Alerting: Improve errors from failed requests in historian app.

Passing an empty body to the query handler would result in the rather unhelpful
response of "EOF", so add some prefixes to errors in useful places.

apps/alerting/historian/pkg/app/notification/notification.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 
 	"github.com/grafana/grafana-app-sdk/app"
@@ -49,7 +50,7 @@ func (n *Notification) QueryHandler(ctx context.Context, writer app.CustomRouteR
 			ErrStatus: metav1.Status{
 				Status:  metav1.StatusFailure,
 				Code:    http.StatusBadRequest,
-				Message: err.Error(),
+				Message: fmt.Sprintf("parse request: %s", err.Error()),
 			}}
 	}
 
@@ -67,7 +68,7 @@ func (n *Notification) QueryHandler(ctx context.Context, writer app.CustomRouteR
 			ErrStatus: metav1.Status{
 				Status:  metav1.StatusFailure,
 				Code:    http.StatusInternalServerError,
-				Message: err.Error(),
+				Message: fmt.Sprintf("notification query: %s", err.Error()),
 			}}
 	}
 

apps/iam/go.sum

@@ -377,10 +377,10 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/centrifugal/centrifuge v0.37.2 h1:rerQNvDfYN2FZEkVtb/hvGV7SIrJfEQrKF3MaE8GDlo=
-github.com/centrifugal/centrifuge v0.37.2/go.mod h1:aj4iRJGhzi3SlL8iUtVezxway1Xf8g+hmNQkLLO7sS8=
-github.com/centrifugal/protocol v0.16.2 h1:KoIHgDeX1fFxyxQoKW+6E8ZTCf5mwGm8JyGoJ5NBMbQ=
-github.com/centrifugal/protocol v0.16.2/go.mod h1:Q7OpS/8HMXDnL7f9DpNx24IhG96MP88WPpVTTCdrokI=
+github.com/centrifugal/centrifuge v0.38.0 h1:UJTowwc5lSwnpvd3vbrTseODbU7osSggN67RTrJ8EfQ=
+github.com/centrifugal/centrifuge v0.38.0/go.mod h1:rcZLARnO5GXOeE9qG7iIPMvERxESespqkSX4cGLCAzo=
+github.com/centrifugal/protocol v0.17.0 h1:hD0WczyiG7zrVJcgkQsd5/nhfFXt0Y04SJHV2Z7B1rg=
+github.com/centrifugal/protocol v0.17.0/go.mod h1:9MdiYyjw5Bw1+d5Sp4Y0NK+qiuTNyd88nrHJsUUh8k4=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -1376,11 +1376,13 @@ github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9p
 github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
 github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
 github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/quagmt/udecimal v1.9.0 h1:TLuZiFeg0HhS6X8VDa78Y6XTaitZZfh+z5q4SXMzpDQ=
+github.com/quagmt/udecimal v1.9.0/go.mod h1:ScmJ/xTGZcEoYiyMMzgDLn79PEJHcMBiJ4NNRT3FirA=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01jfAE=
 github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
-github.com/redis/rueidis v1.0.64 h1:XqgbueDuNV3qFdVdQwAHJl1uNt90zUuAJuzqjH4cw6Y=
-github.com/redis/rueidis v1.0.64/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
+github.com/redis/rueidis v1.0.68 h1:gept0E45JGxVigWb3zoWHvxEc4IOC7kc4V/4XvN8eG8=
+github.com/redis/rueidis v1.0.68/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=

apps/iam/pkg/app/app.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/prometheus/client_golang/prometheus"
+
 	"github.com/grafana/grafana-app-sdk/app"
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
@@ -12,7 +14,6 @@ import (
 	foldersKind "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/apps/iam/pkg/reconcilers"
 	"github.com/grafana/grafana/pkg/services/authz"
-	"github.com/prometheus/client_golang/prometheus"
 )
 
 var appManifestData = app.ManifestData{
@@ -78,7 +79,7 @@ func New(cfg app.Config) (app.App, error) {
 	folderReconciler, err := reconcilers.NewFolderReconciler(reconcilers.ReconcilerConfig{
 		ZanzanaCfg: appSpecificConfig.ZanzanaClientCfg,
 		Metrics:    metrics,
-	})
+	}, appSpecificConfig.MetricsRegisterer)
 	if err != nil {
 		return nil, fmt.Errorf("unable to create FolderReconciler: %w", err)
 	}

apps/iam/pkg/reconcilers/folder_reconciler.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
@@ -35,9 +36,9 @@ type FolderReconciler struct {
 	metrics         *ReconcilerMetrics
 }
 
-func NewFolderReconciler(cfg ReconcilerConfig) (operator.Reconciler, error) {
+func NewFolderReconciler(cfg ReconcilerConfig, reg prometheus.Registerer) (operator.Reconciler, error) {
 	// Create Zanzana client
-	zanzanaClient, err := authz.NewRemoteZanzanaClient("*", cfg.ZanzanaCfg)
+	zanzanaClient, err := authz.NewRemoteZanzanaClient(cfg.ZanzanaCfg, reg)
 
 	if err != nil {
 		return nil, fmt.Errorf("unable to create zanzana client: %w", err)

docs/sources/as-code/observability-as-code/provision-resources/file-path-setup.md

@@ -54,7 +54,7 @@ For production systems, use the `folderFromFilesStructure` capability instead of
 ## Before you begin
 
 {{< admonition type="note" >}}
-Enable the `provisioning` and `kubernetesDashboards` feature toggles in Grafana to use this feature.
+Enable the `provisioning` feature toggle in Grafana to use this feature.
 {{< /admonition >}}
 
 To set up file provisioning, you need:
@@ -67,7 +67,7 @@ To set up file provisioning, you need:
 
 ## Enable required feature toggles and configure permitted paths
 
-To activate local file provisioning in Grafana, you need to enable the `provisioning` and `kubernetesDashboards` feature toggles.
+To activate local file provisioning in Grafana, you need to enable the `provisioning` feature toggle.
 For additional information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles).
 
 The local setting must be a relative path and its relative path must be configured in the `permitted_provisioned_paths` configuration option.
@@ -82,12 +82,11 @@ Any subdirectories are automatically included.
 The values that you enter for the `permitted_provisioning_paths` become the base paths for those entered when you enter a local path in the **Connect to local storage** wizard.
 
 1. Open your Grafana configuration file, either `grafana.ini` or `custom.ini`. For file location based on operating system, refer to [Configuration file location](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
-1. Locate or add a `[feature_toggles]` section. Add these values:
+1. Locate or add a `[feature_toggles]` section. Add this value:
 
    ```ini
    [feature_toggles]
    provisioning = true
-   kubernetesDashboards = true ; use k8s from browser
    ```
 
 1. Locate or add a `[paths]` section. To add more than one location, use the pipe character (`|`) to separate the paths. The list should not include empty paths or trailing pipes. Add these values:

docs/sources/as-code/observability-as-code/provision-resources/git-sync-setup.md

@@ -29,76 +29,70 @@ You can sign up to the private preview using the [Git Sync early access form](ht
 
 {{< /admonition >}}
 
-Git Sync lets you manage Grafana dashboards as code by storing dashboard JSON files and folders in a remote GitHub repository.
-
-To set up Git Sync and synchronize with a GitHub repository follow these steps:
-
-1. [Enable feature toggles in Grafana](#enable-required-feature-toggles) (first time set up).
-1. [Create a GitHub access token](#create-a-github-access-token).
-1. [Configure a connection to your GitHub repository](#set-up-the-connection-to-github).
-1. [Choose what content to sync with Grafana](#choose-what-to-synchronize).
-
-Optionally, you can [extend Git Sync](#configure-webhooks-and-image-rendering) by enabling pull request notifications and image previews of dashboard changes.
-
-| Capability                                            | Benefit                                                                         | Requires                               |
-| ----------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------- |
-| Adds a table summarizing changes to your pull request | Provides a convenient way to save changes back to GitHub.                       | Webhooks configured                    |
-| Add a dashboard preview image to a PR                 | View a snapshot of dashboard changes to a pull request without opening Grafana. | Image renderer and webhooks configured |
-
-{{< admonition type="note" >}}
-
-Alternatively, you can configure a local file system instead of using GitHub. Refer to [Set up file provisioning](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/file-path-setup/) for more information.
-
-{{< /admonition >}}
-
-## Performance impacts of enabling Git Sync
-
-Git Sync is an experimental feature and is under continuous development. Reporting any issues you encounter can help us improve Git Sync.
-
-When Git Sync is enabled, the database load might increase, especially for instances with a lot of folders and nested folders. Evaluate the performance impact, if any, in a non-production environment.
+This guide shows you how to set up Git Sync to synchronize your Grafana dashboards and folders with a GitHub repository. You'll set up Git Sync to enable version-controlled dashboard management either [using the UI](#set-up-git-sync-using-grafana-ui) or [as code](#set-up-git-sync-as-code).
 
 ## Before you begin
 
-{{< admonition type="caution" >}}
+Before you begin, ensure you have the following:
 
-Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#known-limitations/) before using Git Sync.
+- A Grafana instance (Cloud, OSS, or Enterprise).
+- If you're [using webhooks or image rendering](#extend-git-sync-for-real-time-notification-and-image-rendering), a public instance with external access
+- Administration rights in your Grafana organization
+- A [GitHub private access token](#create-a-github-access-token)
+- A GitHub repository to store your dashboards in
+- Optional: The [Image Renderer service](https://github.com/grafana/grafana-image-renderer) to save image previews with your PRs
+
+### Known limitations
+
+Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync#known-limitations) before using Git Sync.
+
+Refer to [Supported resources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync#supported-resources) for details about which resources you can sync.
+
+### Performance considerations
+
+When Git Sync is enabled, the database load might increase, especially for instances with many folders and nested folders. Evaluate the performance impact, if any, in a non-production environment.
+
+Git Sync is under continuous development. [Report any issues](https://grafana.com/help/) you encounter to help us improve Git Sync.
+
+## Set up Git Sync
+
+To set up Git Sync and synchronize with a GitHub repository, follow these steps:
+
+1. [Enable feature toggles in Grafana](#enable-required-feature-toggles) (first time setup)
+1. [Create a GitHub access token](#create-a-github-access-token)
+1. Set up Git Sync [using the UI](#set-up-git-sync-using-grafana-ui) or [as code](#set-up-git-sync-as-code)
+
+After setup, you can [verify your dashboards](#verify-your-dashboards-in-grafana).
+
+Optionally, you can also [extend Git Sync with webhooks and image rendering](#extend-git-sync-for-real-time-notification-and-image-rendering).
+
+{{< admonition type="note" >}}
+
+Alternatively, you can configure a local file system instead of using GitHub. Refer to [Set up file provisioning](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/file-path-setup/) for more information.
 
 {{< /admonition >}}
 
-### Requirements
-
-To set up Git Sync, you need:
-
-- Administration rights in your Grafana organization.
-- Enable the required feature toggles in your Grafana instance. Refer to [Enable required feature toggles](#enable-required-feature-toggles) for instructions.
-- A GitHub repository to store your dashboards in.
-  - If you want to use a local file path, refer to [the local file path guide](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/file-path-setup/).
-- A GitHub access token. The Grafana UI will prompt you during setup.
-- Optional: A public Grafana instance.
-- Optional: The [Image Renderer service](https://github.com/grafana/grafana-image-renderer) to save image previews with your PRs.
-
 ## Enable required feature toggles
 
-To activate Git Sync in Grafana, you need to enable the `provisioning` and `kubernetesDashboards` feature toggles.
-For additional information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles).
+To activate Git Sync in Grafana, you need to enable the `provisioning` feature toggle. For more information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
 
-To enable the required feature toggles, add them to your Grafana configuration file:
+To enable the required feature toggle:
 
 1. Open your Grafana configuration file, either `grafana.ini` or `custom.ini`. For file location based on operating system, refer to [Configuration file location](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
-1. Locate or add a `[feature_toggles]` section. Add these values:
+1. Locate or add a `[feature_toggles]` section. Add this value:
 
    ```ini
    [feature_toggles]
    provisioning = true
-   kubernetesDashboards = true ; use k8s from browser
    ```
 
 1. Save the changes to the file and restart Grafana.
 
 ## Create a GitHub access token
 
-Whenever you connect to a GitHub repository, you need to create a GitHub access token with specific repository permissions.
-This token needs to be added to your Git Sync configuration to enable read and write permissions between Grafana and GitHub repository.
+Whenever you connect to a GitHub repository, you need to create a GitHub access token with specific repository permissions. This token needs to be added to your Git Sync configuration to enable read and write permissions between Grafana and GitHub repository.
+
+To create a GitHub access token:
 
 1. Create a new token using [Create new fine-grained personal access token](https://github.com/settings/personal-access-tokens/new). Refer to [Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) for instructions.
 1. Under **Permissions**, expand **Repository permissions**.
@@ -112,19 +106,23 @@ This token needs to be added to your Git Sync configuration to enable read and w
 1. Verify the options and select **Generate token**.
 1. Copy the access token. Leave the browser window available with the token until you've completed configuration.
 
-GitHub Apps are not currently supported.
+GitHub Apps aren't currently supported.
 
-## Set up the connection to GitHub
+## Set up Git Sync using Grafana UI
 
-Use **Provisioning** to guide you through setting up Git Sync to use a GitHub repository.
+1. [Configure a connection to your GitHub repository](#set-up-the-connection-to-github)
+1. [Choose what content to sync with Grafana](#choose-what-to-synchronize)
+1. [Choose additional settings](#choose-additional-settings)
+
+### Set up the connection to GitHub
+
+Use **Provisioning** to guide you through setting up Git Sync to use a GitHub repository:
 
 1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
 1. Select **Administration** in the left-side menu and then **Provisioning**.
 1. Select **Configure Git Sync**.
 
-### Connect to external storage
-
-To connect your GitHub repository, follow these steps:
+To connect your GitHub repository:
 
 1. Paste your GitHub personal access token into **Enter your access token**. Refer to [Create a GitHub access token](#create-a-github-access-token) for instructions.
 1. Paste the **Repository URL** for your GitHub repository into the text box.
@@ -134,32 +132,12 @@ To connect your GitHub repository, follow these steps:
 
 ### Choose what to synchronize
 
-In this step you can decide which elements to synchronize. Keep in mind the available options depend on the status of your Grafana instance.
+In this step, you can decide which elements to synchronize. The available options depend on the status of your Grafana instance:
 
 - If the instance contains resources in an incompatible data format, you'll have to migrate all the data using instance sync. Folder sync won't be supported.
-- If there is already another connection using folder sync, instance sync won't be offered.
+- If there's already another connection using folder sync, instance sync won't be offered.
 
-#### Synchronization limitations
-
-Git Sync only supports dashboards and folders. Alerts, panels, and other resources are not supported yet.
-
-{{< admonition type="caution" >}}
-
-Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#known-limitations/) before using Git Sync. Refer to [Supported resources](/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#supported-resources) for details about which resources you can sync.
-
-{{< /admonition >}}
-
-Full instance sync is not available in Grafana Cloud.
-
-In Grafana OSS/Enterprise:
-
-- If you try to perform a full instance sync with resources that contain alerts or panels, Git Sync will block the connection.
-- You won't be able to create new alerts or library panels after the setup is completed.
-- If you opted for full instance sync and want to use alerts and library panels, you'll have to delete the synced repository and connect again with folder sync.
-
-#### Set up synchronization
-
-To set up synchronization, choose to either sync your entire organization resources with external storage, or to sync certain resources to a new Grafana folder (with up to 10 connections).
+To set up synchronization:
 
 - Choose **Sync all resources with external storage** if you want to sync and manage your entire Grafana instance through external storage. With this option, all of your dashboards are synced to that one repository. You can only have one provisioned connection with this selection, and you won't have the option of setting up additional repositories to connect to.
 - Choose **Sync external storage to new Grafana folder** to sync external resources into a new folder without affecting the rest of your instance. You can repeat this process for up to 10 connections.
@@ -170,20 +148,183 @@ Next, enter a **Display name** for the repository connection. Resources stored i
 
 Finally, you can set up how often your configured storage is polled for updates.
 
+To configure additional settings:
+
 1. For **Update instance interval (seconds)**, enter how often you want the instance to pull updates from GitHub. The default value is 60 seconds.
 1. Optional: Select **Read only** to ensure resources can't be modified in Grafana.
-1. Optional: If you have the Grafana Image Renderer plugin configured, you can **Enable dashboards previews in pull requests**. If image rendering is not available, then you can't select this option. For more information, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
+1. Optional: If you have the Grafana Image Renderer plugin configured, you can **Enable dashboards previews in pull requests**. If image rendering isn't available, then you can't select this option. For more information, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
 1. Select **Finish** to proceed.
 
+### Modify your configuration after setup is complete
+
+To update your repository configuration after you've completed setup:
+
+1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
+1. Select **Administration** in the left-side menu and then **Provisioning**.
+1. Select **Settings** for the repository you wish to modify.
+1. Use the **Configure repository** screen to update any of the settings.
+1. Select **Save** to preserve the updates.
+
+## Set up Git Sync as code
+
+Alternatively, you can also configure Git Sync using `grafanactl`. Since Git Sync configuration is managed as code using Custom Resource Definitions (CRDs), you can create a Repository CRD in a YAML file and use `grafanactl` to push it to Grafana. This approach enables automated, GitOps-style workflows for managing Git Sync configuration instead of using the Grafana UI.
+
+To set up Git Sync with `grafanactl`, follow these steps:
+
+1. [Create the repository CRD](#create-the-repository-crd)
+1. [Push the repository CRD to Grafana](#push-the-repository-crd-to-grafana)
+1. [Manage repository resources](#manage-repository-resources)
+1. [Verify setup](#verify-setup)
+
+For more information, refer to the following documents:
+
+- [grafanactl Documentation](https://grafana.github.io/grafanactl/)
+- [Repository CRD Reference](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-setup/)
+- [Dashboard CRD Format](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/export-resources/)
+
+### Create the repository CRD
+
+Create a `repository.yaml` file defining your Git Sync configuration:
+
+```yaml
+apiVersion: provisioning.grafana.app/v0alpha1
+kind: Repository
+metadata:
+  name: <REPOSITORY_NAME>
+spec:
+  title: <REPOSITORY_TITLE>
+  type: github
+  github:
+    url: <GITHUB_REPO_URL>
+    branch: <BRANCH>
+    path: grafana/
+    generateDashboardPreviews: true
+  sync:
+    enabled: true
+    intervalSeconds: 60
+    target: folder
+  workflows:
+    - write
+    - branch
+secure:
+  token:
+    create: <GITHUB_PAT>
+```
+
+Replace the placeholders with your values:
+
+- _`<REPOSITORY_NAME>`_: Unique identifier for this repository resource
+- _`<REPOSITORY_TITLE>`_: Human-readable name displayed in Grafana UI
+- _`<GITHUB_REPO_URL>`_: GitHub repository URL
+- _`<BRANCH>`_: Branch to sync
+- _`<GITHUB_PAT>`_: GitHub Personal Access Token
+
+{{< admonition type="note" >}}
+
+Only `target: folder` is currently supported for Git Sync.
+
+{{< /admonition >}}
+
+#### Configuration parameters
+
+The following configuration parameters are available:
+
+| Field                                   | Description                                                 |
+| --------------------------------------- | ----------------------------------------------------------- |
+| `metadata.name`                         | Unique identifier for this repository resource              |
+| `spec.title`                            | Human-readable name displayed in Grafana UI                 |
+| `spec.type`                             | Repository type (`github`)                                  |
+| `spec.github.url`                       | GitHub repository URL                                       |
+| `spec.github.branch`                    | Branch to sync                                              |
+| `spec.github.path`                      | Directory path containing dashboards                        |
+| `spec.github.generateDashboardPreviews` | Generate preview images (true/false)                        |
+| `spec.sync.enabled`                     | Enable synchronization (true/false)                         |
+| `spec.sync.intervalSeconds`             | Sync interval in seconds                                    |
+| `spec.sync.target`                      | Where to place synced dashboards (`folder`)                 |
+| `spec.workflows`                        | Enabled workflows: `write` (direct commits), `branch` (PRs) |
+| `secure.token.create`                   | GitHub Personal Access Token                                |
+
+### Push the repository CRD to Grafana
+
+Before pushing any resources, configure `grafanactl` with your Grafana instance details. Refer to the [grafanactl configuration documentation](https://grafana.github.io/grafanactl/) for setup instructions.
+
+Push the repository configuration:
+
+```sh
+grafanactl resources push --path <DIRECTORY>
+```
+
+The `--path` parameter has to point to the directory containing your `repository.yaml` file.
+
+After pushing, Grafana will:
+
+1. Create the repository resource
+1. Connect to your GitHub repository
+1. Pull dashboards from the specified path
+1. Begin syncing at the configured interval
+
+### Manage repository resources
+
+#### List repositories
+
+To list all repositories:
+
+```sh
+grafanactl resources get repositories
+```
+
+#### Get repository details
+
+To get details for a specific repository:
+
+```sh
+grafanactl resources get repository/<REPOSITORY_NAME>
+grafanactl resources get repository/<REPOSITORY_NAME> -o json
+grafanactl resources get repository/<REPOSITORY_NAME> -o yaml
+```
+
+#### Update the repository
+
+To update a repository:
+
+```sh
+grafanactl resources edit repository/<REPOSITORY_NAME>
+```
+
+#### Delete the repository
+
+To delete a repository:
+
+```sh
+grafanactl resources delete repository/<REPOSITORY_NAME>
+```
+
+### Verify setup
+
+Check that Git Sync is working:
+
+```sh
+# List repositories
+grafanactl resources get repositories
+
+# Check Grafana UI
+# Navigate to: Administration → Provisioning → Git Sync
+```
+
 ## Verify your dashboards in Grafana
 
 To verify that your dashboards are available at the location that you specified, click **Dashboards**. The name of the dashboard is listed in the **Name** column.
 
-Now that your dashboards have been synced from a repository, you can customize the name, change the branch, and create a pull request (PR) for it. Refer to [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/use-git-sync/) for more information.
+Now that your dashboards have been synced from a repository, you can customize the name, change the branch, and create a pull request (PR) for it. Refer to [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/use-git-sync/) for more information.
 
-## Configure webhooks and image rendering
+## Extend Git Sync for real-time notification and image rendering
 
-You can extend Git Sync by getting instant updates and pull requests using webhooks and add dashboard previews in pull requests.
+Optionally, you can extend Git Sync by enabling pull request notifications and image previews of dashboard changes.
+
+| Capability                                            | Benefit                                                                        | Requires                               |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------- |
+| Adds a table summarizing changes to your pull request | Provides a convenient way to save changes back to GitHub                       | Webhooks configured                    |
+| Add a dashboard preview image to a PR                 | View a snapshot of dashboard changes to a pull request without opening Grafana | Image renderer and webhooks configured |
 
 ### Set up webhooks for realtime notification and pull request integration
 
@@ -191,25 +332,26 @@ When connecting to a GitHub repository, Git Sync uses webhooks to enable real-ti
 
 You can set up webhooks with whichever service or tooling you prefer. You can use Cloudflare Tunnels with a Cloudflare-managed domain, port-forwarding and DNS options, or a tool such as `ngrok`.
 
-To set up webhooks you need to expose your Grafana instance to the public Internet. You can do this via port forwarding and DNS, a tool such as `ngrok`, or any other method you prefer. The permissions set in your GitHub access token provide the authorization for this communication.
+To set up webhooks, you need to expose your Grafana instance to the public Internet. You can do this via port forwarding and DNS, a tool such as `ngrok`, or any other method you prefer. The permissions set in your GitHub access token provide the authorization for this communication.
 
 After you have the public URL, you can add it to your Grafana configuration file:
 
-```yaml
+```ini
 [server]
-root_url = https://PUBLIC_DOMAIN.HERE
+root_url = https://<PUBLIC_DOMAIN>
 ```
 
+Replace _`<PUBLIC_DOMAIN>`_ with your public domain.
+
 To check the configured webhooks, go to **Administration** > **Provisioning** and click the **View** link for your GitHub repository.
 
 #### Expose necessary paths only
 
-If your security setup does not permit publicly exposing the Grafana instance, you can either choose to `allowlist` the GitHub IP addresses, or expose only the necessary paths.
+If your security setup doesn't permit publicly exposing the Grafana instance, you can either choose to allowlist the GitHub IP addresses, or expose only the necessary paths.
 
 The necessary paths required to be exposed are, in RegExp:
 
 - `/apis/provisioning\.grafana\.app/v0(alpha1)?/namespaces/[^/]+/repositories/[^/]+/(webhook|render/.*)$`
-<!-- TODO: Path for the blob storage for image rendering? @ryantxu would know this best. -->
 
 ### Set up image rendering for dashboard previews
 
@@ -217,12 +359,13 @@ Set up image rendering to add visual previews of dashboard updates directly in p
 
 To enable this capability, install the Grafana Image Renderer in your Grafana instance. For more information and installation instructions, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
 
-## Modify configurations after set up is complete
+## Next steps
 
-To update your repository configuration after you've completed set up:
+You've successfully set up Git Sync to manage your Grafana dashboards through version control. Your dashboards are now synchronized with a GitHub repository, enabling collaborative development and change tracking.
 
-1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
-1. Select **Administration** in the left-side menu and then **Provisioning**.
-1. Select **Settings** for the repository you wish to modify.
-1. Use the **Configure repository** screen to update any of the settings.
-1. Select **Save** to preserve the updates.
+To learn more about using Git Sync:
+
+- [Work with provisioned dashboards](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/provisioned-dashboards/)
+- [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/use-git-sync/)
+- [Export resources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/export-resources/)
+- [grafanactl documentation](https://grafana.github.io/grafanactl/)

docs/sources/datasources/mysql/troubleshoot/index.md

@@ -0,0 +1,80 @@
+---
+description: Learn how to troubleshoot common problems with the Grafana MySQL data source plugin
+keywords:
+  - grafana
+  - mysql
+  - query
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+menuTitle: Troubleshoot
+title: Troubleshoot common problems with the Grafana MySQL data source plugin
+weight: 40
+refs:
+  variables:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/
+  variable-syntax-advanced-variable-format-options:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/variables/variable-syntax/#advanced-variable-format-options
+  annotate-visualizations:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
+  explore:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
+  query-transform-data:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/
+  panel-inspector:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/panel-inspector/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/panel-inspector/
+  query-editor:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/#query-editors
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/#query-editors
+  alert-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/
+  template-annotations-and-labels:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/templates/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/templates/
+  configure-standard-options:
+    - pattern: /docs/grafana/
+    - destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/
+---
+
+# Troubleshoot common problems with the Grafana MySQL data source plugin
+
+This page lists common issues you might experience when setting up the Grafana MySQL data source plugin.
+
+### My data source connection fails when using the Grafana MySQL data source plugin
+
+- Check if the MySQL server is up and running.
+- Make sure that your firewall is open for MySQL server (default port is `3306`).
+- Ensure that you have the correct permissions to access the MySQL server and also have permission to access the database.
+- If the error persists, create a new user for the Grafana MySQL data source plugin with correct permissions and try to connect with it.
+
+### What should I do if I see "An unexpected error happened" or "Could not connect to MySQL" after trying all of the above?
+
+- Check the Grafana logs for more details about the error.
+- For Grafana Cloud customers, contact support.

go.mod

@@ -48,7 +48,7 @@ require (
 	github.com/blugelabs/bluge_segment_api v0.2.0 // @grafana/grafana-backend-group
 	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // @grafana/grafana-backend-group
 	github.com/bwmarrin/snowflake v0.3.0 // @grafana/grafana-app-platform-squad
-	github.com/centrifugal/centrifuge v0.37.2 // @grafana/grafana-app-platform-squad
+	github.com/centrifugal/centrifuge v0.38.0 // @grafana/grafana-app-platform-squad
 	github.com/crewjam/saml v0.4.14 // @grafana/identity-access-team
 	github.com/dgraph-io/badger/v4 v4.7.0 // @grafana/grafana-search-and-storage
 	github.com/dlmiddlecote/sqlstats v1.0.2 // @grafana/grafana-backend-group
@@ -386,7 +386,7 @@ require (
 	github.com/caio/go-tdigest v3.1.0+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // @grafana/alerting-backend
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/centrifugal/protocol v0.16.2 // indirect
+	github.com/centrifugal/protocol v0.17.0 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cheekybits/genny v1.0.0 // indirect
@@ -562,7 +562,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20241112170944-20d2c9ebc01d // indirect
 	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
-	github.com/redis/rueidis v1.0.64 // indirect
+	github.com/redis/rueidis v1.0.68 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
@@ -687,6 +687,7 @@ require (
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/quagmt/udecimal v1.9.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.3 // indirect
 	github.com/tklauser/go-sysconf v0.3.14 // indirect
 	github.com/tklauser/numcpus v0.8.0 // indirect

go.sum

@@ -1006,10 +1006,10 @@ github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F9
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/centrifugal/centrifuge v0.37.2 h1:rerQNvDfYN2FZEkVtb/hvGV7SIrJfEQrKF3MaE8GDlo=
-github.com/centrifugal/centrifuge v0.37.2/go.mod h1:aj4iRJGhzi3SlL8iUtVezxway1Xf8g+hmNQkLLO7sS8=
-github.com/centrifugal/protocol v0.16.2 h1:KoIHgDeX1fFxyxQoKW+6E8ZTCf5mwGm8JyGoJ5NBMbQ=
-github.com/centrifugal/protocol v0.16.2/go.mod h1:Q7OpS/8HMXDnL7f9DpNx24IhG96MP88WPpVTTCdrokI=
+github.com/centrifugal/centrifuge v0.38.0 h1:UJTowwc5lSwnpvd3vbrTseODbU7osSggN67RTrJ8EfQ=
+github.com/centrifugal/centrifuge v0.38.0/go.mod h1:rcZLARnO5GXOeE9qG7iIPMvERxESespqkSX4cGLCAzo=
+github.com/centrifugal/protocol v0.17.0 h1:hD0WczyiG7zrVJcgkQsd5/nhfFXt0Y04SJHV2Z7B1rg=
+github.com/centrifugal/protocol v0.17.0/go.mod h1:9MdiYyjw5Bw1+d5Sp4Y0NK+qiuTNyd88nrHJsUUh8k4=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -2334,11 +2334,13 @@ github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9p
 github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
 github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
 github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/quagmt/udecimal v1.9.0 h1:TLuZiFeg0HhS6X8VDa78Y6XTaitZZfh+z5q4SXMzpDQ=
+github.com/quagmt/udecimal v1.9.0/go.mod h1:ScmJ/xTGZcEoYiyMMzgDLn79PEJHcMBiJ4NNRT3FirA=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01jfAE=
 github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
-github.com/redis/rueidis v1.0.64 h1:XqgbueDuNV3qFdVdQwAHJl1uNt90zUuAJuzqjH4cw6Y=
-github.com/redis/rueidis v1.0.64/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
+github.com/redis/rueidis v1.0.68 h1:gept0E45JGxVigWb3zoWHvxEc4IOC7kc4V/4XvN8eG8=
+github.com/redis/rueidis v1.0.68/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=

go.work.sum

@@ -708,6 +708,8 @@ github.com/envoyproxy/go-control-plane/envoy v1.32.3/go.mod h1:F6hWupPfh75TBXGKA
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
+github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731 h1:R/ZjJpjQKsZ6L/+Gf9WHbt31GG8NMVcpRqUE+1mMIyo=
+github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731/go.mod h1:M9R1FoZ3y//hwwnJtO51ypFGwm8ZfpxPT/ZLtO1mcgQ=
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
@@ -1330,6 +1332,7 @@ github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgc
 github.com/pkg/sftp v1.13.1 h1:I2qBYMChEhIjOgazfJmV3/mZM256btk6wkCDRmW7JYs=
 github.com/pkg/xattr v0.4.10 h1:Qe0mtiNFHQZ296vRgUjRCoPHPqH7VdTOrZx3g0T+pGA=
 github.com/pkg/xattr v0.4.10/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
+github.com/planetscale/vtprotobuf v0.6.0/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
@@ -1397,6 +1400,7 @@ github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtm
 github.com/schollz/progressbar/v3 v3.14.6 h1:GyjwcWBAf+GFDMLziwerKvpuS7ZF+mNTAXIB2aspiZs=
 github.com/schollz/progressbar/v3 v3.14.6/go.mod h1:Nrzpuw3Nl0srLY0VlTvC4V6RL50pcEymjy6qyJAaLa0=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
+github.com/segmentio/asm v1.1.4/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
 github.com/segmentio/fasthash v1.0.3 h1:EI9+KE1EwvMLBWwjpRDc+fEM+prwxDYbslddQGtrmhM=
 github.com/segmentio/fasthash v1.0.3/go.mod h1:waKX8l2N8yckOgmSsXJi7x1ZfdKZ4x7KRMzBtS3oedY=
 github.com/segmentio/parquet-go v0.0.0-20220811205829-7efc157d28af/go.mod h1:PxYdAI6cGd+s1j4hZDQbz3VFgobF5fDA0weLeNWKTE4=
@@ -1935,6 +1939,7 @@ golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT
 golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
@@ -2001,6 +2006,7 @@ golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
@@ -2077,6 +2083,7 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4/go.mod h1:NnuHhy+bxcg30o7FnVAZbXsPHUDQ9qKWAQKCD7VxFtk=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250603155806-513f23925822 h1:zWFRixYR5QlotL+Uv3YfsPRENIrQFXiGs+iwqel6fOQ=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250603155806-513f23925822/go.mod h1:h6yxum/C2qRb4txaZRLDHK8RyS0H/o2oEDeKY4onY/Y=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97/go.mod h1:v7nGkzlmW8P3n/bKmWBn2WpBjpOEx8Q6gMueudAmKfY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
@@ -2107,6 +2114,7 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
+google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
 google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=

package.json

@@ -124,7 +124,6 @@
     "@types/eslint": "9.6.1",
     "@types/eslint-scope": "^8.0.0",
     "@types/file-saver": "2.0.7",
-    "@types/glob": "^9.0.0",
     "@types/google.analytics": "^0.0.46",
     "@types/gtag.js": "^0.0.20",
     "@types/history": "4.7.11",

packages/grafana-e2e-selectors/src/index.ts

@@ -1,5 +1,5 @@
 /**
- * A library containing the different design components of the Grafana ecosystem.
+ * A library containing e2e selectors for the Grafana ecosystem.
  *
  * @packageDocumentation
  */

packages/grafana-ui/src/components/Table/TableNG/TableNG.test.tsx

@@ -451,6 +451,19 @@ describe('TableNG', () => {
       expect(screen.getByText('A1')).toBeInTheDocument();
       expect(screen.getByText('1')).toBeInTheDocument();
     });
+
+    it('shows full column name in title attribute for truncated headers', () => {
+      const { container } = render(
+        <TableNG enableVirtualization={false} data={createBasicDataFrame()} width={800} height={600} />
+      );
+
+      const headers = container.querySelectorAll('[role="columnheader"]');
+      const firstHeaderSpan = headers[0].querySelector('span');
+      const secondHeaderSpan = headers[1].querySelector('span');
+
+      expect(firstHeaderSpan).toHaveAttribute('title', 'Column A');
+      expect(secondHeaderSpan).toHaveAttribute('title', 'Column B');
+    });
   });
 
   describe('Footer options', () => {

packages/grafana-ui/src/components/Table/TableNG/components/HeaderCell.tsx

@@ -55,7 +55,9 @@ const HeaderCell: React.FC<HeaderCellProps> = ({
       {showTypeIcons && (
         <Icon className={styles.headerCellIcon} name={getFieldTypeIcon(field)} title={field?.type} size="sm" />
       )}
-      <span className={styles.headerCellLabel}>{getDisplayName(field)}</span>
+      <span className={styles.headerCellLabel} title={displayName}>
+        {displayName}
+      </span>
       {direction && (
         <Icon
           className={cx(styles.headerCellIcon, styles.headerSortIcon)}

pkg/api/dashboard_test.go

@@ -111,17 +111,15 @@ func TestGetHomeDashboard(t *testing.T) {
 	}
 }
 
-func newTestLive(t *testing.T, store db.DB) *live.GrafanaLive {
+func newTestLive(t *testing.T) *live.GrafanaLive {
 	features := featuremgmt.WithFeatures()
 	cfg := setting.NewCfg()
 	cfg.AppURL = "http://localhost:3000/"
 	gLive, err := live.ProvideService(nil, cfg,
 		routing.NewRouteRegister(),
 		nil, nil, nil, nil,
-		store,
 		nil,
 		&usagestats.UsageStatsMock{T: t},
-		nil,
 		features, acimpl.ProvideAccessControl(features),
 		&dashboards.FakeDashboardService{},
 		nil, nil)
@@ -751,7 +749,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 				hs := HTTPServer{
 					Cfg:                     cfg,
 					ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
-					Live:                    newTestLive(t, db.InitTestDB(t)),
+					Live:                    newTestLive(t),
 					QuotaService:            quotatest.New(false, nil),
 					LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 					DashboardService:        dashboardService,
@@ -1003,7 +1001,7 @@ func postDashboardScenario(t *testing.T, desc string, url string, routePattern s
 		hs := HTTPServer{
 			Cfg:                   cfg,
 			ProvisioningService:   provisioning.NewProvisioningServiceMock(context.Background()),
-			Live:                  newTestLive(t, db.InitTestDB(t)),
+			Live:                  newTestLive(t),
 			QuotaService:          quotatest.New(false, nil),
 			pluginStore:           &pluginstore.FakePluginStore{},
 			LibraryElementService: &libraryelementsfake.LibraryElementService{},
@@ -1043,7 +1041,7 @@ func restoreDashboardVersionScenario(t *testing.T, desc string, url string, rout
 		hs := HTTPServer{
 			Cfg:                     cfg,
 			ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
-			Live:                    newTestLive(t, db.InitTestDB(t)),
+			Live:                    newTestLive(t),
 			QuotaService:            quotatest.New(false, nil),
 			LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 			DashboardService:        mock,

pkg/api/datasources_test.go

@@ -343,7 +343,7 @@ func TestUpdateDataSourceByID_DataSourceNameExists(t *testing.T) {
 		Cfg:                  setting.NewCfg(),
 		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		accesscontrolService: actest.FakeService{},
-		Live:                 newTestLive(t, nil),
+		Live:                 newTestLive(t),
 	}
 
 	sc := setupScenarioContext(t, "/api/datasources/1")
@@ -450,7 +450,7 @@ func TestAPI_datasources_AccessControl(t *testing.T) {
 				hs.Cfg = setting.NewCfg()
 				hs.DataSourcesService = &dataSourcesServiceMock{expectedDatasource: &datasources.DataSource{}}
 				hs.accesscontrolService = actest.FakeService{}
-				hs.Live = newTestLive(t, hs.SQLStore)
+				hs.Live = newTestLive(t)
 				hs.promRegister, hs.dsConfigHandlerRequestsDuration = setupDsConfigHandlerMetrics()
 			})
 

pkg/api/dtos/live.go

@@ -1,11 +0,0 @@
-package dtos
-
-import "encoding/json"
-
-type LivePublishCmd struct {
-	Channel string          `json:"channel"`
-	Data    json.RawMessage `json:"data,omitempty"`
-}
-
-type LivePublishResponse struct {
-}

pkg/operators/iam/zanzana_folder_reconciler.go

@@ -11,15 +11,16 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/prometheus/client_golang/prometheus"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/transport"
+
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
 	folder "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/apps/iam/pkg/app"
 	"github.com/grafana/grafana/pkg/server"
 	"github.com/grafana/grafana/pkg/setting"
-	"github.com/prometheus/client_golang/prometheus"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/transport"
 
 	"github.com/grafana/authlib/authn"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
@@ -95,7 +96,7 @@ func buildIAMConfigFromSettings(cfg *setting.Cfg, registerer prometheus.Register
 	if zanzanaURL == "" {
 		return nil, fmt.Errorf("zanzana_url is required in [operator] section")
 	}
-	iamCfg.AppConfig.ZanzanaClientCfg.URL = zanzanaURL
+	iamCfg.AppConfig.ZanzanaClientCfg.Addr = zanzanaURL
 
 	iamCfg.AppConfig.InformerConfig.MaxConcurrentWorkers = operatorSec.Key("max_concurrent_workers").MustUint64(20)
 

pkg/server/wire_gen.go

@@ -672,10 +672,7 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	starService := starimpl.ProvideService(sqlStore)
 	searchSearchService := search2.ProvideService(cfg, sqlStore, starService, dashboardService, folderimplService, featureToggles, sortService)
 	plugincontextProvider := plugincontext.ProvideService(cfg, cacheService, pluginstoreService, cacheServiceImpl, service15, service13, requestConfigProvider)
-	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
-	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
-	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
-	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, sqlStore, secretsService, usageStats, queryServiceImpl, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
+	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, secretsService, usageStats, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -684,6 +681,8 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	authnAuthenticator := authnimpl.ProvideAuthnServiceAuthenticateOnly(authnimplService)
 	contexthandlerContextHandler := contexthandler.ProvideService(cfg, authnAuthenticator, featureToggles)
 	logger := loggermw.Provide(cfg, featureToggles)
+	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
+	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
 	ngAlert := metrics2.ProvideService()
 	repositoryImpl := annotationsimpl.ProvideService(sqlStore, cfg, featureToggles, tagimplService, tracingService, dBstore, dashboardService, registerer)
 	alertNG, err := ngalert.ProvideService(cfg, featureToggles, cacheServiceImpl, service15, routeRegisterImpl, sqlStore, kvStore, exprService, dataSourceProxyService, quotaService, secretsService, notificationService, ngAlert, folderimplService, accessControl, dashboardService, renderingService, inProcBus, acimplService, repositoryImpl, pluginstoreService, tracingService, dBstore, httpclientProvider, plugincontextProvider, receiverPermissionsService, userService)
@@ -708,6 +707,7 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	}
 	ossSearchUserFilter := filters.ProvideOSSSearchUserFilter()
 	ossService := searchusers.ProvideUsersService(cfg, ossSearchUserFilter, userService)
+	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
 	serviceAccountsProxy, err := proxy.ProvideServiceAccountsProxy(cfg, accessControl, acimplService, featureToggles, serviceAccountPermissionsService, serviceAccountsService, routeRegisterImpl)
 	if err != nil {
 		return nil, err
@@ -1329,10 +1329,7 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	starService := starimpl.ProvideService(sqlStore)
 	searchSearchService := search2.ProvideService(cfg, sqlStore, starService, dashboardService, folderimplService, featureToggles, sortService)
 	plugincontextProvider := plugincontext.ProvideService(cfg, cacheService, pluginstoreService, cacheServiceImpl, service15, service13, requestConfigProvider)
-	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
-	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
-	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
-	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, sqlStore, secretsService, usageStats, queryServiceImpl, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
+	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, secretsService, usageStats, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -1341,6 +1338,8 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	authnAuthenticator := authnimpl.ProvideAuthnServiceAuthenticateOnly(authnimplService)
 	contexthandlerContextHandler := contexthandler.ProvideService(cfg, authnAuthenticator, featureToggles)
 	logger := loggermw.Provide(cfg, featureToggles)
+	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
+	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
 	notificationServiceMock := notifications.MockNotificationService()
 	ngAlert := metrics2.ProvideServiceForTest()
 	repositoryImpl := annotationsimpl.ProvideService(sqlStore, cfg, featureToggles, tagimplService, tracingService, dBstore, dashboardService, registerer)
@@ -1366,6 +1365,7 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	}
 	ossSearchUserFilter := filters.ProvideOSSSearchUserFilter()
 	ossService := searchusers.ProvideUsersService(cfg, ossSearchUserFilter, userService)
+	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
 	serviceAccountsProxy, err := proxy.ProvideServiceAccountsProxy(cfg, accessControl, acimplService, featureToggles, serviceAccountPermissionsService, serviceAccountsService, routeRegisterImpl)
 	if err != nil {
 		return nil, err

pkg/services/authz/rbac.go

@@ -152,7 +152,7 @@ func ProvideStandaloneAuthZClient(
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	zanzanaEnabled := features.IsEnabledGlobally(featuremgmt.FlagZanzana)
 
-	zanzanaClient, err := ProvideStandaloneZanzanaClient(cfg, features)
+	zanzanaClient, err := ProvideStandaloneZanzanaClient(cfg, features, reg)
 	if err != nil {
 		return nil, err
 	}

pkg/services/authz/zanzana.go

@@ -4,16 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"time"
 
 	"github.com/fullstorydev/grpchan/inprocgrpc"
 	authnlib "github.com/grafana/authlib/authn"
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	"github.com/grafana/authlib/grpcutils"
 	"github.com/grafana/authlib/types"
+	"github.com/grafana/dskit/middleware"
 	"github.com/grafana/dskit/services"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
@@ -43,14 +46,14 @@ func ProvideZanzanaClient(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, fea
 
 	switch cfg.ZanzanaClient.Mode {
 	case setting.ZanzanaModeClient:
-		return NewRemoteZanzanaClient(
-			fmt.Sprintf("stacks-%s", cfg.StackID),
-			ZanzanaClientConfig{
-				URL:              cfg.ZanzanaClient.Addr,
-				Token:            cfg.ZanzanaClient.Token,
-				TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
-				ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
-			})
+		zanzanaConfig := ZanzanaClientConfig{
+			Addr:             cfg.ZanzanaClient.Addr,
+			Token:            cfg.ZanzanaClient.Token,
+			TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
+			TokenNamespace:   cfg.ZanzanaClient.TokenNamespace,
+			ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
+		}
+		return NewRemoteZanzanaClient(zanzanaConfig, reg)
 
 	case setting.ZanzanaModeEmbedded:
 		logger := log.New("zanzana.server")
@@ -97,32 +100,33 @@ func ProvideZanzanaClient(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, fea
 
 // ProvideStandaloneZanzanaClient provides a standalone Zanzana client, without registering the Zanzana service.
 // Client connects to a remote Zanzana server specified in the configuration.
-func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.FeatureToggles) (zanzana.Client, error) {
+func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.FeatureToggles, reg prometheus.Registerer) (zanzana.Client, error) {
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if !features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
 		return zClient.NewNoopClient(), nil
 	}
 
 	zanzanaConfig := ZanzanaClientConfig{
-		URL:              cfg.ZanzanaClient.Addr,
+		Addr:             cfg.ZanzanaClient.Addr,
 		Token:            cfg.ZanzanaClient.Token,
 		TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
+		TokenNamespace:   cfg.ZanzanaClient.TokenNamespace,
 		ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
 	}
 
-	return NewRemoteZanzanaClient(cfg.ZanzanaClient.TokenNamespace, zanzanaConfig)
+	return NewRemoteZanzanaClient(zanzanaConfig, reg)
 }
 
 type ZanzanaClientConfig struct {
-	URL              string
+	Addr             string
 	Token            string
 	TokenExchangeURL string
-	ServerCertFile   string
 	TokenNamespace   string
+	ServerCertFile   string
 }
 
 // NewRemoteZanzanaClient creates a new Zanzana client that connects to remote Zanzana server.
-func NewRemoteZanzanaClient(namespace string, cfg ZanzanaClientConfig) (zanzana.Client, error) {
+func NewRemoteZanzanaClient(cfg ZanzanaClientConfig, reg prometheus.Registerer) (zanzana.Client, error) {
 	tokenClient, err := authnlib.NewTokenExchangeClient(authnlib.TokenExchangeConfig{
 		Token:            cfg.Token,
 		TokenExchangeURL: cfg.TokenExchangeURL,
@@ -139,18 +143,25 @@ func NewRemoteZanzanaClient(namespace string, cfg ZanzanaClientConfig) (zanzana.
 		}
 	}
 
+	authzRequestDuration := promauto.With(reg).NewHistogramVec(prometheus.HistogramOpts{
+		Name:                            "authz_zanzana_client_request_duration_seconds",
+		Help:                            "Time spent executing requests to zanzana server.",
+		NativeHistogramBucketFactor:     1.1,
+		NativeHistogramMaxBucketNumber:  160,
+		NativeHistogramMinResetDuration: time.Hour,
+	}, []string{"operation", "status_code"})
+	unaryInterceptors, streamInterceptors := instrument(authzRequestDuration, middleware.ReportGRPCStatusOption)
+
 	dialOptions := []grpc.DialOption{
 		grpc.WithTransportCredentials(transportCredentials),
 		grpc.WithPerRPCCredentials(
-			NewGRPCTokenAuth(
-				AuthzServiceAudience,
-				namespace,
-				tokenClient,
-			),
+			NewGRPCTokenAuth(AuthzServiceAudience, cfg.TokenNamespace, tokenClient),
 		),
+		grpc.WithChainUnaryInterceptor(unaryInterceptors...),
+		grpc.WithChainStreamInterceptor(streamInterceptors...),
 	}
 
-	conn, err := grpc.NewClient(cfg.URL, dialOptions...)
+	conn, err := grpc.NewClient(cfg.Addr, dialOptions...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create zanzana client to remote server: %w", err)
 	}

pkg/services/live/database/storage.go

@@ -1,48 +0,0 @@
-package database
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/grafana/grafana/pkg/infra/db"
-	"github.com/grafana/grafana/pkg/infra/localcache"
-	"github.com/grafana/grafana/pkg/services/live/model"
-)
-
-type Storage struct {
-	store db.DB
-	cache *localcache.CacheService
-}
-
-func NewStorage(store db.DB, cache *localcache.CacheService) *Storage {
-	return &Storage{store: store, cache: cache}
-}
-
-func getLiveMessageCacheKey(orgID int64, channel string) string {
-	return fmt.Sprintf("live_message_%d_%s", orgID, channel)
-}
-
-func (s *Storage) SaveLiveMessage(query *model.SaveLiveMessageQuery) error {
-	// Come back to saving into database after evaluating database structure.
-	s.cache.Set(getLiveMessageCacheKey(query.OrgID, query.Channel), model.LiveMessage{
-		ID:        0, // Not used actually.
-		OrgID:     query.OrgID,
-		Channel:   query.Channel,
-		Data:      query.Data,
-		Published: time.Now(),
-	}, 0)
-	return nil
-}
-
-func (s *Storage) GetLiveMessage(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
-	// Come back to saving into database after evaluating database structure.
-	m, ok := s.cache.Get(getLiveMessageCacheKey(query.OrgID, query.Channel))
-	if !ok {
-		return model.LiveMessage{}, false, nil
-	}
-	msg, ok := m.(model.LiveMessage)
-	if !ok {
-		return model.LiveMessage{}, false, fmt.Errorf("unexpected live message type in cache: %T", m)
-	}
-	return msg, true, nil
-}

pkg/services/live/database/tests/setup.go

@@ -1,18 +0,0 @@
-package tests
-
-import (
-	"testing"
-	"time"
-
-	"github.com/grafana/grafana/pkg/infra/db"
-	"github.com/grafana/grafana/pkg/infra/localcache"
-	"github.com/grafana/grafana/pkg/services/live/database"
-)
-
-// SetupTestStorage initializes a storage to used by the integration tests.
-// This is required to properly register and execute migrations.
-func SetupTestStorage(t *testing.T) *database.Storage {
-	sqlStore := db.InitTestDB(t)
-	localCache := localcache.New(time.Hour, time.Hour)
-	return database.NewStorage(sqlStore, localCache)
-}

pkg/services/live/database/tests/storage_test.go

@@ -1,67 +0,0 @@
-package tests
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/grafana/grafana/pkg/services/live/model"
-	"github.com/grafana/grafana/pkg/tests/testsuite"
-	"github.com/grafana/grafana/pkg/util/testutil"
-)
-
-func TestMain(m *testing.M) {
-	testsuite.Run(m)
-}
-
-func TestIntegrationLiveMessage(t *testing.T) {
-	testutil.SkipIntegrationTestInShortMode(t)
-
-	storage := SetupTestStorage(t)
-
-	getQuery := &model.GetLiveMessageQuery{
-		OrgID:   1,
-		Channel: "test_channel",
-	}
-	_, ok, err := storage.GetLiveMessage(getQuery)
-	require.NoError(t, err)
-	require.False(t, ok)
-
-	saveQuery := &model.SaveLiveMessageQuery{
-		OrgID:   1,
-		Channel: "test_channel",
-		Data:    []byte(`{}`),
-	}
-	err = storage.SaveLiveMessage(saveQuery)
-	require.NoError(t, err)
-
-	msg, ok, err := storage.GetLiveMessage(getQuery)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.Equal(t, int64(1), msg.OrgID)
-	require.Equal(t, "test_channel", msg.Channel)
-	require.Equal(t, json.RawMessage(`{}`), msg.Data)
-	require.NotZero(t, msg.Published)
-
-	// try saving again, should be replaced.
-	saveQuery2 := &model.SaveLiveMessageQuery{
-		OrgID:   1,
-		Channel: "test_channel",
-		Data:    []byte(`{"input": "hello"}`),
-	}
-	err = storage.SaveLiveMessage(saveQuery2)
-	require.NoError(t, err)
-
-	getQuery2 := &model.GetLiveMessageQuery{
-		OrgID:   1,
-		Channel: "test_channel",
-	}
-	msg2, ok, err := storage.GetLiveMessage(getQuery2)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.Equal(t, int64(1), msg2.OrgID)
-	require.Equal(t, "test_channel", msg2.Channel)
-	require.Equal(t, json.RawMessage(`{"input": "hello"}`), msg2.Data)
-	require.NotZero(t, msg2.Published)
-}

pkg/services/live/features/broadcast.go

@@ -1,70 +0,0 @@
-package features
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/infra/log"
-	"github.com/grafana/grafana/pkg/services/live/model"
-)
-
-var (
-	logger = log.New("live.features") // scoped to all features?
-)
-
-//go:generate mockgen -destination=broadcast_mock.go -package=features github.com/grafana/grafana/pkg/services/live/features LiveMessageStore
-
-type LiveMessageStore interface {
-	SaveLiveMessage(query *model.SaveLiveMessageQuery) error
-	GetLiveMessage(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error)
-}
-
-// BroadcastRunner will simply broadcast all events to `grafana/broadcast/*` channels
-// This assumes that data is a JSON object
-type BroadcastRunner struct {
-	liveMessageStore LiveMessageStore
-}
-
-func NewBroadcastRunner(liveMessageStore LiveMessageStore) *BroadcastRunner {
-	return &BroadcastRunner{liveMessageStore: liveMessageStore}
-}
-
-// GetHandlerForPath called on init
-func (b *BroadcastRunner) GetHandlerForPath(_ string) (model.ChannelHandler, error) {
-	return b, nil // all dashboards share the same handler
-}
-
-// OnSubscribe will let anyone connect to the path
-func (b *BroadcastRunner) OnSubscribe(_ context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
-	reply := model.SubscribeReply{
-		Presence:  true,
-		JoinLeave: true,
-	}
-	query := &model.GetLiveMessageQuery{
-		OrgID:   u.GetOrgID(),
-		Channel: e.Channel,
-	}
-	msg, ok, err := b.liveMessageStore.GetLiveMessage(query)
-	if err != nil {
-		return model.SubscribeReply{}, 0, err
-	}
-	if ok {
-		reply.Data = msg.Data
-	}
-	return reply, backend.SubscribeStreamStatusOK, nil
-}
-
-// OnPublish is called when a client wants to broadcast on the websocket
-func (b *BroadcastRunner) OnPublish(_ context.Context, u identity.Requester, e model.PublishEvent) (model.PublishReply, backend.PublishStreamStatus, error) {
-	query := &model.SaveLiveMessageQuery{
-		OrgID:   u.GetOrgID(),
-		Channel: e.Channel,
-		Data:    e.Data,
-	}
-	if err := b.liveMessageStore.SaveLiveMessage(query); err != nil {
-		return model.PublishReply{}, 0, err
-	}
-	return model.PublishReply{Data: e.Data}, backend.PublishStreamStatusOK, nil
-}

pkg/services/live/features/broadcast_mock.go

@@ -1,66 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/grafana/grafana/pkg/services/live/features (interfaces: LiveMessageStore)
-
-// Package features is a generated GoMock package.
-package features
-
-import (
-	reflect "reflect"
-
-	gomock "github.com/golang/mock/gomock"
-
-	model "github.com/grafana/grafana/pkg/services/live/model"
-)
-
-// MockLiveMessageStore is a mock of LiveMessageStore interface.
-type MockLiveMessageStore struct {
-	ctrl     *gomock.Controller
-	recorder *MockLiveMessageStoreMockRecorder
-}
-
-// MockLiveMessageStoreMockRecorder is the mock recorder for MockLiveMessageStore.
-type MockLiveMessageStoreMockRecorder struct {
-	mock *MockLiveMessageStore
-}
-
-// NewMockLiveMessageStore creates a new mock instance.
-func NewMockLiveMessageStore(ctrl *gomock.Controller) *MockLiveMessageStore {
-	mock := &MockLiveMessageStore{ctrl: ctrl}
-	mock.recorder = &MockLiveMessageStoreMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockLiveMessageStore) EXPECT() *MockLiveMessageStoreMockRecorder {
-	return m.recorder
-}
-
-// GetLiveMessage mocks base method.
-func (m *MockLiveMessageStore) GetLiveMessage(arg0 *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetLiveMessage", arg0)
-	ret0, _ := ret[0].(model.LiveMessage)
-	ret1, _ := ret[1].(bool)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetLiveMessage indicates an expected call of GetLiveMessage.
-func (mr *MockLiveMessageStoreMockRecorder) GetLiveMessage(arg0 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLiveMessage", reflect.TypeOf((*MockLiveMessageStore)(nil).GetLiveMessage), arg0)
-}
-
-// SaveLiveMessage mocks base method.
-func (m *MockLiveMessageStore) SaveLiveMessage(arg0 *model.SaveLiveMessageQuery) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveLiveMessage", arg0)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveLiveMessage indicates an expected call of SaveLiveMessage.
-func (mr *MockLiveMessageStoreMockRecorder) SaveLiveMessage(arg0 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveLiveMessage", reflect.TypeOf((*MockLiveMessageStore)(nil).SaveLiveMessage), arg0)
-}

pkg/services/live/features/broadcast_test.go

@@ -1,87 +0,0 @@
-package features
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/stretchr/testify/require"
-
-	"github.com/grafana/grafana/pkg/services/live/model"
-	"github.com/grafana/grafana/pkg/services/user"
-)
-
-func TestNewBroadcastRunner(t *testing.T) {
-	mockCtrl := gomock.NewController(t)
-	defer mockCtrl.Finish()
-	d := NewMockLiveMessageStore(mockCtrl)
-	br := NewBroadcastRunner(d)
-	require.NotNil(t, br)
-}
-
-func TestBroadcastRunner_OnSubscribe(t *testing.T) {
-	mockCtrl := gomock.NewController(t)
-	defer mockCtrl.Finish()
-	mockDispatcher := NewMockLiveMessageStore(mockCtrl)
-
-	channel := "stream/channel/test"
-	data := json.RawMessage(`{}`)
-
-	mockDispatcher.EXPECT().GetLiveMessage(&model.GetLiveMessageQuery{
-		OrgID:   1,
-		Channel: channel,
-	}).DoAndReturn(func(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
-		return model.LiveMessage{
-			Data: data,
-		}, true, nil
-	}).Times(1)
-
-	br := NewBroadcastRunner(mockDispatcher)
-	require.NotNil(t, br)
-	handler, err := br.GetHandlerForPath("test")
-	require.NoError(t, err)
-	reply, status, err := handler.OnSubscribe(
-		context.Background(),
-		&user.SignedInUser{OrgID: 1, UserID: 2},
-		model.SubscribeEvent{Channel: channel, Path: "test"},
-	)
-	require.NoError(t, err)
-	require.Equal(t, backend.SubscribeStreamStatusOK, status)
-	require.Equal(t, data, reply.Data)
-	require.True(t, reply.Presence)
-	require.True(t, reply.JoinLeave)
-	require.False(t, reply.Recover)
-}
-
-func TestBroadcastRunner_OnPublish(t *testing.T) {
-	mockCtrl := gomock.NewController(t)
-	defer mockCtrl.Finish()
-	mockDispatcher := NewMockLiveMessageStore(mockCtrl)
-
-	channel := "stream/channel/test"
-	data := json.RawMessage(`{}`)
-	var orgID int64 = 1
-
-	mockDispatcher.EXPECT().SaveLiveMessage(&model.SaveLiveMessageQuery{
-		OrgID:   orgID,
-		Channel: channel,
-		Data:    data,
-	}).DoAndReturn(func(query *model.SaveLiveMessageQuery) error {
-		return nil
-	}).Times(1)
-
-	br := NewBroadcastRunner(mockDispatcher)
-	require.NotNil(t, br)
-	handler, err := br.GetHandlerForPath("test")
-	require.NoError(t, err)
-	reply, status, err := handler.OnPublish(
-		context.Background(),
-		&user.SignedInUser{OrgID: 1, UserID: 2},
-		model.PublishEvent{Channel: channel, Path: "test", Data: data},
-	)
-	require.NoError(t, err)
-	require.Equal(t, backend.PublishStreamStatusOK, status)
-	require.Equal(t, data, reply.Data)
-}

pkg/services/live/features/dashboard.go

@@ -7,9 +7,8 @@ import (
 	"strings"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
-
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/live/model"
@@ -35,7 +34,6 @@ type dashboardEvent struct {
 type DashboardHandler struct {
 	Publisher        model.ChannelPublisher
 	ClientCount      model.ChannelClientCount
-	Store            db.DB
 	DashboardService dashboards.DashboardService
 	AccessControl    accesscontrol.AccessControl
 }

pkg/services/live/features/plugin.go

@@ -5,9 +5,11 @@ import (
 	"errors"
 
 	"github.com/centrifugal/centrifuge"
+
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/live/model"
 	"github.com/grafana/grafana/pkg/services/live/orgchannel"

pkg/services/live/live.go

@@ -15,7 +15,6 @@ import (
 
 	"github.com/centrifugal/centrifuge"
 	"github.com/gobwas/glob"
-	jsoniter "github.com/json-iterator/go"
 	"github.com/redis/go-redis/v9"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
@@ -25,12 +24,9 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana-plugin-sdk-go/live"
-	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
-	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/usagestats"
@@ -43,7 +39,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
-	"github.com/grafana/grafana/pkg/services/live/database"
 	"github.com/grafana/grafana/pkg/services/live/features"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/liveplugin"
@@ -57,7 +52,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/plugincontext"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-	"github.com/grafana/grafana/pkg/services/query"
 	"github.com/grafana/grafana/pkg/services/secrets"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util"
@@ -80,8 +74,8 @@ type CoreGrafanaScope struct {
 
 func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, routeRegister routing.RouteRegister,
 	pluginStore pluginstore.Store, pluginClient plugins.Client, cacheService *localcache.CacheService,
-	dataSourceCache datasources.CacheService, sqlStore db.DB, secretsService secrets.Service,
-	usageStatsService usagestats.Service, queryDataService query.Service, toggles featuremgmt.FeatureToggles,
+	dataSourceCache datasources.CacheService, secretsService secrets.Service,
+	usageStatsService usagestats.Service, toggles featuremgmt.FeatureToggles,
 	accessControl accesscontrol.AccessControl, dashboardService dashboards.DashboardService,
 	orgService org.Service, configProvider apiserver.RestConfigProvider) (*GrafanaLive, error) {
 	g := &GrafanaLive{
@@ -93,9 +87,7 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 		pluginClient:          pluginClient,
 		CacheService:          cacheService,
 		DataSourceCache:       dataSourceCache,
-		SQLStore:              sqlStore,
 		SecretsService:        secretsService,
-		queryDataService:      queryDataService,
 		channels:              make(map[string]model.ChannelHandler),
 		GrafanaScope: CoreGrafanaScope{
 			Features: make(map[string]model.ChannelHandlerFactory),
@@ -186,14 +178,11 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 	dash := &features.DashboardHandler{
 		Publisher:        g.Publish,
 		ClientCount:      g.ClientCount,
-		Store:            sqlStore,
 		DashboardService: dashboardService,
 		AccessControl:    accessControl,
 	}
-	g.storage = database.NewStorage(g.SQLStore, g.CacheService)
 	g.GrafanaScope.Dashboards = dash
 	g.GrafanaScope.Features["dashboard"] = dash
-	g.GrafanaScope.Features["broadcast"] = features.NewBroadcastRunner(g.storage)
 
 	// Testing watch with just the provisioning support -- this will be removed when it is well validated
 	//nolint:staticcheck // not yet migrated to OpenFeature
@@ -388,14 +377,14 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 			UserID: strconv.FormatInt(id, 10),
 		}
 		newCtx := centrifuge.SetCredentials(ctx.Req.Context(), cred)
-		newCtx = livecontext.SetContextSignedUser(newCtx, user)
+		newCtx = identity.WithRequester(newCtx, user)
 		r := ctx.Req.WithContext(newCtx)
 		wsHandler.ServeHTTP(ctx.Resp, r)
 	}
 
 	g.pushWebsocketHandler = func(ctx *contextmodel.ReqContext) {
 		user := ctx.SignedInUser
-		newCtx := livecontext.SetContextSignedUser(ctx.Req.Context(), user)
+		newCtx := identity.WithRequester(ctx.Req.Context(), user)
 		newCtx = livecontext.SetContextStreamID(newCtx, web.Params(ctx.Req)[":streamId"])
 		r := ctx.Req.WithContext(newCtx)
 		pushWSHandler.ServeHTTP(ctx.Resp, r)
@@ -403,7 +392,7 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 
 	g.pushPipelineWebsocketHandler = func(ctx *contextmodel.ReqContext) {
 		user := ctx.SignedInUser
-		newCtx := livecontext.SetContextSignedUser(ctx.Req.Context(), user)
+		newCtx := identity.WithRequester(ctx.Req.Context(), user)
 		newCtx = livecontext.SetContextChannelID(newCtx, web.Params(ctx.Req)["*"])
 		r := ctx.Req.WithContext(newCtx)
 		pushPipelineWSHandler.ServeHTTP(ctx.Resp, r)
@@ -475,14 +464,12 @@ type GrafanaLive struct {
 	RouteRegister         routing.RouteRegister
 	CacheService          *localcache.CacheService
 	DataSourceCache       datasources.CacheService
-	SQLStore              db.DB
 	SecretsService        secrets.Service
 	pluginStore           pluginstore.Store
 	pluginClient          plugins.Client
-	queryDataService      query.Service
 	orgService            org.Service
 
-	keyPrefix string
+	keyPrefix string // HA prefix for grafana cloud (since the org is always 1)
 
 	node         *centrifuge.Node
 	surveyCaller *survey.Caller
@@ -505,7 +492,6 @@ type GrafanaLive struct {
 
 	contextGetter    *liveplugin.ContextGetter
 	runStreamManager *runstream.Manager
-	storage          *database.Storage
 
 	usageStatsService usagestats.Service
 	usageStats        usageStats
@@ -673,18 +659,13 @@ func (g *GrafanaLive) HandleDatasourceUpdate(orgID int64, dsUID string) {
 	}
 }
 
-// Use a configuration that's compatible with the standard library
-// to minimize the risk of introducing bugs. This will make sure
-// that map keys is ordered.
-var jsonStd = jsoniter.ConfigCompatibleWithStandardLibrary
-
 func (g *GrafanaLive) handleOnRPC(clientContextWithSpan context.Context, client *centrifuge.Client, e centrifuge.RPCEvent) (centrifuge.RPCReply, error) {
 	logger.Debug("Client calls RPC", "user", client.UserID(), "client", client.ID(), "method", e.Method)
 	if e.Method != "grafana.query" {
 		return centrifuge.RPCReply{}, centrifuge.ErrorMethodNotFound
 	}
-	user, ok := livecontext.GetContextSignedUser(clientContextWithSpan)
-	if !ok {
+	user, err := identity.GetRequester(clientContextWithSpan)
+	if err != nil {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "method", e.Method)
 		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
 	}
@@ -694,38 +675,15 @@ func (g *GrafanaLive) handleOnRPC(clientContextWithSpan context.Context, client
 		return centrifuge.RPCReply{}, centrifuge.ErrorExpired
 	}
 
-	var req dtos.MetricRequest
-	err := json.Unmarshal(e.Data, &req)
-	if err != nil {
-		return centrifuge.RPCReply{}, centrifuge.ErrorBadRequest
-	}
-	resp, err := g.queryDataService.QueryData(clientContextWithSpan, user, false, req)
-	if err != nil {
-		logger.Error("Error query data", "user", client.UserID(), "client", client.ID(), "method", e.Method, "error", err)
-		if errors.Is(err, datasources.ErrDataSourceAccessDenied) {
-			return centrifuge.RPCReply{}, &centrifuge.Error{Code: uint32(http.StatusForbidden), Message: http.StatusText(http.StatusForbidden)}
-		}
-		var gfErr errutil.Error
-		if errors.As(err, &gfErr) && gfErr.Reason.Status() == errutil.StatusBadRequest {
-			return centrifuge.RPCReply{}, &centrifuge.Error{Code: uint32(http.StatusBadRequest), Message: http.StatusText(http.StatusBadRequest)}
-		}
-		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
-	}
-	data, err := jsonStd.Marshal(resp)
-	if err != nil {
-		logger.Error("Error marshaling query response", "user", client.UserID(), "client", client.ID(), "method", e.Method, "error", err)
-		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
-	}
-	return centrifuge.RPCReply{
-		Data: data,
-	}, nil
+	// RPC events not available
+	return centrifuge.RPCReply{}, centrifuge.ErrorNotAvailable
 }
 
 func (g *GrafanaLive) handleOnSubscribe(clientContextWithSpan context.Context, client *centrifuge.Client, e centrifuge.SubscribeEvent) (centrifuge.SubscribeReply, error) {
 	logger.Debug("Client wants to subscribe", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 
-	user, ok := livecontext.GetContextSignedUser(clientContextWithSpan)
-	if !ok {
+	user, err := identity.GetRequester(clientContextWithSpan)
+	if err != nil {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 		return centrifuge.SubscribeReply{}, centrifuge.ErrorInternal
 	}
@@ -830,8 +788,8 @@ func (g *GrafanaLive) handleOnSubscribe(clientContextWithSpan context.Context, c
 func (g *GrafanaLive) handleOnPublish(clientCtxWithSpan context.Context, client *centrifuge.Client, e centrifuge.PublishEvent) (centrifuge.PublishReply, error) {
 	logger.Debug("Client wants to publish", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 
-	user, ok := livecontext.GetContextSignedUser(clientCtxWithSpan)
-	if !ok {
+	user, err := identity.GetRequester(clientCtxWithSpan)
+	if err != nil {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 		return centrifuge.PublishReply{}, centrifuge.ErrorInternal
 	}
@@ -1083,7 +1041,7 @@ func (g *GrafanaLive) ClientCount(orgID int64, channel string) (int, error) {
 }
 
 func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.Response {
-	cmd := dtos.LivePublishCmd{}
+	cmd := model.LivePublishCmd{}
 	if err := web.Bind(ctx.Req, &cmd); err != nil {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
@@ -1122,7 +1080,7 @@ func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.R
 				logger.Error("Error processing input", "user", user, "channel", channel, "error", err)
 				return response.Error(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError), nil)
 			}
-			return response.JSON(http.StatusOK, dtos.LivePublishResponse{})
+			return response.JSON(http.StatusOK, model.LivePublishResponse{})
 		}
 	}
 
@@ -1150,7 +1108,7 @@ func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.R
 		}
 	}
 	logger.Debug("Publication successful", "identity", ctx.GetID(), "channel", cmd.Channel)
-	return response.JSON(http.StatusOK, dtos.LivePublishResponse{})
+	return response.JSON(http.StatusOK, model.LivePublishResponse{})
 }
 
 type streamChannelListResponse struct {

pkg/services/live/live_test.go

@@ -11,20 +11,17 @@ import (
 	"testing"
 	"time"
 
+	"github.com/centrifugal/centrifuge"
 	"github.com/go-jose/go-jose/v4"
 	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/stretchr/testify/require"
 
-	"github.com/centrifugal/centrifuge"
-
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/usagestats"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
-	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tests/testsuite"
 	"github.com/grafana/grafana/pkg/util/testutil"
@@ -245,7 +242,7 @@ func Test_handleOnPublish_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnPublish(ctx, client, centrifuge.PublishEvent{
 			Channel: "test",
 			Data:    []byte("test"),
@@ -257,7 +254,7 @@ func Test_handleOnPublish_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnPublish(ctx, client, centrifuge.PublishEvent{
 			Channel: "test",
 			Data:    []byte("test"),
@@ -280,7 +277,7 @@ func Test_handleOnRPC_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnRPC(ctx, client, centrifuge.RPCEvent{
 			Method: "grafana.query",
 			Data:   []byte("test"),
@@ -292,7 +289,7 @@ func Test_handleOnRPC_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnRPC(ctx, client, centrifuge.RPCEvent{
 			Method: "grafana.query",
 			Data:   []byte("test"),
@@ -315,7 +312,7 @@ func Test_handleOnSubscribe_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnSubscribe(ctx, client, centrifuge.SubscribeEvent{
 			Channel: "test",
 		})
@@ -326,7 +323,7 @@ func Test_handleOnSubscribe_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnSubscribe(ctx, client, centrifuge.SubscribeEvent{
 			Channel: "test",
 		})
@@ -347,10 +344,8 @@ func setupLiveService(cfg *setting.Cfg, t *testing.T) (*GrafanaLive, error) {
 		cfg,
 		routing.NewRouteRegister(),
 		nil, nil, nil, nil,
-		db.InitTestDB(t),
 		nil,
 		&usagestats.UsageStatsMock{T: t},
-		nil,
 		featuremgmt.WithFeatures(),
 		acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		&dashboards.FakeDashboardService{},
@@ -361,7 +356,12 @@ type dummyTransport struct {
 	name string
 }
 
+var (
+	_ centrifuge.Transport = (*dummyTransport)(nil)
+)
+
 func (t *dummyTransport) Name() string                      { return t.name }
+func (t *dummyTransport) AcceptProtocol() string            { return "" }
 func (t *dummyTransport) Protocol() centrifuge.ProtocolType { return centrifuge.ProtocolTypeJSON }
 func (t *dummyTransport) ProtocolVersion() centrifuge.ProtocolVersion {
 	return centrifuge.ProtocolVersion2

pkg/services/live/livecontext/context.go

@@ -2,27 +2,8 @@ package livecontext
 
 import (
 	"context"
-
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
 )
 
-type signedUserContextKeyType int
-
-var signedUserContextKey signedUserContextKeyType
-
-func SetContextSignedUser(ctx context.Context, user identity.Requester) context.Context {
-	ctx = context.WithValue(ctx, signedUserContextKey, user)
-	return ctx
-}
-
-func GetContextSignedUser(ctx context.Context) (identity.Requester, bool) {
-	if val := ctx.Value(signedUserContextKey); val != nil {
-		user, ok := val.(identity.Requester)
-		return user, ok
-	}
-	return nil, false
-}
-
 type streamIDContextKey struct{}
 
 func SetContextStreamID(ctx context.Context, streamID string) context.Context {

pkg/services/live/model/model.go

@@ -67,21 +67,9 @@ type ChannelHandlerFactory interface {
 	GetHandlerForPath(path string) (ChannelHandler, error)
 }
 
-type LiveMessage struct {
-	ID        int64 `xorm:"pk autoincr 'id'"`
-	OrgID     int64 `xorm:"org_id"`
-	Channel   string
-	Data      json.RawMessage
-	Published time.Time
+type LivePublishCmd struct {
+	Channel string          `json:"channel"`
+	Data    json.RawMessage `json:"data,omitempty"`
 }
 
-type SaveLiveMessageQuery struct {
-	OrgID   int64 `xorm:"org_id"`
-	Channel string
-	Data    json.RawMessage
-}
-
-type GetLiveMessageQuery struct {
-	OrgID   int64 `xorm:"org_id"`
-	Channel string
-}
+type LivePublishResponse struct{}

pkg/services/live/pipeline/data_output_builtin.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
-	"github.com/grafana/grafana/pkg/services/live/livecontext"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 
@@ -25,8 +25,8 @@ func (s *BuiltinDataOutput) Type() string {
 }
 
 func (s *BuiltinDataOutput) OutputData(ctx context.Context, vars Vars, data []byte) ([]*ChannelData, error) {
-	u, ok := livecontext.GetContextSignedUser(ctx)
-	if !ok {
+	u, err := identity.GetRequester(ctx)
+	if err != nil {
 		return nil, errors.New("user not found in context")
 	}
 	handler, _, err := s.channelHandlerGetter.GetChannelHandler(ctx, u, vars.Channel)

pkg/services/live/pipeline/subscribe_builtin.go

@@ -7,7 +7,6 @@ import (
 	"github.com/grafana/grafana-plugin-sdk-go/live"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 
@@ -30,8 +29,8 @@ func (s *BuiltinSubscriber) Type() string {
 }
 
 func (s *BuiltinSubscriber) Subscribe(ctx context.Context, vars Vars, data []byte) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
-	u, ok := livecontext.GetContextSignedUser(ctx)
-	if !ok {
+	u, err := identity.GetRequester(ctx)
+	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, nil
 	}
 	handler, _, err := s.channelHandlerGetter.GetChannelHandler(ctx, u, vars.Channel)

pkg/services/live/pipeline/subscribe_managed_stream.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
-	"github.com/grafana/grafana/pkg/services/live/livecontext"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/live/managedstream"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
@@ -30,8 +30,8 @@ func (s *ManagedStreamSubscriber) Subscribe(ctx context.Context, vars Vars, _ []
 		logger.Error("Error getting managed stream", "error", err)
 		return model.SubscribeReply{}, 0, err
 	}
-	u, ok := livecontext.GetContextSignedUser(ctx)
-	if !ok {
+	u, err := identity.GetRequester(ctx)
+	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, nil
 	}
 	return stream.OnSubscribe(ctx, u, model.SubscribeEvent{

pkg/services/live/pipeline/subscribe_multiple.go

@@ -4,7 +4,6 @@ import (
 	"context"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
-
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 

pkg/services/live/pushws/push_pipeline.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/gorilla/websocket"
 
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/live/convert"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/pipeline"
@@ -44,8 +45,8 @@ func (s *PipelinePushHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	user, ok := livecontext.GetContextSignedUser(r.Context())
-	if !ok {
+	user, err := identity.GetRequester(r.Context())
+	if err != nil {
 		logger.Error("No user found in context")
 		rw.WriteHeader(http.StatusInternalServerError)
 		return

pkg/services/live/pushws/push_stream.go

@@ -5,8 +5,9 @@ import (
 	"time"
 
 	"github.com/gorilla/websocket"
-	liveDto "github.com/grafana/grafana-plugin-sdk-go/live"
 
+	liveDto "github.com/grafana/grafana-plugin-sdk-go/live"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/live/convert"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/managedstream"
@@ -47,8 +48,8 @@ func (s *Handler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	user, ok := livecontext.GetContextSignedUser(r.Context())
-	if !ok {
+	user, err := identity.GetRequester(r.Context())
+	if err != nil {
 		logger.Error("No user found in context")
 		rw.WriteHeader(http.StatusInternalServerError)
 		return

pkg/services/setting/service.go

@@ -2,27 +2,26 @@ package setting
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"time"
 
-	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/trace"
 	"gopkg.in/ini.v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apiserver/pkg/endpoints/request"
-	"k8s.io/client-go/dynamic"
-	clientrest "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest"
 	"k8s.io/client-go/transport"
 
 	authlib "github.com/grafana/authlib/authn"
 	logging "github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/semconv"
 )
 
@@ -38,18 +37,11 @@ const (
 	ApiGroup   = "setting.grafana.app"
 	apiVersion = "v0alpha1"
 	resource   = "settings"
-	kind       = "Setting"
-	listKind   = "SettingList"
 )
 
-var settingGroupVersion = schema.GroupVersionResource{
-	Group:    ApiGroup,
-	Version:  apiVersion,
-	Resource: resource,
-}
-
-var settingGroupListKind = map[schema.GroupVersionResource]string{
-	settingGroupVersion: listKind,
+var settingGroupVersion = schema.GroupVersion{
+	Group:   ApiGroup,
+	Version: apiVersion,
 }
 
 type remoteSettingServiceMetrics struct {
@@ -106,10 +98,10 @@ type Service interface {
 }
 
 type remoteSettingService struct {
-	dynamicClient dynamic.Interface
-	log           logging.Logger
-	pageSize      int64
-	metrics       remoteSettingServiceMetrics
+	restClient *rest.RESTClient
+	log        logging.Logger
+	pageSize   int64
+	metrics    remoteSettingServiceMetrics
 }
 
 var _ Service = (*remoteSettingService)(nil)
@@ -126,7 +118,7 @@ type Config struct {
 	// At least one of WrapTransport or TokenExchangeClient is required.
 	WrapTransport transport.WrapperFunc
 	// TLSClientConfig configures TLS for the client connection.
-	TLSClientConfig clientrest.TLSClientConfig
+	TLSClientConfig rest.TLSClientConfig
 	// QPS limits requests per second (defaults to DefaultQPS).
 	QPS float32
 	// Burst allows request bursts above QPS (defaults to DefaultBurst).
@@ -145,29 +137,39 @@ type Setting struct {
 	Value string `json:"value"`
 }
 
+// settingResource represents a single Setting resource from the K8s API.
+type settingResource struct {
+	Spec Setting `json:"spec"`
+}
+
+// settingListMetadata contains pagination info from the K8s list response.
+type settingListMetadata struct {
+	Continue string `json:"continue,omitempty"`
+}
+
 // New creates a Service from the provided configuration.
 func New(config Config) (Service, error) {
 	log := logging.New(LogPrefix)
-	dynamicClient, err := getDynamicClient(config, log)
+
+	restClient, err := getRestClient(config, log)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create REST client: %w", err)
 	}
+
 	pageSize := DefaultPageSize
 	if config.PageSize > 0 {
 		pageSize = config.PageSize
 	}
 
-	metrics := initMetrics()
-
 	return &remoteSettingService{
-		dynamicClient: dynamicClient,
-		pageSize:      pageSize,
-		log:           log,
-		metrics:       metrics,
+		restClient: restClient,
+		log:        log,
+		pageSize:   pageSize,
+		metrics:    initMetrics(),
 	}, nil
 }
 
-func (m *remoteSettingService) ListAsIni(ctx context.Context, labelSelector metav1.LabelSelector) (*ini.File, error) {
+func (s *remoteSettingService) ListAsIni(ctx context.Context, labelSelector metav1.LabelSelector) (*ini.File, error) {
 	namespace, ok := request.NamespaceFrom(ctx)
 	ns := semconv.GrafanaNamespaceName(namespace)
 	ctx, span := tracer.Start(ctx, "remoteSettingService.ListAsIni",
@@ -178,33 +180,34 @@ func (m *remoteSettingService) ListAsIni(ctx context.Context, labelSelector meta
 		return nil, tracing.Errorf(span, "missing namespace in context")
 	}
 
-	settings, err := m.List(ctx, labelSelector)
+	settings, err := s.List(ctx, labelSelector)
 	if err != nil {
 		return nil, err
 	}
-	iniFile, err := m.toIni(settings)
+	iniFile, err := toIni(settings)
 	if err != nil {
 		return nil, tracing.Error(span, err)
 	}
 	return iniFile, nil
 }
 
-func (m *remoteSettingService) List(ctx context.Context, labelSelector metav1.LabelSelector) ([]*Setting, error) {
+func (s *remoteSettingService) List(ctx context.Context, labelSelector metav1.LabelSelector) ([]*Setting, error) {
 	namespace, ok := request.NamespaceFrom(ctx)
 	ns := semconv.GrafanaNamespaceName(namespace)
 	ctx, span := tracer.Start(ctx, "remoteSettingService.List",
 		trace.WithAttributes(ns))
 	defer span.End()
+
 	if !ok || namespace == "" {
 		return nil, tracing.Errorf(span, "missing namespace in context")
 	}
-	log := m.log.FromContext(ctx).New(ns.Key, ns.Value, "function", "remoteSettingService.List", "traceId", span.SpanContext().TraceID())
+	log := s.log.FromContext(ctx).New(ns.Key, ns.Value, "function", "remoteSettingService.List", "traceId", span.SpanContext().TraceID())
 
 	startTime := time.Now()
 	var status string
 	defer func() {
 		duration := time.Since(startTime).Seconds()
-		m.metrics.listDuration.WithLabelValues(status).Observe(duration)
+		s.metrics.listDuration.WithLabelValues(status).Observe(duration)
 	}()
 
 	selector, err := metav1.LabelSelectorAsSelector(&labelSelector)
@@ -216,64 +219,142 @@ func (m *remoteSettingService) List(ctx context.Context, labelSelector metav1.La
 		log.Debug("empty selector. Fetching all settings")
 	}
 
-	var allSettings []*Setting
+	// Pre-allocate with estimated capacity
+	allSettings := make([]*Setting, 0, s.pageSize*8)
 	var continueToken string
 	hasNext := true
 	totalPages := 0
 	// Using an upper limit to prevent infinite loops
 	for hasNext && totalPages < 1000 {
 		totalPages++
-		opts := metav1.ListOptions{
-			Limit:    m.pageSize,
-			Continue: continueToken,
-		}
-		if !selector.Empty() {
-			opts.LabelSelector = selector.String()
-		}
 
-		settingsList, lErr := m.dynamicClient.Resource(settingGroupVersion).Namespace(namespace).List(ctx, opts)
+		settings, nextToken, lErr := s.fetchPage(ctx, namespace, selector.String(), continueToken)
 		if lErr != nil {
 			status = "error"
 			return nil, tracing.Error(span, lErr)
 		}
-		for i := range settingsList.Items {
-			setting, pErr := parseSettingResource(&settingsList.Items[i])
-			if pErr != nil {
-				status = "error"
-				return nil, tracing.Error(span, pErr)
-			}
-			allSettings = append(allSettings, setting)
-		}
-		continueToken = settingsList.GetContinue()
+
+		allSettings = append(allSettings, settings...)
+		continueToken = nextToken
 		if continueToken == "" {
 			hasNext = false
 		}
 	}
 
 	status = "success"
-	m.metrics.listResultSize.WithLabelValues(status).Observe(float64(len(allSettings)))
+	s.metrics.listResultSize.WithLabelValues(status).Observe(float64(len(allSettings)))
 
 	return allSettings, nil
 }
 
-func parseSettingResource(setting *unstructured.Unstructured) (*Setting, error) {
-	spec, found, err := unstructured.NestedMap(setting.Object, "spec")
+func (s *remoteSettingService) fetchPage(ctx context.Context, namespace, labelSelector, continueToken string) ([]*Setting, string, error) {
+	req := s.restClient.Get().
+		Resource(resource).
+		Namespace(namespace).
+		Param("limit", fmt.Sprintf("%d", s.pageSize))
+
+	if labelSelector != "" {
+		req = req.Param("labelSelector", labelSelector)
+	}
+	if continueToken != "" {
+		req = req.Param("continue", continueToken)
+	}
+
+	stream, err := req.Stream(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get spec from setting: %w", err)
-	}
-	if !found {
-		return nil, fmt.Errorf("spec not found in setting %s", setting.GetName())
+		return nil, "", fmt.Errorf("request failed: %w", err)
 	}
+	defer func() { _ = stream.Close() }()
 
-	var result Setting
-	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(spec, &result); err != nil {
-		return nil, fmt.Errorf("failed to convert spec to Setting: %w", err)
-	}
-
-	return &result, nil
+	return parseSettingList(stream)
 }
 
-func (m *remoteSettingService) toIni(settings []*Setting) (*ini.File, error) {
+// parseSettingList parses a SettingList JSON response using token-by-token streaming.
+func parseSettingList(r io.Reader) ([]*Setting, string, error) {
+	decoder := json.NewDecoder(r)
+	// Currently, first page may have a large number of items.
+	settings := make([]*Setting, 0, 1600)
+	var continueToken string
+
+	// Skip to the start of the object
+	if _, err := decoder.Token(); err != nil {
+		return nil, "", fmt.Errorf("expected start of object: %w", err)
+	}
+
+	for decoder.More() {
+		// Read field name
+		tok, err := decoder.Token()
+		if err != nil {
+			return nil, "", fmt.Errorf("failed to read field name: %w", err)
+		}
+
+		fieldName, ok := tok.(string)
+		if !ok {
+			continue
+		}
+
+		switch fieldName {
+		case "metadata":
+			var meta settingListMetadata
+			if err := decoder.Decode(&meta); err != nil {
+				return nil, "", fmt.Errorf("failed to decode metadata: %w", err)
+			}
+			continueToken = meta.Continue
+
+		case "items":
+			// Parse items array token-by-token
+			itemSettings, err := parseItems(decoder)
+			if err != nil {
+				return nil, "", err
+			}
+			settings = append(settings, itemSettings...)
+
+		default:
+			// Skip unknown fields
+			var skip json.RawMessage
+			if err := decoder.Decode(&skip); err != nil {
+				return nil, "", fmt.Errorf("failed to skip field %s: %w", fieldName, err)
+			}
+		}
+	}
+
+	return settings, continueToken, nil
+}
+
+func parseItems(decoder *json.Decoder) ([]*Setting, error) {
+	// Expect start of array
+	tok, err := decoder.Token()
+	if err != nil {
+		return nil, fmt.Errorf("expected start of items array: %w", err)
+	}
+	if tok != json.Delim('[') {
+		return nil, fmt.Errorf("expected '[', got %v", tok)
+	}
+
+	settings := make([]*Setting, 0, DefaultPageSize)
+
+	// Parse each item
+	for decoder.More() {
+		var item settingResource
+		if err := decoder.Decode(&item); err != nil {
+			return nil, fmt.Errorf("failed to decode setting item: %w", err)
+		}
+		settings = append(settings, &Setting{
+			Section: item.Spec.Section,
+			Key:     item.Spec.Key,
+			Value:   item.Spec.Value,
+		})
+	}
+
+	// Consume end of array
+	if _, err := decoder.Token(); err != nil {
+		return nil, fmt.Errorf("expected end of items array: %w", err)
+	}
+
+	return settings, nil
+}
+
+func toIni(settings []*Setting) (*ini.File, error) {
 	conf := ini.Empty()
 	for _, setting := range settings {
 		if !conf.HasSection(setting.Section) {
@@ -287,7 +368,7 @@ func (m *remoteSettingService) toIni(settings []*Setting) (*ini.File, error) {
 	return conf, nil
 }
 
-func getDynamicClient(config Config, log logging.Logger) (dynamic.Interface, error) {
+func getRestClient(config Config, log logging.Logger) (*rest.RESTClient, error) {
 	if config.URL == "" {
 		return nil, fmt.Errorf("URL cannot be empty")
 	}
@@ -296,7 +377,7 @@ func getDynamicClient(config Config, log logging.Logger) (dynamic.Interface, err
 	}
 
 	wrapTransport := config.WrapTransport
-	if config.WrapTransport == nil {
+	if wrapTransport == nil {
 		log.Debug("using default wrapTransport with TokenExchangeClient")
 		wrapTransport = func(rt http.RoundTripper) http.RoundTripper {
 			return &authRoundTripper{
@@ -316,13 +397,21 @@ func getDynamicClient(config Config, log logging.Logger) (dynamic.Interface, err
 		burst = config.Burst
 	}
 
-	return dynamic.NewForConfig(&clientrest.Config{
+	restConfig := &rest.Config{
 		Host:            config.URL,
-		WrapTransport:   wrapTransport,
 		TLSClientConfig: config.TLSClientConfig,
+		WrapTransport:   wrapTransport,
 		QPS:             qps,
 		Burst:           burst,
-	})
+		// Configure for our API group
+		APIPath: "/apis",
+		ContentConfig: rest.ContentConfig{
+			GroupVersion:         &settingGroupVersion,
+			NegotiatedSerializer: serializer.NewCodecFactory(nil).WithoutConversion(),
+		},
+	}
+
+	return rest.RESTClientFor(restConfig)
 }
 
 // authRoundTripper wraps an HTTP transport with token-based authentication.
@@ -341,10 +430,9 @@ func (a *authRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	if err != nil {
 		return nil, fmt.Errorf("failed to exchange token: %w", err)
 	}
-	req = utilnet.CloneRequest(req)
-
-	req.Header.Set("X-Access-Token", fmt.Sprintf("Bearer %s", token.Token))
-	return a.transport.RoundTrip(req)
+	reqCopy := req.Clone(req.Context())
+	reqCopy.Header.Set("X-Access-Token", fmt.Sprintf("Bearer %s", token.Token))
+	return a.transport.RoundTrip(reqCopy)
 }
 
 func initMetrics() remoteSettingServiceMetrics {
@@ -373,12 +461,12 @@ func initMetrics() remoteSettingServiceMetrics {
 	return metrics
 }
 
-func (m *remoteSettingService) Describe(descs chan<- *prometheus.Desc) {
-	m.metrics.listDuration.Describe(descs)
-	m.metrics.listResultSize.Describe(descs)
+func (s *remoteSettingService) Describe(descs chan<- *prometheus.Desc) {
+	s.metrics.listDuration.Describe(descs)
+	s.metrics.listResultSize.Describe(descs)
 }
 
-func (m *remoteSettingService) Collect(metrics chan<- prometheus.Metric) {
-	m.metrics.listDuration.Collect(metrics)
-	m.metrics.listResultSize.Collect(metrics)
+func (s *remoteSettingService) Collect(metrics chan<- prometheus.Metric) {
+	s.metrics.listDuration.Collect(metrics)
+	s.metrics.listResultSize.Collect(metrics)
 }

pkg/services/setting/service_test.go

@@ -1,69 +1,36 @@
 package setting
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/endpoints/request"
-	"k8s.io/client-go/dynamic/fake"
-	k8testing "k8s.io/client-go/testing"
-
-	authlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/grafana/pkg/infra/log"
 )
 
 func TestRemoteSettingService_ListAsIni(t *testing.T) {
-	t.Run("should filter settings by label selector", func(t *testing.T) {
-		// Create multiple settings, only some matching the selector
-		setting1 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "postgres"})
-		setting2 := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
-		setting3 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "host", Value: "localhost"})
-
-		client := newTestClient(500, setting1, setting2, setting3)
-
-		// Create a selector that should match only database settings
-		selector := metav1.LabelSelector{
-			MatchLabels: map[string]string{
-				"section": "database",
-			},
-		}
-
-		ctx := request.WithNamespace(context.Background(), "test-namespace")
-		result, err := client.ListAsIni(ctx, selector)
-
-		require.NoError(t, err)
-		assert.NotNil(t, result)
-		// Should only have database settings, not server settings
-		assert.True(t, result.HasSection("database"))
-		assert.Equal(t, "postgres", result.Section("database").Key("type").String())
-		assert.Equal(t, "localhost", result.Section("database").Key("host").String())
-		// Should NOT have server settings
-		assert.False(t, result.HasSection("server"))
-	})
-
 	t.Run("should return all settings with empty selector", func(t *testing.T) {
-		// Create multiple settings across different sections
-		setting1 := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
-		setting2 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "mysql"})
-
-		client := newTestClient(500, setting1, setting2)
-
-		// Empty selector should select everything
-		selector := metav1.LabelSelector{}
+		settings := []Setting{
+			{Section: "server", Key: "port", Value: "3000"},
+			{Section: "database", Key: "type", Value: "mysql"},
+		}
+		server := newTestServer(t, settings, "")
+		defer server.Close()
 
+		client := newTestClient(t, server.URL, 500)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
-		result, err := client.ListAsIni(ctx, selector)
+
+		result, err := client.ListAsIni(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
-		// Should have all settings from all sections
 		assert.True(t, result.HasSection("server"))
 		assert.Equal(t, "3000", result.Section("server").Key("port").String())
 		assert.True(t, result.HasSection("database"))
@@ -73,209 +40,168 @@ func TestRemoteSettingService_ListAsIni(t *testing.T) {
 
 func TestRemoteSettingService_List(t *testing.T) {
 	t.Run("should handle single page response", func(t *testing.T) {
-		setting := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
-
-		client := newTestClient(500, setting)
+		settings := []Setting{
+			{Section: "server", Key: "port", Value: "3000"},
+		}
+		server := newTestServer(t, settings, "")
+		defer server.Close()
 
+		client := newTestClient(t, server.URL, 500)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
+
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
 		assert.Len(t, result, 1)
-
-		spec := result[0]
-		assert.Equal(t, "server", spec.Section)
-		assert.Equal(t, "port", spec.Key)
-		assert.Equal(t, "3000", spec.Value)
+		assert.Equal(t, "server", result[0].Section)
+		assert.Equal(t, "port", result[0].Key)
+		assert.Equal(t, "3000", result[0].Value)
 	})
 
-	t.Run("should handle multiple pages", func(t *testing.T) {
-		totalPages := 3
-		pageSize := 5
-
-		pages := make([][]*unstructured.Unstructured, totalPages)
-		for pageNum := 0; pageNum < totalPages; pageNum++ {
-			for idx := 0; idx < pageSize; idx++ {
-				item := newUnstructuredSetting(
-					"test-namespace",
-					Setting{
-						Section: fmt.Sprintf("section-%d", pageNum),
-						Key:     fmt.Sprintf("key-%d", idx),
-						Value:   fmt.Sprintf("val-%d-%d", pageNum, idx),
-					},
-				)
-				pages[pageNum] = append(pages[pageNum], item)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
-		listCallCount := 0
-		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
-			listCallCount++
-
-			continueToken := fmt.Sprintf("continue-%d", listCallCount)
-			if listCallCount == totalPages {
-				continueToken = ""
-			}
-
-			if listCallCount <= totalPages {
-				list := &unstructured.UnstructuredList{
-					Object: map[string]interface{}{
-						"apiVersion": ApiGroup + "/" + apiVersion,
-						"kind":       listKind,
-					},
-				}
-				list.SetContinue(continueToken)
-				for _, item := range pages[listCallCount-1] {
-					list.Items = append(list.Items, *item)
-				}
-				return true, list, nil
-			}
-
-			return false, nil, nil
-		})
-
-		client := &remoteSettingService{
-			dynamicClient: dynamicClient,
-			pageSize:      int64(pageSize),
-			log:           log.NewNopLogger(),
-			metrics:       initMetrics(),
+	t.Run("should handle multiple settings", func(t *testing.T) {
+		settings := []Setting{
+			{Section: "server", Key: "port", Value: "3000"},
+			{Section: "database", Key: "host", Value: "localhost"},
+			{Section: "database", Key: "port", Value: "5432"},
 		}
+		server := newTestServer(t, settings, "")
+		defer server.Close()
 
+		client := newTestClient(t, server.URL, 500)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
+
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
-		assert.Len(t, result, totalPages*pageSize)
-		assert.Equal(t, totalPages, listCallCount)
+		assert.Len(t, result, 3)
 	})
 
-	t.Run("should pass label selector when provided", func(t *testing.T) {
-		scheme := runtime.NewScheme()
-		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
-		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
-			listAction := action.(k8testing.ListActionImpl)
-			assert.Equal(t, "app=grafana", listAction.ListOptions.LabelSelector)
-			return true, &unstructured.UnstructuredList{}, nil
-		})
-
-		client := &remoteSettingService{
-			dynamicClient: dynamicClient,
-			pageSize:      500,
-			log:           log.NewNopLogger(),
-			metrics:       initMetrics(),
+	t.Run("should handle pagination with continue token", func(t *testing.T) {
+		// First page
+		page1Settings := []Setting{
+			{Section: "section-0", Key: "key-0", Value: "value-0"},
+			{Section: "section-0", Key: "key-1", Value: "value-1"},
+		}
+		// Second page
+		page2Settings := []Setting{
+			{Section: "section-1", Key: "key-0", Value: "value-2"},
+			{Section: "section-1", Key: "key-1", Value: "value-3"},
 		}
 
+		requestCount := 0
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestCount++
+			continueToken := r.URL.Query().Get("continue")
+
+			var settings []Setting
+			var nextContinue string
+
+			if continueToken == "" {
+				settings = page1Settings
+				nextContinue = "page2"
+			} else {
+				settings = page2Settings
+				nextContinue = ""
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(generateSettingsJSON(settings, nextContinue)))
+		}))
+		defer server.Close()
+
+		client := newTestClient(t, server.URL, 2)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
-		_, err := client.List(ctx, metav1.LabelSelector{MatchLabels: map[string]string{"app": "grafana"}})
+
+		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
+		assert.Len(t, result, 4)
+		assert.Equal(t, 2, requestCount)
 	})
 
-	t.Run("should stop pagination at 1000 pages", func(t *testing.T) {
-		scheme := runtime.NewScheme()
-		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
-		listCallCount := 0
-		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
-			listCallCount++
-			// Always return a continue token to simulate infinite pagination
-			list := &unstructured.UnstructuredList{}
-			list.SetContinue("continue-forever")
-			return true, list, nil
-		})
+	t.Run("should return error when namespace is missing", func(t *testing.T) {
+		server := newTestServer(t, nil, "")
+		defer server.Close()
 
-		client := &remoteSettingService{
-			dynamicClient: dynamicClient,
-			pageSize:      10,
-			log:           log.NewNopLogger(),
-			metrics:       initMetrics(),
-		}
+		client := newTestClient(t, server.URL, 500)
+		ctx := context.Background() // No namespace
 
-		ctx := request.WithNamespace(context.Background(), "test-namespace")
-		_, err := client.List(ctx, metav1.LabelSelector{})
-
-		require.NoError(t, err)
-		assert.Equal(t, 1000, listCallCount, "Should stop at 1000 pages to prevent infinite loops")
-	})
-
-	t.Run("should return error when parsing setting fails", func(t *testing.T) {
-		scheme := runtime.NewScheme()
-		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
-		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
-			// Return a malformed setting without spec
-			list := &unstructured.UnstructuredList{
-				Object: map[string]interface{}{
-					"apiVersion": ApiGroup + "/" + apiVersion,
-					"kind":       listKind,
-				},
-			}
-			malformedSetting := &unstructured.Unstructured{
-				Object: map[string]interface{}{
-					"apiVersion": ApiGroup + "/" + apiVersion,
-					"kind":       kind,
-					"metadata": map[string]interface{}{
-						"name":      "malformed",
-						"namespace": "test-namespace",
-					},
-					// Missing spec
-				},
-			}
-			list.Items = append(list.Items, *malformedSetting)
-			return true, list, nil
-		})
-
-		client := &remoteSettingService{
-			dynamicClient: dynamicClient,
-			pageSize:      500,
-			log:           log.NewNopLogger(),
-			metrics:       initMetrics(),
-		}
-
-		ctx := request.WithNamespace(context.Background(), "test-namespace")
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.Error(t, err)
 		assert.Nil(t, result)
-		assert.Contains(t, err.Error(), "spec not found")
-	})
-}
-
-func TestParseSettingResource(t *testing.T) {
-	t.Run("should parse valid setting resource", func(t *testing.T) {
-		setting := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "postgres"})
-
-		result, err := parseSettingResource(setting)
-
-		require.NoError(t, err)
-		assert.NotNil(t, result)
-		assert.Equal(t, "database", result.Section)
-		assert.Equal(t, "type", result.Key)
-		assert.Equal(t, "postgres", result.Value)
+		assert.Contains(t, err.Error(), "missing namespace")
 	})
 
-	t.Run("should return error when spec is missing", func(t *testing.T) {
-		setting := &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"apiVersion": ApiGroup + "/" + apiVersion,
-				"kind":       kind,
-				"metadata": map[string]interface{}{
-					"name":      "test-setting",
-					"namespace": "test-namespace",
-				},
-				// No spec
-			},
-		}
+	t.Run("should return error on HTTP error", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("internal server error"))
+		}))
+		defer server.Close()
 
-		result, err := parseSettingResource(setting)
+		client := newTestClient(t, server.URL, 500)
+		ctx := request.WithNamespace(context.Background(), "test-namespace")
+
+		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.Error(t, err)
 		assert.Nil(t, result)
-		assert.Contains(t, err.Error(), "spec not found")
 	})
 }
 
-func TestRemoteSettingService_ToIni(t *testing.T) {
+func TestParseSettingList(t *testing.T) {
+	t.Run("should parse valid settings list", func(t *testing.T) {
+		jsonData := `{
+			"apiVersion": "setting.grafana.app/v0alpha1",
+			"kind": "SettingList",
+			"metadata": {"continue": ""},
+			"items": [
+				{"spec": {"section": "database", "key": "type", "value": "postgres"}},
+				{"spec": {"section": "server", "key": "port", "value": "3000"}}
+			]
+		}`
+
+		settings, continueToken, err := parseSettingList(strings.NewReader(jsonData))
+
+		require.NoError(t, err)
+		assert.Len(t, settings, 2)
+		assert.Equal(t, "", continueToken)
+		assert.Equal(t, "database", settings[0].Section)
+		assert.Equal(t, "type", settings[0].Key)
+		assert.Equal(t, "postgres", settings[0].Value)
+	})
+
+	t.Run("should parse continue token", func(t *testing.T) {
+		jsonData := `{
+			"apiVersion": "setting.grafana.app/v0alpha1",
+			"kind": "SettingList",
+			"metadata": {"continue": "next-page-token"},
+			"items": []
+		}`
+
+		_, continueToken, err := parseSettingList(strings.NewReader(jsonData))
+
+		require.NoError(t, err)
+		assert.Equal(t, "next-page-token", continueToken)
+	})
+
+	t.Run("should handle empty items", func(t *testing.T) {
+		jsonData := `{
+			"apiVersion": "setting.grafana.app/v0alpha1",
+			"kind": "SettingList",
+			"metadata": {},
+			"items": []
+		}`
+
+		settings, _, err := parseSettingList(strings.NewReader(jsonData))
+
+		require.NoError(t, err)
+		assert.Len(t, settings, 0)
+	})
+}
+
+func TestToIni(t *testing.T) {
 	t.Run("should convert settings to ini format", func(t *testing.T) {
 		settings := []*Setting{
 			{Section: "database", Key: "type", Value: "postgres"},
@@ -283,12 +209,7 @@ func TestRemoteSettingService_ToIni(t *testing.T) {
 			{Section: "server", Key: "http_port", Value: "3000"},
 		}
 
-		client := &remoteSettingService{
-			pageSize: 500,
-			log:      log.NewNopLogger(),
-		}
-
-		result, err := client.toIni(settings)
+		result, err := toIni(settings)
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
@@ -302,12 +223,7 @@ func TestRemoteSettingService_ToIni(t *testing.T) {
 	t.Run("should handle empty settings list", func(t *testing.T) {
 		var settings []*Setting
 
-		client := &remoteSettingService{
-			pageSize: 500,
-			log:      log.NewNopLogger(),
-		}
-
-		result, err := client.toIni(settings)
+		result, err := toIni(settings)
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
@@ -315,35 +231,13 @@ func TestRemoteSettingService_ToIni(t *testing.T) {
 		assert.Len(t, sections, 1) // Only default section
 	})
 
-	t.Run("should create section if it does not exist", func(t *testing.T) {
-		settings := []*Setting{
-			{Section: "new_section", Key: "new_key", Value: "new_value"},
-		}
-
-		client := &remoteSettingService{
-			pageSize: 500,
-			log:      log.NewNopLogger(),
-		}
-
-		result, err := client.toIni(settings)
-
-		require.NoError(t, err)
-		assert.True(t, result.HasSection("new_section"))
-		assert.Equal(t, "new_value", result.Section("new_section").Key("new_key").String())
-	})
-
 	t.Run("should handle multiple keys in same section", func(t *testing.T) {
 		settings := []*Setting{
 			{Section: "auth", Key: "disable_login_form", Value: "false"},
 			{Section: "auth", Key: "disable_signout_menu", Value: "true"},
 		}
 
-		client := &remoteSettingService{
-			pageSize: 500,
-			log:      log.NewNopLogger(),
-		}
-
-		result, err := client.toIni(settings)
+		result, err := toIni(settings)
 
 		require.NoError(t, err)
 		assert.True(t, result.HasSection("auth"))
@@ -383,24 +277,23 @@ func TestNew(t *testing.T) {
 		assert.Equal(t, int64(100), remoteClient.pageSize)
 	})
 
-	t.Run("should use default page size when zero is provided", func(t *testing.T) {
+	t.Run("should create client with custom QPS and Burst", func(t *testing.T) {
 		config := Config{
 			URL:           "https://example.com",
 			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-			PageSize:      0,
+			QPS:           50.0,
+			Burst:         100,
 		}
 
 		client, err := New(config)
 
 		require.NoError(t, err)
 		assert.NotNil(t, client)
-		remoteClient := client.(*remoteSettingService)
-		assert.Equal(t, DefaultPageSize, remoteClient.pageSize)
 	})
 
-	t.Run("should return error when config is invalid", func(t *testing.T) {
+	t.Run("should return error when URL is empty", func(t *testing.T) {
 		config := Config{
-			URL: "", // Invalid: empty URL
+			URL: "",
 		}
 
 		client, err := New(config)
@@ -409,134 +302,126 @@ func TestNew(t *testing.T) {
 		assert.Nil(t, client)
 		assert.Contains(t, err.Error(), "URL cannot be empty")
 	})
-}
 
-func TestGetDynamicClient(t *testing.T) {
-	logger := log.NewNopLogger()
-
-	t.Run("should return error when SettingServiceURL is empty", func(t *testing.T) {
-		config := Config{
-			URL:           "",
-			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-		}
-
-		client, err := getDynamicClient(config, logger)
-
-		require.Error(t, err)
-		assert.Nil(t, client)
-		assert.Contains(t, err.Error(), "URL cannot be empty")
-	})
-
-	t.Run("should return error when both TokenExchangeClient and WrapTransport are nil", func(t *testing.T) {
+	t.Run("should return error when auth is not configured", func(t *testing.T) {
 		config := Config{
 			URL:                 "https://example.com",
 			TokenExchangeClient: nil,
 			WrapTransport:       nil,
 		}
 
-		client, err := getDynamicClient(config, logger)
+		client, err := New(config)
 
 		require.Error(t, err)
 		assert.Nil(t, client)
 		assert.Contains(t, err.Error(), "must set either TokenExchangeClient or WrapTransport")
 	})
 
-	t.Run("should create client with WrapTransport", func(t *testing.T) {
-		config := Config{
-			URL:           "https://example.com",
-			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-		}
-
-		client, err := getDynamicClient(config, logger)
-
-		require.NoError(t, err)
-		assert.NotNil(t, client)
-	})
-
-	t.Run("should not fail when QPS and Burst are not provided", func(t *testing.T) {
-		config := Config{
-			URL:           "https://example.com",
-			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-		}
-
-		client, err := getDynamicClient(config, logger)
-
-		require.NoError(t, err)
-		assert.NotNil(t, client)
-	})
-
-	t.Run("should not fail when custom QPS and Burst are provided", func(t *testing.T) {
-		config := Config{
-			URL:           "https://example.com",
-			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-			QPS:           10.0,
-			Burst:         20,
-		}
-
-		client, err := getDynamicClient(config, logger)
-
-		require.NoError(t, err)
-		assert.NotNil(t, client)
-	})
-
-	t.Run("should use WrapTransport when both WrapTransport and TokenExchangeClient are provided", func(t *testing.T) {
+	t.Run("should use WrapTransport when provided", func(t *testing.T) {
 		wrapTransportCalled := false
-		tokenExchangeClient := &authlib.TokenExchangeClient{}
 
 		config := Config{
-			URL:                 "https://example.com",
-			TokenExchangeClient: tokenExchangeClient,
+			URL: "https://example.com",
 			WrapTransport: func(rt http.RoundTripper) http.RoundTripper {
 				wrapTransportCalled = true
 				return rt
 			},
 		}
 
-		client, err := getDynamicClient(config, logger)
+		client, err := New(config)
 
 		require.NoError(t, err)
 		assert.NotNil(t, client)
-		assert.True(t, wrapTransportCalled, "WrapTransport should be called and take precedence over TokenExchangeClient")
+		assert.True(t, wrapTransportCalled)
 	})
 }
 
-// Helper function to create an unstructured Setting object for tests
-func newUnstructuredSetting(namespace string, spec Setting) *unstructured.Unstructured {
-	// Generate resource name in the format {section}--{key}
-	name := fmt.Sprintf("%s--%s", spec.Section, spec.Key)
+// Helper functions
 
-	obj := &unstructured.Unstructured{
-		Object: map[string]interface{}{
-			"apiVersion": ApiGroup + "/" + apiVersion,
-			"kind":       kind,
-			"metadata": map[string]interface{}{
-				"name":      name,
-				"namespace": namespace,
-			},
-			"spec": map[string]interface{}{
-				"section": spec.Section,
-				"key":     spec.Key,
-				"value":   spec.Value,
-			},
-		},
-	}
-	// Always set section and key labels
-	obj.SetLabels(map[string]string{
-		"section": spec.Section,
-		"key":     spec.Key,
-	})
-	return obj
+func newTestServer(t *testing.T, settings []Setting, continueToken string) *httptest.Server {
+	t.Helper()
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(generateSettingsJSON(settings, continueToken)))
+	}))
 }
 
-// Helper function to create a test client with the dynamic fake client
-func newTestClient(pageSize int64, objects ...runtime.Object) *remoteSettingService {
-	scheme := runtime.NewScheme()
-	dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind, objects...)
+func newTestClient(t *testing.T, serverURL string, pageSize int64) Service {
+	t.Helper()
+	config := Config{
+		URL:           serverURL,
+		WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
+		PageSize:      pageSize,
+	}
+	client, err := New(config)
+	require.NoError(t, err)
+	return client
+}
 
-	return &remoteSettingService{
-		dynamicClient: dynamicClient,
-		pageSize:      pageSize,
-		log:           log.NewNopLogger(),
-		metrics:       initMetrics(),
+func generateSettingsJSON(settings []Setting, continueToken string) string {
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf(`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"SettingList","metadata":{"continue":"%s"},"items":[`, continueToken))
+
+	for i, s := range settings {
+		if i > 0 {
+			sb.WriteString(",")
+		}
+		sb.WriteString(fmt.Sprintf(
+			`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"Setting","metadata":{"name":"%s--%s","namespace":"test-namespace"},"spec":{"section":"%s","key":"%s","value":"%s"}}`,
+			s.Section, s.Key, s.Section, s.Key, s.Value,
+		))
+	}
+
+	sb.WriteString(`]}`)
+	return sb.String()
+}
+
+// Benchmark tests for streaming JSON parser
+
+func BenchmarkParseSettingList(b *testing.B) {
+	jsonData := generateSettingListJSON(4000, 100)
+	jsonBytes := []byte(jsonData)
+
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		reader := bytes.NewReader(jsonBytes)
+		_, _, _ = parseSettingList(reader)
 	}
 }
+
+func BenchmarkParseSettingList_SinglePage(b *testing.B) {
+	jsonData := generateSettingListJSON(500, 50)
+	jsonBytes := []byte(jsonData)
+
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		reader := bytes.NewReader(jsonBytes)
+		_, _, _ = parseSettingList(reader)
+	}
+}
+
+// generateSettingListJSON generates a K8s-style SettingList JSON response for benchmarks
+func generateSettingListJSON(totalSettings, numSections int) string {
+	var sb strings.Builder
+	sb.WriteString(`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"SettingList","metadata":{"continue":""},"items":[`)
+
+	settingsPerSection := totalSettings / numSections
+	first := true
+	for section := 0; section < numSections; section++ {
+		for key := 0; key < settingsPerSection; key++ {
+			if !first {
+				sb.WriteString(",")
+			}
+			first = false
+			sb.WriteString(fmt.Sprintf(
+				`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"Setting","metadata":{"name":"section-%03d--key-%03d","namespace":"bench-ns"},"spec":{"section":"section-%03d","key":"key-%03d","value":"value-for-section-%d-key-%d"}}`,
+				section, key, section, key, section, key,
+			))
+		}
+	}
+
+	sb.WriteString(`]}`)
+	return sb.String()
+}

pkg/services/sqlstore/migrations/migrations.go

@@ -165,5 +165,7 @@ func (oss *OSSMigrations) AddMigration(mg *Migrator) {
 
 	ualert.AddStateAnnotationsColumn(mg)
 
+	ualert.CollateBinAlertRuleNamespace(mg)
+
 	ualert.CollateBinAlertRuleGroup(mg)
 }

pkg/services/sqlstore/migrations/ualert/alert_rule_namespace_collation.go

@@ -0,0 +1,10 @@
+package ualert
+
+import "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
+
+// CollateBinAlertRuleNamespace ensures that namespace_uid column collates in the same way go sorts strings.
+func CollateBinAlertRuleNamespace(mg *migrator.Migrator) {
+	mg.AddMigration("ensure namespace_uid column sorts the same way as golang", migrator.NewRawSQLMigration("").
+		Mysql("ALTER TABLE alert_rule MODIFY namespace_uid VARCHAR(40) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL;").
+		Postgres(`ALTER TABLE alert_rule ALTER COLUMN namespace_uid SET DATA TYPE varchar(40) COLLATE "C";`))
+}

pkg/setting/setting_plugins.go

@@ -102,7 +102,7 @@ func (cfg *Cfg) processPreinstallPlugins(rawInstallPlugins []string, preinstallP
 		if len(parts) > 1 {
 			version = parts[1]
 			if len(parts) > 2 {
-				url = parts[2]
+				url = strings.Join(parts[2:], "@")
 			}
 		}
 

pkg/setting/setting_plugins_test.go

@@ -210,6 +210,11 @@ func Test_readPluginSettings(t *testing.T) {
 				rawInput: "plugin1@@https://example.com/plugin1.tar.gz",
 				expected: append(defaultPreinstallPluginsList, InstallPlugin{ID: "plugin1", Version: "", URL: "https://example.com/plugin1.tar.gz"}),
 			},
+			{
+				name:     "should parse a plugin with credentials in the URL",
+				rawInput: "plugin1@@https://username:password@example.com/plugin1.tar.gz",
+				expected: append(defaultPreinstallPluginsList, InstallPlugin{ID: "plugin1", Version: "", URL: "https://username:password@example.com/plugin1.tar.gz"}),
+			},
 			{
 				name:         "when preinstall_async is false, should add all plugins to preinstall_sync",
 				rawInput:     "plugin1",

pkg/setting/settings_zanzana.go

@@ -110,15 +110,24 @@ func (cfg *Cfg) readZanzanaSettings() {
 		zc.Mode = "embedded"
 	}
 
-	zc.Token = clientSec.Key("token").MustString("")
-	zc.TokenExchangeURL = clientSec.Key("token_exchange_url").MustString("")
 	zc.Addr = clientSec.Key("address").MustString("")
 	zc.ServerCertFile = clientSec.Key("tls_cert").MustString("")
 
-	// TODO: read Token and TokenExchangeURL from grpc_client_authentication section
 	grpcClientAuthSection := cfg.SectionWithEnvOverrides("grpc_client_authentication")
+	zc.Token = grpcClientAuthSection.Key("token").MustString("")
+	zc.TokenExchangeURL = grpcClientAuthSection.Key("token_exchange_url").MustString("")
 	zc.TokenNamespace = grpcClientAuthSection.Key("token_namespace").MustString("stacks-" + cfg.StackID)
 
+	// TODO: remove old settings when migrated
+	token := clientSec.Key("token").MustString("")
+	tokenExchangeURL := clientSec.Key("token_exchange_url").MustString("")
+	if token != "" {
+		zc.Token = token
+	}
+	if tokenExchangeURL != "" {
+		zc.TokenExchangeURL = tokenExchangeURL
+	}
+
 	cfg.ZanzanaClient = zc
 
 	zs := ZanzanaServerSettings{}

pkg/tests/apis/provisioning/fieldselector_test.go

@@ -0,0 +1,211 @@
+package provisioning
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
+	"github.com/grafana/grafana/pkg/util/testutil"
+)
+
+// TestIntegrationProvisioning_RepositoryFieldSelector tests that fieldSelector
+// works correctly for Repository resources. This prevents regression where
+// fieldSelector=metadata.name=<name> was not working properly.
+func TestIntegrationProvisioning_RepositoryFieldSelector(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+
+	helper := runGrafana(t)
+	ctx := context.Background()
+
+	// Create multiple repositories for testing
+	repo1Name := "repo-selector-test-1"
+	repo2Name := "repo-selector-test-2"
+	repo3Name := "repo-selector-test-3"
+
+	// Create first repository
+	repo1 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
+		"Name":        repo1Name,
+		"SyncEnabled": false, // Disable sync to speed up test
+	})
+	_, err := helper.Repositories.Resource.Create(ctx, repo1, metav1.CreateOptions{})
+	require.NoError(t, err, "failed to create first repository")
+	helper.WaitForHealthyRepository(t, repo1Name)
+
+	// Create second repository
+	repo2 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
+		"Name":        repo2Name,
+		"SyncEnabled": false,
+	})
+	_, err = helper.Repositories.Resource.Create(ctx, repo2, metav1.CreateOptions{})
+	require.NoError(t, err, "failed to create second repository")
+	helper.WaitForHealthyRepository(t, repo2Name)
+
+	// Create third repository
+	repo3 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
+		"Name":        repo3Name,
+		"SyncEnabled": false,
+	})
+	_, err = helper.Repositories.Resource.Create(ctx, repo3, metav1.CreateOptions{})
+	require.NoError(t, err, "failed to create third repository")
+	helper.WaitForHealthyRepository(t, repo3Name)
+
+	// Verify all repositories were created
+	allRepos, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{})
+	require.NoError(t, err, "should be able to list all repositories")
+	require.GreaterOrEqual(t, len(allRepos.Items), 3, "should have at least 3 repositories")
+
+	t.Run("should filter by metadata.name and return single repository", func(t *testing.T) {
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=" + repo2Name,
+		})
+		require.NoError(t, err, "fieldSelector query should succeed")
+		require.Len(t, list.Items, 1, "should return exactly one repository")
+		require.Equal(t, repo2Name, list.Items[0].GetName(), "should return the correct repository")
+	})
+
+	t.Run("should filter by different metadata.name", func(t *testing.T) {
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=" + repo1Name,
+		})
+		require.NoError(t, err, "fieldSelector query should succeed")
+		require.Len(t, list.Items, 1, "should return exactly one repository")
+		require.Equal(t, repo1Name, list.Items[0].GetName(), "should return the first repository")
+	})
+
+	t.Run("should return empty when fieldSelector does not match any repository", func(t *testing.T) {
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=non-existent-repository",
+		})
+		require.NoError(t, err, "fieldSelector query should succeed even with no matches")
+		require.Empty(t, list.Items, "should return empty list when no repositories match")
+	})
+
+	t.Run("listing without fieldSelector should return all repositories", func(t *testing.T) {
+		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err, "should be able to list without fieldSelector")
+		require.GreaterOrEqual(t, len(list.Items), 3, "should return all repositories when no filter is applied")
+
+		// Verify our test repositories are in the list
+		names := make(map[string]bool)
+		for _, item := range list.Items {
+			names[item.GetName()] = true
+		}
+		require.True(t, names[repo1Name], "should contain repo1")
+		require.True(t, names[repo2Name], "should contain repo2")
+		require.True(t, names[repo3Name], "should contain repo3")
+	})
+}
+
+// TestIntegrationProvisioning_JobFieldSelector tests that fieldSelector
+// works correctly for Job resources. This prevents regression where
+// fieldSelector=metadata.name=<name> was not working properly.
+func TestIntegrationProvisioning_JobFieldSelector(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+
+	helper := runGrafana(t)
+	ctx := context.Background()
+
+	// Create a repository to trigger jobs
+	repoName := "job-selector-test-repo"
+	repo := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
+		"Name":        repoName,
+		"SyncEnabled": false,
+	})
+	_, err := helper.Repositories.Resource.Create(ctx, repo, metav1.CreateOptions{})
+	require.NoError(t, err, "failed to create repository")
+	helper.WaitForHealthyRepository(t, repoName)
+
+	// Copy some test files to trigger jobs
+	helper.CopyToProvisioningPath(t, "testdata/all-panels.json", "job-test-dashboard-1.json")
+	helper.CopyToProvisioningPath(t, "testdata/text-options.json", "job-test-dashboard-2.json")
+
+	// Trigger multiple jobs to have multiple job resources
+	job1Spec := provisioning.JobSpec{
+		Action: provisioning.JobActionPull,
+		Pull:   &provisioning.SyncJobOptions{},
+	}
+
+	// Trigger first job
+	body1 := asJSON(job1Spec)
+	result1 := helper.AdminREST.Post().
+		Namespace("default").
+		Resource("repositories").
+		Name(repoName).
+		SubResource("jobs").
+		Body(body1).
+		SetHeader("Content-Type", "application/json").
+		Do(ctx)
+	require.NoError(t, result1.Error(), "should be able to trigger first job")
+
+	obj1, err := result1.Get()
+	require.NoError(t, err, "should get first job object")
+	job1 := obj1.(*unstructured.Unstructured)
+	job1Name := job1.GetName()
+	require.NotEmpty(t, job1Name, "first job should have a name")
+
+	// Wait for first job to complete before starting second
+	helper.AwaitJobs(t, repoName)
+
+	// Trigger second job
+	result2 := helper.AdminREST.Post().
+		Namespace("default").
+		Resource("repositories").
+		Name(repoName).
+		SubResource("jobs").
+		Body(body1).
+		SetHeader("Content-Type", "application/json").
+		Do(ctx)
+	require.NoError(t, result2.Error(), "should be able to trigger second job")
+
+	obj2, err := result2.Get()
+	require.NoError(t, err, "should get second job object")
+	job2 := obj2.(*unstructured.Unstructured)
+	job2Name := job2.GetName()
+	require.NotEmpty(t, job2Name, "second job should have a name")
+
+	t.Run("should filter by metadata.name and return single job", func(t *testing.T) {
+		// Note: Jobs are ephemeral and may complete quickly, so we test while they exist
+		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=" + job2Name,
+		})
+		require.NoError(t, err, "fieldSelector query should succeed")
+
+		// The job might have completed already, but if it exists, it should be the only one
+		if len(list.Items) > 0 {
+			require.Len(t, list.Items, 1, "should return at most one job")
+			require.Equal(t, job2Name, list.Items[0].GetName(), "should return the correct job")
+		}
+	})
+
+	t.Run("should filter by different metadata.name", func(t *testing.T) {
+		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=" + job1Name,
+		})
+		require.NoError(t, err, "fieldSelector query should succeed")
+
+		// The job might have completed already, but if it exists, it should be the only one
+		if len(list.Items) > 0 {
+			require.Len(t, list.Items, 1, "should return at most one job")
+			require.Equal(t, job1Name, list.Items[0].GetName(), "should return the first job")
+		}
+	})
+
+	t.Run("should return empty when fieldSelector does not match any job", func(t *testing.T) {
+		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
+			FieldSelector: "metadata.name=non-existent-job",
+		})
+		require.NoError(t, err, "fieldSelector query should succeed even with no matches")
+		require.Empty(t, list.Items, "should return empty list when no jobs match")
+	})
+
+	t.Run("listing without fieldSelector should work", func(t *testing.T) {
+		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err, "should be able to list without fieldSelector")
+		// Jobs may have completed, so we don't assert on count, just that the query works
+		t.Logf("Found %d active jobs without filter", len(list.Items))
+	})
+}

public/app/features/alerting/unified/components/assistant/AnalizeRuleButton.tsx

@@ -59,7 +59,7 @@ function AnalyzeRuleButtonView({
     });
 
     openAssistant({
-      origin: 'alerting',
+      origin: 'alerting/analyze-rule-menu-item',
       mode: 'assistant',
       prompt: analyzeRulePrompt,
       context: [alertContext],

public/app/features/alerting/unified/components/rules/RuleDetailsMatchingInstances.tsx

@@ -40,26 +40,44 @@ interface ShowMoreInstancesProps {
   stats: ShowMoreStats;
   onClick?: React.ComponentProps<typeof LinkButton>['onClick'];
   href?: React.ComponentProps<typeof LinkButton>['href'];
+  enableFiltering?: boolean;
+  alertState?: InstanceStateFilter;
 }
 
-function ShowMoreInstances({ stats, onClick, href }: ShowMoreInstancesProps) {
+function ShowMoreInstances({ stats, onClick, href, enableFiltering, alertState }: ShowMoreInstancesProps) {
   const styles = useStyles2(getStyles);
   const { visibleItemsCount, totalItemsCount } = stats;
 
   return (
     <div className={styles.footerRow}>
       <div>
-        <Trans
-          i18nKey="alerting.rule-details-matching-instances.showing-count"
-          values={{ visibleItemsCount, totalItemsCount }}
-        >
-          Showing {{ visibleItemsCount }} out of {{ totalItemsCount }} instances
-        </Trans>
+        {enableFiltering && alertState ? (
+          <Trans
+            i18nKey="alerting.rule-details-matching-instances.showing-count-with-state"
+            values={{ visibleItemsCount, alertState, totalItemsCount }}
+          >
+            Showing {{ visibleItemsCount }} {{ alertState }} out of {{ totalItemsCount }} instances
+          </Trans>
+        ) : (
+          <Trans
+            i18nKey="alerting.rule-details-matching-instances.showing-count"
+            values={{ visibleItemsCount, totalItemsCount }}
+          >
+            Showing {{ visibleItemsCount }} out of {{ totalItemsCount }} instances
+          </Trans>
+        )}
       </div>
       <LinkButton size="sm" variant="secondary" data-testid="show-all" onClick={onClick} href={href}>
-        <Trans i18nKey="alerting.rule-details-matching-instances.button-show-all" values={{ totalItemsCount }}>
-          Show all {{ totalItemsCount }} alert instances
-        </Trans>
+        {enableFiltering ? (
+          <Trans i18nKey="alerting.rule-details-matching-instances.button-show-all">Show all</Trans>
+        ) : (
+          <Trans
+            i18nKey="alerting.rule-details-matching-instances.button-show-all-instances"
+            values={{ totalItemsCount }}
+          >
+            Show all {{ totalItemsCount }} alert instances
+          </Trans>
+        )}
       </LinkButton>
     </div>
   );
@@ -128,6 +146,8 @@ export function RuleDetailsMatchingInstances(props: Props) {
       stats={stats}
       onClick={enableFiltering ? resetFilter : undefined}
       href={!enableFiltering ? ruleViewPageLink : undefined}
+      enableFiltering={enableFiltering}
+      alertState={alertState}
     />
   ) : undefined;
 

public/app/features/dashboard-scene/edit-pane/shared.ts

@@ -245,10 +245,29 @@ export const dashboardEditActions = {
     description: t('dashboard.variable.description.action', 'Change variable description'),
     prop: 'description',
   }),
-  changeVariableHideValue: makeEditAction<SceneVariable, 'hide'>({
-    description: t('dashboard.variable.hide.action', 'Change variable hide option'),
-    prop: 'hide',
-  }),
+  changeVariableHideValue({ source, oldValue, newValue }: EditActionProps<SceneVariable, 'hide'>) {
+    const variableSet = source.parent;
+    const variablesBeforeChange =
+      variableSet instanceof SceneVariableSet ? [...(variableSet.state.variables ?? [])] : undefined;
+
+    dashboardEditActions.edit({
+      description: t('dashboard.variable.hide.action', 'Change variable hide option'),
+      source,
+      perform: () => {
+        source.setState({ hide: newValue });
+        // Updating the variables set since components that show/hide variables subscribe to the variable set, not the individual variables.
+        if (variableSet instanceof SceneVariableSet) {
+          variableSet.setState({ variables: [...(variableSet.state.variables ?? [])] });
+        }
+      },
+      undo: () => {
+        source.setState({ hide: oldValue });
+        if (variableSet instanceof SceneVariableSet && variablesBeforeChange) {
+          variableSet.setState({ variables: variablesBeforeChange });
+        }
+      },
+    });
+  },
 
   moveElement(props: MoveElementActionHelperProps) {
     const { movedObject, source, perform, undo } = props;

public/app/features/dashboard-scene/scene/DataLayerControl.tsx

@@ -64,6 +64,7 @@ const getStyles = (theme: GrafanaTheme2) => ({
     display: 'flex',
     alignItems: 'center',
     gap: theme.spacing(1),
+    padding: theme.spacing(1),
   }),
   controlWrapper: css({
     height: theme.spacing(2),

public/app/features/dashboard-scene/scene/VariableControls.tsx

@@ -82,19 +82,39 @@ export function VariableValueSelectWrapper({ variable, inMenu }: VariableSelectP
   // For switch variables in menu, we want to show the switch on the left and the label on the right
   if (inMenu && sceneUtils.isSwitchVariable(variable)) {
     return (
-      <div className={styles.switchMenuContainer} data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}>
+      <div
+        className={cx(
+          styles.switchMenuContainer,
+          isSelected && 'dashboard-selected-element',
+          isSelectable && !isSelected && 'dashboard-selectable-element'
+        )}
+        onPointerDown={onPointerDown}
+        data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}
+      >
         <div className={styles.switchControl}>
           <variable.Component model={variable} />
         </div>
-        <VariableLabel variable={variable} layout={'vertical'} className={styles.switchLabel} />
+        <VariableLabel
+          variable={variable}
+          layout={'vertical'}
+          className={cx(isSelectable && styles.labelSelectable, styles.switchLabel)}
+        />
       </div>
     );
   }
 
   if (inMenu) {
     return (
-      <div className={styles.verticalContainer} data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}>
-        <VariableLabel variable={variable} layout={'vertical'} />
+      <div
+        className={cx(
+          styles.verticalContainer,
+          isSelected && 'dashboard-selected-element',
+          isSelectable && !isSelected && 'dashboard-selectable-element'
+        )}
+        onPointerDown={onPointerDown}
+        data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}
+      >
+        <VariableLabel variable={variable} layout={'vertical'} className={cx(isSelectable && styles.labelSelectable)} />
         <variable.Component model={variable} />
       </div>
     );
@@ -164,11 +184,13 @@ const getStyles = (theme: GrafanaTheme2) => ({
   verticalContainer: css({
     display: 'flex',
     flexDirection: 'column',
+    padding: theme.spacing(1),
   }),
   switchMenuContainer: css({
     display: 'flex',
     alignItems: 'center',
     gap: theme.spacing(1),
+    padding: theme.spacing(1),
   }),
   switchControl: css({
     '& > div': {

public/app/features/dashboard-scene/scene/dashboard-controls-menu/DashboardControlsMenu.tsx

@@ -1,4 +1,4 @@
-import { css, cx } from '@emotion/css';
+import { css } from '@emotion/css';
 
 import { GrafanaTheme2 } from '@grafana/data';
 import { SceneDataLayerProvider, SceneVariable } from '@grafana/scenes';
@@ -17,8 +17,6 @@ interface DashboardControlsMenuProps {
 }
 
 export function DashboardControlsMenu({ variables, links, annotations, dashboardUID }: DashboardControlsMenuProps) {
-  const styles = useStyles2(getStyles);
-
   return (
     <Box
       minWidth={32}
@@ -29,7 +27,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
       direction={'column'}
       borderRadius={'default'}
       backgroundColor={'primary'}
-      padding={1.5}
+      padding={1}
       gap={0.5}
       onClick={(e) => {
         // Normally, clicking the overlay closes the dropdown.
@@ -39,7 +37,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
     >
       {/* Variables */}
       {variables.map((variable, index) => (
-        <div className={cx({ [styles.menuItem]: index > 0 })} key={variable.state.key}>
+        <div key={variable.state.key}>
           <VariableValueSelectWrapper variable={variable} inMenu />
         </div>
       ))}
@@ -47,7 +45,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
       {/* Annotation layers */}
       {annotations.length > 0 &&
         annotations.map((layer, index) => (
-          <div className={cx({ [styles.menuItem]: variables.length > 0 || index > 0 })} key={layer.state.key}>
+          <div key={layer.state.key}>
             <DataLayerControl layer={layer} inMenu />
           </div>
         ))}
@@ -79,10 +77,7 @@ function MenuDivider() {
 
 const getStyles = (theme: GrafanaTheme2) => ({
   divider: css({
-    marginTop: theme.spacing(2),
+    marginTop: theme.spacing(1),
     padding: theme.spacing(0, 0.5),
   }),
-  menuItem: css({
-    marginTop: theme.spacing(2),
-  }),
 });

public/app/features/provisioning/GettingStarted/GettingStarted.tsx

@@ -22,7 +22,6 @@ const featureIni = `# In your custom.ini file
 
 [feature_toggles]
 provisioning = true
-kubernetesDashboards = true ; use k8s from browser
 `;
 
 const ngrokExample = `ngrok http 3000
@@ -103,7 +102,7 @@ const getModalContent = (setupType: SetupType) => {
             ),
             description: t(
               'provisioning.getting-started.step-description-enable-feature-toggles',
-              'Add these settings to your custom.ini file to enable necessary features:'
+              'Add the provisioning feature toggle to your custom.ini file. Note: kubernetesDashboards is enabled by default, but if you have explicitly disabled it, you will need to enable it in your Grafana settings or remove the override from your configuration.'
             ),
             code: featureIni,
           },

public/app/features/scopes/ScopesService.test.ts

@@ -22,8 +22,8 @@ describe('ScopesService', () => {
     | undefined;
   let dashboardsStateSubscription:
     | ((
-        state: { navigationScope?: string; drawerOpened: boolean },
-        prevState: { navigationScope?: string; drawerOpened: boolean }
+        state: { navigationScope?: string; drawerOpened: boolean; navScopePath?: string[] },
+        prevState: { navigationScope?: string; drawerOpened: boolean; navScopePath?: string[] }
       ) => void)
     | undefined;
 
@@ -56,7 +56,7 @@ describe('ScopesService', () => {
         selectorStateSubscription = callback;
         return { unsubscribe: jest.fn() };
       }),
-      changeScopes: jest.fn(),
+      changeScopes: jest.fn().mockResolvedValue(undefined),
       resolvePathToRoot: jest.fn().mockResolvedValue({ path: [], tree: {} }),
     } as unknown as jest.Mocked<ScopesSelectorService>;
 
@@ -71,6 +71,7 @@ describe('ScopesService', () => {
         loading: false,
         searchQuery: '',
         navigationScope: undefined,
+        navScopePath: undefined,
       },
       stateObservable: new BehaviorSubject({
         drawerOpened: false,
@@ -82,12 +83,14 @@ describe('ScopesService', () => {
         loading: false,
         searchQuery: '',
         navigationScope: undefined,
+        navScopePath: undefined,
       }),
       subscribeToState: jest.fn((callback) => {
         dashboardsStateSubscription = callback;
         return { unsubscribe: jest.fn() };
       }),
       setNavigationScope: jest.fn(),
+      setNavScopePath: jest.fn(),
     } as unknown as jest.Mocked<ScopesDashboardsService>;
 
     locationService = {
@@ -188,7 +191,7 @@ describe('ScopesService', () => {
 
       service = new ScopesService(selectorService, dashboardsService, locationService);
 
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1');
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
     });
 
     it('should read navigation_scope along with other scope parameters', () => {
@@ -199,7 +202,7 @@ describe('ScopesService', () => {
 
       service = new ScopesService(selectorService, dashboardsService, locationService);
 
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1');
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
       expect(selectorService.changeScopes).toHaveBeenCalledWith(['scope1'], undefined, 'node1', false);
     });
 
@@ -213,6 +216,45 @@ describe('ScopesService', () => {
 
       expect(dashboardsService.setNavigationScope).not.toHaveBeenCalled();
     });
+
+    it('should read nav_scope_path along with navigation_scope from URL on init', () => {
+      locationService.getLocation = jest.fn().mockReturnValue({
+        pathname: '/test',
+        search: '?navigation_scope=navScope1&nav_scope_path=mimir%2Cloki',
+      });
+
+      service = new ScopesService(selectorService, dashboardsService, locationService);
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, ['mimir', 'loki']);
+    });
+
+    it('should handle nav_scope_path without navigation_scope by calling setNavScopePath after changeScopes', async () => {
+      locationService.getLocation = jest.fn().mockReturnValue({
+        pathname: '/test',
+        search: '?scopes=scope1&nav_scope_path=mimir',
+      });
+
+      service = new ScopesService(selectorService, dashboardsService, locationService);
+
+      // Wait for the changeScopes promise to resolve
+      await Promise.resolve();
+
+      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir']);
+    });
+
+    it('should handle URL-encoded nav_scope_path values', () => {
+      locationService.getLocation = jest.fn().mockReturnValue({
+        pathname: '/test',
+        search: '?navigation_scope=navScope1&nav_scope_path=' + encodeURIComponent('folder one,folder two'),
+      });
+
+      service = new ScopesService(selectorService, dashboardsService, locationService);
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, [
+        'folder one',
+        'folder two',
+      ]);
+    });
   });
 
   describe('URL synchronization', () => {
@@ -346,16 +388,22 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
+          navScopePath: undefined,
         },
         {
           navigationScope: undefined,
           drawerOpened: false,
+          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith({
-        navigation_scope: 'navScope1',
-      });
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: 'navScope1',
+          nav_scope_path: null,
+        },
+        true
+      );
     });
 
     it('should update navigation_scope in URL when navigationScope changes', () => {
@@ -367,16 +415,22 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope2',
           drawerOpened: true,
+          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
+          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith({
-        navigation_scope: 'navScope2',
-      });
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: 'navScope2',
+          nav_scope_path: null,
+        },
+        true
+      );
     });
 
     it('should not update URL when navigationScope has not changed', () => {
@@ -390,10 +444,12 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
+          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: false,
+          navScopePath: undefined,
         }
       );
 
@@ -409,16 +465,126 @@ describe('ScopesService', () => {
         {
           navigationScope: undefined,
           drawerOpened: false,
+          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
+          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith({
-        navigation_scope: undefined,
-      });
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: null,
+          nav_scope_path: null,
+        },
+        true
+      );
+    });
+
+    it('should write nav_scope_path to URL when navScopePath changes', () => {
+      if (!dashboardsStateSubscription) {
+        throw new Error('dashboardsStateSubscription not set');
+      }
+
+      dashboardsStateSubscription(
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: ['mimir', 'loki'],
+        },
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: undefined,
+        }
+      );
+
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: 'navScope1',
+          nav_scope_path: encodeURIComponent('mimir,loki'),
+        },
+        true
+      );
+    });
+
+    it('should update nav_scope_path in URL when navScopePath changes', () => {
+      if (!dashboardsStateSubscription) {
+        throw new Error('dashboardsStateSubscription not set');
+      }
+
+      dashboardsStateSubscription(
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: ['mimir', 'loki', 'tempo'],
+        },
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: ['mimir', 'loki'],
+        }
+      );
+
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: 'navScope1',
+          nav_scope_path: encodeURIComponent('mimir,loki,tempo'),
+        },
+        true
+      );
+    });
+
+    it('should clear nav_scope_path from URL when navScopePath becomes empty', () => {
+      if (!dashboardsStateSubscription) {
+        throw new Error('dashboardsStateSubscription not set');
+      }
+
+      dashboardsStateSubscription(
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: [],
+        },
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: ['mimir'],
+        }
+      );
+
+      expect(locationService.partial).toHaveBeenCalledWith(
+        {
+          navigation_scope: 'navScope1',
+          nav_scope_path: null,
+        },
+        true
+      );
+    });
+
+    it('should not update URL when only drawerOpened changes but navigationScope and navScopePath remain the same', () => {
+      if (!dashboardsStateSubscription) {
+        throw new Error('dashboardsStateSubscription not set');
+      }
+
+      jest.clearAllMocks();
+
+      dashboardsStateSubscription(
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: false,
+          navScopePath: ['mimir'],
+        },
+        {
+          navigationScope: 'navScope1',
+          drawerOpened: true,
+          navScopePath: ['mimir'],
+        }
+      );
+
+      expect(locationService.partial).not.toHaveBeenCalled();
     });
   });
 
@@ -457,4 +623,113 @@ describe('ScopesService', () => {
       );
     });
   });
+
+  describe('back/forward navigation handling', () => {
+    let locationSubject: BehaviorSubject<{ pathname: string; search: string }>;
+
+    beforeEach(() => {
+      locationSubject = new BehaviorSubject({
+        pathname: '/test',
+        search: '',
+      });
+
+      locationService.getLocation = jest.fn().mockReturnValue({
+        pathname: '/test',
+        search: '',
+      });
+      locationService.getLocationObservable = jest.fn().mockReturnValue(locationSubject);
+
+      // Set initial state for dashboards service
+      dashboardsService.state.navigationScope = undefined;
+      dashboardsService.state.navScopePath = undefined;
+
+      service = new ScopesService(selectorService, dashboardsService, locationService);
+      service.setEnabled(true);
+
+      jest.clearAllMocks();
+    });
+
+    it('should update navigation scope when URL changes via back/forward', () => {
+      // Simulate URL change (e.g., browser back button)
+      locationSubject.next({
+        pathname: '/test',
+        search: '?navigation_scope=navScope1',
+      });
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
+    });
+
+    it('should update nav_scope_path when URL changes via back/forward', () => {
+      // Set current state
+      dashboardsService.state.navigationScope = 'navScope1';
+      dashboardsService.state.navScopePath = undefined;
+
+      // Simulate URL change with nav_scope_path
+      locationSubject.next({
+        pathname: '/test',
+        search: '?navigation_scope=navScope1&nav_scope_path=' + encodeURIComponent('mimir,loki'),
+      });
+
+      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir', 'loki']);
+    });
+
+    it('should clear navigation scope when removed from URL via back/forward', () => {
+      // Set current state
+      dashboardsService.state.navigationScope = 'navScope1';
+      dashboardsService.state.navScopePath = ['mimir'];
+
+      // Simulate URL change (navigation scope removed)
+      locationSubject.next({
+        pathname: '/test',
+        search: '',
+      });
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined);
+    });
+
+    it('should handle navigation scope change along with nav_scope_path', () => {
+      // Set current state
+      dashboardsService.state.navigationScope = 'navScope1';
+      dashboardsService.state.navScopePath = ['mimir'];
+
+      // Simulate URL change to different navigation scope with new path
+      locationSubject.next({
+        pathname: '/test',
+        search: '?navigation_scope=navScope2&nav_scope_path=' + encodeURIComponent('loki,tempo'),
+      });
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope2', undefined, ['loki', 'tempo']);
+    });
+
+    it('should handle URL-encoded navigation_scope from back/forward', () => {
+      // Set current state
+      dashboardsService.state.navigationScope = undefined;
+
+      // Simulate URL change with encoded navigation scope
+      locationSubject.next({
+        pathname: '/test',
+        search: '?navigation_scope=' + encodeURIComponent('scope with spaces'),
+      });
+
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('scope with spaces', undefined, undefined);
+    });
+
+    it('should handle nav_scope_path change without navigation_scope', async () => {
+      // Set current state - no navigation scope but has nav scope path
+      dashboardsService.state.navigationScope = undefined;
+      dashboardsService.state.navScopePath = undefined;
+      selectorService.state.appliedScopes = [{ scopeId: 'scope1' }];
+
+      // Simulate URL change with only nav_scope_path
+      locationSubject.next({
+        pathname: '/test',
+        search: '?scopes=scope1&nav_scope_path=mimir',
+      });
+
+      // Wait for changeScopes promise
+      await Promise.resolve();
+
+      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir']);
+    });
+  });
 });

public/app/features/scopes/ScopesService.ts

@@ -5,6 +5,7 @@ import { map, distinctUntilChanged } from 'rxjs/operators';
 import { LocationService, ScopesContextValue, ScopesContextValueState } from '@grafana/runtime';
 
 import { ScopesDashboardsService } from './dashboards/ScopesDashboardsService';
+import { deserializeFolderPath, serializeFolderPath } from './dashboards/scopeNavgiationUtils';
 import { ScopesSelectorService } from './selector/ScopesSelectorService';
 
 export interface State {
@@ -72,12 +73,21 @@ export class ScopesService implements ScopesContextValue {
     const queryParams = new URLSearchParams(locationService.getLocation().search);
     const scopeNodeId = queryParams.get('scope_node');
     const navigationScope = queryParams.get('navigation_scope');
+    const navScopePath = queryParams.get('nav_scope_path');
 
     if (navigationScope) {
-      this.dashboardsService.setNavigationScope(navigationScope);
+      this.dashboardsService.setNavigationScope(
+        navigationScope,
+        undefined,
+        navScopePath ? deserializeFolderPath(navScopePath) : undefined
+      );
     }
 
-    this.changeScopes(queryParams.getAll('scopes'), undefined, scopeNodeId ?? undefined);
+    this.changeScopes(queryParams.getAll('scopes'), undefined, scopeNodeId ?? undefined).then(() => {
+      if (navScopePath && !navigationScope) {
+        this.dashboardsService.setNavScopePath(deserializeFolderPath(navScopePath));
+      }
+    });
 
     // Pre-load scope node (which loads parent too)
     const nodeToPreload = scopeNodeId;
@@ -99,6 +109,9 @@ export class ScopesService implements ScopesContextValue {
         const scopes = queryParams.getAll('scopes');
         const scopeNodeId = queryParams.get('scope_node');
 
+        const navigationScope = queryParams.get('navigation_scope');
+        const navScopePath = queryParams.get('nav_scope_path');
+
         // Check if new scopes are different from the old scopes
         const currentScopes = this.selectorService.state.appliedScopes.map((scope) => scope.scopeId);
         if (scopes.length && !isEqual(scopes, currentScopes)) {
@@ -107,6 +120,31 @@ export class ScopesService implements ScopesContextValue {
           // changes the URL directly, it would trigger a reload so scopes would still be reset.
           this.changeScopes(scopes, undefined, scopeNodeId ?? undefined);
         }
+
+        // Handle navigation_scope and nav_scope_path changes from back/forward navigation
+        const currentNavigationScope = this.dashboardsService.state.navigationScope;
+        const currentNavScopePath = this.dashboardsService.state.navScopePath;
+        const newNavScopePath = navScopePath ? deserializeFolderPath(navScopePath) : undefined;
+        const decodedNavigationScope = navigationScope ? decodeURIComponent(navigationScope) : undefined;
+
+        const navigationScopeChanged = decodedNavigationScope !== currentNavigationScope;
+        const navScopePathChanged = !isEqual(newNavScopePath, currentNavScopePath);
+
+        if (navigationScopeChanged) {
+          // Navigation scope changed - do full update
+          if (decodedNavigationScope) {
+            this.dashboardsService.setNavigationScope(decodedNavigationScope, undefined, newNavScopePath);
+          } else if (newNavScopePath?.length) {
+            this.changeScopes(scopes, undefined, scopeNodeId ?? undefined).then(() => {
+              this.dashboardsService.setNavScopePath(newNavScopePath);
+            });
+          } else {
+            this.dashboardsService.setNavigationScope(undefined);
+          }
+        } else if (navScopePathChanged) {
+          // Navigation scope unchanged but path changed
+          this.dashboardsService.setNavScopePath(newNavScopePath);
+        }
       })
     );
 
@@ -137,10 +175,17 @@ export class ScopesService implements ScopesContextValue {
     // Update the URL based on change in the navigation scope
     this.subscriptions.push(
       this.dashboardsService.subscribeToState((state, prevState) => {
-        if (state.navigationScope !== prevState.navigationScope) {
-          this.locationService.partial({
-            navigation_scope: state.navigationScope,
-          });
+        if (
+          state.navigationScope !== prevState.navigationScope ||
+          !isEqual(state.navScopePath, prevState.navScopePath)
+        ) {
+          this.locationService.partial(
+            {
+              navigation_scope: state.navigationScope ? encodeURIComponent(state.navigationScope) : null,
+              nav_scope_path: state.navScopePath?.length ? serializeFolderPath(state.navScopePath) : null,
+            },
+            true
+          );
         }
       })
     );

public/app/features/scopes/dashboards/ScopesDashboards.tsx

@@ -67,7 +67,12 @@ export function ScopesDashboards() {
         />
       ) : filteredFolders[''] ? (
         <ScrollContainer>
-          <ScopesDashboardsTree folders={filteredFolders} folderPath={['']} onFolderUpdate={updateFolder} />
+          <ScopesDashboardsTree
+            folders={filteredFolders}
+            folderPath={['']}
+            subScopePath={[]}
+            onFolderUpdate={updateFolder}
+          />
         </ScrollContainer>
       ) : (
         <p className={styles.noResultsContainer} data-testid="scopes-dashboards-notFoundForFilter">

public/app/features/scopes/dashboards/ScopesDashboardsService.test.ts

@@ -839,4 +839,52 @@ describe('ScopesDashboardsService', () => {
       expect(service.state.drawerOpened).toBe(true);
     });
   });
+
+  describe('setNavScopePath', () => {
+    beforeEach(() => {
+      (locationService.getLocation as jest.Mock).mockReturnValue({ pathname: '/' } as Location);
+    });
+
+    it('should set nav scope path', async () => {
+      await service.setNavScopePath(['mimir']);
+      expect(service.state.navScopePath).toEqual(['mimir']);
+    });
+
+    it('should replace existing path with new path', async () => {
+      await service.setNavScopePath(['mimir']);
+      expect(service.state.navScopePath).toEqual(['mimir']);
+
+      await service.setNavScopePath(['loki']);
+      expect(service.state.navScopePath).toEqual(['loki']);
+    });
+
+    it('should handle multiple scopes in path', async () => {
+      await service.setNavScopePath(['mimir', 'loki']);
+      expect(service.state.navScopePath).toEqual(['mimir', 'loki']);
+    });
+
+    it('should clear path with empty array', async () => {
+      await service.setNavScopePath(['mimir', 'loki']);
+      expect(service.state.navScopePath).toEqual(['mimir', 'loki']);
+
+      await service.setNavScopePath([]);
+      expect(service.state.navScopePath).toEqual([]);
+    });
+
+    it('should handle undefined path as empty array', async () => {
+      await service.setNavScopePath(['mimir']);
+      expect(service.state.navScopePath).toEqual(['mimir']);
+
+      await service.setNavScopePath(undefined);
+      expect(service.state.navScopePath).toEqual([]);
+    });
+
+    it('should not update state if path is unchanged', async () => {
+      await service.setNavScopePath(['mimir']);
+
+      await service.setNavScopePath(['mimir']);
+      // Path should remain the same
+      expect(service.state.navScopePath).toEqual(['mimir']);
+    });
+  });
 });

public/app/features/scopes/dashboards/ScopesDashboardsService.ts

@@ -7,8 +7,13 @@ import { config, locationService } from '@grafana/runtime';
 import { ScopesApiClient } from '../ScopesApiClient';
 import { ScopesServiceBase } from '../ScopesServiceBase';
 
-import { isCurrentPath } from './scopeNavgiationUtils';
-import { ScopeNavigation, SuggestedNavigationsFoldersMap, SuggestedNavigationsMap } from './types';
+import { buildSubScopePath, isCurrentPath } from './scopeNavgiationUtils';
+import {
+  ScopeNavigation,
+  SuggestedNavigationsFolder,
+  SuggestedNavigationsFoldersMap,
+  SuggestedNavigationsMap,
+} from './types';
 
 interface ScopesDashboardsServiceState {
   // State of the drawer showing related dashboards
@@ -24,6 +29,8 @@ interface ScopesDashboardsServiceState {
   loading: boolean;
   searchQuery: string;
   navigationScope?: string;
+  // Path of subScopes which should be expanded
+  navScopePath?: string[];
 }
 
 export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsServiceState> {
@@ -38,6 +45,7 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
       forScopeNames: [],
       loading: false,
       searchQuery: '',
+      navScopePath: undefined,
     });
 
     // Add/ remove location subscribtion based on the drawer opened state
@@ -57,9 +65,40 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     });
   }
 
+  private openSubScopeFolder = (subScopePath: string[]) => {
+    const subScope = subScopePath[subScopePath.length - 1];
+    const path = buildSubScopePath(subScope, this.state.folders);
+
+    // Get path to the folder - path can now be undefined
+    if (path && path.length > 0) {
+      this.updateFolder(path, true);
+    }
+  };
+
+  public setNavScopePath = async (navScopePath?: string[]) => {
+    const navScopePathArray = navScopePath ?? [];
+
+    if (!isEqual(navScopePathArray, this.state.navScopePath)) {
+      this.updateState({ navScopePath: navScopePathArray });
+
+      for (const subScope of navScopePathArray) {
+        // Find the actual path to the folder with this subScopeName
+        const folderPath = buildSubScopePath(subScope, this.state.folders);
+        if (folderPath && folderPath.length > 0) {
+          await this.fetchSubScopeItems(folderPath, subScope);
+          this.openSubScopeFolder([subScope]);
+        }
+      }
+    }
+  };
+
   // The fallbackScopeNames is used to fetch the ScopeNavigations for the current dashboard when the navigationScope is not set.
   // You only need to awaut this function if you need to wait for the dashboards to be fetched before doing something else.
-  public setNavigationScope = async (navigationScope?: string, fallbackScopeNames?: string[]) => {
+  public setNavigationScope = async (
+    navigationScope?: string,
+    fallbackScopeNames?: string[],
+    navScopePath?: string[]
+  ) => {
     if (this.state.navigationScope === navigationScope) {
       return;
     }
@@ -67,6 +106,7 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     const forScopeNames = navigationScope ? [navigationScope] : (fallbackScopeNames ?? []);
     this.updateState({ navigationScope, drawerOpened: forScopeNames.length > 0 });
     await this.fetchDashboards(forScopeNames);
+    await this.setNavScopePath(navScopePath);
   };
 
   // Expand the group that matches the current path, if it is not already expanded
@@ -148,6 +188,15 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
   };
 
   private fetchSubScopeItems = async (path: string[], subScopeName: string) => {
+    // Check if folder already has content - skip fetching to preserve existing state
+    const targetFolder = this.getFolder(path);
+    if (
+      targetFolder &&
+      (Object.keys(targetFolder.folders).length > 0 || Object.keys(targetFolder.suggestedNavigations).length > 0)
+    ) {
+      return;
+    }
+
     let subScopeFolders: SuggestedNavigationsFoldersMap | undefined;
 
     try {
@@ -208,6 +257,15 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     this.updateState({ folders, filteredFolders });
   };
 
+  // Helper to get a folder at a given path
+  private getFolder = (path: string[]): SuggestedNavigationsFolder | undefined => {
+    let folder: SuggestedNavigationsFoldersMap = this.state.folders;
+    for (let i = 0; i < path.length - 1; i++) {
+      folder = folder[path[i]]?.folders ?? {};
+    }
+    return folder[path[path.length - 1]];
+  };
+
   public changeSearchQuery = (searchQuery: string) => {
     searchQuery = searchQuery ?? '';
 

public/app/features/scopes/dashboards/ScopesDashboardsTree.tsx

@@ -12,10 +12,17 @@ export interface ScopesDashboardsTreeProps {
   subScope?: string;
   folders: SuggestedNavigationsFoldersMap;
   folderPath: string[];
+  subScopePath?: string[];
   onFolderUpdate: OnFolderUpdate;
 }
 
-export function ScopesDashboardsTree({ subScope, folders, folderPath, onFolderUpdate }: ScopesDashboardsTreeProps) {
+export function ScopesDashboardsTree({
+  subScopePath,
+  subScope,
+  folders,
+  folderPath,
+  onFolderUpdate,
+}: ScopesDashboardsTreeProps) {
   const [queryParams] = useQueryParams();
   const styles = useStyles2(getStyles);
 
@@ -54,6 +61,7 @@ export function ScopesDashboardsTree({ subScope, folders, folderPath, onFolderUp
       {regularNavigations.map((navigation) => (
         <ScopesNavigationTreeLink
           subScope={subScope}
+          subScopePath={subScopePath}
           key={navigation.id + navigation.title}
           to={urlUtil.renderUrl(navigation.url, queryParams)}
           title={navigation.title}
@@ -68,6 +76,7 @@ export function ScopesDashboardsTree({ subScope, folders, folderPath, onFolderUp
       {subScopeFolders.map(([subFolderId, subFolder]) => (
         <ScopesDashboardsTreeFolderItem
           key={subFolderId}
+          subScopePath={[...(subScopePath ?? []), subFolder.subScopeName ?? '']}
           folder={subFolder}
           folders={folder.folders}
           folderPath={[...folderPath, subFolderId]}

public/app/features/scopes/dashboards/ScopesDashboardsTreeFolderItem.test.tsx

@@ -16,6 +16,9 @@ const mockScopesSelectorService = {
 
 const mockScopesDashboardsService = {
   setNavigationScope: jest.fn(),
+  state: {
+    navScopePath: undefined,
+  },
 };
 
 jest.mock('../ScopesContextProvider', () => ({
@@ -133,7 +136,7 @@ describe('ScopesDashboardsTreeFolderItem', () => {
     const exchangeButton = screen.getByRole('button', { name: /change root scope/i });
     await user.click(exchangeButton);
 
-    expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, ['subScope1']);
+    expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, undefined, []);
   });
 
   it('calls changeScopes when exchange icon is clicked', async () => {
@@ -152,7 +155,7 @@ describe('ScopesDashboardsTreeFolderItem', () => {
     const exchangeButton = screen.getByRole('button', { name: /change root scope/i });
     await user.click(exchangeButton);
 
-    expect(mockScopesSelectorService.changeScopes).toHaveBeenCalledWith(['subScope1']);
+    expect(mockScopesSelectorService.changeScopes).toHaveBeenCalledWith(['subScope1'], undefined, undefined, false);
   });
 
   it('passes subScope prop to ScopesDashboardsTree when folder is expanded', () => {

public/app/features/scopes/dashboards/ScopesDashboardsTreeFolderItem.tsx

@@ -14,9 +14,11 @@ export interface ScopesDashboardsTreeFolderItemProps {
   folderPath: string[];
   folders: SuggestedNavigationsFoldersMap;
   onFolderUpdate: OnFolderUpdate;
+  subScopePath?: string[];
 }
 
 export function ScopesDashboardsTreeFolderItem({
+  subScopePath,
   folder,
   folderPath,
   folders,
@@ -53,12 +55,27 @@ export function ScopesDashboardsTreeFolderItem({
               scope: folder.subScopeName || '',
             })}
             name="exchange-alt"
-            onClick={(e) => {
+            onClick={async (e) => {
               e.preventDefault();
               e.stopPropagation();
               if (folder.subScopeName && scopesSelectorService) {
-                scopesDashboardsService?.setNavigationScope(undefined, [folder.subScopeName]);
-                scopesSelectorService.changeScopes([folder.subScopeName]);
+                const activeSubScopePath = scopesDashboardsService?.state.navScopePath;
+                // Check if the active scope is a child of the current folder's scope
+                const activeScope = activeSubScopePath?.[activeSubScopePath.length - 1];
+                const folderLocationInActivePath = activeSubScopePath?.indexOf(folder.subScopeName) ?? -1;
+
+                await scopesDashboardsService?.setNavigationScope(
+                  folderLocationInActivePath >= 0 ? folder.subScopeName : undefined,
+                  undefined,
+                  activeSubScopePath?.slice(folderLocationInActivePath + 1) ?? []
+                );
+                // Now changeScopes will skip fetchDashboards because navigationScope is set
+                scopesSelectorService.changeScopes(
+                  folderLocationInActivePath >= 0 && activeScope ? [activeScope] : [folder.subScopeName],
+                  undefined,
+                  undefined,
+                  false
+                );
               }
             }}
           />
@@ -68,6 +85,7 @@ export function ScopesDashboardsTreeFolderItem({
       {folder.expanded && (
         <div className={styles.children}>
           <ScopesDashboardsTree
+            subScopePath={subScopePath}
             subScope={folder.subScopeName}
             folders={folders}
             folderPath={folderPath}

public/app/features/scopes/dashboards/ScopesNavigationTreeLink.test.tsx

@@ -209,7 +209,7 @@ describe('ScopesNavigationTreeLink', () => {
       const link = screen.getByTestId('scopes-dashboards-test-id');
       await userEvent.click(link);
 
-      expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith('currentScope');
+      expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith('currentScope', undefined, undefined);
     });
 
     it('should not set navigation scope when already set', async () => {

public/app/features/scopes/dashboards/ScopesNavigationTreeLink.tsx

@@ -8,16 +8,17 @@ import { Icon, useStyles2 } from '@grafana/ui';
 
 import { useScopesServices } from '../ScopesContextProvider';
 
-import { isCurrentPath, normalizePath } from './scopeNavgiationUtils';
+import { isCurrentPath, normalizePath, serializeFolderPath } from './scopeNavgiationUtils';
 
 export interface ScopesNavigationTreeLinkProps {
   subScope?: string;
   to: string;
   title: string;
   id: string;
+  subScopePath?: string[];
 }
 
-export function ScopesNavigationTreeLink({ subScope, to, title, id }: ScopesNavigationTreeLinkProps) {
+export function ScopesNavigationTreeLink({ subScope, to, title, id, subScopePath }: ScopesNavigationTreeLinkProps) {
   const styles = useStyles2(getStyles);
   const linkIcon = useMemo(() => getLinkIcon(to), [to]);
   const locPathname = useLocation().pathname;
@@ -25,7 +26,7 @@ export function ScopesNavigationTreeLink({ subScope, to, title, id }: ScopesNavi
   // Ignore query params
   const isCurrent = isCurrentPath(locPathname, to);
 
-  const handleClick = (e: React.MouseEvent<HTMLAnchorElement>) => {
+  const handleClick = async (e: React.MouseEvent<HTMLAnchorElement>) => {
     if (subScope) {
       e.preventDefault(); // Prevent default Link navigation
 
@@ -39,11 +40,18 @@ export function ScopesNavigationTreeLink({ subScope, to, title, id }: ScopesNavi
       const searchParams = new URLSearchParams(url.search);
       if (!currentNavigationScope && currentScope) {
         searchParams.set('navigation_scope', currentScope);
-        services?.scopesDashboardsService?.setNavigationScope(currentScope);
+        await services?.scopesDashboardsService?.setNavigationScope(
+          currentScope,
+          undefined,
+          subScopePath && subScopePath.length > 0 ? subScopePath : undefined
+        );
       }
 
       // Update query params with the new subScope
       searchParams.set('scopes', subScope);
+
+      // Set nav_scope_path to the subScopePath
+      searchParams.set('nav_scope_path', subScopePath ? serializeFolderPath(subScopePath) : '');
       // Remove scope_node and scope_parent since we're changing to a subScope
       searchParams.delete('scope_node');
       searchParams.delete('scope_parent');

public/app/features/scopes/dashboards/scopeNavgiationUtils.test.ts

@@ -1,4 +1,11 @@
-import { getDashboardPathForComparison, isCurrentPath } from './scopeNavgiationUtils';
+import {
+  buildSubScopePath,
+  deserializeFolderPath,
+  getDashboardPathForComparison,
+  isCurrentPath,
+  serializeFolderPath,
+} from './scopeNavgiationUtils';
+import { SuggestedNavigationsFoldersMap } from './types';
 
 describe('scopeNavgiationUtils', () => {
   it('should return the correct path for a dashboard', () => {
@@ -28,4 +35,194 @@ describe('scopeNavgiationUtils', () => {
     expect(isCurrentPath('/d/dashboardId/slug', '/d/dashboardId#hash')).toBe(true);
     expect(isCurrentPath('/d/dashboardId', '/d/dashboardId#hash')).toBe(true);
   });
+
+  describe('deserializeFolderPath', () => {
+    it('should return empty array for empty string', () => {
+      expect(deserializeFolderPath('')).toEqual([]);
+    });
+
+    it('should parse a simple comma-separated string', () => {
+      expect(deserializeFolderPath('mimir,loki')).toEqual(['mimir', 'loki']);
+    });
+
+    it('should handle single value', () => {
+      expect(deserializeFolderPath('mimir')).toEqual(['mimir']);
+    });
+
+    it('should trim whitespace around values', () => {
+      expect(deserializeFolderPath(' mimir , loki ')).toEqual(['mimir', 'loki']);
+    });
+
+    it('should handle URL-encoded strings', () => {
+      expect(deserializeFolderPath(encodeURIComponent('mimir,loki'))).toEqual(['mimir', 'loki']);
+    });
+
+    it('should handle URL-encoded strings with special characters', () => {
+      expect(deserializeFolderPath(encodeURIComponent('folder one,folder two'))).toEqual(['folder one', 'folder two']);
+    });
+
+    it('should fallback to split without decoding if decodeURIComponent fails', () => {
+      // Invalid URI sequence that would cause decodeURIComponent to throw
+      const invalidUri = '%E0%A4%A';
+      expect(deserializeFolderPath(invalidUri)).toEqual(['%E0%A4%A']);
+    });
+  });
+
+  describe('serializeFolderPath', () => {
+    it('should return empty string for empty array', () => {
+      expect(serializeFolderPath([])).toBe('');
+    });
+
+    it('should serialize a simple array', () => {
+      expect(serializeFolderPath(['mimir', 'loki'])).toBe(encodeURIComponent('mimir,loki'));
+    });
+
+    it('should handle single value', () => {
+      expect(serializeFolderPath(['mimir'])).toBe('mimir');
+    });
+
+    it('should handle values with spaces', () => {
+      expect(serializeFolderPath(['folder one', 'folder two'])).toBe(encodeURIComponent('folder one,folder two'));
+    });
+
+    it('should return empty string for null/undefined input', () => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect(serializeFolderPath(null as any)).toBe('');
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect(serializeFolderPath(undefined as any)).toBe('');
+    });
+  });
+
+  describe('serializeFolderPath and deserializeFolderPath round-trip', () => {
+    it('should round-trip simple paths', () => {
+      const original = ['mimir', 'loki'];
+      const serialized = serializeFolderPath(original);
+      const deserialized = deserializeFolderPath(serialized);
+      expect(deserialized).toEqual(original);
+    });
+
+    it('should round-trip paths with spaces', () => {
+      const original = ['folder one', 'folder two'];
+      const serialized = serializeFolderPath(original);
+      const deserialized = deserializeFolderPath(serialized);
+      expect(deserialized).toEqual(original);
+    });
+  });
+
+  describe('buildSubScopePath', () => {
+    it('should return undefined when folders is empty', () => {
+      const folders: SuggestedNavigationsFoldersMap = {};
+      expect(buildSubScopePath('mimir', folders)).toBeUndefined();
+    });
+
+    it('should find subScope at root level', () => {
+      const folders: SuggestedNavigationsFoldersMap = {
+        'Mimir Dashboards': {
+          title: 'Mimir Dashboards',
+          expanded: false,
+          folders: {},
+          suggestedNavigations: {},
+          subScopeName: 'mimir',
+        },
+      };
+      expect(buildSubScopePath('mimir', folders)).toEqual(['Mimir Dashboards']);
+    });
+
+    it('should find subScope in nested folders', () => {
+      const folders: SuggestedNavigationsFoldersMap = {
+        '': {
+          title: '',
+          expanded: true,
+          folders: {
+            'Parent Folder': {
+              title: 'Parent Folder',
+              expanded: false,
+              folders: {
+                'Mimir Dashboards': {
+                  title: 'Mimir Dashboards',
+                  expanded: false,
+                  folders: {},
+                  suggestedNavigations: {},
+                  subScopeName: 'mimir',
+                },
+              },
+              suggestedNavigations: {},
+            },
+          },
+          suggestedNavigations: {},
+        },
+      };
+      expect(buildSubScopePath('mimir', folders)).toEqual(['', 'Parent Folder', 'Mimir Dashboards']);
+    });
+
+    it('should return undefined when subScope is not found', () => {
+      const folders: SuggestedNavigationsFoldersMap = {
+        '': {
+          title: '',
+          expanded: true,
+          folders: {
+            'Loki Dashboards': {
+              title: 'Loki Dashboards',
+              expanded: false,
+              folders: {},
+              suggestedNavigations: {},
+              subScopeName: 'loki',
+            },
+          },
+          suggestedNavigations: {},
+        },
+      };
+      expect(buildSubScopePath('mimir', folders)).toBeUndefined();
+    });
+
+    it('should return first match when multiple folders have the same subScope', () => {
+      const folders: SuggestedNavigationsFoldersMap = {
+        'Mimir Dashboards': {
+          title: 'Mimir Dashboards',
+          expanded: false,
+          folders: {},
+          suggestedNavigations: {},
+          subScopeName: 'mimir',
+        },
+        'Mimir Overview': {
+          title: 'Mimir Overview',
+          expanded: false,
+          folders: {},
+          suggestedNavigations: {},
+          subScopeName: 'mimir',
+        },
+      };
+      // Should return the first one found (order depends on Object.entries)
+      const result = buildSubScopePath('mimir', folders);
+      expect(result).toBeDefined();
+      expect(result?.length).toBe(1);
+    });
+
+    it('should find deeply nested subScope', () => {
+      const folders: SuggestedNavigationsFoldersMap = {
+        level1: {
+          title: 'Level 1',
+          expanded: true,
+          folders: {
+            level2: {
+              title: 'Level 2',
+              expanded: true,
+              folders: {
+                level3: {
+                  title: 'Level 3',
+                  expanded: false,
+                  folders: {},
+                  suggestedNavigations: {},
+                  subScopeName: 'deep-scope',
+                },
+              },
+              suggestedNavigations: {},
+            },
+          },
+          suggestedNavigations: {},
+        },
+      };
+      expect(buildSubScopePath('deep-scope', folders)).toEqual(['level1', 'level2', 'level3']);
+    });
+  });
 });

public/app/features/scopes/dashboards/scopeNavgiationUtils.ts

@@ -1,3 +1,5 @@
+import { SuggestedNavigationsFoldersMap } from './types';
+
 // Helper function to get the base path for a dashboard URL for comparison purposes.
 // e.g., /d/dashboardId/slug -> /d/dashboardId
 //       /d/dashboardId      -> /d/dashboardId
@@ -5,12 +7,63 @@ export function getDashboardPathForComparison(pathname: string): string {
   return pathname.split('/').slice(0, 3).join('/');
 }
 
+/**
+ * Finds the path to a folder with the given subScopeName by searching recursively.
+ * @param subScope - The subScope name to find
+ * @param folders - The root folder structure to search
+ * @returns Array representing the path to the folder, or undefined if not found
+ */
+export function buildSubScopePath(subScope: string, folders: SuggestedNavigationsFoldersMap): string[] | undefined {
+  function findPath(currentFolders: SuggestedNavigationsFoldersMap, currentPath: string[]): string[] | undefined {
+    for (const [key, folder] of Object.entries(currentFolders)) {
+      const newPath = [...currentPath, key];
+      if (folder.subScopeName === subScope) {
+        return newPath;
+      }
+      // Search in nested folders
+      const nestedPath = findPath(folder.folders, newPath);
+      if (nestedPath) {
+        return nestedPath;
+      }
+    }
+    return undefined;
+  }
+
+  return findPath(folders, []);
+}
+
 export function normalizePath(path: string): string {
   // Remove query + hash + trailing slash (except root)
   const noQuery = path.split('?')[0].split('#')[0];
   return noQuery !== '/' && noQuery.endsWith('/') ? noQuery.slice(0, -1) : noQuery;
 }
 
+/**
+ * Deserializes a comma-separated folder path string into an array.
+ * Handles URL-encoded strings.
+ */
+export function deserializeFolderPath(navScopePath: string): string[] {
+  if (!navScopePath) {
+    return [];
+  }
+  try {
+    const decoded = decodeURIComponent(navScopePath);
+    return decoded.split(',').map((s) => s.trim());
+  } catch {
+    return navScopePath.split(',').map((s) => s.trim());
+  }
+}
+
+/**
+ * Serializes a folder path array into a comma-separated string.
+ */
+export function serializeFolderPath(path: string[]): string {
+  if (!path) {
+    return '';
+  }
+  return encodeURIComponent(path.join(','));
+}
+
 // Pathname comes from location.pathname
 export function isCurrentPath(pathname: string, to: string): boolean {
   const isDashboard = to.startsWith('/d/');

public/app/features/scopes/selector/ScopesSelectorService.test.ts

@@ -444,7 +444,7 @@ describe('ScopesSelectorService', () => {
       await service.selectScope('test-scope-node');
       await service.apply();
       await service.removeAllScopes();
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined);
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, undefined, undefined);
     });
   });
 

public/app/features/scopes/selector/ScopesSelectorService.ts

@@ -405,7 +405,7 @@ export class ScopesSelectorService extends ScopesServiceBase<ScopesSelectorServi
 
   public removeAllScopes = () => {
     this.applyScopes([], false);
-    this.dashboardsService.setNavigationScope(undefined);
+    this.dashboardsService.setNavigationScope(undefined, undefined, undefined);
   };
 
   private addRecentScopes = (scopes: Scope[], parentNode?: ScopeNode, scopeNodeId?: string) => {

public/locales/cs-CZ/grafana.json

@@ -8897,6 +8897,13 @@
       "aria-label-default": "Vyberte barvu",
       "aria-label-selected-color": "{{colorLabel}} barva"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Odstranit",
       "cancel": "Zrušit",
@@ -9094,6 +9101,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Sbalit všechny řádky",
       "aria-label-expand-all": "Rozbalit všechny řádky",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Řádek přepnutí rozbalen",
       "tooltip-collapse-all": "Sbalit všechny řádky",
       "tooltip-expand-all": "Rozbalit všechny řádky"
@@ -12529,13 +12538,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/de-DE/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Wählen Sie eine Farbe",
       "aria-label-selected-color": "{{colorLabel}} Farbe"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Löschen",
       "cancel": "Abbrechen",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Alle Zeilen einklappen",
       "aria-label-expand-all": "Alle Zeilen erweitern",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Zeile umschalten erweitert",
       "tooltip-collapse-all": "Alle Zeilen einklappen",
       "tooltip-expand-all": "Alle Zeilen erweitern"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/en-US/grafana.json

@@ -2334,8 +2334,10 @@
       "label-tenant-sources": "Tenant sources"
     },
     "rule-details-matching-instances": {
-      "button-show-all": "Show all {{totalItemsCount}} alert instances",
-      "showing-count": "Showing {{visibleItemsCount}} out of {{totalItemsCount}} instances"
+      "button-show-all": "Show all",
+      "button-show-all-instances": "Show all {{totalItemsCount}} alert instances",
+      "showing-count": "Showing {{visibleItemsCount}} out of {{totalItemsCount}} instances",
+      "showing-count-with-state": "Showing {{visibleItemsCount}} {{alertState}} out of {{totalItemsCount}} instances"
     },
     "rule-editor": {
       "get-content": {
@@ -11836,7 +11838,7 @@
       "modal-title-set-up-public-access": "Set up public access",
       "modal-title-set-up-required-features": "Set up required features",
       "step-description-copy-url": "From the ngrok output, copy the https:// forwarding URL that looks like this:",
-      "step-description-enable-feature-toggles": "Add these settings to your custom.ini file to enable necessary features:",
+      "step-description-enable-feature-toggles": "Add the provisioning feature toggle to your custom.ini file. Note: kubernetesDashboards is enabled by default, but if you have explicitly disabled it, you will need to enable it in your Grafana settings or remove the override from your configuration.",
       "step-description-start-ngrok": "Run this command to create a secure tunnel to your local Grafana:",
       "step-description-update-grafana-config": "Add this to your custom.ini file, replacing the URL with your actual ngrok URL:",
       "step-title-copy-url": "Copy your public URL",

public/locales/es-ES/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Elegir un color",
       "aria-label-selected-color": "{{colorLabel}} color"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Eliminar",
       "cancel": "Cancelar",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Contraer todas las filas",
       "aria-label-expand-all": "Expandir todas las filas",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Alternar fila expandida",
       "tooltip-collapse-all": "Contraer todas las filas",
       "tooltip-expand-all": "Expandir todas las filas"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/fr-FR/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Choisir une couleur",
       "aria-label-selected-color": "Couleur {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Supprimer",
       "cancel": "Annuler",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Réduire toutes les lignes",
       "aria-label-expand-all": "Développer toutes les lignes",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Basculer la ligne développée",
       "tooltip-collapse-all": "Réduire toutes les lignes",
       "tooltip-expand-all": "Développer toutes les lignes"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/hu-HU/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Válasszon színt",
       "aria-label-selected-color": "{{colorLabel}} szín"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Törlés",
       "cancel": "Mégse",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Minden sor összecsukása",
       "aria-label-expand-all": "Minden sor kibontása",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Sorkibontás váltása",
       "tooltip-collapse-all": "Minden sor összecsukása",
       "tooltip-expand-all": "Minden sor kibontása"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/id-ID/grafana.json

@@ -8792,6 +8792,13 @@
       "aria-label-default": "Pilih warna",
       "aria-label-selected-color": "warna {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Hapus",
       "cancel": "Batalkan",
@@ -8989,6 +8996,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Ciutkan semua baris",
       "aria-label-expand-all": "Perluas semua baris",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Alihkan baris diperluas",
       "tooltip-collapse-all": "Ciutkan semua baris",
       "tooltip-expand-all": "Perluas semua baris"
@@ -12373,13 +12382,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/it-IT/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Scegli un colore",
       "aria-label-selected-color": "Colore {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Elimina",
       "cancel": "Annulla",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Ridurre tutte le righe",
       "aria-label-expand-all": "Espandi tutte le righe",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Attiva/disattiva riga espansa",
       "tooltip-collapse-all": "Ridurre tutte le righe",
       "tooltip-expand-all": "Espandi tutte le righe"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/ja-JP/grafana.json

@@ -8792,6 +8792,13 @@
       "aria-label-default": "色を選択",
       "aria-label-selected-color": "{{colorLabel}}色"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "削除",
       "cancel": "キャンセル",
@@ -8989,6 +8996,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "すべての行を折りたたむ",
       "aria-label-expand-all": "すべての行を広げる",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "行の展開を切り替える",
       "tooltip-collapse-all": "すべての行を折りたたむ",
       "tooltip-expand-all": "すべての行を広げる"
@@ -12373,13 +12382,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/ko-KR/grafana.json

@@ -8792,6 +8792,13 @@
       "aria-label-default": "색상 선택",
       "aria-label-selected-color": "{{colorLabel}} 색상"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "삭제",
       "cancel": "취소",
@@ -8989,6 +8996,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "모든 행 접기",
       "aria-label-expand-all": "모든 행 펼치기",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "토글하여 펼쳐진 행으로 전환",
       "tooltip-collapse-all": "모든 행 접기",
       "tooltip-expand-all": "모든 행 펼치기"
@@ -12373,13 +12382,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/nl-NL/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Kies een kleur",
       "aria-label-selected-color": "Kleur {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Verwijderen",
       "cancel": "Annuleren",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Alle rijen samenvouwen",
       "aria-label-expand-all": "Alle rijen uitvouwen",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Rij in-/uitschakelen uitgevouwen",
       "tooltip-collapse-all": "Alle rijen samenvouwen",
       "tooltip-expand-all": "Alle rijen uitvouwen"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/pl-PL/grafana.json

@@ -8897,6 +8897,13 @@
       "aria-label-default": "Wybierz kolor",
       "aria-label-selected-color": "Kolor {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Usuń",
       "cancel": "Anuluj",
@@ -9094,6 +9101,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Zwiń wszystkie wiersze",
       "aria-label-expand-all": "Rozwiń wszystkie wiersze",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Przełącz rozwinięcie wiersza",
       "tooltip-collapse-all": "Zwiń wszystkie wiersze",
       "tooltip-expand-all": "Rozwiń wszystkie wiersze"
@@ -12529,13 +12538,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/pt-BR/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Escolha uma cor",
       "aria-label-selected-color": "cor {{colorLabel}}"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Excluir",
       "cancel": "Cancelar",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Recolher todas as linhas",
       "aria-label-expand-all": "Expandir todas as linhas",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Alternar linha expandida",
       "tooltip-collapse-all": "Recolher todas as linhas",
       "tooltip-expand-all": "Expandir todas as linhas"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/pt-PT/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Escolher uma cor",
       "aria-label-selected-color": "cor {{colorLabel}} "
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Eliminar",
       "cancel": "Cancelar",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Recolher todas as linhas",
       "aria-label-expand-all": "Expandir todas as linhas",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Alternar linha expandida",
       "tooltip-collapse-all": "Recolher todas as linhas",
       "tooltip-expand-all": "Expandir todas as linhas"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/ru-RU/grafana.json

@@ -8897,6 +8897,13 @@
       "aria-label-default": "Выбрать цвет",
       "aria-label-selected-color": "{{colorLabel}} цвет"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Удалить",
       "cancel": "Отмена",
@@ -9094,6 +9101,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Свернуть все строки",
       "aria-label-expand-all": "Развернуть все строки",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Развернута строка переключения",
       "tooltip-collapse-all": "Свернуть все строки",
       "tooltip-expand-all": "Развернуть все строки"
@@ -12529,13 +12538,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/sv-SE/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Välj en färg",
       "aria-label-selected-color": "{{colorLabel}} färg"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Radera",
       "cancel": "Avbryt",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Dölj alla rader",
       "aria-label-expand-all": "Expandera alla rader",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Växla rad utökad",
       "tooltip-collapse-all": "Dölj alla rader",
       "tooltip-expand-all": "Expandera alla rader"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/tr-TR/grafana.json

@@ -8827,6 +8827,13 @@
       "aria-label-default": "Bir renk seçin",
       "aria-label-selected-color": "{{colorLabel}} rengi"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "Sil",
       "cancel": "İptal",
@@ -9024,6 +9031,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "Tüm satırları daralt",
       "aria-label-expand-all": "Tüm satırları genişlet",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "Satır genişletmeyi aç/kapat",
       "tooltip-collapse-all": "Tüm satırları daralt",
       "tooltip-expand-all": "Tüm satırları genişlet"
@@ -12425,13 +12434,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/zh-Hans/grafana.json

@@ -8792,6 +8792,13 @@
       "aria-label-default": "选择颜色",
       "aria-label-selected-color": "{{colorLabel}} 颜色"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "删除",
       "cancel": "取消",
@@ -8989,6 +8996,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "折叠所有行",
       "aria-label-expand-all": "展开所有行",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "切换行展开",
       "tooltip-collapse-all": "折叠所有行",
       "tooltip-expand-all": "展开所有行"
@@ -12373,13 +12382,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

public/locales/zh-Hant/grafana.json

@@ -8792,6 +8792,13 @@
       "aria-label-default": "挑選顏色",
       "aria-label-selected-color": "{{colorLabel}} 顏色"
     },
+    "components": {
+      "sparkline": {
+        "warning": {
+          "too-few-values": ""
+        }
+      }
+    },
     "confirm-button": {
       "aria-label-delete": "刪除",
       "cancel": "取消",
@@ -8989,6 +8996,8 @@
     "interactive-table": {
       "aria-label-collapse-all": "收闔所有列",
       "aria-label-expand-all": "展開所有列",
+      "aria-label-sort-column": "",
+      "expand-row-header": "",
       "expand-row-tooltip": "切換列展開",
       "tooltip-collapse-all": "收闔所有列",
       "tooltip-expand-all": "展開所有列"
@@ -12373,13 +12382,12 @@
       "effects": {
         "bar-glow": "",
         "center-glow": "",
+        "gradient": "",
+        "label": "",
         "rounded-bars": "",
         "spotlight": "",
         "spotlight-tooltip": ""
       },
-      "gradient": "",
-      "gradient-auto": "",
-      "gradient-none": "",
       "segment-count": "",
       "segment-spacing": "",
       "shape": "",

scripts/publish-npm-packages.sh

@@ -68,6 +68,47 @@ if (( CHANGES_COUNT > 0 )); then
     TAGS=$(npm dist-tag ls @grafana/e2e-selectors)
     if [[ $TAGS =~ $regex_pattern ]]; then
         echo "$CHANGES_COUNT file(s) in packages/grafana-e2e-selectors were changed. Adding 'modified' tag to @grafana/e2e-selectors@${BASH_REMATCH[1]}"
+        
+        # If using OIDC, exchange token for npm auth (npm publish handles OIDC internally,
+        # but dist-tag requires explicit authentication)
+        # Reference: https://github.com/electron/npm-trusted-auth-action
+        if [ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] && [ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]; then
+            echo "Fetching GitHub OIDC token..."
+            OIDC_TOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+                "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" | jq -r '.value // empty')
+            
+            if [ -z "$OIDC_TOKEN" ]; then
+                echo "Warning: Failed to fetch OIDC token, dist-tag operation may fail"
+            else
+                # Mask the OIDC token so it won't appear in logs
+                echo "::add-mask::$OIDC_TOKEN"
+                echo "Exchanging OIDC token for npm auth token..."
+                ENCODED_PACKAGE=$(printf "%s" "@grafana/e2e-selectors" | jq -Rr @uri)
+                RESPONSE=$(curl -sS -X POST \
+                    -H "Authorization: Bearer $OIDC_TOKEN" \
+                    -H "Accept: application/json" \
+                    -w "\n%{http_code}" \
+                    "https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/$ENCODED_PACKAGE")
+                
+                HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+                BODY=$(echo "$RESPONSE" | sed '$d')
+                
+                if [ "$HTTP_CODE" != "201" ]; then
+                    echo "Warning: Failed to exchange token. Status: $HTTP_CODE"
+                else
+                    NPM_AUTH_TOKEN=$(echo "$BODY" | jq -r '.token // empty')
+                    if [ -n "$NPM_AUTH_TOKEN" ]; then
+                        # Mask the token so it won't appear in logs
+                        echo "::add-mask::$NPM_AUTH_TOKEN"
+                        echo "Configuring npm auth token in ~/.npmrc"
+                        echo "//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}" >> ~/.npmrc
+                    else
+                        echo "Warning: No token in response, dist-tag operation may fail"
+                    fi
+                fi
+            fi
+        fi
+        
         npm dist-tag add @grafana/e2e-selectors@"${BASH_REMATCH[1]}" modified
     fi
 fi

yarn.lock

@@ -10421,15 +10421,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/glob@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "@types/glob@npm:9.0.0"
-  dependencies:
-    glob: "npm:*"
-  checksum: 10/a9ea3afe1eafbc8fb303d2d39cd786084aece75fd8eeae1bad8febbf6e0323b429145f31e779a3d68fa693b2a53648ec2c639ee4858fb29132f801c74678051c
-  languageName: node
-  linkType: hard
-
 "@types/google.analytics@npm:^0.0.46":
   version: 0.0.46
   resolution: "@types/google.analytics@npm:0.0.46"
@@ -19135,22 +19126,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:*, glob@npm:12.0.0":
-  version: 12.0.0
-  resolution: "glob@npm:12.0.0"
-  dependencies:
-    foreground-child: "npm:^3.3.1"
-    jackspeak: "npm:^4.1.1"
-    minimatch: "npm:^10.1.1"
-    minipass: "npm:^7.1.2"
-    package-json-from-dist: "npm:^1.0.0"
-    path-scurry: "npm:^2.0.0"
-  bin:
-    glob: dist/esm/bin.mjs
-  checksum: 10/6e21b3f1f1fa635836d45e54bbe50704884cc3e310e0cc011cfb5429db65a030e12936d99b07e66236370efe45dc8c8b26fa5334dbf555d6f8709e0315c77c30
-  languageName: node
-  linkType: hard
-
 "glob@npm:10.4.1":
   version: 10.4.1
   resolution: "glob@npm:10.4.1"
@@ -19198,6 +19173,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"glob@npm:12.0.0":
+  version: 12.0.0
+  resolution: "glob@npm:12.0.0"
+  dependencies:
+    foreground-child: "npm:^3.3.1"
+    jackspeak: "npm:^4.1.1"
+    minimatch: "npm:^10.1.1"
+    minipass: "npm:^7.1.2"
+    package-json-from-dist: "npm:^1.0.0"
+    path-scurry: "npm:^2.0.0"
+  bin:
+    glob: dist/esm/bin.mjs
+  checksum: 10/6e21b3f1f1fa635836d45e54bbe50704884cc3e310e0cc011cfb5429db65a030e12936d99b07e66236370efe45dc8c8b26fa5334dbf555d6f8709e0315c77c30
+  languageName: node
+  linkType: hard
+
 "glob@npm:^7.0.3, glob@npm:^7.1.2, glob@npm:^7.1.3, glob@npm:^7.1.4, glob@npm:^7.1.6, glob@npm:^7.1.7":
   version: 7.2.3
   resolution: "glob@npm:7.2.3"
@@ -19502,7 +19493,6 @@ __metadata:
     "@types/eslint": "npm:9.6.1"
     "@types/eslint-scope": "npm:^8.0.0"
     "@types/file-saver": "npm:2.0.7"
-    "@types/glob": "npm:^9.0.0"
     "@types/google.analytics": "npm:^0.0.46"
     "@types/gtag.js": "npm:^0.0.20"
     "@types/history": "npm:4.7.11"