedStorageSearch feature toggle?)")
+		return nil, fmt.Errorf("search is not configured properly (missing enable_search config?)")
 	}
 
 	ctx, span := tracer.Start(ctx, "resource.searchSupport.getOrCreateIndex")

pkg/storage/unified/resource/search_server_distributor.go

@@ -60,7 +60,7 @@ func ProvideSearchDistributorServer(cfg *setting.Cfg, features featuremgmt.Featu
 }
 
 type RingClient struct {
-	Client ResourceClient
+	Client SearchClient
 	grpc_health_v1.HealthClient
 	Conn *grpc.ClientConn
 }
@@ -99,7 +99,7 @@ var (
 func (ds *distributorServer) Search(ctx context.Context, r *resourcepb.ResourceSearchRequest) (*resourcepb.ResourceSearchResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.Search")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Options.Key.Namespace, "Search")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Options.Key.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +110,7 @@ func (ds *distributorServer) Search(ctx context.Context, r *resourcepb.ResourceS
 func (ds *distributorServer) GetStats(ctx context.Context, r *resourcepb.ResourceStatsRequest) (*resourcepb.ResourceStatsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.GetStats")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "GetStats")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -215,7 +215,7 @@ func (ds *distributorServer) RebuildIndexes(ctx context.Context, r *resourcepb.R
 func (ds *distributorServer) CountManagedObjects(ctx context.Context, r *resourcepb.CountManagedObjectsRequest) (*resourcepb.CountManagedObjectsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.CountManagedObjects")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "CountManagedObjects")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -226,7 +226,7 @@ func (ds *distributorServer) CountManagedObjects(ctx context.Context, r *resourc
 func (ds *distributorServer) ListManagedObjects(ctx context.Context, r *resourcepb.ListManagedObjectsRequest) (*resourcepb.ListManagedObjectsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.ListManagedObjects")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "ListManagedObjects")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -234,7 +234,7 @@ func (ds *distributorServer) ListManagedObjects(ctx context.Context, r *resource
 	return client.ListManagedObjects(ctx, r)
 }
 
-func (ds *distributorServer) getClientToDistributeRequest(ctx context.Context, namespace string, methodName string) (context.Context, ResourceClient, error) {
+func (ds *distributorServer) getClientToDistributeRequest(ctx context.Context, namespace string) (context.Context, SearchClient, error) {
 	ringHasher := fnv.New32a()
 	_, err := ringHasher.Write([]byte(namespace))
 	if err != nil {

pkg/storage/unified/resource/server.go

@@ -34,12 +34,18 @@ import (
 
 var tracer = otel.Tracer("github.com/grafana/grafana/pkg/storage/unified/resource")
 
+type SearchServer interface {
+	LifecycleHooks
+
+	resourcepb.ResourceIndexServer
+	resourcepb.ManagedObjectIndexServer
+	resourcepb.DiagnosticsServer
+}
+
 // ResourceServer implements all gRPC services
 type ResourceServer interface {
 	resourcepb.ResourceStoreServer
 	resourcepb.BulkStoreServer
-	resourcepb.ResourceIndexServer
-	resourcepb.ManagedObjectIndexServer
 	resourcepb.BlobStoreServer
 	resourcepb.DiagnosticsServer
 	resourcepb.QuotasServer
@@ -221,9 +227,6 @@ type ResourceServerOptions struct {
 	// The blob configuration
 	Blob BlobConfig
 
-	// Search options
-	Search SearchOptions
-
 	// Quota service
 	OverridesService *OverridesService
 
@@ -251,16 +254,15 @@ type ResourceServerOptions struct {
 
 	storageMetrics *StorageMetrics
 
-	IndexMetrics *BleveIndexMetrics
-
 	// MaxPageSizeBytes is the maximum size of a page in bytes.
 	MaxPageSizeBytes int
+	// IndexMinUpdateInterval is the time to wait after a successful write operation to ensure read-after-write consistency in search.
+	// This config is shared with search
+	IndexMinUpdateInterval time.Duration
 
 	// QOSQueue is the quality of service queue used to enqueue
 	QOSQueue  QOSEnqueuer
 	QOSConfig QueueConfig
-
-	OwnsIndexFn func(key NamespacedResource) (bool, error)
 }
 
 func NewResourceServer(opts ResourceServerOptions) (*server, error) {
@@ -343,23 +345,24 @@ func NewResourceServer(opts ResourceServerOptions) (*server, error) {
 		ctx:              ctx,
 		cancel:           cancel,
 		storageMetrics:   opts.storageMetrics,
-		indexMetrics:     opts.IndexMetrics,
 		maxPageSizeBytes: opts.MaxPageSizeBytes,
 		reg:              opts.Reg,
 		queue:            opts.QOSQueue,
 		queueConfig:      opts.QOSConfig,
 		overridesService: opts.OverridesService,
 
-		artificialSuccessfulWriteDelay: opts.Search.IndexMinUpdateInterval,
+		artificialSuccessfulWriteDelay: opts.IndexMinUpdateInterval,
 	}
 
-	if opts.Search.Resources != nil {
-		var err error
-		s.search, err = newSearchSupport(opts.Search, s.backend, s.access, s.blob, opts.IndexMetrics, opts.OwnsIndexFn)
-		if err != nil {
-			return nil, err
+	/*
+		if opts.Search.Resources != nil {
+			var err error
+			s.search, err = newSearchSupport(opts.Search, s.backend, s.access, s.blob, opts.IndexMetrics, opts.OwnsIndexFn)
+			if err != nil {
+				return nil, err
+			}
 		}
-	}
+	*/
 
 	err := s.Init(ctx)
 	if err != nil {
@@ -377,7 +380,6 @@ type server struct {
 	backend          StorageBackend
 	blob             BlobSupport
 	secure           secrets.InlineSecureValueSupport
-	search           *searchSupport
 	diagnostics      resourcepb.DiagnosticsServer
 	access           claims.AccessClient
 	writeHooks       WriteAccessHooks
@@ -424,11 +426,6 @@ func (s *server) Init(ctx context.Context) error {
 			s.initErr = s.overridesService.init(ctx)
 		}
 
-		// initialize the search index
-		if s.initErr == nil && s.search != nil {
-			s.initErr = s.search.init(ctx)
-		}
-
 		// Start watching for changes
 		if s.initErr == nil {
 			s.initErr = s.initWatcher()
@@ -453,10 +450,6 @@ func (s *server) Stop(ctx context.Context) error {
 		}
 	}
 
-	if s.search != nil {
-		s.search.stop()
-	}
-
 	if s.overridesService != nil {
 		if err := s.overridesService.stop(ctx); err != nil {
 			stopFailed = true
@@ -1372,47 +1365,6 @@ func (s *server) Watch(req *resourcepb.WatchRequest, srv resourcepb.ResourceStor
 	}
 }
 
-func (s *server) Search(ctx context.Context, req *resourcepb.ResourceSearchRequest) (*resourcepb.ResourceSearchResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.Search(ctx, req)
-}
-
-// GetStats implements ResourceServer.
-func (s *server) GetStats(ctx context.Context, req *resourcepb.ResourceStatsRequest) (*resourcepb.ResourceStatsResponse, error) {
-	if err := s.Init(ctx); err != nil {
-		return nil, err
-	}
-
-	if s.search == nil {
-		// If the backend implements "GetStats", we can use it
-		srv, ok := s.backend.(resourcepb.ResourceIndexServer)
-		if ok {
-			return srv.GetStats(ctx, req)
-		}
-		return nil, fmt.Errorf("search index not configured")
-	}
-	return s.search.GetStats(ctx, req)
-}
-
-func (s *server) ListManagedObjects(ctx context.Context, req *resourcepb.ListManagedObjectsRequest) (*resourcepb.ListManagedObjectsResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.ListManagedObjects(ctx, req)
-}
-
-func (s *server) CountManagedObjects(ctx context.Context, req *resourcepb.CountManagedObjectsRequest) (*resourcepb.CountManagedObjectsResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.CountManagedObjects(ctx, req)
-}
-
 // IsHealthy implements ResourceServer.
 func (s *server) IsHealthy(ctx context.Context, req *resourcepb.HealthCheckRequest) (*resourcepb.HealthCheckResponse, error) {
 	return s.diagnostics.IsHealthy(ctx, req)
@@ -1568,14 +1520,6 @@ func (s *server) runInQueue(ctx context.Context, tenantID string, runnable func(
 	}
 }
 
-func (s *server) RebuildIndexes(ctx context.Context, req *resourcepb.RebuildIndexesRequest) (*resourcepb.RebuildIndexesResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.RebuildIndexes(ctx, req)
-}
-
 func (s *server) checkQuota(ctx context.Context, nsr NamespacedResource) {
 	span := trace.SpanFromContext(ctx)
 	span.AddEvent("checkQuota", trace.WithAttributes(

pkg/storage/unified/search/bleve.go

@@ -1253,21 +1253,23 @@ func (b *bleveIndex) toBleveSearchRequest(ctx context.Context, req *resourcepb.R
 		queryExact.SetField(resource.SEARCH_FIELD_TITLE)
 		queryExact.Analyzer = keyword.Name                // don't analyze the query input - treat it as a single token
 		queryExact.Operator = query.MatchQueryOperatorAnd // This doesn't make a difference for keyword analyzer, we add it just to be explicit.
+		searchQuery := bleve.NewDisjunctionQuery(queryExact)
 
 		// Query 2: Phrase query with standard analyzer
 		queryPhrase := bleve.NewMatchPhraseQuery(req.Query)
 		queryPhrase.SetBoost(5.0)
 		queryPhrase.SetField(resource.SEARCH_FIELD_TITLE)
 		queryPhrase.Analyzer = standard.Name
+		searchQuery.AddQuery(queryPhrase)
 
 		// Query 3: Match query with standard analyzer
 		queryAnalyzed := bleve.NewMatchQuery(removeSmallTerms(req.Query))
 		queryAnalyzed.SetField(resource.SEARCH_FIELD_TITLE)
+		queryAnalyzed.SetBoost(2.0)
 		queryAnalyzed.Analyzer = standard.Name
 		queryAnalyzed.Operator = query.MatchQueryOperatorAnd // Make sure all terms from the query are matched
+		searchQuery.AddQuery(queryAnalyzed)
 
-		// At least one of the queries must match
-		searchQuery := bleve.NewDisjunctionQuery(queryExact, queryAnalyzed, queryPhrase)
 		queries = append(queries, searchQuery)
 	}
 

pkg/storage/unified/search/bleve_test.go

@@ -23,7 +23,6 @@ import (
 	"go.uber.org/goleak"
 
 	authlib "github.com/grafana/authlib/types"
-
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/storage/unified/search/builders/dashboard.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -18,6 +19,7 @@ import (
 const DASHBOARD_SCHEMA_VERSION = "schema_version"
 const DASHBOARD_LINK_COUNT = "link_count"
 const DASHBOARD_PANEL_TYPES = "panel_types"
+const DASHBOARD_PANEL_TITLE = "panel_title"
 const DASHBOARD_DS_TYPES = "ds_types"
 const DASHBOARD_TRANSFORMATIONS = "transformation"
 const DASHBOARD_LIBRARY_PANEL_REFERENCE = "reference.LibraryPanel"
@@ -53,11 +55,21 @@ func DashboardBuilder(namespaced resource.NamespacedDocumentSupplier) (resource.
 			Type:        resourcepb.ResourceTableColumnDefinition_INT32,
 			Description: "How many links appear on the page",
 		},
+		{
+			Name:        DASHBOARD_PANEL_TITLE,
+			Type:        resourcepb.ResourceTableColumnDefinition_STRING,
+			IsArray:     true,
+			Description: "The panel title text",
+			Properties: &resourcepb.ResourceTableColumnDefinition_Properties{
+				Filterable: false, // full text
+				FreeText:   true,
+			},
+		},
 		{
 			Name:        DASHBOARD_PANEL_TYPES,
 			Type:        resourcepb.ResourceTableColumnDefinition_STRING,
 			IsArray:     true,
-			Description: "How many links appear on the page",
+			Description: "The panel types used in this dashboard",
 			Properties: &resourcepb.ResourceTableColumnDefinition_Properties{
 				Filterable: true,
 			},
@@ -269,14 +281,22 @@ func (s *DashboardDocumentBuilder) BuildDocument(ctx context.Context, key *resou
 	doc.Description = summary.Description
 	doc.Tags = summary.Tags
 
+	panelTitles := []string{}
 	panelTypes := []string{}
 	transformations := []string{}
 	dsTypes := []string{}
 
-	for _, p := range summary.Panels {
-		if p.Type != "" {
+	for p := range summary.PanelIterator() {
+		switch p.Type {
+		case "": // ignore
+		case "row": // row should map to a layout type when we support v2 constructs
+		default:
 			panelTypes = append(panelTypes, p.Type)
 		}
+
+		if len(p.Title) > 0 {
+			panelTitles = append(panelTitles, p.Title)
+		}
 		if len(p.Transformer) > 0 {
 			transformations = append(transformations, p.Transformer...)
 		}
@@ -309,17 +329,20 @@ func (s *DashboardDocumentBuilder) BuildDocument(ctx context.Context, key *resou
 		resource.SEARCH_FIELD_LEGACY_ID: summary.ID,
 	}
 
+	if len(panelTitles) > 0 {
+		doc.Fields[DASHBOARD_PANEL_TITLE] = panelTitles
+	}
 	if len(panelTypes) > 0 {
 		sort.Strings(panelTypes)
-		doc.Fields[DASHBOARD_PANEL_TYPES] = panelTypes
+		doc.Fields[DASHBOARD_PANEL_TYPES] = slices.Compact(panelTypes) // distinct values
 	}
 	if len(dsTypes) > 0 {
 		sort.Strings(dsTypes)
-		doc.Fields[DASHBOARD_DS_TYPES] = dsTypes
+		doc.Fields[DASHBOARD_DS_TYPES] = slices.Compact(dsTypes) // distinct values
 	}
 	if len(transformations) > 0 {
 		sort.Strings(transformations)
-		doc.Fields[DASHBOARD_TRANSFORMATIONS] = transformations
+		doc.Fields[DASHBOARD_TRANSFORMATIONS] = slices.Compact(transformations) // distinct values
 	}
 
 	for k, v := range s.Stats[summary.UID] {

pkg/storage/unified/search/builders/testdata/doc/dashboard-aaa-out.json

@@ -32,10 +32,16 @@
     "errors_last_7_days": 1,
     "grafana.app/deprecatedInternalID": 141,
     "link_count": 0,
+    "panel_title": [
+      "green pie",
+      "red pie",
+      "blue pie",
+      "collapsed row"
+    ],
     "panel_types": [
       "barchart",
       "graph",
-      "row"
+      "pie"
     ],
     "schema_version": 38
   },
@@ -46,6 +52,12 @@
       "kind": "DataSource",
       "name": "DSUID"
     },
+    {
+      "relation": "depends-on",
+      "group": "dashboards.grafana.app",
+      "kind": "LibraryPanel",
+      "name": "l3d2s634-fdgf-75u4-3fg3-67j966ii7jur"
+    },
     {
       "relation": "depends-on",
       "group": "dashboards.grafana.app",

pkg/storage/unified/search/builders/testdata/doc/dashboard-aaa.json

@@ -67,7 +67,7 @@
           "name": "red pie",
           "uid": "e1d5f519-dabd-47c6-9ad7-83d181ce1cee"
         },
-        "title": "green pie"
+        "title": "red pie"
       },
       {
         "id": 7,
@@ -78,6 +78,14 @@
         "id": 8,
         "type": "graph"
       },
+      {
+        "id": 20,
+        "type": "graph"
+      },
+      {
+        "id": 30,
+        "type": "graph"
+      },
       {
         "collapsed": true,
         "gridPos": {
@@ -101,6 +109,10 @@
               "uid": "l3d2s634-fdgf-75u4-3fg3-67j966ii7jur"
             },
             "title": "blue pie"
+          },
+          {
+            "id": 40,
+            "type": "pie"
           }
         ],
         "title": "collapsed row",

pkg/storage/unified/search/options.go

@@ -19,7 +19,7 @@ func NewSearchOptions(
 	ownsIndexFn func(key resource.NamespacedResource) (bool, error),
 ) (resource.SearchOptions, error) {
 	//nolint:staticcheck // not yet migrated to OpenFeature
-	if cfg.EnableSearch || features.IsEnabledGlobally(featuremgmt.FlagUnifiedStorageSearch) || features.IsEnabledGlobally(featuremgmt.FlagProvisioning) {
+	if cfg.EnableSearch || features.IsEnabledGlobally(featuremgmt.FlagProvisioning) {
 		root := cfg.IndexPath
 		if root == "" {
 			root = filepath.Join(cfg.DataPath, "unified-search", "bleve")

pkg/storage/unified/search/testdata/manual-dashboard.json

@@ -71,11 +71,18 @@
       "description": "How many links appear on the page",
       "priority": 0
     },
+    {
+      "name": "panel_title",
+      "type": "string",
+      "format": "",
+      "description": "The panel title text",
+      "priority": 0
+    },
     {
       "name": "panel_types",
       "type": "string",
       "format": "",
-      "description": "How many links appear on the page",
+      "description": "The panel types used in this dashboard",
       "priority": 0
     },
     {
@@ -214,6 +221,7 @@
         null,
         null,
         null,
+        null,
         null
       ],
       "object": {
@@ -239,6 +247,7 @@
         "repo",
         null,
         null,
+        null,
         [
           "timeseries"
         ],
@@ -282,6 +291,7 @@
         "repo",
         null,
         null,
+        null,
         [
           "timeseries",
           "table"

pkg/storage/unified/sql/backend.go

@@ -11,6 +11,9 @@ import (
 	"time"
 
 	"github.com/go-sql-driver/mysql"
+	infraDB "github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
+	"github.com/grafana/grafana/pkg/storage/unified/sql/db/dbimpl"
 	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/lib/pq"
 	"github.com/prometheus/client_golang/prometheus"
@@ -44,10 +47,63 @@ const defaultPrunerHistoryLimit = 20
 
 func ProvideStorageBackend(
 	cfg *setting.Cfg,
+	db infraDB.DB,
+	tracer trace.Tracer,
+	reg prometheus.Registerer,
+	storageMetrics *resource.StorageMetrics,
 ) (resource.StorageBackend, error) {
-	// TODO: make this the central place to provide SQL backend
-	// Currently it is skipped as we need to handle the cases of Diagnostics and Lifecycle
-	return nil, nil
+	// Create the resource DB
+	eDB, err := dbimpl.ProvideResourceDB(db, cfg, tracer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create resource DB: %w", err)
+	}
+
+	// Check if HA is enabled
+	isHA := isHighAvailabilityEnabled(
+		cfg.SectionWithEnvOverrides("database"),
+		cfg.SectionWithEnvOverrides("resource_api"),
+	)
+
+	// Create the backend
+	backend, err := NewBackend(BackendOptions{
+		DBProvider:           eDB,
+		Reg:                  reg,
+		IsHA:                 isHA,
+		storageMetrics:       storageMetrics,
+		LastImportTimeMaxAge: cfg.MaxFileIndexAge,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create backend: %w", err)
+	}
+
+	// Initialize the backend
+	if err := backend.Init(context.Background()); err != nil {
+		return nil, fmt.Errorf("failed to initialize backend: %w", err)
+	}
+
+	return backend, nil
+}
+
+// isHighAvailabilityEnabled determines if high availability mode should
+// be enabled based on database configuration. High availability is enabled
+// by default except for SQLite databases.
+func isHighAvailabilityEnabled(dbCfg, resourceAPICfg *setting.DynamicSection) bool {
+	// If the resource API is using a non-SQLite database, we assume it's in HA mode.
+	resourceDBType := resourceAPICfg.Key("db_type").String()
+	if resourceDBType != "" && resourceDBType != migrator.SQLite {
+		return true
+	}
+
+	// Check in the config if HA is enabled - by default we always assume a HA setup.
+	isHA := dbCfg.Key("high_availability").MustBool(true)
+
+	// SQLite is not possible to run in HA, so we force it to false.
+	databaseType := dbCfg.Key("type").String()
+	if databaseType == migrator.SQLite {
+		isHA = false
+	}
+
+	return isHA
 }
 
 type Backend interface {

pkg/storage/unified/sql/search_service.go

@@ -0,0 +1,322 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"hash/fnv"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/grafana/grafana/pkg/storage/unified/search"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+	"google.golang.org/grpc/health/grpc_health_v1"
+
+	"github.com/grafana/dskit/kv"
+	"github.com/grafana/dskit/ring"
+	"github.com/grafana/dskit/services"
+
+	infraDB "github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/modules"
+	"github.com/grafana/grafana/pkg/services/authz"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/grpcserver"
+	"github.com/grafana/grafana/pkg/services/grpcserver/interceptors"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/storage/unified/resource"
+	"github.com/grafana/grafana/pkg/storage/unified/resource/grpc"
+	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
+)
+
+var _ UnifiedStorageGrpcService = (*searchService)(nil)
+
+// operation used by the search-servers to check if they own the namespace
+var (
+	searchOwnerRead = ring.NewOp([]ring.InstanceState{ring.JOINING, ring.ACTIVE, ring.LEAVING}, nil)
+)
+
+type searchService struct {
+	*services.BasicService
+
+	backend          resource.StorageBackend
+	cfg              *setting.Cfg
+	features         featuremgmt.FeatureToggles
+	db               infraDB.DB
+	stopCh           chan struct{}
+	stoppedCh        chan error
+	handler          grpcserver.Provider
+	tracing          trace.Tracer
+	authenticator    func(ctx context.Context) (context.Context, error)
+	httpServerRouter *mux.Router
+
+	log          log.Logger
+	reg          prometheus.Registerer
+	docBuilders  resource.DocumentBuilderSupplier
+	indexMetrics *resource.BleveIndexMetrics
+	searchRing   *ring.Ring
+
+	// Ring lifecycle and sharding support
+	ringLifecycler *ring.BasicLifecycler
+
+	// Subservices manager
+	subservices        *services.Manager
+	subservicesWatcher *services.FailureWatcher
+	hasSubservices     bool
+}
+
+func ProvideUnifiedSearchGrpcService(
+	cfg *setting.Cfg,
+	features featuremgmt.FeatureToggles,
+	db infraDB.DB,
+	log log.Logger,
+	reg prometheus.Registerer,
+	docBuilders resource.DocumentBuilderSupplier,
+	indexMetrics *resource.BleveIndexMetrics,
+	searchRing *ring.Ring,
+	memberlistKVConfig kv.Config,
+	backend resource.StorageBackend,
+	httpServerRouter *mux.Router,
+) (UnifiedStorageGrpcService, error) {
+	var err error
+	tracer := otel.Tracer("unified-search-server")
+
+	authn := NewAuthenticatorWithFallback(cfg, reg, tracer, func(ctx context.Context) (context.Context, error) {
+		auth := grpc.Authenticator{Tracer: tracer}
+		return auth.Authenticate(ctx)
+	})
+
+	s := &searchService{
+		backend:            backend,
+		cfg:                cfg,
+		features:           features,
+		stopCh:             make(chan struct{}),
+		stoppedCh:          make(chan error, 1),
+		authenticator:      authn,
+		tracing:            tracer,
+		db:                 db,
+		log:                log,
+		reg:                reg,
+		docBuilders:        docBuilders,
+		indexMetrics:       indexMetrics,
+		searchRing:         searchRing,
+		httpServerRouter:   httpServerRouter,
+		subservicesWatcher: services.NewFailureWatcher(),
+	}
+
+	subservices := []services.Service{}
+	if cfg.EnableSharding {
+		ringStore, err := kv.NewClient(
+			memberlistKVConfig,
+			ring.GetCodec(),
+			kv.RegistererWithKVName(reg, resource.RingName),
+			log,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create KV store client: %s", err)
+		}
+
+		lifecyclerCfg, err := toLifecyclerConfig(cfg, log)
+		if err != nil {
+			return nil, fmt.Errorf("failed to initialize search-ring lifecycler config: %s", err)
+		}
+
+		// Define lifecycler delegates in reverse order (last to be called defined first because they're
+		// chained via "next delegate").
+		delegate := ring.BasicLifecyclerDelegate(ring.NewInstanceRegisterDelegate(ring.JOINING, resource.RingNumTokens))
+		delegate = ring.NewLeaveOnStoppingDelegate(delegate, log)
+		delegate = ring.NewAutoForgetDelegate(resource.RingHeartbeatTimeout*2, delegate, log)
+
+		s.ringLifecycler, err = ring.NewBasicLifecycler(
+			lifecyclerCfg,
+			resource.RingName,
+			resource.RingKey,
+			ringStore,
+			delegate,
+			log,
+			reg,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to initialize search-ring lifecycler: %s", err)
+		}
+
+		s.ringLifecycler.SetKeepInstanceInTheRingOnShutdown(true)
+		subservices = append(subservices, s.ringLifecycler)
+	}
+
+	if len(subservices) > 0 {
+		s.hasSubservices = true
+		s.subservices, err = services.NewManager(subservices...)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create subservices manager: %w", err)
+		}
+	}
+
+	// This will be used when running as a dskit service
+	s.BasicService = services.NewBasicService(s.starting, s.running, s.stopping).WithName(modules.SearchServer)
+
+	// Register HTTP endpoints if router is provided
+	s.RegisterHTTPEndpoints(httpServerRouter)
+
+	return s, nil
+}
+
+func (s *searchService) PrepareDownscale(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodPost:
+		s.log.Info("Preparing for downscale. Will not keep instance in ring on shutdown.")
+		s.ringLifecycler.SetKeepInstanceInTheRingOnShutdown(false)
+	case http.MethodDelete:
+		s.log.Info("Downscale canceled. Will keep instance in ring on shutdown.")
+		s.ringLifecycler.SetKeepInstanceInTheRingOnShutdown(true)
+	case http.MethodGet:
+		// used for delayed downscale use case, which we don't support. Leaving here for completion sake
+		s.log.Info("Received GET request for prepare-downscale. Behavior not implemented.")
+	default:
+	}
+}
+
+func (s *searchService) OwnsIndex(key resource.NamespacedResource) (bool, error) {
+	if s.searchRing == nil {
+		return true, nil
+	}
+
+	if st := s.searchRing.State(); st != services.Running {
+		return false, fmt.Errorf("ring is not Running: %s", st)
+	}
+
+	ringHasher := fnv.New32a()
+	_, err := ringHasher.Write([]byte(key.Namespace))
+	if err != nil {
+		return false, fmt.Errorf("error hashing namespace: %w", err)
+	}
+
+	rs, err := s.searchRing.GetWithOptions(ringHasher.Sum32(), searchOwnerRead, ring.WithReplicationFactor(s.searchRing.ReplicationFactor()))
+	if err != nil {
+		return false, fmt.Errorf("error getting replicaset from ring: %w", err)
+	}
+
+	return rs.Includes(s.ringLifecycler.GetInstanceAddr()), nil
+}
+
+func (s *searchService) starting(ctx context.Context) error {
+	if s.hasSubservices {
+		s.subservicesWatcher.WatchManager(s.subservices)
+		if err := services.StartManagerAndAwaitHealthy(ctx, s.subservices); err != nil {
+			return fmt.Errorf("failed to start subservices: %w", err)
+		}
+	}
+
+	authzClient, err := authz.ProvideStandaloneAuthZClient(s.cfg, s.features, s.tracing, s.reg)
+	if err != nil {
+		return err
+	}
+
+	// Create search options for the search server
+	searchOptions, err := search.NewSearchOptions(s.features, s.cfg, s.docBuilders, s.indexMetrics, s.OwnsIndex)
+	if err != nil {
+		return err
+	}
+
+	// Create the search server
+	searchServer, err := NewSearchServer(SearchServerOptions{
+		Backend:       s.backend,
+		DB:            s.db,
+		Cfg:           s.cfg,
+		Tracer:        s.tracing,
+		Reg:           s.reg,
+		AccessClient:  authzClient,
+		SearchOptions: searchOptions,
+		IndexMetrics:  s.indexMetrics,
+		OwnsIndexFn:   s.OwnsIndex,
+	})
+	if err != nil {
+		return err
+	}
+
+	s.handler, err = grpcserver.ProvideService(s.cfg, s.features, interceptors.AuthenticatorFunc(s.authenticator), s.tracing, prometheus.DefaultRegisterer)
+	if err != nil {
+		return err
+	}
+
+	healthService, err := resource.ProvideHealthService(searchServer)
+	if err != nil {
+		return err
+	}
+
+	srv := s.handler.GetServer()
+	// Register search services
+	resourcepb.RegisterResourceIndexServer(srv, searchServer)
+	resourcepb.RegisterManagedObjectIndexServer(srv, searchServer)
+	resourcepb.RegisterDiagnosticsServer(srv, searchServer)
+	grpc_health_v1.RegisterHealthServer(srv, healthService)
+
+	// register reflection service
+	_, err = grpcserver.ProvideReflectionService(s.cfg, s.handler)
+	if err != nil {
+		return err
+	}
+
+	if s.cfg.EnableSharding {
+		s.log.Info("waiting until search server is JOINING in the ring")
+		lfcCtx, cancel := context.WithTimeout(context.Background(), s.cfg.ResourceServerJoinRingTimeout)
+		defer cancel()
+		if err := ring.WaitInstanceState(lfcCtx, s.searchRing, s.ringLifecycler.GetInstanceID(), ring.JOINING); err != nil {
+			return fmt.Errorf("error switching to JOINING in the ring: %s", err)
+		}
+		s.log.Info("search server is JOINING in the ring")
+
+		if err := s.ringLifecycler.ChangeState(ctx, ring.ACTIVE); err != nil {
+			return fmt.Errorf("error switching to ACTIVE in the ring: %s", err)
+		}
+		s.log.Info("search server is ACTIVE in the ring")
+	}
+
+	// start the gRPC server
+	go func() {
+		err := s.handler.Run(ctx)
+		if err != nil {
+			s.stoppedCh <- err
+		} else {
+			s.stoppedCh <- nil
+		}
+	}()
+	return nil
+}
+
+// GetAddress returns the address of the gRPC server.
+func (s *searchService) GetAddress() string {
+	return s.handler.GetAddress()
+}
+
+func (s *searchService) running(ctx context.Context) error {
+	select {
+	case err := <-s.stoppedCh:
+		if err != nil && !errors.Is(err, context.Canceled) {
+			return err
+		}
+	case err := <-s.subservicesWatcher.Chan():
+		return fmt.Errorf("subservice failure: %w", err)
+	case <-ctx.Done():
+		close(s.stopCh)
+	}
+	return nil
+}
+
+func (s *searchService) stopping(_ error) error {
+	if s.hasSubservices {
+		err := services.StopManagerAndAwaitStopped(context.Background(), s.subservices)
+		if err != nil {
+			return fmt.Errorf("failed to stop subservices: %w", err)
+		}
+	}
+	return nil
+}
+
+func (s *searchService) RegisterHTTPEndpoints(httpServerRouter *mux.Router) {
+	if httpServerRouter != nil && s.cfg.EnableSharding {
+		httpServerRouter.Path("/prepare-downscale").Methods("GET", "POST", "DELETE").Handler(http.HandlerFunc(s.PrepareDownscale))
+	}
+}

pkg/storage/unified/sql/server.go

@@ -16,7 +16,6 @@ import (
 	secrets "github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
 	inlinesecurevalue "github.com/grafana/grafana/pkg/registry/apis/secret/inline"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
-	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
 	"github.com/grafana/grafana/pkg/storage/unified/sql/db/dbimpl"
@@ -30,8 +29,21 @@ type QOSEnqueueDequeuer interface {
 	Dequeue(ctx context.Context) (func(), error)
 }
 
-// ServerOptions contains the options for creating a new ResourceServer
-type ServerOptions struct {
+// SearchServerOptions contains the options for creating a new SearchServer
+type SearchServerOptions struct {
+	Backend       resource.StorageBackend
+	DB            infraDB.DB
+	Cfg           *setting.Cfg
+	Tracer        trace.Tracer
+	Reg           prometheus.Registerer
+	AccessClient  types.AccessClient
+	SearchOptions resource.SearchOptions
+	IndexMetrics  *resource.BleveIndexMetrics
+	OwnsIndexFn   func(key resource.NamespacedResource) (bool, error)
+}
+
+// StorageServerOptions contains the options for creating a storage-only server (without search)
+type StorageServerOptions struct {
 	Backend          resource.StorageBackend
 	OverridesService *resource.OverridesService
 	DB               infraDB.DB
@@ -39,16 +51,66 @@ type ServerOptions struct {
 	Tracer           trace.Tracer
 	Reg              prometheus.Registerer
 	AccessClient     types.AccessClient
-	SearchOptions    resource.SearchOptions
 	StorageMetrics   *resource.StorageMetrics
-	IndexMetrics     *resource.BleveIndexMetrics
 	Features         featuremgmt.FeatureToggles
 	QOSQueue         QOSEnqueueDequeuer
 	SecureValues     secrets.InlineSecureValueSupport
-	OwnsIndexFn      func(key resource.NamespacedResource) (bool, error)
 }
 
-func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
+// NewSearchServer creates a new SearchServer with the given options.
+// This can be used to create a standalone search server or to create a search server
+// that will be passed to NewResourceServer.
+//
+// Important: When running in monolith mode, the backend should be provided by the caller
+// to avoid duplicate metrics registration. Only in standalone microservice mode should
+// this function create its own backend.
+func NewSearchServer(opts SearchServerOptions) (resource.SearchServer, error) {
+	backend := opts.Backend
+	if backend == nil {
+		eDB, err := dbimpl.ProvideResourceDB(opts.DB, opts.Cfg, opts.Tracer)
+		if err != nil {
+			return nil, err
+		}
+
+		isHA := isHighAvailabilityEnabled(opts.Cfg.SectionWithEnvOverrides("database"),
+			opts.Cfg.SectionWithEnvOverrides("resource_api"))
+
+		b, err := NewBackend(BackendOptions{
+			DBProvider:           eDB,
+			Reg:                  opts.Reg,
+			IsHA:                 isHA,
+			LastImportTimeMaxAge: opts.SearchOptions.MaxIndexAge,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		// Initialize the backend before creating search server
+		if err := b.Init(context.Background()); err != nil {
+			return nil, fmt.Errorf("failed to initialize backend: %w", err)
+		}
+		backend = b
+	}
+
+	search, err := resource.NewSearchServer(opts.SearchOptions, backend, opts.AccessClient, nil, opts.IndexMetrics, opts.OwnsIndexFn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create search server: %w", err)
+	}
+
+	if err := search.Init(context.Background()); err != nil {
+		return nil, fmt.Errorf("failed to initialize search server: %w", err)
+	}
+
+	return search, nil
+}
+
+// NewStorageServer creates a storage-only server without search capabilities.
+// Use this when you want to run storage and search as separate services.
+//
+// Important: When running in monolith mode, the backend should be provided by the caller
+// to avoid duplicate metrics registration. Only in standalone microservice mode should
+// this function create its own backend.
+func NewStorageServer(opts StorageServerOptions) (resource.ResourceServer, error) {
 	apiserverCfg := opts.Cfg.SectionWithEnvOverrides("grafana-apiserver")
 
 	if opts.SecureValues == nil && opts.Cfg != nil && opts.Cfg.SecretsManagement.GrpcClientEnable {
@@ -92,7 +154,6 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 
 	if opts.Backend != nil {
 		serverOptions.Backend = opts.Backend
-		// TODO: we should probably have a proper interface for diagnostics/lifecycle
 	} else {
 		eDB, err := dbimpl.ProvideResourceDB(opts.DB, opts.Cfg, opts.Tracer)
 		if err != nil {
@@ -130,7 +191,6 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 				return nil, fmt.Errorf("failed to create resource version manager: %w", err)
 			}
 
-			// TODO add config to decide whether to pass RvManager or not
 			kvBackendOpts.RvManager = rvManager
 			kvBackend, err := resource.NewKVStorageBackend(kvBackendOpts)
 			if err != nil {
@@ -148,7 +208,7 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 				Reg:                  opts.Reg,
 				IsHA:                 isHA,
 				storageMetrics:       opts.StorageMetrics,
-				LastImportTimeMaxAge: opts.SearchOptions.MaxIndexAge, // No need to keep last_import_times older than max index age.
+				LastImportTimeMaxAge: opts.Cfg.MaxFileIndexAge,
 			})
 			if err != nil {
 				return nil, err
@@ -159,33 +219,15 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 		}
 	}
 
-	serverOptions.Search = opts.SearchOptions
-	serverOptions.IndexMetrics = opts.IndexMetrics
+	// Initialize the backend before creating server
+	if serverOptions.Lifecycle != nil {
+		if err := serverOptions.Lifecycle.Init(context.Background()); err != nil {
+			return nil, fmt.Errorf("failed to initialize backend: %w", err)
+		}
+	}
+
 	serverOptions.QOSQueue = opts.QOSQueue
-	serverOptions.OwnsIndexFn = opts.OwnsIndexFn
 	serverOptions.OverridesService = opts.OverridesService
 
 	return resource.NewResourceServer(serverOptions)
 }
-
-// isHighAvailabilityEnabled determines if high availability mode should
-// be enabled based on database configuration. High availability is enabled
-// by default except for SQLite databases.
-func isHighAvailabilityEnabled(dbCfg, resourceAPICfg *setting.DynamicSection) bool {
-	// If the resource API is using a non-SQLite database, we assume it's in HA mode.
-	resourceDBType := resourceAPICfg.Key("db_type").String()
-	if resourceDBType != "" && resourceDBType != migrator.SQLite {
-		return true
-	}
-
-	// Check in the config if HA is enabled - by default we always assume a HA setup.
-	isHA := dbCfg.Key("high_availability").MustBool(true)
-
-	// SQLite is not possible to run in HA, so we force it to false.
-	databaseType := dbCfg.Key("type").String()
-	if databaseType == migrator.SQLite {
-		isHA = false
-	}
-
-	return isHA
-}

pkg/storage/unified/sql/service.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/gorilla/mux"
+	"github.com/grafana/grafana/pkg/storage/unified/search"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	"go.opentelemetry.io/otel"
@@ -36,7 +37,7 @@ import (
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
 	"github.com/grafana/grafana/pkg/storage/unified/resource/grpc"
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
-	"github.com/grafana/grafana/pkg/storage/unified/search"
+	"github.com/grafana/grafana/pkg/storage/unified/sql/db/dbimpl"
 	"github.com/grafana/grafana/pkg/util/scheduler"
 )
 
@@ -54,38 +55,40 @@ type UnifiedStorageGrpcService interface {
 type service struct {
 	*services.BasicService
 
-	// Subservices manager
-	subservices        *services.Manager
-	subservicesWatcher *services.FailureWatcher
-	hasSubservices     bool
-
-	backend   resource.StorageBackend
-	cfg       *setting.Cfg
-	features  featuremgmt.FeatureToggles
-	db        infraDB.DB
-	stopCh    chan struct{}
-	stoppedCh chan error
-
-	handler grpcserver.Provider
-
-	tracing trace.Tracer
-
-	authenticator func(ctx context.Context) (context.Context, error)
-
+	backend        resource.StorageBackend
+	cfg            *setting.Cfg
+	features       featuremgmt.FeatureToggles
+	stopCh         chan struct{}
+	stoppedCh      chan error
+	authenticator  func(context.Context) (context.Context, error)
+	tracing        trace.Tracer
+	db             infraDB.DB
 	log            log.Logger
 	reg            prometheus.Registerer
+	docBuilders    resource.DocumentBuilderSupplier
 	storageMetrics *resource.StorageMetrics
 	indexMetrics   *resource.BleveIndexMetrics
-
-	docBuilders resource.DocumentBuilderSupplier
-
 	searchRing     *ring.Ring
+
+	// Handler for the gRPC server
+	handler grpcserver.Provider
+
+	// Ring lifecycle and sharding support
 	ringLifecycler *ring.BasicLifecycler
 
-	queue     QOSEnqueueDequeuer
+	// QoS support
+	queue     *scheduler.Queue
 	scheduler *scheduler.Scheduler
+
+	// Subservices management
+	hasSubservices     bool
+	subservices        *services.Manager
+	subservicesWatcher *services.FailureWatcher
 }
 
+// ProvideUnifiedStorageGrpcService provides a combined storage and search service running on the same gRPC server.
+// This is used when running Grafana as a monolith where both services share the same process.
+// Each service (storage and search) maintains its own lifecycle but shares the gRPC server.
 func ProvideUnifiedStorageGrpcService(
 	cfg *setting.Cfg,
 	features featuremgmt.FeatureToggles,
@@ -101,7 +104,7 @@ func ProvideUnifiedStorageGrpcService(
 	backend resource.StorageBackend,
 ) (UnifiedStorageGrpcService, error) {
 	var err error
-	tracer := otel.Tracer("unified-storage")
+	tracer := otel.Tracer("unified-storage-combined")
 
 	// FIXME: This is a temporary solution while we are migrating to the new authn interceptor
 	// grpcutils.NewGrpcAuthenticator should be used instead.
@@ -178,7 +181,7 @@ func ProvideUnifiedStorageGrpcService(
 			MaxSizePerTenant: cfg.QOSMaxSizePerTenant,
 			Registerer:       qosReg,
 		})
-		scheduler, err := scheduler.NewScheduler(queue, &scheduler.Config{
+		sched, err := scheduler.NewScheduler(queue, &scheduler.Config{
 			NumWorkers: cfg.QOSNumberWorker,
 			Logger:     log,
 		})
@@ -187,7 +190,7 @@ func ProvideUnifiedStorageGrpcService(
 		}
 
 		s.queue = queue
-		s.scheduler = scheduler
+		s.scheduler = sched
 		subservices = append(subservices, s.queue, s.scheduler)
 	}
 
@@ -200,6 +203,7 @@ func ProvideUnifiedStorageGrpcService(
 	}
 
 	// This will be used when running as a dskit service
+	// Note: We use StorageServer as the module name for backward compatibility
 	s.BasicService = services.NewBasicService(s.starting, s.running, s.stopping).WithName(modules.StorageServer)
 
 	return s, nil
@@ -220,11 +224,6 @@ func (s *service) PrepareDownscale(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-var (
-	// operation used by the search-servers to check if they own the namespace
-	searchOwnerRead = ring.NewOp([]ring.InstanceState{ring.JOINING, ring.ACTIVE, ring.LEAVING}, nil)
-)
-
 func (s *service) OwnsIndex(key resource.NamespacedResource) (bool, error) {
 	if s.searchRing == nil {
 		return true, nil
@@ -261,59 +260,108 @@ func (s *service) starting(ctx context.Context) error {
 		return err
 	}
 
-	searchOptions, err := search.NewSearchOptions(s.features, s.cfg, s.docBuilders, s.indexMetrics, s.OwnsIndex)
-	if err != nil {
-		return err
-	}
-
-	serverOptions := ServerOptions{
-		Backend:        s.backend,
-		DB:             s.db,
-		Cfg:            s.cfg,
-		Tracer:         s.tracing,
-		Reg:            s.reg,
-		AccessClient:   authzClient,
-		SearchOptions:  searchOptions,
-		StorageMetrics: s.storageMetrics,
-		IndexMetrics:   s.indexMetrics,
-		Features:       s.features,
-		QOSQueue:       s.queue,
-		OwnsIndexFn:    s.OwnsIndex,
-	}
-
+	// Setup overrides service if enabled
+	var overridesSvc *resource.OverridesService
 	if s.cfg.OverridesFilePath != "" {
-		overridesSvc, err := resource.NewOverridesService(context.Background(), s.log, s.reg, s.tracing, resource.ReloadOptions{
+		overridesSvc, err = resource.NewOverridesService(context.Background(), s.log, s.reg, s.tracing, resource.ReloadOptions{
 			FilePath:     s.cfg.OverridesFilePath,
 			ReloadPeriod: s.cfg.OverridesReloadInterval,
 		})
 		if err != nil {
 			return err
 		}
-		serverOptions.OverridesService = overridesSvc
 	}
 
-	server, err := NewResourceServer(serverOptions)
+	// Ensure we have a backend - create one if needed
+	// This is critical: we create the backend ONCE and share it between search and storage servers
+	// to avoid duplicate metrics registration
+	backend := s.backend
+	if backend == nil {
+		eDB, err := dbimpl.ProvideResourceDB(s.db, s.cfg, s.tracing)
+		if err != nil {
+			return fmt.Errorf("failed to create resource DB: %w", err)
+		}
+
+		isHA := isHighAvailabilityEnabled(s.cfg.SectionWithEnvOverrides("database"),
+			s.cfg.SectionWithEnvOverrides("resource_api"))
+
+		b, err := NewBackend(BackendOptions{
+			DBProvider:           eDB,
+			Reg:                  s.reg,
+			IsHA:                 isHA,
+			storageMetrics:       s.storageMetrics,
+			LastImportTimeMaxAge: s.cfg.MaxFileIndexAge,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to create backend: %w", err)
+		}
+
+		// Initialize the backend
+		if err := b.Init(context.Background()); err != nil {
+			return fmt.Errorf("failed to initialize backend: %w", err)
+		}
+		backend = b
+	}
+
+	// Create search options for the search server
+	searchOptions, err := search.NewSearchOptions(s.features, s.cfg, s.docBuilders, s.indexMetrics, s.OwnsIndex)
 	if err != nil {
 		return err
 	}
+
+	// Create the search server - pass the shared backend
+	searchServer, err := NewSearchServer(SearchServerOptions{
+		Backend:       backend, // Use the shared backend
+		DB:            s.db,
+		Cfg:           s.cfg,
+		Tracer:        s.tracing,
+		Reg:           s.reg,
+		AccessClient:  authzClient,
+		SearchOptions: searchOptions,
+		IndexMetrics:  s.indexMetrics,
+		OwnsIndexFn:   s.OwnsIndex,
+	})
+	if err != nil {
+		return err
+	}
+
+	// Create the storage server - pass the shared backend
+	storageServer, err := NewStorageServer(StorageServerOptions{
+		Backend:          backend, // Use the shared backend
+		OverridesService: overridesSvc,
+		DB:               s.db,
+		Cfg:              s.cfg,
+		Tracer:           s.tracing,
+		Reg:              s.reg,
+		AccessClient:     authzClient,
+		StorageMetrics:   s.storageMetrics,
+		Features:         s.features,
+		QOSQueue:         s.queue,
+	})
+	if err != nil {
+		return err
+	}
+
 	s.handler, err = grpcserver.ProvideService(s.cfg, s.features, interceptors.AuthenticatorFunc(s.authenticator), s.tracing, prometheus.DefaultRegisterer)
 	if err != nil {
 		return err
 	}
 
-	healthService, err := resource.ProvideHealthService(server)
+	healthService, err := resource.ProvideHealthService(storageServer)
 	if err != nil {
 		return err
 	}
 
 	srv := s.handler.GetServer()
-	resourcepb.RegisterResourceStoreServer(srv, server)
-	resourcepb.RegisterBulkStoreServer(srv, server)
-	resourcepb.RegisterResourceIndexServer(srv, server)
-	resourcepb.RegisterManagedObjectIndexServer(srv, server)
-	resourcepb.RegisterBlobStoreServer(srv, server)
-	resourcepb.RegisterDiagnosticsServer(srv, server)
-	resourcepb.RegisterQuotasServer(srv, server)
+	// Register storage services
+	resourcepb.RegisterResourceStoreServer(srv, storageServer)
+	resourcepb.RegisterBulkStoreServer(srv, storageServer)
+	resourcepb.RegisterBlobStoreServer(srv, storageServer)
+	resourcepb.RegisterDiagnosticsServer(srv, storageServer)
+	resourcepb.RegisterQuotasServer(srv, storageServer)
+	// Register search services
+	resourcepb.RegisterResourceIndexServer(srv, searchServer)
+	resourcepb.RegisterManagedObjectIndexServer(srv, searchServer)
 	grpc_health_v1.RegisterHealthServer(srv, healthService)
 
 	// register reflection service

pkg/storage/unified/sql/storage_service.go

@@ -0,0 +1,234 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+	"google.golang.org/grpc/health/grpc_health_v1"
+
+	"github.com/grafana/dskit/services"
+
+	infraDB "github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/modules"
+	"github.com/grafana/grafana/pkg/services/authz"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/grpcserver"
+	"github.com/grafana/grafana/pkg/services/grpcserver/interceptors"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/storage/unified/resource"
+	"github.com/grafana/grafana/pkg/storage/unified/resource/grpc"
+	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
+	"github.com/grafana/grafana/pkg/util/scheduler"
+)
+
+var _ UnifiedStorageGrpcService = (*storageService)(nil)
+
+type storageService struct {
+	*services.BasicService
+
+	backend   resource.StorageBackend
+	cfg       *setting.Cfg
+	features  featuremgmt.FeatureToggles
+	db        infraDB.DB
+	stopCh    chan struct{}
+	stoppedCh chan error
+
+	handler grpcserver.Provider
+
+	tracing trace.Tracer
+
+	authenticator func(ctx context.Context) (context.Context, error)
+
+	log            log.Logger
+	reg            prometheus.Registerer
+	storageMetrics *resource.StorageMetrics
+
+	queue     QOSEnqueueDequeuer
+	scheduler *scheduler.Scheduler
+
+	// Subservices manager
+	subservices        *services.Manager
+	subservicesWatcher *services.FailureWatcher
+	hasSubservices     bool
+}
+
+func ProvideStorageService(
+	cfg *setting.Cfg,
+	features featuremgmt.FeatureToggles,
+	db infraDB.DB,
+	log log.Logger,
+	reg prometheus.Registerer,
+	storageMetrics *resource.StorageMetrics,
+	backend resource.StorageBackend,
+) (UnifiedStorageGrpcService, error) {
+	var err error
+	tracer := otel.Tracer("unified-storage-server")
+
+	authn := NewAuthenticatorWithFallback(cfg, reg, tracer, func(ctx context.Context) (context.Context, error) {
+		auth := grpc.Authenticator{Tracer: tracer}
+		return auth.Authenticate(ctx)
+	})
+
+	s := &storageService{
+		backend:            backend,
+		cfg:                cfg,
+		features:           features,
+		stopCh:             make(chan struct{}),
+		stoppedCh:          make(chan error, 1),
+		authenticator:      authn,
+		tracing:            tracer,
+		db:                 db,
+		log:                log,
+		reg:                reg,
+		storageMetrics:     storageMetrics,
+		subservicesWatcher: services.NewFailureWatcher(),
+	}
+
+	subservices := []services.Service{}
+
+	// Setup QOS if enabled
+	if cfg.QOSEnabled {
+		qosReg := prometheus.WrapRegistererWithPrefix("resource_server_qos_", reg)
+		queue := scheduler.NewQueue(&scheduler.QueueOptions{
+			MaxSizePerTenant: cfg.QOSMaxSizePerTenant,
+			Registerer:       qosReg,
+		})
+		sched, err := scheduler.NewScheduler(queue, &scheduler.Config{
+			NumWorkers: cfg.QOSNumberWorker,
+			Logger:     log,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to create qos scheduler: %s", err)
+		}
+
+		s.queue = queue
+		s.scheduler = sched
+		subservices = append(subservices, s.queue, s.scheduler)
+	}
+
+	if len(subservices) > 0 {
+		s.hasSubservices = true
+		s.subservices, err = services.NewManager(subservices...)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create subservices manager: %w", err)
+		}
+	}
+
+	// This will be used when running as a dskit service
+	s.BasicService = services.NewBasicService(s.starting, s.running, s.stopping).WithName(modules.StorageServer)
+
+	return s, nil
+}
+
+func (s *storageService) starting(ctx context.Context) error {
+	if s.hasSubservices {
+		s.subservicesWatcher.WatchManager(s.subservices)
+		if err := services.StartManagerAndAwaitHealthy(ctx, s.subservices); err != nil {
+			return fmt.Errorf("failed to start subservices: %w", err)
+		}
+	}
+
+	authzClient, err := authz.ProvideStandaloneAuthZClient(s.cfg, s.features, s.tracing, s.reg)
+	if err != nil {
+		return err
+	}
+
+	// Setup overrides service if enabled
+	var overridesSvc *resource.OverridesService
+	if s.cfg.OverridesFilePath != "" {
+		overridesSvc, err = resource.NewOverridesService(context.Background(), s.log, s.reg, s.tracing, resource.ReloadOptions{
+			FilePath:     s.cfg.OverridesFilePath,
+			ReloadPeriod: s.cfg.OverridesReloadInterval,
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	// Create the storage server
+	storageServer, err := NewStorageServer(StorageServerOptions{
+		Backend:          s.backend,
+		OverridesService: overridesSvc,
+		DB:               s.db,
+		Cfg:              s.cfg,
+		Tracer:           s.tracing,
+		Reg:              s.reg,
+		AccessClient:     authzClient,
+		StorageMetrics:   s.storageMetrics,
+		Features:         s.features,
+		QOSQueue:         s.queue,
+	})
+	if err != nil {
+		return err
+	}
+
+	s.handler, err = grpcserver.ProvideService(s.cfg, s.features, interceptors.AuthenticatorFunc(s.authenticator), s.tracing, prometheus.DefaultRegisterer)
+	if err != nil {
+		return err
+	}
+
+	healthService, err := resource.ProvideHealthService(storageServer)
+	if err != nil {
+		return err
+	}
+
+	srv := s.handler.GetServer()
+	// Register storage services
+	resourcepb.RegisterResourceStoreServer(srv, storageServer)
+	resourcepb.RegisterBulkStoreServer(srv, storageServer)
+	resourcepb.RegisterBlobStoreServer(srv, storageServer)
+	resourcepb.RegisterDiagnosticsServer(srv, storageServer)
+	resourcepb.RegisterQuotasServer(srv, storageServer)
+	grpc_health_v1.RegisterHealthServer(srv, healthService)
+
+	// register reflection service
+	_, err = grpcserver.ProvideReflectionService(s.cfg, s.handler)
+	if err != nil {
+		return err
+	}
+
+	// start the gRPC server
+	go func() {
+		err := s.handler.Run(ctx)
+		if err != nil {
+			s.stoppedCh <- err
+		} else {
+			s.stoppedCh <- nil
+		}
+	}()
+	return nil
+}
+
+// GetAddress returns the address of the gRPC server.
+func (s *storageService) GetAddress() string {
+	return s.handler.GetAddress()
+}
+
+func (s *storageService) running(ctx context.Context) error {
+	select {
+	case err := <-s.stoppedCh:
+		if err != nil && !errors.Is(err, context.Canceled) {
+			return err
+		}
+	case err := <-s.subservicesWatcher.Chan():
+		return fmt.Errorf("subservice failure: %w", err)
+	case <-ctx.Done():
+		close(s.stopCh)
+	}
+	return nil
+}
+
+func (s *storageService) stopping(_ error) error {
+	if s.hasSubservices {
+		err := services.StopManagerAndAwaitStopped(context.Background(), s.subservices)
+		if err != nil {
+			return fmt.Errorf("failed to stop subservices: %w", err)
+		}
+	}
+	return nil
+}

pkg/storage/unified/testing/search_and_storage.go

@@ -32,6 +32,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 	nsPrefix := "test-ns"
 
 	var server resource.ResourceServer
+	var searchServer resource.SearchServer
 
 	t.Run("Create initial resources in storage", func(t *testing.T) {
 		initialResources := []struct {
@@ -96,25 +97,34 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 	})
 
 	t.Run("Create a resource server with both backends", func(t *testing.T) {
-		// Create a resource server with both backends
+		// Create search server first
 		var err error
-		server, err = resource.NewResourceServer(resource.ResourceServerOptions{
-			Backend: backend,
-			Search: resource.SearchOptions{
-				Backend: searchBackend,
-				Resources: &resource.TestDocumentBuilderSupplier{
-					GroupsResources: map[string]string{
-						"test.grafana.app": "testresources",
-					},
+		searchOpts := resource.SearchOptions{
+			Backend: searchBackend,
+			Resources: &resource.TestDocumentBuilderSupplier{
+				GroupsResources: map[string]string{
+					"test.grafana.app": "testresources",
 				},
 			},
+		}
+		searchServer, err = resource.NewSearchServer(searchOpts, backend, nil, nil, nil, nil)
+		require.NoError(t, err)
+		require.NotNil(t, searchServer)
+
+		// Initialize the search server
+		err = searchServer.Init(ctx)
+		require.NoError(t, err)
+
+		// Create a resource server separately from the search server
+		server, err = resource.NewResourceServer(resource.ResourceServerOptions{
+			Backend: backend,
 		})
 		require.NoError(t, err)
 	})
 
 	t.Run("Search for initial resources", func(t *testing.T) {
 		// Test 1: Search for initial resources
-		searchResp, err := server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err := searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",
@@ -194,7 +204,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 	})
 
 	t.Run("Search for documents", func(t *testing.T) {
-		searchResp, err := server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err := searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",
@@ -212,7 +222,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 	})
 
 	t.Run("Search with tags", func(t *testing.T) {
-		searchResp, err := server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err := searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",
@@ -231,7 +241,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 		require.Equal(t, int64(0), searchResp.TotalHits)
 
 		// this is the correct way of searching by tag
-		searchResp, err = server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err = searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",
@@ -253,7 +263,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 	})
 
 	t.Run("Search with specific tag", func(t *testing.T) {
-		searchResp, err := server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err := searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",
@@ -272,7 +282,7 @@ func RunTestSearchAndStorage(t *testing.T, ctx context.Context, backend resource
 		require.Equal(t, int64(0), searchResp.TotalHits)
 
 		// this is the correct way of searching by tag
-		searchResp, err = server.Search(ctx, &resourcepb.ResourceSearchRequest{
+		searchResp, err = searchServer.Search(ctx, &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: &resourcepb.ResourceKey{
 					Group:     "test.grafana.app",

pkg/tests/apis/dashboard/search_test.go

@@ -4,10 +4,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io/fs"
+	"math"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic"
@@ -16,12 +21,167 @@ import (
 	dashboardV0 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apiserver/rest"
+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tests/apis"
 	"github.com/grafana/grafana/pkg/tests/testinfra"
 	"github.com/grafana/grafana/pkg/util/testutil"
 )
 
+func TestIntegrationSearchDevDashboards(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+	ctx := context.Background()
+
+	helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+		DisableDataMigrations: true,
+		AppModeProduction:     true,
+		DisableAnonymous:      true,
+		APIServerStorageType:  "unified",
+		UnifiedStorageConfig: map[string]setting.UnifiedStorageConfig{
+			"dashboards.dashboard.grafana.app": {DualWriterMode: rest.Mode5},
+			"folders.folder.grafana.app":       {DualWriterMode: rest.Mode5},
+		},
+		UnifiedStorageEnableSearch: true,
+	})
+	defer helper.Shutdown()
+
+	// Create devenv dashboards from legacy API
+	cfg := dynamic.ConfigFor(helper.Org1.Admin.NewRestConfig())
+	cfg.GroupVersion = &dashboardV0.GroupVersion
+	adminClient, err := k8srest.RESTClientFor(cfg)
+	require.NoError(t, err)
+	adminClient.Get()
+
+	fileCount := 0
+	devenv := "../../../../devenv/dev-dashboards/panel-timeseries"
+	err = filepath.WalkDir(devenv, func(p string, d fs.DirEntry, e error) error {
+		require.NoError(t, err)
+		if d.IsDir() || filepath.Ext(d.Name()) != ".json" {
+			return nil
+		}
+
+		// use the filename as UID
+		uid := strings.TrimSuffix(d.Name(), ".json")
+		if len(uid) > 40 {
+			uid = uid[:40] // avoid uid too long, max 40 characters
+		}
+
+		// nolint:gosec
+		data, err := os.ReadFile(p)
+		require.NoError(t, err)
+
+		cmd := dashboards.SaveDashboardCommand{
+			Dashboard: &simplejson.Json{},
+			Overwrite: true,
+		}
+		err = cmd.Dashboard.FromDB(data)
+		require.NoError(t, err)
+		cmd.Dashboard.Set("id", nil)
+		cmd.Dashboard.Set("uid", uid)
+		data, err = json.Marshal(cmd)
+		require.NoError(t, err)
+
+		var statusCode int
+		result := adminClient.Post().AbsPath("api", "dashboards", "db").
+			Body(data).
+			SetHeader("Content-type", "application/json").
+			Do(ctx).
+			StatusCode(&statusCode)
+		require.NoError(t, result.Error(), "file: [%d] %s [status:%d]", fileCount, d.Name(), statusCode)
+		require.Equal(t, int(http.StatusOK), statusCode)
+		fileCount++
+		return nil
+	})
+	require.NoError(t, err)
+	require.Equal(t, 16, fileCount, "file count from %s", devenv)
+
+	// Helper to call search
+	callSearch := func(user apis.User, params string) dashboardV0.SearchResults {
+		require.NotNil(t, user)
+		ns := user.Identity.GetNamespace()
+		cfg := dynamic.ConfigFor(user.NewRestConfig())
+		cfg.GroupVersion = &dashboardV0.GroupVersion
+		restClient, err := k8srest.RESTClientFor(cfg)
+		require.NoError(t, err)
+
+		var statusCode int
+		req := restClient.Get().AbsPath("apis", "dashboard.grafana.app", "v0alpha1", "namespaces", ns, "search").
+			Param("limit", "1000").
+			Param("type", "dashboard") // Only search dashboards
+
+		for kv := range strings.SplitSeq(params, "&") {
+			if kv == "" {
+				continue
+			}
+			parts := strings.SplitN(kv, "=", 2)
+			if len(parts) == 2 {
+				req = req.Param(parts[0], parts[1])
+			}
+		}
+		res := req.Do(ctx).StatusCode(&statusCode)
+		require.NoError(t, res.Error())
+		require.Equal(t, int(http.StatusOK), statusCode)
+		var sr dashboardV0.SearchResults
+		raw, err := res.Raw()
+		require.NoError(t, err)
+		require.NoError(t, json.Unmarshal(raw, &sr))
+
+		// Normalize scores and query cost for snapshot comparison
+		sr.QueryCost = 0 // this depends on the hardware
+		sr.MaxScore = roundTo(sr.MaxScore, 3)
+		for i := range sr.Hits {
+			sr.Hits[i].Score = roundTo(sr.Hits[i].Score, 3) // 0.6250571494814442 -> 0.625
+		}
+		return sr
+	}
+
+	// Compare a results to snapshots
+	testCases := []struct {
+		name   string
+		user   apis.User
+		params string
+	}{
+		{
+			name:   "all",
+			user:   helper.Org1.Admin,
+			params: "", // only dashboards
+		},
+		{
+			name:   "simple-query",
+			user:   helper.Org1.Admin,
+			params: "query=stacking",
+		},
+		{
+			name:   "with-text-panel",
+			user:   helper.Org1.Admin,
+			params: "field=panel_types&panelType=text",
+		},
+	}
+	for i, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			res := callSearch(tc.user, tc.params)
+			jj, err := json.MarshalIndent(res, "", "  ")
+			require.NoError(t, err)
+
+			fname := fmt.Sprintf("testdata/searchV0/t%02d-%s.json", i, tc.name)
+			// nolint:gosec
+			snapshot, err := os.ReadFile(fname)
+			if err != nil {
+				assert.Failf(t, "Failed to read snapshot", "file: %s", fname)
+				err = os.WriteFile(fname, jj, 0o644)
+				require.NoErrorf(t, err, "Failed to write snapshot file %s", fname)
+				return
+			}
+
+			if !assert.JSONEq(t, string(snapshot), string(jj)) {
+				err = os.WriteFile(fname, jj, 0o644)
+				require.NoErrorf(t, err, "Failed to write snapshot file %s", fname)
+			}
+		})
+	}
+}
+
 func TestIntegrationSearchPermissionFiltering(t *testing.T) {
 	testutil.SkipIntegrationTestInShortMode(t)
 
@@ -285,3 +445,11 @@ func setFolderPermissions(t *testing.T, helper *apis.K8sTestHelper, actingUser a
 
 	require.Equal(t, http.StatusOK, resp.Response.StatusCode, "Failed to set permissions for folder %s", folderUID)
 }
+
+// roundTo rounds a float64 to a specified number of decimal places.
+func roundTo(n float64, decimals uint32) float64 {
+	// Calculate the power of 10 for the desired number of decimals
+	scale := math.Pow(10, float64(decimals))
+	// Multiply, round to the nearest integer, and then divide back
+	return math.Round(n*scale) / scale
+}

pkg/tests/apis/dashboard/testdata/searchV0/t00-all.json

@@ -0,0 +1,165 @@
+{
+  "totalHits": 16,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries",
+      "title": "Panel Tests - Graph NG",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-by-value-color-schemes",
+      "title": "Panel Tests - Graph NG - By value color schemes",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-nulls",
+      "title": "Panel Tests - Graph NG - Discrete panels",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng",
+        "timeseries",
+        "trend",
+        "state-timeline",
+        "transform"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-gradient-area",
+      "title": "Panel Tests - Graph NG - Gradient Area Fills",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-soft-limits",
+      "title": "Panel Tests - Graph NG - softMin/softMax",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-yaxis-ticks",
+      "title": "Panel Tests - Graph NG - Y axis ticks",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-hue-gradients",
+      "title": "Panel Tests - GraphNG - Hue Gradients",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-time",
+      "title": "Panel Tests - GraphNG - Time Axis",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-thresholds",
+      "title": "Panel Tests - GraphNG Thresholds",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-shared-tooltip-cursor-positio",
+      "title": "Panel Tests - shared tooltips cursor positioning",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-bars-high-density",
+      "title": "Panel Tests - TimeSeries - bars high density (stroke + fill)",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-out-of-rage",
+      "title": "Panel Tests - Timeseries - Out of range",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-stacking",
+      "title": "Panel Tests - TimeSeries - stacking",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-formats",
+      "title": "Panel Tests - Timeseries - Supported input formats"
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-stacking2",
+      "title": "TimeSeries \u0026 BarChart Stacking",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-y-ticks-zero-decimals",
+      "title": "Zero Decimals Y Ticks",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ]
+    }
+  ],
+  "maxScore": 1
+}

pkg/tests/apis/dashboard/testdata/searchV0/t01-simple-query.json

@@ -0,0 +1,28 @@
+{
+  "totalHits": 2,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries-stacking",
+      "title": "Panel Tests - TimeSeries - stacking",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ],
+      "score": 0.658
+    },
+    {
+      "resource": "dashboards",
+      "name": "timeseries-stacking2",
+      "title": "TimeSeries \u0026 BarChart Stacking",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ],
+      "score": 0.625
+    }
+  ],
+  "maxScore": 0.658
+}

pkg/tests/apis/dashboard/testdata/searchV0/t02-with-text-panel.json

@@ -0,0 +1,18 @@
+{
+  "totalHits": 1,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries-formats",
+      "title": "Panel Tests - Timeseries - Supported input formats",
+      "field": {
+        "panel_types": [
+          "table",
+          "text",
+          "timeseries"
+        ]
+      }
+    }
+  ],
+  "maxScore": 1.778
+}

pkg/tests/apis/folder/folders_test.go

@@ -2054,9 +2054,7 @@ func TestIntegrationDeleteFolderWithProvisionedDashboards(t *testing.T) {
 						DualWriterMode: modeDw,
 					},
 				},
-				EnableFeatureToggles: []string{
-					featuremgmt.FlagUnifiedStorageSearch,
-				},
+				UnifiedStorageEnableSearch: true,
 			}
 
 			setupProvisioningDir(t, &ops)
@@ -2163,9 +2161,7 @@ func TestIntegrationProvisionedFolderPropagatesLabelsAndAnnotations(t *testing.T
 				DualWriterMode: mode3,
 			},
 		},
-		EnableFeatureToggles: []string{
-			featuremgmt.FlagUnifiedStorageSearch,
-		},
+		UnifiedStorageEnableSearch: true,
 	}
 
 	setupProvisioningDir(t, &ops)

pkg/tests/apis/openapi_snapshots/dashboard.grafana.app-v0alpha1.json

@@ -1830,6 +1830,22 @@
               "type": "string"
             }
           },
+          {
+            "name": "panelType",
+            "in": "query",
+            "description": "find dashboards using panels of a given plugin type",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "dataSourceType",
+            "in": "query",
+            "description": "find dashboards using datasources of a given plugin type",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "permission",
             "in": "query",

pkg/tests/apis/provisioning/connection_test.go

@@ -559,3 +559,175 @@ func TestIntegrationConnectionController_HealthCheckUpdates(t *testing.T) {
 		assert.True(t, final.Status.Health.Healthy, "connection should remain healthy")
 	})
 }
+
+func TestIntegrationProvisioning_RepositoryFieldSelectorByConnection(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+
+	helper := runGrafana(t)
+	ctx := context.Background()
+	createOptions := metav1.CreateOptions{FieldValidation: "Strict"}
+
+	// Create a connection first
+	connection := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "provisioning.grafana.app/v0alpha1",
+		"kind":       "Connection",
+		"metadata": map[string]any{
+			"name":      "test-conn-for-field-selector",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"type": "github",
+			"github": map[string]any{
+				"appID":          "123456",
+				"installationID": "789012",
+			},
+		},
+		"secure": map[string]any{
+			"privateKey": map[string]any{
+				"create": "test-private-key",
+			},
+		},
+	}}
+
+	_, err := helper.Connections.Resource.Create(ctx, connection, createOptions)
+	require.NoError(t, err, "failed to create connection")
+
+	t.Cleanup(func() {
+		// Clean up repositories first
+		_ = helper.Repositories.Resource.Delete(ctx, "repo-with-connection", metav1.DeleteOptions{})
+		_ = helper.Repositories.Resource.Delete(ctx, "repo-without-connection", metav1.DeleteOptions{})
+		_ = helper.Repositories.Resource.Delete(ctx, "repo-with-different-connection", metav1.DeleteOptions{})
+		// Then clean up the connection
+		_ = helper.Connections.Resource.Delete(ctx, "test-conn-for-field-selector", metav1.DeleteOptions{})
+	})
+
+	// Create a repository WITH the connection
+	repoWithConnection := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "provisioning.grafana.app/v0alpha1",
+		"kind":       "Repository",
+		"metadata": map[string]any{
+			"name":      "repo-with-connection",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"title": "Repo With Connection",
+			"type":  "local",
+			"sync": map[string]any{
+				"enabled": false,
+				"target":  "folder",
+			},
+			"local": map[string]any{
+				"path": helper.ProvisioningPath,
+			},
+			"connection": map[string]any{
+				"name": "test-conn-for-field-selector",
+			},
+		},
+	}}
+
+	_, err = helper.Repositories.Resource.Create(ctx, repoWithConnection, createOptions)
+	require.NoError(t, err, "failed to create repository with connection")
+
+	// Create a repository WITHOUT the connection
+	repoWithoutConnection := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "provisioning.grafana.app/v0alpha1",
+		"kind":       "Repository",
+		"metadata": map[string]any{
+			"name":      "repo-without-connection",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"title": "Repo Without Connection",
+			"type":  "local",
+			"sync": map[string]any{
+				"enabled": false,
+				"target":  "folder",
+			},
+			"local": map[string]any{
+				"path": helper.ProvisioningPath,
+			},
+		},
+	}}
+
+	_, err = helper.Repositories.Resource.Create(ctx, repoWithoutConnection, createOptions)
+	require.NoError(t, err, "failed to create repository without connection")
+
+	// Create a repository with a DIFFERENT connection name (non-existent)
+	repoWithDifferentConnection := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "provisioning.grafana.app/v0alpha1",
+		"kind":       "Repository",
+		"metadata": map[string]any{
+			"name":      "repo-with-different-connection",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"title": "Repo With Different Connection",
+			"type":  "local",
+			"sync": map[string]any{
+				"enabled": false,
+				"target":  "folder",
+			},
+			"local": map[string]any{
+				"path": helper.ProvisioningPath,
+			},
+			"connection": map[string]any{
+				"name": "some-other-connection",
+			},
+		},
+	}}
+
+	_, err = helper.Repositories.Resource.Create(ctx, repoWithDifferentConnection, createOptions)
+	require.NoError(t, err, "failed to create repository with different connection")
+
+	t.Run("filter repositories by spec.connection.name", func(t *testing.T) {
+		// List repositories with field selector for the specific connection
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "spec.connection.name=test-conn-for-field-selector",
+		})
+		require.NoError(t, err, "failed to list repositories with field selector")
+
+		// Should only return the repository with the matching connection
+		assert.Len(t, list.Items, 1, "should return exactly one repository")
+		assert.Equal(t, "repo-with-connection", list.Items[0].GetName(), "should return the correct repository")
+	})
+
+	t.Run("filter repositories by non-existent connection returns empty", func(t *testing.T) {
+		// List repositories with field selector for a non-existent connection
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "spec.connection.name=non-existent-connection",
+		})
+		require.NoError(t, err, "failed to list repositories with field selector")
+
+		// Should return empty list
+		assert.Len(t, list.Items, 0, "should return no repositories for non-existent connection")
+	})
+
+	t.Run("filter repositories by empty connection name", func(t *testing.T) {
+		// List repositories with field selector for empty connection (repos without connection)
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "spec.connection.name=",
+		})
+		require.NoError(t, err, "failed to list repositories with empty connection field selector")
+
+		// Should return the repository without a connection
+		assert.Len(t, list.Items, 1, "should return exactly one repository without connection")
+		assert.Equal(t, "repo-without-connection", list.Items[0].GetName(), "should return the repository without connection")
+	})
+
+	t.Run("list all repositories without field selector", func(t *testing.T) {
+		// List all repositories without field selector
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err, "failed to list all repositories")
+
+		// Should return all three repositories
+		assert.Len(t, list.Items, 3, "should return all three repositories")
+
+		names := make([]string, len(list.Items))
+		for i, item := range list.Items {
+			names[i] = item.GetName()
+		}
+		assert.Contains(t, names, "repo-with-connection")
+		assert.Contains(t, names, "repo-without-connection")
+		assert.Contains(t, names, "repo-with-different-connection")
+	})
+}

public/app/api/clients/collections/v1alpha1/index.ts

@@ -1,7 +1,7 @@
 import { generatedAPI } from '@grafana/api-clients/rtkq/collections/v1alpha1';
 import { t } from '@grafana/i18n';
-import { notifyApp } from 'app/core/actions';
 import { createSuccessNotification, createErrorNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 
 export const collectionsAPIv1alpha1 = generatedAPI.enhanceEndpoints({
   endpoints: {

public/app/api/clients/playlist/v0alpha1/index.ts

@@ -1,8 +1,8 @@
 import { generatedAPI, type Playlist, type PlaylistSpec } from '@grafana/api-clients/rtkq/playlist/v0alpha1';
 import { getBackendSrv } from '@grafana/runtime';
 
-import { notifyApp } from '../../../../core/actions';
 import { createSuccessNotification } from '../../../../core/copy/appNotification';
+import { notifyApp } from '../../../../core/reducers/appNotification';
 import { contextSrv } from '../../../../core/services/context_srv';
 import { handleError } from '../../../utils';
 

public/app/api/clients/provisioning/v0alpha1/index.ts

@@ -12,8 +12,8 @@ import { isFetchError } from '@grafana/runtime';
 import { clearFolders } from 'app/features/browse-dashboards/state/slice';
 import { getState } from 'app/store/store';
 
-import { notifyApp } from '../../../../core/actions';
 import { createSuccessNotification, createErrorNotification } from '../../../../core/copy/appNotification';
+import { notifyApp } from '../../../../core/reducers/appNotification';
 import { PAGE_SIZE } from '../../../../features/browse-dashboards/api/services';
 import { refetchChildren } from '../../../../features/browse-dashboards/state/actions';
 import { handleError } from '../../../utils';

public/app/api/utils.ts

@@ -1,8 +1,8 @@
 import { normalizeError } from '@grafana/api-clients';
 import { ThunkDispatch } from 'app/types/store';
 
-import { notifyApp } from '../core/actions';
 import { createErrorNotification } from '../core/copy/appNotification';
+import { notifyApp } from '../core/reducers/appNotification';
 
 /**
  * Handle an error from a k8s API call

public/app/core/actions/index.ts

@@ -1,4 +0,0 @@
-import { hideAppNotification, notifyApp } from '../reducers/appNotification';
-import { updateNavIndex, updateConfigurationSubtitle } from '../reducers/navModel';
-
-export { updateNavIndex, updateConfigurationSubtitle, notifyApp, hideAppNotification };

public/app/core/components/AppNotifications/AppNotificationList.tsx

@@ -4,10 +4,9 @@ import { useLocation } from 'react-router-dom';
 
 import { AlertErrorPayload, AlertPayload, AppEvents, GrafanaTheme2 } from '@grafana/data';
 import { useStyles2, Stack } from '@grafana/ui';
-import { notifyApp, hideAppNotification } from 'app/core/actions';
 import { appEvents } from 'app/core/app_events';
 import { useGrafana } from 'app/core/context/GrafanaContext';
-import { selectVisible } from 'app/core/reducers/appNotification';
+import { hideAppNotification, notifyApp, selectVisible } from 'app/core/reducers/appNotification';
 import { useSelector, useDispatch } from 'app/types/store';
 
 import {

public/app/core/copy/appNotification.ts

@@ -6,7 +6,7 @@ import { dispatch as storeDispatch } from 'app/store/store';
 import { AppNotificationSeverity, AppNotification } from 'app/types/appNotifications';
 import { useDispatch } from 'app/types/store';
 
-import { notifyApp } from '../actions';
+import { notifyApp } from '../reducers/appNotification';
 
 const defaultSuccessNotification = {
   title: '',

public/app/core/icons/cached.json

@@ -29,6 +29,7 @@
   "unicons/bookmark",
   "unicons/book-open",
   "unicons/brackets-curly",
+  "unicons/brain",
   "unicons/bug",
   "unicons/building",
   "unicons/calculator-alt",

public/app/core/utils/richHistory.ts

@@ -10,7 +10,6 @@ import {
 } from '@grafana/data';
 import { t } from '@grafana/i18n';
 import { getDataSourceSrv } from '@grafana/runtime';
-import { notifyApp } from 'app/core/actions';
 import { createErrorNotification, createWarningNotification } from 'app/core/copy/appNotification';
 import { dispatch } from 'app/store/store';
 import { RichHistoryQuery } from 'app/types/explore';
@@ -23,6 +22,7 @@ import {
 } from '../history/RichHistoryStorage';
 import { createRetentionPeriodBoundary } from '../history/richHistoryLocalStorageUtils';
 import { getLocalRichHistoryStorage, getRichHistoryStorage } from '../history/richHistoryStorageProvider';
+import { notifyApp } from '../reducers/appNotification';
 import { contextSrv } from '../services/context_srv';
 
 import {

public/app/core/utils/shortLinks.ts

@@ -5,7 +5,6 @@ import { t } from '@grafana/i18n';
 import { getBackendSrv, config, locationService } from '@grafana/runtime';
 import { sceneGraph, SceneTimeRangeLike, VizPanel } from '@grafana/scenes';
 import { shortURLAPIv1beta1 } from 'app/api/clients/shorturl/v1beta1';
-import { notifyApp } from 'app/core/actions';
 import { createErrorNotification, createSuccessNotification } from 'app/core/copy/appNotification';
 import { DashboardScene } from 'app/features/dashboard-scene/scene/DashboardScene';
 import { getDashboardUrl } from 'app/features/dashboard-scene/utils/getDashboardUrl';
@@ -14,6 +13,7 @@ import { dispatch } from 'app/store/store';
 import { ShortURL } from '../../../../apps/shorturl/plugin/src/generated/shorturl/v1beta1/shorturl_object_gen';
 import { extractErrorMessage } from '../../api/utils';
 import { ShareLinkConfiguration } from '../../features/dashboard-scene/sharing/ShareButton/utils';
+import { notifyApp } from '../reducers/appNotification';
 
 import { copyStringToClipboard } from './explore';
 

public/app/features/dashboard-scene/pages/utils.ts

@@ -1,7 +1,7 @@
 import { UrlQueryMap, getTimeZone, getDefaultTimeRange, dateMath } from '@grafana/data';
 import { locationService } from '@grafana/runtime';
 import { getFolderByUidFacade } from 'app/api/clients/folder/v1beta1/hooks';
-import { updateNavIndex } from 'app/core/actions';
+import { updateNavIndex } from 'app/core/reducers/navModel';
 import { buildNavModel } from 'app/features/folders/state/navModel';
 import { store } from 'app/store/store';
 

public/app/features/dashboard-scene/scene/AlertStatesDataLayer.ts

@@ -9,8 +9,8 @@ import {
   sceneGraph,
   SceneTimeRangeLike,
 } from '@grafana/scenes';
-import { notifyApp } from 'app/core/actions';
 import { createErrorNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { contextSrv } from 'app/core/services/context_srv';
 import { getMessageFromError } from 'app/core/utils/errors';
 import { alertRuleApi } from 'app/features/alerting/unified/api/alertRuleApi';

public/app/features/dashboard-scene/scene/export/exporters.ts

@@ -12,9 +12,9 @@ import {
   LibraryPanelRef,
   LibraryPanelKind,
 } from '@grafana/schema/dist/esm/schema/dashboard/v2';
-import { notifyApp } from 'app/core/actions';
 import config from 'app/core/config';
 import { createErrorNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { buildPanelKind } from 'app/features/dashboard/api/ResponseTransformers';
 import { DashboardModel } from 'app/features/dashboard/state/DashboardModel';
 import { PanelModel, GridPos } from 'app/features/dashboard/state/PanelModel';

public/app/features/dashboard-scene/sharing/ExportButton/ExportAsCode.tsx

@@ -9,8 +9,8 @@ import { Trans, t } from '@grafana/i18n';
 import { config } from '@grafana/runtime';
 import { SceneComponentProps } from '@grafana/scenes';
 import { Button, ClipboardButton, CodeEditor, Label, Spinner, Stack, Switch, useStyles2 } from '@grafana/ui';
-import { notifyApp } from 'app/core/actions';
 import { createSuccessNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { dispatch } from 'app/store/store';
 
 import { ShareExportTab } from '../ShareExportTab';

public/app/features/dashboard-scene/sharing/ShareSnapshotTab.tsx

@@ -6,8 +6,8 @@ import { Trans, t } from '@grafana/i18n';
 import { SceneComponentProps, sceneGraph, SceneObjectBase, SceneObjectRef, VizPanel } from '@grafana/scenes';
 import { Dashboard } from '@grafana/schema';
 import { Button, ClipboardButton, Field, Input, Modal, RadioButtonGroup, Stack } from '@grafana/ui';
-import { notifyApp } from 'app/core/actions';
 import { createSuccessNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { getTrackingSource, shareDashboardType } from 'app/features/dashboard/components/ShareModal/utils';
 import { getDashboardSnapshotSrv, SnapshotSharingOptions } from 'app/features/dashboard/services/SnapshotSrv';
 import { dispatch } from 'app/store/store';

public/app/features/dashboard/api/publicDashboardApi.ts

@@ -3,8 +3,8 @@ import { createApi } from '@reduxjs/toolkit/query/react';
 import { createBaseQuery } from '@grafana/api-clients/rtkq';
 import { t } from '@grafana/i18n';
 import { config, FetchError, isFetchError } from '@grafana/runtime';
-import { notifyApp } from 'app/core/actions';
 import { createErrorNotification, createSuccessNotification } from 'app/core/copy/appNotification';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import {
   PublicDashboard,
   PublicDashboardSettings,

public/app/features/dashboard/components/DashNav/DashNav.tsx

@@ -14,7 +14,6 @@ import {
   ToolbarButtonRow,
   ConfirmModal,
 } from '@grafana/ui';
-import { updateNavIndex } from 'app/core/actions';
 import { appEvents } from 'app/core/app_events';
 import { AppChromeUpdate } from 'app/core/components/AppChrome/AppChromeUpdate';
 import { NavToolbarSeparator } from 'app/core/components/AppChrome/NavToolbar/NavToolbarSeparator';
@@ -22,7 +21,7 @@ import config from 'app/core/config';
 import { useAppNotification } from 'app/core/copy/appNotification';
 import { useBusEvent } from 'app/core/hooks/useBusEvent';
 import { ID_PREFIX, setStarred } from 'app/core/reducers/navBarTree';
-import { removeNavIndex } from 'app/core/reducers/navModel';
+import { removeNavIndex, updateNavIndex } from 'app/core/reducers/navModel';
 import AddPanelButton from 'app/features/dashboard/components/AddPanelButton/AddPanelButton';
 import { SaveDashboardDrawer } from 'app/features/dashboard/components/SaveDashboard/SaveDashboardDrawer';
 import { getDashboardSrv } from 'app/features/dashboard/services/DashboardSrv';

public/app/features/dashboard/components/PanelEditor/PanelEditor.tsx

@@ -24,6 +24,7 @@ import { appEvents } from 'app/core/app_events';
 import { AppChromeUpdate } from 'app/core/components/AppChrome/AppChromeUpdate';
 import { Page } from 'app/core/components/Page/Page';
 import { SplitPaneWrapper } from 'app/core/components/SplitPaneWrapper/SplitPaneWrapper';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { SubMenuItems } from 'app/features/dashboard/components/SubMenu/SubMenuItems';
 import { SaveLibraryPanelModal } from 'app/features/library-panels/components/SaveLibraryPanelModal/SaveLibraryPanelModal';
 import { PanelModelWithLibraryPanel } from 'app/features/library-panels/types';
@@ -32,7 +33,6 @@ import { updateTimeZoneForSession } from 'app/features/profile/state/reducers';
 import { PanelOptionsChangedEvent, ShowModalReactEvent } from 'app/types/events';
 import { StoreState } from 'app/types/store';
 
-import { notifyApp } from '../../../../core/actions';
 import { UnlinkModal } from '../../../dashboard-scene/scene/UnlinkModal';
 import { isPanelModelLibraryPanel } from '../../../library-panels/guard';
 import { getVariablesByKey } from '../../../variables/state/selectors';

public/app/features/dashboard/containers/DashboardPage.test.tsx

@@ -8,10 +8,10 @@ import { createTheme } from '@grafana/data';
 import { selectors } from '@grafana/e2e-selectors';
 import { config, setDataSourceSrv } from '@grafana/runtime';
 import { Dashboard } from '@grafana/schema';
-import { notifyApp } from 'app/core/actions';
 import { AppChrome } from 'app/core/components/AppChrome/AppChrome';
 import { getRouteComponentProps } from 'app/core/navigation/mocks/routeProps';
 import { RouteDescriptor } from 'app/core/navigation/types';
+import { notifyApp } from 'app/core/reducers/appNotification';
 import { HOME_NAV_ID } from 'app/core/reducers/navModel';
 import { DashboardInitPhase, DashboardMeta, DashboardRoutes } from 'app/types/dashboard';