Initial prototype extracting SearchServer from ResourceServer.

apps/alerting/historian/pkg/app/notification/notification.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 
 	"github.com/grafana/grafana-app-sdk/app"
@@ -50,7 +49,7 @@ func (n *Notification) QueryHandler(ctx context.Context, writer app.CustomRouteR
 			ErrStatus: metav1.Status{
 				Status:  metav1.StatusFailure,
 				Code:    http.StatusBadRequest,
-				Message: fmt.Sprintf("parse request: %s", err.Error()),
+				Message: err.Error(),
 			}}
 	}
 
@@ -68,7 +67,7 @@ func (n *Notification) QueryHandler(ctx context.Context, writer app.CustomRouteR
 			ErrStatus: metav1.Status{
 				Status:  metav1.StatusFailure,
 				Code:    http.StatusInternalServerError,
-				Message: fmt.Sprintf("notification query: %s", err.Error()),
+				Message: err.Error(),
 			}}
 	}
 

apps/folder/kinds/folder.cue

@@ -8,6 +8,12 @@ foldersV1beta1: {
 		spec: {
 			title:    string
 			description?: string
+			foo: bool
+			bar: int
 		}
 	}
-}
+
+	selectableFields: [
+		"spec.title",
+	]
+}

apps/folder/pkg/apis/folder/v1beta1/folder_schema_gen.go

@@ -5,13 +5,26 @@
 package v1beta1
 
 import (
+	"errors"
+
 	"github.com/grafana/grafana-app-sdk/resource"
 )
 
 // schema is unexported to prevent accidental overwrites
 var (
 	schemaFolder = resource.NewSimpleSchema("folder.grafana.app", "v1beta1", NewFolder(), &FolderList{}, resource.WithKind("Folder"),
-		resource.WithPlural("folders"), resource.WithScope(resource.NamespacedScope))
+		resource.WithPlural("folders"), resource.WithScope(resource.NamespacedScope), resource.WithSelectableFields([]resource.SelectableField{resource.SelectableField{
+			FieldSelector: "spec.title",
+			FieldValueFunc: func(o resource.Object) (string, error) {
+				cast, ok := o.(*Folder)
+				if !ok {
+					return "", errors.New("provided object must be of type *Folder")
+				}
+
+				return cast.Spec.Title, nil
+			},
+		},
+		}))
 	kindFolder = resource.Kind{
 		Schema: schemaFolder,
 		Codecs: map[resource.KindEncoding]resource.Codec{

apps/folder/pkg/apis/manifestdata/folder_manifest.go

@@ -18,6 +18,8 @@ import (
 	v1beta1 "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 )
 
+var ()
+
 var appManifestData = app.ManifestData{
 	AppName:          "folder",
 	Group:            "folder.grafana.app",
@@ -32,6 +34,9 @@ var appManifestData = app.ManifestData{
 					Plural:     "Folders",
 					Scope:      "Namespaced",
 					Conversion: false,
+					SelectableFields: []string{
+						"spec.title",
+					},
 				},
 			},
 			Routes: app.ManifestVersionRoutes{

apps/iam/go.sum

@@ -377,10 +377,10 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/centrifugal/centrifuge v0.38.0 h1:UJTowwc5lSwnpvd3vbrTseODbU7osSggN67RTrJ8EfQ=
-github.com/centrifugal/centrifuge v0.38.0/go.mod h1:rcZLARnO5GXOeE9qG7iIPMvERxESespqkSX4cGLCAzo=
-github.com/centrifugal/protocol v0.17.0 h1:hD0WczyiG7zrVJcgkQsd5/nhfFXt0Y04SJHV2Z7B1rg=
-github.com/centrifugal/protocol v0.17.0/go.mod h1:9MdiYyjw5Bw1+d5Sp4Y0NK+qiuTNyd88nrHJsUUh8k4=
+github.com/centrifugal/centrifuge v0.37.2 h1:rerQNvDfYN2FZEkVtb/hvGV7SIrJfEQrKF3MaE8GDlo=
+github.com/centrifugal/centrifuge v0.37.2/go.mod h1:aj4iRJGhzi3SlL8iUtVezxway1Xf8g+hmNQkLLO7sS8=
+github.com/centrifugal/protocol v0.16.2 h1:KoIHgDeX1fFxyxQoKW+6E8ZTCf5mwGm8JyGoJ5NBMbQ=
+github.com/centrifugal/protocol v0.16.2/go.mod h1:Q7OpS/8HMXDnL7f9DpNx24IhG96MP88WPpVTTCdrokI=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -1376,13 +1376,11 @@ github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9p
 github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
 github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
 github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
-github.com/quagmt/udecimal v1.9.0 h1:TLuZiFeg0HhS6X8VDa78Y6XTaitZZfh+z5q4SXMzpDQ=
-github.com/quagmt/udecimal v1.9.0/go.mod h1:ScmJ/xTGZcEoYiyMMzgDLn79PEJHcMBiJ4NNRT3FirA=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01jfAE=
 github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
-github.com/redis/rueidis v1.0.68 h1:gept0E45JGxVigWb3zoWHvxEc4IOC7kc4V/4XvN8eG8=
-github.com/redis/rueidis v1.0.68/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
+github.com/redis/rueidis v1.0.64 h1:XqgbueDuNV3qFdVdQwAHJl1uNt90zUuAJuzqjH4cw6Y=
+github.com/redis/rueidis v1.0.64/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=

apps/iam/kinds/user.cue

@@ -14,7 +14,7 @@ userKind: {
 }
 
 userv0alpha1: userKind & {
-	// TODO: Uncomment this when User will be added to ManagedKinds 
+	// TODO: Uncomment this when User will be added to ManagedKinds
 	// validation: {
 	// 	operations: [
 	// 		"CREATE",

apps/iam/pkg/apis/iam_manifest.go

@@ -74,6 +74,10 @@ var appManifestData = app.ManifestData{
 					Plural:     "Users",
 					Scope:      "Namespaced",
 					Conversion: false,
+					SelectableFields: []string{
+						"spec.email",
+						"spec.login",
+					},
 				},
 
 				{

apps/iam/pkg/app/app.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/prometheus/client_golang/prometheus"
-
 	"github.com/grafana/grafana-app-sdk/app"
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
@@ -14,6 +12,7 @@ import (
 	foldersKind "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/apps/iam/pkg/reconcilers"
 	"github.com/grafana/grafana/pkg/services/authz"
+	"github.com/prometheus/client_golang/prometheus"
 )
 
 var appManifestData = app.ManifestData{
@@ -79,7 +78,7 @@ func New(cfg app.Config) (app.App, error) {
 	folderReconciler, err := reconcilers.NewFolderReconciler(reconcilers.ReconcilerConfig{
 		ZanzanaCfg: appSpecificConfig.ZanzanaClientCfg,
 		Metrics:    metrics,
-	}, appSpecificConfig.MetricsRegisterer)
+	})
 	if err != nil {
 		return nil, fmt.Errorf("unable to create FolderReconciler: %w", err)
 	}

apps/iam/pkg/reconcilers/folder_reconciler.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
@@ -36,9 +35,9 @@ type FolderReconciler struct {
 	metrics         *ReconcilerMetrics
 }
 
-func NewFolderReconciler(cfg ReconcilerConfig, reg prometheus.Registerer) (operator.Reconciler, error) {
+func NewFolderReconciler(cfg ReconcilerConfig) (operator.Reconciler, error) {
 	// Create Zanzana client
-	zanzanaClient, err := authz.NewRemoteZanzanaClient(cfg.ZanzanaCfg, reg)
+	zanzanaClient, err := authz.NewRemoteZanzanaClient("*", cfg.ZanzanaCfg)
 
 	if err != nil {
 		return nil, fmt.Errorf("unable to create zanzana client: %w", err)

docs/sources/as-code/observability-as-code/provision-resources/file-path-setup.md

@@ -54,7 +54,7 @@ For production systems, use the `folderFromFilesStructure` capability instead of
 ## Before you begin
 
 {{< admonition type="note" >}}
-Enable the `provisioning` feature toggle in Grafana to use this feature.
+Enable the `provisioning` and `kubernetesDashboards` feature toggles in Grafana to use this feature.
 {{< /admonition >}}
 
 To set up file provisioning, you need:
@@ -67,7 +67,7 @@ To set up file provisioning, you need:
 
 ## Enable required feature toggles and configure permitted paths
 
-To activate local file provisioning in Grafana, you need to enable the `provisioning` feature toggle.
+To activate local file provisioning in Grafana, you need to enable the `provisioning` and `kubernetesDashboards` feature toggles.
 For additional information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles).
 
 The local setting must be a relative path and its relative path must be configured in the `permitted_provisioned_paths` configuration option.
@@ -82,11 +82,12 @@ Any subdirectories are automatically included.
 The values that you enter for the `permitted_provisioning_paths` become the base paths for those entered when you enter a local path in the **Connect to local storage** wizard.
 
 1. Open your Grafana configuration file, either `grafana.ini` or `custom.ini`. For file location based on operating system, refer to [Configuration file location](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
-1. Locate or add a `[feature_toggles]` section. Add this value:
+1. Locate or add a `[feature_toggles]` section. Add these values:
 
    ```ini
    [feature_toggles]
    provisioning = true
+   kubernetesDashboards = true ; use k8s from browser
    ```
 
 1. Locate or add a `[paths]` section. To add more than one location, use the pipe character (`|`) to separate the paths. The list should not include empty paths or trailing pipes. Add these values:

docs/sources/as-code/observability-as-code/provision-resources/git-sync-setup.md

@@ -29,70 +29,76 @@ You can sign up to the private preview using the [Git Sync early access form](ht
 
 {{< /admonition >}}
 
-This guide shows you how to set up Git Sync to synchronize your Grafana dashboards and folders with a GitHub repository. You'll set up Git Sync to enable version-controlled dashboard management either [using the UI](#set-up-git-sync-using-grafana-ui) or [as code](#set-up-git-sync-as-code).
+Git Sync lets you manage Grafana dashboards as code by storing dashboard JSON files and folders in a remote GitHub repository.
 
-## Before you begin
+To set up Git Sync and synchronize with a GitHub repository follow these steps:
 
-Before you begin, ensure you have the following:
+1. [Enable feature toggles in Grafana](#enable-required-feature-toggles) (first time set up).
+1. [Create a GitHub access token](#create-a-github-access-token).
+1. [Configure a connection to your GitHub repository](#set-up-the-connection-to-github).
+1. [Choose what content to sync with Grafana](#choose-what-to-synchronize).
 
-- A Grafana instance (Cloud, OSS, or Enterprise).
-- If you're [using webhooks or image rendering](#extend-git-sync-for-real-time-notification-and-image-rendering), a public instance with external access
-- Administration rights in your Grafana organization
-- A [GitHub private access token](#create-a-github-access-token)
-- A GitHub repository to store your dashboards in
-- Optional: The [Image Renderer service](https://github.com/grafana/grafana-image-renderer) to save image previews with your PRs
+Optionally, you can [extend Git Sync](#configure-webhooks-and-image-rendering) by enabling pull request notifications and image previews of dashboard changes.
 
-### Known limitations
-
-Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync#known-limitations) before using Git Sync.
-
-Refer to [Supported resources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/intro-git-sync#supported-resources) for details about which resources you can sync.
-
-### Performance considerations
-
-When Git Sync is enabled, the database load might increase, especially for instances with many folders and nested folders. Evaluate the performance impact, if any, in a non-production environment.
-
-Git Sync is under continuous development. [Report any issues](https://grafana.com/help/) you encounter to help us improve Git Sync.
-
-## Set up Git Sync
-
-To set up Git Sync and synchronize with a GitHub repository, follow these steps:
-
-1. [Enable feature toggles in Grafana](#enable-required-feature-toggles) (first time setup)
-1. [Create a GitHub access token](#create-a-github-access-token)
-1. Set up Git Sync [using the UI](#set-up-git-sync-using-grafana-ui) or [as code](#set-up-git-sync-as-code)
-
-After setup, you can [verify your dashboards](#verify-your-dashboards-in-grafana).
-
-Optionally, you can also [extend Git Sync with webhooks and image rendering](#extend-git-sync-for-real-time-notification-and-image-rendering).
+| Capability                                            | Benefit                                                                         | Requires                               |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------- |
+| Adds a table summarizing changes to your pull request | Provides a convenient way to save changes back to GitHub.                       | Webhooks configured                    |
+| Add a dashboard preview image to a PR                 | View a snapshot of dashboard changes to a pull request without opening Grafana. | Image renderer and webhooks configured |
 
 {{< admonition type="note" >}}
 
-Alternatively, you can configure a local file system instead of using GitHub. Refer to [Set up file provisioning](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/file-path-setup/) for more information.
+Alternatively, you can configure a local file system instead of using GitHub. Refer to [Set up file provisioning](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/file-path-setup/) for more information.
 
 {{< /admonition >}}
 
+## Performance impacts of enabling Git Sync
+
+Git Sync is an experimental feature and is under continuous development. Reporting any issues you encounter can help us improve Git Sync.
+
+When Git Sync is enabled, the database load might increase, especially for instances with a lot of folders and nested folders. Evaluate the performance impact, if any, in a non-production environment.
+
+## Before you begin
+
+{{< admonition type="caution" >}}
+
+Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#known-limitations/) before using Git Sync.
+
+{{< /admonition >}}
+
+### Requirements
+
+To set up Git Sync, you need:
+
+- Administration rights in your Grafana organization.
+- Enable the required feature toggles in your Grafana instance. Refer to [Enable required feature toggles](#enable-required-feature-toggles) for instructions.
+- A GitHub repository to store your dashboards in.
+  - If you want to use a local file path, refer to [the local file path guide](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/file-path-setup/).
+- A GitHub access token. The Grafana UI will prompt you during setup.
+- Optional: A public Grafana instance.
+- Optional: The [Image Renderer service](https://github.com/grafana/grafana-image-renderer) to save image previews with your PRs.
+
 ## Enable required feature toggles
 
-To activate Git Sync in Grafana, you need to enable the `provisioning` feature toggle. For more information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
+To activate Git Sync in Grafana, you need to enable the `provisioning` and `kubernetesDashboards` feature toggles.
+For additional information about feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles).
 
-To enable the required feature toggle:
+To enable the required feature toggles, add them to your Grafana configuration file:
 
 1. Open your Grafana configuration file, either `grafana.ini` or `custom.ini`. For file location based on operating system, refer to [Configuration file location](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/#experimental-feature-toggles).
-1. Locate or add a `[feature_toggles]` section. Add this value:
+1. Locate or add a `[feature_toggles]` section. Add these values:
 
    ```ini
    [feature_toggles]
    provisioning = true
+   kubernetesDashboards = true ; use k8s from browser
    ```
 
 1. Save the changes to the file and restart Grafana.
 
 ## Create a GitHub access token
 
-Whenever you connect to a GitHub repository, you need to create a GitHub access token with specific repository permissions. This token needs to be added to your Git Sync configuration to enable read and write permissions between Grafana and GitHub repository.
-
-To create a GitHub access token:
+Whenever you connect to a GitHub repository, you need to create a GitHub access token with specific repository permissions.
+This token needs to be added to your Git Sync configuration to enable read and write permissions between Grafana and GitHub repository.
 
 1. Create a new token using [Create new fine-grained personal access token](https://github.com/settings/personal-access-tokens/new). Refer to [Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) for instructions.
 1. Under **Permissions**, expand **Repository permissions**.
@@ -106,23 +112,19 @@ To create a GitHub access token:
 1. Verify the options and select **Generate token**.
 1. Copy the access token. Leave the browser window available with the token until you've completed configuration.
 
-GitHub Apps aren't currently supported.
+GitHub Apps are not currently supported.
 
-## Set up Git Sync using Grafana UI
+## Set up the connection to GitHub
 
-1. [Configure a connection to your GitHub repository](#set-up-the-connection-to-github)
-1. [Choose what content to sync with Grafana](#choose-what-to-synchronize)
-1. [Choose additional settings](#choose-additional-settings)
-
-### Set up the connection to GitHub
-
-Use **Provisioning** to guide you through setting up Git Sync to use a GitHub repository:
+Use **Provisioning** to guide you through setting up Git Sync to use a GitHub repository.
 
 1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
 1. Select **Administration** in the left-side menu and then **Provisioning**.
 1. Select **Configure Git Sync**.
 
-To connect your GitHub repository:
+### Connect to external storage
+
+To connect your GitHub repository, follow these steps:
 
 1. Paste your GitHub personal access token into **Enter your access token**. Refer to [Create a GitHub access token](#create-a-github-access-token) for instructions.
 1. Paste the **Repository URL** for your GitHub repository into the text box.
@@ -132,12 +134,32 @@ To connect your GitHub repository:
 
 ### Choose what to synchronize
 
-In this step, you can decide which elements to synchronize. The available options depend on the status of your Grafana instance:
+In this step you can decide which elements to synchronize. Keep in mind the available options depend on the status of your Grafana instance.
 
 - If the instance contains resources in an incompatible data format, you'll have to migrate all the data using instance sync. Folder sync won't be supported.
-- If there's already another connection using folder sync, instance sync won't be offered.
+- If there is already another connection using folder sync, instance sync won't be offered.
 
-To set up synchronization:
+#### Synchronization limitations
+
+Git Sync only supports dashboards and folders. Alerts, panels, and other resources are not supported yet.
+
+{{< admonition type="caution" >}}
+
+Refer to [Known limitations](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#known-limitations/) before using Git Sync. Refer to [Supported resources](/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/intro-git-sync#supported-resources) for details about which resources you can sync.
+
+{{< /admonition >}}
+
+Full instance sync is not available in Grafana Cloud.
+
+In Grafana OSS/Enterprise:
+
+- If you try to perform a full instance sync with resources that contain alerts or panels, Git Sync will block the connection.
+- You won't be able to create new alerts or library panels after the setup is completed.
+- If you opted for full instance sync and want to use alerts and library panels, you'll have to delete the synced repository and connect again with folder sync.
+
+#### Set up synchronization
+
+To set up synchronization, choose to either sync your entire organization resources with external storage, or to sync certain resources to a new Grafana folder (with up to 10 connections).
 
 - Choose **Sync all resources with external storage** if you want to sync and manage your entire Grafana instance through external storage. With this option, all of your dashboards are synced to that one repository. You can only have one provisioned connection with this selection, and you won't have the option of setting up additional repositories to connect to.
 - Choose **Sync external storage to new Grafana folder** to sync external resources into a new folder without affecting the rest of your instance. You can repeat this process for up to 10 connections.
@@ -148,183 +170,20 @@ Next, enter a **Display name** for the repository connection. Resources stored i
 
 Finally, you can set up how often your configured storage is polled for updates.
 
-To configure additional settings:
-
 1. For **Update instance interval (seconds)**, enter how often you want the instance to pull updates from GitHub. The default value is 60 seconds.
 1. Optional: Select **Read only** to ensure resources can't be modified in Grafana.
-1. Optional: If you have the Grafana Image Renderer plugin configured, you can **Enable dashboards previews in pull requests**. If image rendering isn't available, then you can't select this option. For more information, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
+1. Optional: If you have the Grafana Image Renderer plugin configured, you can **Enable dashboards previews in pull requests**. If image rendering is not available, then you can't select this option. For more information, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
 1. Select **Finish** to proceed.
 
-### Modify your configuration after setup is complete
-
-To update your repository configuration after you've completed setup:
-
-1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
-1. Select **Administration** in the left-side menu and then **Provisioning**.
-1. Select **Settings** for the repository you wish to modify.
-1. Use the **Configure repository** screen to update any of the settings.
-1. Select **Save** to preserve the updates.
-
-## Set up Git Sync as code
-
-Alternatively, you can also configure Git Sync using `grafanactl`. Since Git Sync configuration is managed as code using Custom Resource Definitions (CRDs), you can create a Repository CRD in a YAML file and use `grafanactl` to push it to Grafana. This approach enables automated, GitOps-style workflows for managing Git Sync configuration instead of using the Grafana UI.
-
-To set up Git Sync with `grafanactl`, follow these steps:
-
-1. [Create the repository CRD](#create-the-repository-crd)
-1. [Push the repository CRD to Grafana](#push-the-repository-crd-to-grafana)
-1. [Manage repository resources](#manage-repository-resources)
-1. [Verify setup](#verify-setup)
-
-For more information, refer to the following documents:
-
-- [grafanactl Documentation](https://grafana.github.io/grafanactl/)
-- [Repository CRD Reference](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/git-sync-setup/)
-- [Dashboard CRD Format](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/export-resources/)
-
-### Create the repository CRD
-
-Create a `repository.yaml` file defining your Git Sync configuration:
-
-```yaml
-apiVersion: provisioning.grafana.app/v0alpha1
-kind: Repository
-metadata:
-  name: <REPOSITORY_NAME>
-spec:
-  title: <REPOSITORY_TITLE>
-  type: github
-  github:
-    url: <GITHUB_REPO_URL>
-    branch: <BRANCH>
-    path: grafana/
-    generateDashboardPreviews: true
-  sync:
-    enabled: true
-    intervalSeconds: 60
-    target: folder
-  workflows:
-    - write
-    - branch
-secure:
-  token:
-    create: <GITHUB_PAT>
-```
-
-Replace the placeholders with your values:
-
-- _`<REPOSITORY_NAME>`_: Unique identifier for this repository resource
-- _`<REPOSITORY_TITLE>`_: Human-readable name displayed in Grafana UI
-- _`<GITHUB_REPO_URL>`_: GitHub repository URL
-- _`<BRANCH>`_: Branch to sync
-- _`<GITHUB_PAT>`_: GitHub Personal Access Token
-
-{{< admonition type="note" >}}
-
-Only `target: folder` is currently supported for Git Sync.
-
-{{< /admonition >}}
-
-#### Configuration parameters
-
-The following configuration parameters are available:
-
-| Field                                   | Description                                                 |
-| --------------------------------------- | ----------------------------------------------------------- |
-| `metadata.name`                         | Unique identifier for this repository resource              |
-| `spec.title`                            | Human-readable name displayed in Grafana UI                 |
-| `spec.type`                             | Repository type (`github`)                                  |
-| `spec.github.url`                       | GitHub repository URL                                       |
-| `spec.github.branch`                    | Branch to sync                                              |
-| `spec.github.path`                      | Directory path containing dashboards                        |
-| `spec.github.generateDashboardPreviews` | Generate preview images (true/false)                        |
-| `spec.sync.enabled`                     | Enable synchronization (true/false)                         |
-| `spec.sync.intervalSeconds`             | Sync interval in seconds                                    |
-| `spec.sync.target`                      | Where to place synced dashboards (`folder`)                 |
-| `spec.workflows`                        | Enabled workflows: `write` (direct commits), `branch` (PRs) |
-| `secure.token.create`                   | GitHub Personal Access Token                                |
-
-### Push the repository CRD to Grafana
-
-Before pushing any resources, configure `grafanactl` with your Grafana instance details. Refer to the [grafanactl configuration documentation](https://grafana.github.io/grafanactl/) for setup instructions.
-
-Push the repository configuration:
-
-```sh
-grafanactl resources push --path <DIRECTORY>
-```
-
-The `--path` parameter has to point to the directory containing your `repository.yaml` file.
-
-After pushing, Grafana will:
-
-1. Create the repository resource
-1. Connect to your GitHub repository
-1. Pull dashboards from the specified path
-1. Begin syncing at the configured interval
-
-### Manage repository resources
-
-#### List repositories
-
-To list all repositories:
-
-```sh
-grafanactl resources get repositories
-```
-
-#### Get repository details
-
-To get details for a specific repository:
-
-```sh
-grafanactl resources get repository/<REPOSITORY_NAME>
-grafanactl resources get repository/<REPOSITORY_NAME> -o json
-grafanactl resources get repository/<REPOSITORY_NAME> -o yaml
-```
-
-#### Update the repository
-
-To update a repository:
-
-```sh
-grafanactl resources edit repository/<REPOSITORY_NAME>
-```
-
-#### Delete the repository
-
-To delete a repository:
-
-```sh
-grafanactl resources delete repository/<REPOSITORY_NAME>
-```
-
-### Verify setup
-
-Check that Git Sync is working:
-
-```sh
-# List repositories
-grafanactl resources get repositories
-
-# Check Grafana UI
-# Navigate to: Administration → Provisioning → Git Sync
-```
-
 ## Verify your dashboards in Grafana
 
 To verify that your dashboards are available at the location that you specified, click **Dashboards**. The name of the dashboard is listed in the **Name** column.
 
-Now that your dashboards have been synced from a repository, you can customize the name, change the branch, and create a pull request (PR) for it. Refer to [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/use-git-sync/) for more information.
+Now that your dashboards have been synced from a repository, you can customize the name, change the branch, and create a pull request (PR) for it. Refer to [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/observability-as-code/provision-resources/use-git-sync/) for more information.
 
-## Extend Git Sync for real-time notification and image rendering
+## Configure webhooks and image rendering
 
-Optionally, you can extend Git Sync by enabling pull request notifications and image previews of dashboard changes.
-
-| Capability                                            | Benefit                                                                        | Requires                               |
-| ----------------------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------- |
-| Adds a table summarizing changes to your pull request | Provides a convenient way to save changes back to GitHub                       | Webhooks configured                    |
-| Add a dashboard preview image to a PR                 | View a snapshot of dashboard changes to a pull request without opening Grafana | Image renderer and webhooks configured |
+You can extend Git Sync by getting instant updates and pull requests using webhooks and add dashboard previews in pull requests.
 
 ### Set up webhooks for realtime notification and pull request integration
 
@@ -332,26 +191,25 @@ When connecting to a GitHub repository, Git Sync uses webhooks to enable real-ti
 
 You can set up webhooks with whichever service or tooling you prefer. You can use Cloudflare Tunnels with a Cloudflare-managed domain, port-forwarding and DNS options, or a tool such as `ngrok`.
 
-To set up webhooks, you need to expose your Grafana instance to the public Internet. You can do this via port forwarding and DNS, a tool such as `ngrok`, or any other method you prefer. The permissions set in your GitHub access token provide the authorization for this communication.
+To set up webhooks you need to expose your Grafana instance to the public Internet. You can do this via port forwarding and DNS, a tool such as `ngrok`, or any other method you prefer. The permissions set in your GitHub access token provide the authorization for this communication.
 
 After you have the public URL, you can add it to your Grafana configuration file:
 
-```ini
+```yaml
 [server]
-root_url = https://<PUBLIC_DOMAIN>
+root_url = https://PUBLIC_DOMAIN.HERE
 ```
 
-Replace _`<PUBLIC_DOMAIN>`_ with your public domain.
-
 To check the configured webhooks, go to **Administration** > **Provisioning** and click the **View** link for your GitHub repository.
 
 #### Expose necessary paths only
 
-If your security setup doesn't permit publicly exposing the Grafana instance, you can either choose to allowlist the GitHub IP addresses, or expose only the necessary paths.
+If your security setup does not permit publicly exposing the Grafana instance, you can either choose to `allowlist` the GitHub IP addresses, or expose only the necessary paths.
 
 The necessary paths required to be exposed are, in RegExp:
 
 - `/apis/provisioning\.grafana\.app/v0(alpha1)?/namespaces/[^/]+/repositories/[^/]+/(webhook|render/.*)$`
+<!-- TODO: Path for the blob storage for image rendering? @ryantxu would know this best. -->
 
 ### Set up image rendering for dashboard previews
 
@@ -359,13 +217,12 @@ Set up image rendering to add visual previews of dashboard updates directly in p
 
 To enable this capability, install the Grafana Image Renderer in your Grafana instance. For more information and installation instructions, refer to the [Image Renderer service](https://github.com/grafana/grafana-image-renderer).
 
-## Next steps
+## Modify configurations after set up is complete
 
-You've successfully set up Git Sync to manage your Grafana dashboards through version control. Your dashboards are now synchronized with a GitHub repository, enabling collaborative development and change tracking.
+To update your repository configuration after you've completed set up:
 
-To learn more about using Git Sync:
-
-- [Work with provisioned dashboards](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/provisioned-dashboards/)
-- [Manage provisioned repositories with Git Sync](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/use-git-sync/)
-- [Export resources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/as-code/observability-as-code/provision-resources/export-resources/)
-- [grafanactl documentation](https://grafana.github.io/grafanactl/)
+1. Log in to your Grafana server with an account that has the Grafana Admin flag set.
+1. Select **Administration** in the left-side menu and then **Provisioning**.
+1. Select **Settings** for the repository you wish to modify.
+1. Use the **Configure repository** screen to update any of the settings.
+1. Select **Save** to preserve the updates.

docs/sources/datasources/mysql/troubleshoot/index.md

@@ -1,80 +0,0 @@
----
-description: Learn how to troubleshoot common problems with the Grafana MySQL data source plugin
-keywords:
-  - grafana
-  - mysql
-  - query
-labels:
-  products:
-    - cloud
-    - enterprise
-    - oss
-menuTitle: Troubleshoot
-title: Troubleshoot common problems with the Grafana MySQL data source plugin
-weight: 40
-refs:
-  variables:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/variables/
-  variable-syntax-advanced-variable-format-options:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/variables/variable-syntax/#advanced-variable-format-options
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/variables/variable-syntax/#advanced-variable-format-options
-  annotate-visualizations:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/dashboards/build-dashboards/annotate-visualizations/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/dashboards/build-dashboards/annotate-visualizations/
-  explore:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/explore/
-  query-transform-data:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/
-  panel-inspector:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/panel-inspector/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/panel-inspector/
-  query-editor:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/query-transform-data/#query-editors
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/query-transform-data/#query-editors
-  alert-rules:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/
-  template-annotations-and-labels:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/templates/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/templates/
-  configure-standard-options:
-    - pattern: /docs/grafana/
-    - destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/configure-standard-options/
----
-
-# Troubleshoot common problems with the Grafana MySQL data source plugin
-
-This page lists common issues you might experience when setting up the Grafana MySQL data source plugin.
-
-### My data source connection fails when using the Grafana MySQL data source plugin
-
-- Check if the MySQL server is up and running.
-- Make sure that your firewall is open for MySQL server (default port is `3306`).
-- Ensure that you have the correct permissions to access the MySQL server and also have permission to access the database.
-- If the error persists, create a new user for the Grafana MySQL data source plugin with correct permissions and try to connect with it.
-
-### What should I do if I see "An unexpected error happened" or "Could not connect to MySQL" after trying all of the above?
-
-- Check the Grafana logs for more details about the error.
-- For Grafana Cloud customers, contact support.

go.mod

@@ -48,7 +48,7 @@ require (
 	github.com/blugelabs/bluge_segment_api v0.2.0 // @grafana/grafana-backend-group
 	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // @grafana/grafana-backend-group
 	github.com/bwmarrin/snowflake v0.3.0 // @grafana/grafana-app-platform-squad
-	github.com/centrifugal/centrifuge v0.38.0 // @grafana/grafana-app-platform-squad
+	github.com/centrifugal/centrifuge v0.37.2 // @grafana/grafana-app-platform-squad
 	github.com/crewjam/saml v0.4.14 // @grafana/identity-access-team
 	github.com/dgraph-io/badger/v4 v4.7.0 // @grafana/grafana-search-and-storage
 	github.com/dlmiddlecote/sqlstats v1.0.2 // @grafana/grafana-backend-group
@@ -386,7 +386,7 @@ require (
 	github.com/caio/go-tdigest v3.1.0+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // @grafana/alerting-backend
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/centrifugal/protocol v0.17.0 // indirect
+	github.com/centrifugal/protocol v0.16.2 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cheekybits/genny v1.0.0 // indirect
@@ -562,7 +562,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20241112170944-20d2c9ebc01d // indirect
 	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
-	github.com/redis/rueidis v1.0.68 // indirect
+	github.com/redis/rueidis v1.0.64 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
@@ -687,7 +687,6 @@ require (
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/quagmt/udecimal v1.9.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.3 // indirect
 	github.com/tklauser/go-sysconf v0.3.14 // indirect
 	github.com/tklauser/numcpus v0.8.0 // indirect

go.sum

@@ -1006,10 +1006,10 @@ github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F9
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/centrifugal/centrifuge v0.38.0 h1:UJTowwc5lSwnpvd3vbrTseODbU7osSggN67RTrJ8EfQ=
-github.com/centrifugal/centrifuge v0.38.0/go.mod h1:rcZLARnO5GXOeE9qG7iIPMvERxESespqkSX4cGLCAzo=
-github.com/centrifugal/protocol v0.17.0 h1:hD0WczyiG7zrVJcgkQsd5/nhfFXt0Y04SJHV2Z7B1rg=
-github.com/centrifugal/protocol v0.17.0/go.mod h1:9MdiYyjw5Bw1+d5Sp4Y0NK+qiuTNyd88nrHJsUUh8k4=
+github.com/centrifugal/centrifuge v0.37.2 h1:rerQNvDfYN2FZEkVtb/hvGV7SIrJfEQrKF3MaE8GDlo=
+github.com/centrifugal/centrifuge v0.37.2/go.mod h1:aj4iRJGhzi3SlL8iUtVezxway1Xf8g+hmNQkLLO7sS8=
+github.com/centrifugal/protocol v0.16.2 h1:KoIHgDeX1fFxyxQoKW+6E8ZTCf5mwGm8JyGoJ5NBMbQ=
+github.com/centrifugal/protocol v0.16.2/go.mod h1:Q7OpS/8HMXDnL7f9DpNx24IhG96MP88WPpVTTCdrokI=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -2334,13 +2334,11 @@ github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9p
 github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
 github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
 github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
-github.com/quagmt/udecimal v1.9.0 h1:TLuZiFeg0HhS6X8VDa78Y6XTaitZZfh+z5q4SXMzpDQ=
-github.com/quagmt/udecimal v1.9.0/go.mod h1:ScmJ/xTGZcEoYiyMMzgDLn79PEJHcMBiJ4NNRT3FirA=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01jfAE=
 github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
-github.com/redis/rueidis v1.0.68 h1:gept0E45JGxVigWb3zoWHvxEc4IOC7kc4V/4XvN8eG8=
-github.com/redis/rueidis v1.0.68/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
+github.com/redis/rueidis v1.0.64 h1:XqgbueDuNV3qFdVdQwAHJl1uNt90zUuAJuzqjH4cw6Y=
+github.com/redis/rueidis v1.0.64/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=

go.work.sum

@@ -708,8 +708,6 @@ github.com/envoyproxy/go-control-plane/envoy v1.32.3/go.mod h1:F6hWupPfh75TBXGKA
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
-github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731 h1:R/ZjJpjQKsZ6L/+Gf9WHbt31GG8NMVcpRqUE+1mMIyo=
-github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731/go.mod h1:M9R1FoZ3y//hwwnJtO51ypFGwm8ZfpxPT/ZLtO1mcgQ=
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
@@ -1332,7 +1330,6 @@ github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgc
 github.com/pkg/sftp v1.13.1 h1:I2qBYMChEhIjOgazfJmV3/mZM256btk6wkCDRmW7JYs=
 github.com/pkg/xattr v0.4.10 h1:Qe0mtiNFHQZ296vRgUjRCoPHPqH7VdTOrZx3g0T+pGA=
 github.com/pkg/xattr v0.4.10/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
-github.com/planetscale/vtprotobuf v0.6.0/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
@@ -1400,7 +1397,6 @@ github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtm
 github.com/schollz/progressbar/v3 v3.14.6 h1:GyjwcWBAf+GFDMLziwerKvpuS7ZF+mNTAXIB2aspiZs=
 github.com/schollz/progressbar/v3 v3.14.6/go.mod h1:Nrzpuw3Nl0srLY0VlTvC4V6RL50pcEymjy6qyJAaLa0=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
-github.com/segmentio/asm v1.1.4/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
 github.com/segmentio/fasthash v1.0.3 h1:EI9+KE1EwvMLBWwjpRDc+fEM+prwxDYbslddQGtrmhM=
 github.com/segmentio/fasthash v1.0.3/go.mod h1:waKX8l2N8yckOgmSsXJi7x1ZfdKZ4x7KRMzBtS3oedY=
 github.com/segmentio/parquet-go v0.0.0-20220811205829-7efc157d28af/go.mod h1:PxYdAI6cGd+s1j4hZDQbz3VFgobF5fDA0weLeNWKTE4=
@@ -1939,7 +1935,6 @@ golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT
 golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
@@ -2006,7 +2001,6 @@ golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
@@ -2083,7 +2077,6 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4/go.mod h1:NnuHhy+bxcg30o7FnVAZbXsPHUDQ9qKWAQKCD7VxFtk=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250603155806-513f23925822 h1:zWFRixYR5QlotL+Uv3YfsPRENIrQFXiGs+iwqel6fOQ=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250603155806-513f23925822/go.mod h1:h6yxum/C2qRb4txaZRLDHK8RyS0H/o2oEDeKY4onY/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97/go.mod h1:v7nGkzlmW8P3n/bKmWBn2WpBjpOEx8Q6gMueudAmKfY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
@@ -2114,7 +2107,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
-google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
 google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=

package.json

@@ -124,6 +124,7 @@
     "@types/eslint": "9.6.1",
     "@types/eslint-scope": "^8.0.0",
     "@types/file-saver": "2.0.7",
+    "@types/glob": "^9.0.0",
     "@types/google.analytics": "^0.0.46",
     "@types/gtag.js": "^0.0.20",
     "@types/history": "4.7.11",

packages/grafana-e2e-selectors/src/index.ts

@@ -1,5 +1,5 @@
 /**
- * A library containing e2e selectors for the Grafana ecosystem.
+ * A library containing the different design components of the Grafana ecosystem.
  *
  * @packageDocumentation
  */

packages/grafana-ui/src/components/Table/TableNG/TableNG.test.tsx

@@ -451,19 +451,6 @@ describe('TableNG', () => {
       expect(screen.getByText('A1')).toBeInTheDocument();
       expect(screen.getByText('1')).toBeInTheDocument();
     });
-
-    it('shows full column name in title attribute for truncated headers', () => {
-      const { container } = render(
-        <TableNG enableVirtualization={false} data={createBasicDataFrame()} width={800} height={600} />
-      );
-
-      const headers = container.querySelectorAll('[role="columnheader"]');
-      const firstHeaderSpan = headers[0].querySelector('span');
-      const secondHeaderSpan = headers[1].querySelector('span');
-
-      expect(firstHeaderSpan).toHaveAttribute('title', 'Column A');
-      expect(secondHeaderSpan).toHaveAttribute('title', 'Column B');
-    });
   });
 
   describe('Footer options', () => {

packages/grafana-ui/src/components/Table/TableNG/components/HeaderCell.tsx

@@ -55,9 +55,7 @@ const HeaderCell: React.FC<HeaderCellProps> = ({
       {showTypeIcons && (
         <Icon className={styles.headerCellIcon} name={getFieldTypeIcon(field)} title={field?.type} size="sm" />
       )}
-      <span className={styles.headerCellLabel} title={displayName}>
-        {displayName}
-      </span>
+      <span className={styles.headerCellLabel}>{getDisplayName(field)}</span>
       {direction && (
         <Icon
           className={cx(styles.headerCellIcon, styles.headerSortIcon)}

pkg/api/dashboard_test.go

@@ -111,15 +111,17 @@ func TestGetHomeDashboard(t *testing.T) {
 	}
 }
 
-func newTestLive(t *testing.T) *live.GrafanaLive {
+func newTestLive(t *testing.T, store db.DB) *live.GrafanaLive {
 	features := featuremgmt.WithFeatures()
 	cfg := setting.NewCfg()
 	cfg.AppURL = "http://localhost:3000/"
 	gLive, err := live.ProvideService(nil, cfg,
 		routing.NewRouteRegister(),
 		nil, nil, nil, nil,
+		store,
 		nil,
 		&usagestats.UsageStatsMock{T: t},
+		nil,
 		features, acimpl.ProvideAccessControl(features),
 		&dashboards.FakeDashboardService{},
 		nil, nil)
@@ -749,7 +751,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 				hs := HTTPServer{
 					Cfg:                     cfg,
 					ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
-					Live:                    newTestLive(t),
+					Live:                    newTestLive(t, db.InitTestDB(t)),
 					QuotaService:            quotatest.New(false, nil),
 					LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 					DashboardService:        dashboardService,
@@ -1001,7 +1003,7 @@ func postDashboardScenario(t *testing.T, desc string, url string, routePattern s
 		hs := HTTPServer{
 			Cfg:                   cfg,
 			ProvisioningService:   provisioning.NewProvisioningServiceMock(context.Background()),
-			Live:                  newTestLive(t),
+			Live:                  newTestLive(t, db.InitTestDB(t)),
 			QuotaService:          quotatest.New(false, nil),
 			pluginStore:           &pluginstore.FakePluginStore{},
 			LibraryElementService: &libraryelementsfake.LibraryElementService{},
@@ -1041,7 +1043,7 @@ func restoreDashboardVersionScenario(t *testing.T, desc string, url string, rout
 		hs := HTTPServer{
 			Cfg:                     cfg,
 			ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
-			Live:                    newTestLive(t),
+			Live:                    newTestLive(t, db.InitTestDB(t)),
 			QuotaService:            quotatest.New(false, nil),
 			LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 			DashboardService:        mock,

pkg/api/datasources_test.go

@@ -343,7 +343,7 @@ func TestUpdateDataSourceByID_DataSourceNameExists(t *testing.T) {
 		Cfg:                  setting.NewCfg(),
 		AccessControl:        acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		accesscontrolService: actest.FakeService{},
-		Live:                 newTestLive(t),
+		Live:                 newTestLive(t, nil),
 	}
 
 	sc := setupScenarioContext(t, "/api/datasources/1")
@@ -450,7 +450,7 @@ func TestAPI_datasources_AccessControl(t *testing.T) {
 				hs.Cfg = setting.NewCfg()
 				hs.DataSourcesService = &dataSourcesServiceMock{expectedDatasource: &datasources.DataSource{}}
 				hs.accesscontrolService = actest.FakeService{}
-				hs.Live = newTestLive(t)
+				hs.Live = newTestLive(t, hs.SQLStore)
 				hs.promRegister, hs.dsConfigHandlerRequestsDuration = setupDsConfigHandlerMetrics()
 			})
 

pkg/api/dtos/live.go

@@ -0,0 +1,11 @@
+package dtos
+
+import "encoding/json"
+
+type LivePublishCmd struct {
+	Channel string          `json:"channel"`
+	Data    json.RawMessage `json:"data,omitempty"`
+}
+
+type LivePublishResponse struct {
+}

pkg/apiserver/registry/generic/storage.go

@@ -4,11 +4,24 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/registry/generic"
 	"k8s.io/apiserver/pkg/registry/generic/registry"
+	"k8s.io/apiserver/pkg/storage"
 
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 )
 
-func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter) (*registry.Store, error) {
+type registryStoreOptions struct {
+	attrFunc storage.AttrFunc
+}
+
+type OptionFn func(*registryStoreOptions)
+
+func WithAttrFunc(attrFunc storage.AttrFunc) OptionFn {
+	return func(opts *registryStoreOptions) {
+		opts.attrFunc = attrFunc
+	}
+}
+
+func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, optsGetter generic.RESTOptionsGetter, options ...OptionFn) (*registry.Store, error) {
 	gv := resourceInfo.GroupVersion()
 	gv.Version = runtime.APIVersionInternal
 	strategy := NewStrategy(scheme, gv)
@@ -20,7 +33,7 @@ func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, o
 		NewListFunc:               resourceInfo.NewListFunc,
 		KeyRootFunc:               KeyRootFunc(resourceInfo.GroupResource()),
 		KeyFunc:                   NamespaceKeyFunc(resourceInfo.GroupResource()),
-		PredicateFunc:             Matcher,
+		//PredicateFunc:             Matcher,
 		DefaultQualifiedResource:  resourceInfo.GroupResource(),
 		SingularQualifiedResource: resourceInfo.SingularGroupResource(),
 		TableConvertor:            resourceInfo.TableConverter(),
@@ -28,8 +41,16 @@ func NewRegistryStore(scheme *runtime.Scheme, resourceInfo utils.ResourceInfo, o
 		UpdateStrategy:            strategy,
 		DeleteStrategy:            strategy,
 	}
-	options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: GetAttrs}
-	if err := store.CompleteWithOptions(options); err != nil {
+
+	opts := &registryStoreOptions{
+		attrFunc: GetAttrs,
+	}
+	for _, opt := range options {
+		opt(opts)
+	}
+
+	o := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: opts.attrFunc}
+	if err := store.CompleteWithOptions(o); err != nil {
 		return nil, err
 	}
 	return store, nil

pkg/operators/iam/zanzana_folder_reconciler.go

@@ -11,16 +11,15 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/prometheus/client_golang/prometheus"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/transport"
-
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
 	folder "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/apps/iam/pkg/app"
 	"github.com/grafana/grafana/pkg/server"
 	"github.com/grafana/grafana/pkg/setting"
+	"github.com/prometheus/client_golang/prometheus"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/transport"
 
 	"github.com/grafana/authlib/authn"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
@@ -96,7 +95,7 @@ func buildIAMConfigFromSettings(cfg *setting.Cfg, registerer prometheus.Register
 	if zanzanaURL == "" {
 		return nil, fmt.Errorf("zanzana_url is required in [operator] section")
 	}
-	iamCfg.AppConfig.ZanzanaClientCfg.Addr = zanzanaURL
+	iamCfg.AppConfig.ZanzanaClientCfg.URL = zanzanaURL
 
 	iamCfg.AppConfig.InformerConfig.MaxConcurrentWorkers = operatorSec.Key("max_concurrent_workers").MustUint64(20)
 

pkg/registry/apis/dashboard/legacy/client.go

@@ -38,10 +38,10 @@ func (d *directResourceClient) GetBlob(ctx context.Context, in *resourcepb.GetBl
 	return d.server.GetBlob(ctx, in)
 }
 
-// GetStats implements ResourceClient.
-func (d *directResourceClient) GetStats(ctx context.Context, in *resourcepb.ResourceStatsRequest, opts ...grpc.CallOption) (*resourcepb.ResourceStatsResponse, error) {
-	return d.server.GetStats(ctx, in)
-}
+//// GetStats implements ResourceClient.
+//func (d *directResourceClient) GetStats(ctx context.Context, in *resourcepb.ResourceStatsRequest, opts ...grpc.CallOption) (*resourcepb.ResourceStatsResponse, error) {
+//	return d.server.GetStats(ctx, in)
+//}
 
 // IsHealthy implements ResourceClient.
 func (d *directResourceClient) IsHealthy(ctx context.Context, in *resourcepb.HealthCheckRequest, opts ...grpc.CallOption) (*resourcepb.HealthCheckResponse, error) {
@@ -53,13 +53,13 @@ func (d *directResourceClient) List(ctx context.Context, in *resourcepb.ListRequ
 	return d.server.List(ctx, in)
 }
 
-func (d *directResourceClient) ListManagedObjects(ctx context.Context, in *resourcepb.ListManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.ListManagedObjectsResponse, error) {
-	return d.server.ListManagedObjects(ctx, in)
-}
-
-func (d *directResourceClient) CountManagedObjects(ctx context.Context, in *resourcepb.CountManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.CountManagedObjectsResponse, error) {
-	return d.server.CountManagedObjects(ctx, in)
-}
+//func (d *directResourceClient) ListManagedObjects(ctx context.Context, in *resourcepb.ListManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.ListManagedObjectsResponse, error) {
+//	return d.server.ListManagedObjects(ctx, in)
+//}
+//
+//func (d *directResourceClient) CountManagedObjects(ctx context.Context, in *resourcepb.CountManagedObjectsRequest, opts ...grpc.CallOption) (*resourcepb.CountManagedObjectsResponse, error) {
+//	return d.server.CountManagedObjects(ctx, in)
+//}
 
 // PutBlob implements ResourceClient.
 func (d *directResourceClient) PutBlob(ctx context.Context, in *resourcepb.PutBlobRequest, opts ...grpc.CallOption) (*resourcepb.PutBlobResponse, error) {
@@ -72,9 +72,9 @@ func (d *directResourceClient) Read(ctx context.Context, in *resourcepb.ReadRequ
 }
 
 // Search implements ResourceClient.
-func (d *directResourceClient) Search(ctx context.Context, in *resourcepb.ResourceSearchRequest, opts ...grpc.CallOption) (*resourcepb.ResourceSearchResponse, error) {
-	return d.server.Search(ctx, in)
-}
+//func (d *directResourceClient) Search(ctx context.Context, in *resourcepb.ResourceSearchRequest, opts ...grpc.CallOption) (*resourcepb.ResourceSearchResponse, error) {
+//	return d.server.Search(ctx, in)
+//}
 
 // Update implements ResourceClient.
 func (d *directResourceClient) Update(ctx context.Context, in *resourcepb.UpdateRequest, opts ...grpc.CallOption) (*resourcepb.UpdateResponse, error) {

pkg/registry/apis/dashboard/legacy_storage.go

@@ -11,6 +11,7 @@ import (
 	"k8s.io/apiserver/pkg/registry/rest"
 
 	"github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"

pkg/registry/apis/folders/register.go

@@ -8,6 +8,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
@@ -22,6 +24,8 @@ import (
 	authlib "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana-app-sdk/logging"
 
+	sdkres "github.com/grafana/grafana-app-sdk/resource"
+
 	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/apps/iam/pkg/reconcilers"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
@@ -37,7 +41,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/storage/unified/apistore"
-	"github.com/grafana/grafana/pkg/storage/unified/resource"
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
@@ -74,7 +77,7 @@ func RegisterAPIService(cfg *setting.Cfg,
 	acService accesscontrol.Service,
 	accessClient authlib.AccessClient,
 	registerer prometheus.Registerer,
-	unified resource.ResourceClient,
+	unified resourcepb.ResourceIndexClient,
 	zanzanaClient zanzana.Client,
 ) *FolderAPIBuilder {
 	builder := &FolderAPIBuilder{
@@ -93,7 +96,7 @@ func RegisterAPIService(cfg *setting.Cfg,
 	return builder
 }
 
-func NewAPIService(ac authlib.AccessClient, searcher resource.ResourceClient, features featuremgmt.FeatureToggles, zanzanaClient zanzana.Client, resourcePermissionsSvc *dynamic.NamespaceableResourceInterface) *FolderAPIBuilder {
+func NewAPIService(ac authlib.AccessClient, searcher resourcepb.ResourceIndexClient, features featuremgmt.FeatureToggles, zanzanaClient zanzana.Client, resourcePermissionsSvc *dynamic.NamespaceableResourceInterface) *FolderAPIBuilder {
 	return &FolderAPIBuilder{
 		features:               features,
 		accessClient:           ac,
@@ -129,6 +132,29 @@ func (b *FolderAPIBuilder) InstallSchema(scheme *runtime.Scheme) error {
 		Version: runtime.APIVersionInternal,
 	})
 
+	kinds := []sdkres.Kind{folders.FolderKind()}
+	for _, kind := range kinds {
+		gvk := gv.WithKind(kind.Kind())
+		err := scheme.AddFieldLabelConversionFunc(
+			gvk,
+			func(label, value string) (string, string, error) {
+				if label == "metadata.name" || label == "metadata.namespace" {
+					return label, value, nil
+				}
+				fields := kind.SelectableFields()
+				for _, field := range fields {
+					if field.FieldSelector == label {
+						return label, value, nil
+					}
+				}
+				return "", "", fmt.Errorf("field label not supported for %s: %s", gvk, label)
+			},
+		)
+		if err != nil {
+			return err
+		}
+	}
+
 	// If multiple versions exist, then register conversions from zz_generated.conversion.go
 	// if err := playlist.RegisterConversions(scheme); err != nil {
 	//   return err
@@ -137,6 +163,26 @@ func (b *FolderAPIBuilder) InstallSchema(scheme *runtime.Scheme) error {
 	return scheme.SetVersionPriority(gv)
 }
 
+// TODO: work with all kinds from schema, not just one.
+func (b *FolderAPIBuilder) BuildGetAttrsFn(k sdkres.Kind) func(obj runtime.Object) (labels.Set, fields.Set, error) {
+	return func(obj runtime.Object) (labels.Set, fields.Set, error) {
+		if robj, ok := obj.(sdkres.Object); !ok {
+			return nil, nil, fmt.Errorf("not a resource.Object")
+		} else {
+			fieldsSet := fields.Set{}
+
+			for _, f := range k.SelectableFields() {
+				v, err := f.FieldValueFunc(robj)
+				if err != nil {
+					return nil, nil, err
+				}
+				fieldsSet[f.FieldSelector] = v
+			}
+			return robj.GetLabels(), fieldsSet, nil
+		}
+	}
+}
+
 func (b *FolderAPIBuilder) AllowedV0Alpha1Resources() []string {
 	return nil
 }
@@ -148,10 +194,11 @@ func (b *FolderAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.API
 		Permissions:                 b.setDefaultFolderPermissions,
 	})
 
-	unified, err := grafanaregistry.NewRegistryStore(opts.Scheme, resourceInfo, opts.OptsGetter)
+	unified, err := grafanaregistry.NewRegistryStore(opts.Scheme, resourceInfo, opts.OptsGetter, grafanaregistry.WithAttrFunc(b.BuildGetAttrsFn(folders.FolderKind())))
 	if err != nil {
 		return err
 	}
+
 	b.registerPermissionHooks(unified)
 	b.storage = unified
 

pkg/registry/apis/iam/register.go

@@ -615,7 +615,7 @@ func NewLocalStore(resourceInfo utils.ResourceInfo, scheme *runtime.Scheme, defa
 		return nil, err
 	}
 
-	client := resource.NewLocalResourceClient(server)
+	client := resource.NewLocalResourceClient(server, nil)
 	optsGetter := apistore.NewRESTOptionsGetterForClient(client, nil, defaultOpts.StorageConfig.Config, nil)
 
 	store, err := grafanaregistry.NewRegistryStore(scheme, resourceInfo, optsGetter)

pkg/server/wire_gen.go

@@ -672,7 +672,10 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	starService := starimpl.ProvideService(sqlStore)
 	searchSearchService := search2.ProvideService(cfg, sqlStore, starService, dashboardService, folderimplService, featureToggles, sortService)
 	plugincontextProvider := plugincontext.ProvideService(cfg, cacheService, pluginstoreService, cacheServiceImpl, service15, service13, requestConfigProvider)
-	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, secretsService, usageStats, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
+	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
+	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
+	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
+	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, sqlStore, secretsService, usageStats, queryServiceImpl, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -681,8 +684,6 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	authnAuthenticator := authnimpl.ProvideAuthnServiceAuthenticateOnly(authnimplService)
 	contexthandlerContextHandler := contexthandler.ProvideService(cfg, authnAuthenticator, featureToggles)
 	logger := loggermw.Provide(cfg, featureToggles)
-	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
-	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
 	ngAlert := metrics2.ProvideService()
 	repositoryImpl := annotationsimpl.ProvideService(sqlStore, cfg, featureToggles, tagimplService, tracingService, dBstore, dashboardService, registerer)
 	alertNG, err := ngalert.ProvideService(cfg, featureToggles, cacheServiceImpl, service15, routeRegisterImpl, sqlStore, kvStore, exprService, dataSourceProxyService, quotaService, secretsService, notificationService, ngAlert, folderimplService, accessControl, dashboardService, renderingService, inProcBus, acimplService, repositoryImpl, pluginstoreService, tracingService, dBstore, httpclientProvider, plugincontextProvider, receiverPermissionsService, userService)
@@ -707,7 +708,6 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	}
 	ossSearchUserFilter := filters.ProvideOSSSearchUserFilter()
 	ossService := searchusers.ProvideUsersService(cfg, ossSearchUserFilter, userService)
-	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
 	serviceAccountsProxy, err := proxy.ProvideServiceAccountsProxy(cfg, accessControl, acimplService, featureToggles, serviceAccountPermissionsService, serviceAccountsService, routeRegisterImpl)
 	if err != nil {
 		return nil, err
@@ -1329,7 +1329,10 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	starService := starimpl.ProvideService(sqlStore)
 	searchSearchService := search2.ProvideService(cfg, sqlStore, starService, dashboardService, folderimplService, featureToggles, sortService)
 	plugincontextProvider := plugincontext.ProvideService(cfg, cacheService, pluginstoreService, cacheServiceImpl, service15, service13, requestConfigProvider)
-	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, secretsService, usageStats, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
+	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
+	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
+	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
+	grafanaLive, err := live.ProvideService(plugincontextProvider, cfg, routeRegisterImpl, pluginstoreService, middlewareHandler, cacheService, cacheServiceImpl, sqlStore, secretsService, usageStats, queryServiceImpl, featureToggles, accessControl, dashboardService, orgService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -1338,8 +1341,6 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	authnAuthenticator := authnimpl.ProvideAuthnServiceAuthenticateOnly(authnimplService)
 	contexthandlerContextHandler := contexthandler.ProvideService(cfg, authnAuthenticator, featureToggles)
 	logger := loggermw.Provide(cfg, featureToggles)
-	qsDatasourceClientBuilder := dsquerierclient.NewNullQSDatasourceClientBuilder()
-	exprService := expr.ProvideService(cfg, middlewareHandler, plugincontextProvider, featureToggles, registerer, tracingService, qsDatasourceClientBuilder)
 	notificationServiceMock := notifications.MockNotificationService()
 	ngAlert := metrics2.ProvideServiceForTest()
 	repositoryImpl := annotationsimpl.ProvideService(sqlStore, cfg, featureToggles, tagimplService, tracingService, dBstore, dashboardService, registerer)
@@ -1365,7 +1366,6 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	}
 	ossSearchUserFilter := filters.ProvideOSSSearchUserFilter()
 	ossService := searchusers.ProvideUsersService(cfg, ossSearchUserFilter, userService)
-	queryServiceImpl := query.ProvideService(cfg, cacheServiceImpl, exprService, ossDataSourceRequestValidator, middlewareHandler, plugincontextProvider, qsDatasourceClientBuilder)
 	serviceAccountsProxy, err := proxy.ProvideServiceAccountsProxy(cfg, accessControl, acimplService, featureToggles, serviceAccountPermissionsService, serviceAccountsService, routeRegisterImpl)
 	if err != nil {
 		return nil, err

pkg/services/authz/rbac.go

@@ -152,7 +152,7 @@ func ProvideStandaloneAuthZClient(
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	zanzanaEnabled := features.IsEnabledGlobally(featuremgmt.FlagZanzana)
 
-	zanzanaClient, err := ProvideStandaloneZanzanaClient(cfg, features, reg)
+	zanzanaClient, err := ProvideStandaloneZanzanaClient(cfg, features)
 	if err != nil {
 		return nil, err
 	}

pkg/services/authz/zanzana.go

@@ -4,19 +4,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"time"
 
 	"github.com/fullstorydev/grpchan/inprocgrpc"
 	authnlib "github.com/grafana/authlib/authn"
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	"github.com/grafana/authlib/grpcutils"
 	"github.com/grafana/authlib/types"
-	"github.com/grafana/dskit/middleware"
 	"github.com/grafana/dskit/services"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promauto"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
@@ -46,14 +43,14 @@ func ProvideZanzanaClient(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, fea
 
 	switch cfg.ZanzanaClient.Mode {
 	case setting.ZanzanaModeClient:
-		zanzanaConfig := ZanzanaClientConfig{
-			Addr:             cfg.ZanzanaClient.Addr,
-			Token:            cfg.ZanzanaClient.Token,
-			TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
-			TokenNamespace:   cfg.ZanzanaClient.TokenNamespace,
-			ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
-		}
-		return NewRemoteZanzanaClient(zanzanaConfig, reg)
+		return NewRemoteZanzanaClient(
+			fmt.Sprintf("stacks-%s", cfg.StackID),
+			ZanzanaClientConfig{
+				URL:              cfg.ZanzanaClient.Addr,
+				Token:            cfg.ZanzanaClient.Token,
+				TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
+				ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
+			})
 
 	case setting.ZanzanaModeEmbedded:
 		logger := log.New("zanzana.server")
@@ -100,33 +97,32 @@ func ProvideZanzanaClient(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, fea
 
 // ProvideStandaloneZanzanaClient provides a standalone Zanzana client, without registering the Zanzana service.
 // Client connects to a remote Zanzana server specified in the configuration.
-func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.FeatureToggles, reg prometheus.Registerer) (zanzana.Client, error) {
+func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.FeatureToggles) (zanzana.Client, error) {
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if !features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
 		return zClient.NewNoopClient(), nil
 	}
 
 	zanzanaConfig := ZanzanaClientConfig{
-		Addr:             cfg.ZanzanaClient.Addr,
+		URL:              cfg.ZanzanaClient.Addr,
 		Token:            cfg.ZanzanaClient.Token,
 		TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
-		TokenNamespace:   cfg.ZanzanaClient.TokenNamespace,
 		ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
 	}
 
-	return NewRemoteZanzanaClient(zanzanaConfig, reg)
+	return NewRemoteZanzanaClient(cfg.ZanzanaClient.TokenNamespace, zanzanaConfig)
 }
 
 type ZanzanaClientConfig struct {
-	Addr             string
+	URL              string
 	Token            string
 	TokenExchangeURL string
-	TokenNamespace   string
 	ServerCertFile   string
+	TokenNamespace   string
 }
 
 // NewRemoteZanzanaClient creates a new Zanzana client that connects to remote Zanzana server.
-func NewRemoteZanzanaClient(cfg ZanzanaClientConfig, reg prometheus.Registerer) (zanzana.Client, error) {
+func NewRemoteZanzanaClient(namespace string, cfg ZanzanaClientConfig) (zanzana.Client, error) {
 	tokenClient, err := authnlib.NewTokenExchangeClient(authnlib.TokenExchangeConfig{
 		Token:            cfg.Token,
 		TokenExchangeURL: cfg.TokenExchangeURL,
@@ -143,25 +139,18 @@ func NewRemoteZanzanaClient(cfg ZanzanaClientConfig, reg prometheus.Registerer)
 		}
 	}
 
-	authzRequestDuration := promauto.With(reg).NewHistogramVec(prometheus.HistogramOpts{
-		Name:                            "authz_zanzana_client_request_duration_seconds",
-		Help:                            "Time spent executing requests to zanzana server.",
-		NativeHistogramBucketFactor:     1.1,
-		NativeHistogramMaxBucketNumber:  160,
-		NativeHistogramMinResetDuration: time.Hour,
-	}, []string{"operation", "status_code"})
-	unaryInterceptors, streamInterceptors := instrument(authzRequestDuration, middleware.ReportGRPCStatusOption)
-
 	dialOptions := []grpc.DialOption{
 		grpc.WithTransportCredentials(transportCredentials),
 		grpc.WithPerRPCCredentials(
-			NewGRPCTokenAuth(AuthzServiceAudience, cfg.TokenNamespace, tokenClient),
+			NewGRPCTokenAuth(
+				AuthzServiceAudience,
+				namespace,
+				tokenClient,
+			),
 		),
-		grpc.WithChainUnaryInterceptor(unaryInterceptors...),
-		grpc.WithChainStreamInterceptor(streamInterceptors...),
 	}
 
-	conn, err := grpc.NewClient(cfg.Addr, dialOptions...)
+	conn, err := grpc.NewClient(cfg.URL, dialOptions...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create zanzana client to remote server: %w", err)
 	}

pkg/services/live/database/storage.go

@@ -0,0 +1,48 @@
+package database
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/localcache"
+	"github.com/grafana/grafana/pkg/services/live/model"
+)
+
+type Storage struct {
+	store db.DB
+	cache *localcache.CacheService
+}
+
+func NewStorage(store db.DB, cache *localcache.CacheService) *Storage {
+	return &Storage{store: store, cache: cache}
+}
+
+func getLiveMessageCacheKey(orgID int64, channel string) string {
+	return fmt.Sprintf("live_message_%d_%s", orgID, channel)
+}
+
+func (s *Storage) SaveLiveMessage(query *model.SaveLiveMessageQuery) error {
+	// Come back to saving into database after evaluating database structure.
+	s.cache.Set(getLiveMessageCacheKey(query.OrgID, query.Channel), model.LiveMessage{
+		ID:        0, // Not used actually.
+		OrgID:     query.OrgID,
+		Channel:   query.Channel,
+		Data:      query.Data,
+		Published: time.Now(),
+	}, 0)
+	return nil
+}
+
+func (s *Storage) GetLiveMessage(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
+	// Come back to saving into database after evaluating database structure.
+	m, ok := s.cache.Get(getLiveMessageCacheKey(query.OrgID, query.Channel))
+	if !ok {
+		return model.LiveMessage{}, false, nil
+	}
+	msg, ok := m.(model.LiveMessage)
+	if !ok {
+		return model.LiveMessage{}, false, fmt.Errorf("unexpected live message type in cache: %T", m)
+	}
+	return msg, true, nil
+}

pkg/services/live/database/tests/setup.go

@@ -0,0 +1,18 @@
+package tests
+
+import (
+	"testing"
+	"time"
+
+	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/localcache"
+	"github.com/grafana/grafana/pkg/services/live/database"
+)
+
+// SetupTestStorage initializes a storage to used by the integration tests.
+// This is required to properly register and execute migrations.
+func SetupTestStorage(t *testing.T) *database.Storage {
+	sqlStore := db.InitTestDB(t)
+	localCache := localcache.New(time.Hour, time.Hour)
+	return database.NewStorage(sqlStore, localCache)
+}

pkg/services/live/database/tests/storage_test.go

@@ -0,0 +1,67 @@
+package tests
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/services/live/model"
+	"github.com/grafana/grafana/pkg/tests/testsuite"
+	"github.com/grafana/grafana/pkg/util/testutil"
+)
+
+func TestMain(m *testing.M) {
+	testsuite.Run(m)
+}
+
+func TestIntegrationLiveMessage(t *testing.T) {
+	testutil.SkipIntegrationTestInShortMode(t)
+
+	storage := SetupTestStorage(t)
+
+	getQuery := &model.GetLiveMessageQuery{
+		OrgID:   1,
+		Channel: "test_channel",
+	}
+	_, ok, err := storage.GetLiveMessage(getQuery)
+	require.NoError(t, err)
+	require.False(t, ok)
+
+	saveQuery := &model.SaveLiveMessageQuery{
+		OrgID:   1,
+		Channel: "test_channel",
+		Data:    []byte(`{}`),
+	}
+	err = storage.SaveLiveMessage(saveQuery)
+	require.NoError(t, err)
+
+	msg, ok, err := storage.GetLiveMessage(getQuery)
+	require.NoError(t, err)
+	require.True(t, ok)
+	require.Equal(t, int64(1), msg.OrgID)
+	require.Equal(t, "test_channel", msg.Channel)
+	require.Equal(t, json.RawMessage(`{}`), msg.Data)
+	require.NotZero(t, msg.Published)
+
+	// try saving again, should be replaced.
+	saveQuery2 := &model.SaveLiveMessageQuery{
+		OrgID:   1,
+		Channel: "test_channel",
+		Data:    []byte(`{"input": "hello"}`),
+	}
+	err = storage.SaveLiveMessage(saveQuery2)
+	require.NoError(t, err)
+
+	getQuery2 := &model.GetLiveMessageQuery{
+		OrgID:   1,
+		Channel: "test_channel",
+	}
+	msg2, ok, err := storage.GetLiveMessage(getQuery2)
+	require.NoError(t, err)
+	require.True(t, ok)
+	require.Equal(t, int64(1), msg2.OrgID)
+	require.Equal(t, "test_channel", msg2.Channel)
+	require.Equal(t, json.RawMessage(`{"input": "hello"}`), msg2.Data)
+	require.NotZero(t, msg2.Published)
+}

pkg/services/live/features/broadcast.go

@@ -0,0 +1,70 @@
+package features
+
+import (
+	"context"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/services/live/model"
+)
+
+var (
+	logger = log.New("live.features") // scoped to all features?
+)
+
+//go:generate mockgen -destination=broadcast_mock.go -package=features github.com/grafana/grafana/pkg/services/live/features LiveMessageStore
+
+type LiveMessageStore interface {
+	SaveLiveMessage(query *model.SaveLiveMessageQuery) error
+	GetLiveMessage(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error)
+}
+
+// BroadcastRunner will simply broadcast all events to `grafana/broadcast/*` channels
+// This assumes that data is a JSON object
+type BroadcastRunner struct {
+	liveMessageStore LiveMessageStore
+}
+
+func NewBroadcastRunner(liveMessageStore LiveMessageStore) *BroadcastRunner {
+	return &BroadcastRunner{liveMessageStore: liveMessageStore}
+}
+
+// GetHandlerForPath called on init
+func (b *BroadcastRunner) GetHandlerForPath(_ string) (model.ChannelHandler, error) {
+	return b, nil // all dashboards share the same handler
+}
+
+// OnSubscribe will let anyone connect to the path
+func (b *BroadcastRunner) OnSubscribe(_ context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
+	reply := model.SubscribeReply{
+		Presence:  true,
+		JoinLeave: true,
+	}
+	query := &model.GetLiveMessageQuery{
+		OrgID:   u.GetOrgID(),
+		Channel: e.Channel,
+	}
+	msg, ok, err := b.liveMessageStore.GetLiveMessage(query)
+	if err != nil {
+		return model.SubscribeReply{}, 0, err
+	}
+	if ok {
+		reply.Data = msg.Data
+	}
+	return reply, backend.SubscribeStreamStatusOK, nil
+}
+
+// OnPublish is called when a client wants to broadcast on the websocket
+func (b *BroadcastRunner) OnPublish(_ context.Context, u identity.Requester, e model.PublishEvent) (model.PublishReply, backend.PublishStreamStatus, error) {
+	query := &model.SaveLiveMessageQuery{
+		OrgID:   u.GetOrgID(),
+		Channel: e.Channel,
+		Data:    e.Data,
+	}
+	if err := b.liveMessageStore.SaveLiveMessage(query); err != nil {
+		return model.PublishReply{}, 0, err
+	}
+	return model.PublishReply{Data: e.Data}, backend.PublishStreamStatusOK, nil
+}

pkg/services/live/features/broadcast_mock.go

@@ -0,0 +1,66 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/grafana/grafana/pkg/services/live/features (interfaces: LiveMessageStore)
+
+// Package features is a generated GoMock package.
+package features
+
+import (
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+
+	model "github.com/grafana/grafana/pkg/services/live/model"
+)
+
+// MockLiveMessageStore is a mock of LiveMessageStore interface.
+type MockLiveMessageStore struct {
+	ctrl     *gomock.Controller
+	recorder *MockLiveMessageStoreMockRecorder
+}
+
+// MockLiveMessageStoreMockRecorder is the mock recorder for MockLiveMessageStore.
+type MockLiveMessageStoreMockRecorder struct {
+	mock *MockLiveMessageStore
+}
+
+// NewMockLiveMessageStore creates a new mock instance.
+func NewMockLiveMessageStore(ctrl *gomock.Controller) *MockLiveMessageStore {
+	mock := &MockLiveMessageStore{ctrl: ctrl}
+	mock.recorder = &MockLiveMessageStoreMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLiveMessageStore) EXPECT() *MockLiveMessageStoreMockRecorder {
+	return m.recorder
+}
+
+// GetLiveMessage mocks base method.
+func (m *MockLiveMessageStore) GetLiveMessage(arg0 *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetLiveMessage", arg0)
+	ret0, _ := ret[0].(model.LiveMessage)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetLiveMessage indicates an expected call of GetLiveMessage.
+func (mr *MockLiveMessageStoreMockRecorder) GetLiveMessage(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLiveMessage", reflect.TypeOf((*MockLiveMessageStore)(nil).GetLiveMessage), arg0)
+}
+
+// SaveLiveMessage mocks base method.
+func (m *MockLiveMessageStore) SaveLiveMessage(arg0 *model.SaveLiveMessageQuery) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveLiveMessage", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveLiveMessage indicates an expected call of SaveLiveMessage.
+func (mr *MockLiveMessageStoreMockRecorder) SaveLiveMessage(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveLiveMessage", reflect.TypeOf((*MockLiveMessageStore)(nil).SaveLiveMessage), arg0)
+}

pkg/services/live/features/broadcast_test.go

@@ -0,0 +1,87 @@
+package features
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/services/live/model"
+	"github.com/grafana/grafana/pkg/services/user"
+)
+
+func TestNewBroadcastRunner(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	defer mockCtrl.Finish()
+	d := NewMockLiveMessageStore(mockCtrl)
+	br := NewBroadcastRunner(d)
+	require.NotNil(t, br)
+}
+
+func TestBroadcastRunner_OnSubscribe(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	defer mockCtrl.Finish()
+	mockDispatcher := NewMockLiveMessageStore(mockCtrl)
+
+	channel := "stream/channel/test"
+	data := json.RawMessage(`{}`)
+
+	mockDispatcher.EXPECT().GetLiveMessage(&model.GetLiveMessageQuery{
+		OrgID:   1,
+		Channel: channel,
+	}).DoAndReturn(func(query *model.GetLiveMessageQuery) (model.LiveMessage, bool, error) {
+		return model.LiveMessage{
+			Data: data,
+		}, true, nil
+	}).Times(1)
+
+	br := NewBroadcastRunner(mockDispatcher)
+	require.NotNil(t, br)
+	handler, err := br.GetHandlerForPath("test")
+	require.NoError(t, err)
+	reply, status, err := handler.OnSubscribe(
+		context.Background(),
+		&user.SignedInUser{OrgID: 1, UserID: 2},
+		model.SubscribeEvent{Channel: channel, Path: "test"},
+	)
+	require.NoError(t, err)
+	require.Equal(t, backend.SubscribeStreamStatusOK, status)
+	require.Equal(t, data, reply.Data)
+	require.True(t, reply.Presence)
+	require.True(t, reply.JoinLeave)
+	require.False(t, reply.Recover)
+}
+
+func TestBroadcastRunner_OnPublish(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	defer mockCtrl.Finish()
+	mockDispatcher := NewMockLiveMessageStore(mockCtrl)
+
+	channel := "stream/channel/test"
+	data := json.RawMessage(`{}`)
+	var orgID int64 = 1
+
+	mockDispatcher.EXPECT().SaveLiveMessage(&model.SaveLiveMessageQuery{
+		OrgID:   orgID,
+		Channel: channel,
+		Data:    data,
+	}).DoAndReturn(func(query *model.SaveLiveMessageQuery) error {
+		return nil
+	}).Times(1)
+
+	br := NewBroadcastRunner(mockDispatcher)
+	require.NotNil(t, br)
+	handler, err := br.GetHandlerForPath("test")
+	require.NoError(t, err)
+	reply, status, err := handler.OnPublish(
+		context.Background(),
+		&user.SignedInUser{OrgID: 1, UserID: 2},
+		model.PublishEvent{Channel: channel, Path: "test", Data: data},
+	)
+	require.NoError(t, err)
+	require.Equal(t, backend.PublishStreamStatusOK, status)
+	require.Equal(t, data, reply.Data)
+}

pkg/services/live/features/dashboard.go

@@ -7,8 +7,9 @@ import (
 	"strings"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
+	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/live/model"
@@ -34,6 +35,7 @@ type dashboardEvent struct {
 type DashboardHandler struct {
 	Publisher        model.ChannelPublisher
 	ClientCount      model.ChannelClientCount
+	Store            db.DB
 	DashboardService dashboards.DashboardService
 	AccessControl    accesscontrol.AccessControl
 }

pkg/services/live/features/plugin.go

@@ -5,11 +5,9 @@ import (
 	"errors"
 
 	"github.com/centrifugal/centrifuge"
-
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/live/model"
 	"github.com/grafana/grafana/pkg/services/live/orgchannel"

pkg/services/live/live.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/centrifugal/centrifuge"
 	"github.com/gobwas/glob"
+	jsoniter "github.com/json-iterator/go"
 	"github.com/redis/go-redis/v9"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
@@ -24,9 +25,12 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana-plugin-sdk-go/live"
+	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/usagestats"
@@ -39,6 +43,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/live/database"
 	"github.com/grafana/grafana/pkg/services/live/features"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/liveplugin"
@@ -52,6 +57,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/plugincontext"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
+	"github.com/grafana/grafana/pkg/services/query"
 	"github.com/grafana/grafana/pkg/services/secrets"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util"
@@ -74,8 +80,8 @@ type CoreGrafanaScope struct {
 
 func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, routeRegister routing.RouteRegister,
 	pluginStore pluginstore.Store, pluginClient plugins.Client, cacheService *localcache.CacheService,
-	dataSourceCache datasources.CacheService, secretsService secrets.Service,
-	usageStatsService usagestats.Service, toggles featuremgmt.FeatureToggles,
+	dataSourceCache datasources.CacheService, sqlStore db.DB, secretsService secrets.Service,
+	usageStatsService usagestats.Service, queryDataService query.Service, toggles featuremgmt.FeatureToggles,
 	accessControl accesscontrol.AccessControl, dashboardService dashboards.DashboardService,
 	orgService org.Service, configProvider apiserver.RestConfigProvider) (*GrafanaLive, error) {
 	g := &GrafanaLive{
@@ -87,7 +93,9 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 		pluginClient:          pluginClient,
 		CacheService:          cacheService,
 		DataSourceCache:       dataSourceCache,
+		SQLStore:              sqlStore,
 		SecretsService:        secretsService,
+		queryDataService:      queryDataService,
 		channels:              make(map[string]model.ChannelHandler),
 		GrafanaScope: CoreGrafanaScope{
 			Features: make(map[string]model.ChannelHandlerFactory),
@@ -178,11 +186,14 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 	dash := &features.DashboardHandler{
 		Publisher:        g.Publish,
 		ClientCount:      g.ClientCount,
+		Store:            sqlStore,
 		DashboardService: dashboardService,
 		AccessControl:    accessControl,
 	}
+	g.storage = database.NewStorage(g.SQLStore, g.CacheService)
 	g.GrafanaScope.Dashboards = dash
 	g.GrafanaScope.Features["dashboard"] = dash
+	g.GrafanaScope.Features["broadcast"] = features.NewBroadcastRunner(g.storage)
 
 	// Testing watch with just the provisioning support -- this will be removed when it is well validated
 	//nolint:staticcheck // not yet migrated to OpenFeature
@@ -377,14 +388,14 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 			UserID: strconv.FormatInt(id, 10),
 		}
 		newCtx := centrifuge.SetCredentials(ctx.Req.Context(), cred)
-		newCtx = identity.WithRequester(newCtx, user)
+		newCtx = livecontext.SetContextSignedUser(newCtx, user)
 		r := ctx.Req.WithContext(newCtx)
 		wsHandler.ServeHTTP(ctx.Resp, r)
 	}
 
 	g.pushWebsocketHandler = func(ctx *contextmodel.ReqContext) {
 		user := ctx.SignedInUser
-		newCtx := identity.WithRequester(ctx.Req.Context(), user)
+		newCtx := livecontext.SetContextSignedUser(ctx.Req.Context(), user)
 		newCtx = livecontext.SetContextStreamID(newCtx, web.Params(ctx.Req)[":streamId"])
 		r := ctx.Req.WithContext(newCtx)
 		pushWSHandler.ServeHTTP(ctx.Resp, r)
@@ -392,7 +403,7 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 
 	g.pushPipelineWebsocketHandler = func(ctx *contextmodel.ReqContext) {
 		user := ctx.SignedInUser
-		newCtx := identity.WithRequester(ctx.Req.Context(), user)
+		newCtx := livecontext.SetContextSignedUser(ctx.Req.Context(), user)
 		newCtx = livecontext.SetContextChannelID(newCtx, web.Params(ctx.Req)["*"])
 		r := ctx.Req.WithContext(newCtx)
 		pushPipelineWSHandler.ServeHTTP(ctx.Resp, r)
@@ -464,12 +475,14 @@ type GrafanaLive struct {
 	RouteRegister         routing.RouteRegister
 	CacheService          *localcache.CacheService
 	DataSourceCache       datasources.CacheService
+	SQLStore              db.DB
 	SecretsService        secrets.Service
 	pluginStore           pluginstore.Store
 	pluginClient          plugins.Client
+	queryDataService      query.Service
 	orgService            org.Service
 
-	keyPrefix string // HA prefix for grafana cloud (since the org is always 1)
+	keyPrefix string
 
 	node         *centrifuge.Node
 	surveyCaller *survey.Caller
@@ -492,6 +505,7 @@ type GrafanaLive struct {
 
 	contextGetter    *liveplugin.ContextGetter
 	runStreamManager *runstream.Manager
+	storage          *database.Storage
 
 	usageStatsService usagestats.Service
 	usageStats        usageStats
@@ -659,13 +673,18 @@ func (g *GrafanaLive) HandleDatasourceUpdate(orgID int64, dsUID string) {
 	}
 }
 
+// Use a configuration that's compatible with the standard library
+// to minimize the risk of introducing bugs. This will make sure
+// that map keys is ordered.
+var jsonStd = jsoniter.ConfigCompatibleWithStandardLibrary
+
 func (g *GrafanaLive) handleOnRPC(clientContextWithSpan context.Context, client *centrifuge.Client, e centrifuge.RPCEvent) (centrifuge.RPCReply, error) {
 	logger.Debug("Client calls RPC", "user", client.UserID(), "client", client.ID(), "method", e.Method)
 	if e.Method != "grafana.query" {
 		return centrifuge.RPCReply{}, centrifuge.ErrorMethodNotFound
 	}
-	user, err := identity.GetRequester(clientContextWithSpan)
-	if err != nil {
+	user, ok := livecontext.GetContextSignedUser(clientContextWithSpan)
+	if !ok {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "method", e.Method)
 		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
 	}
@@ -675,15 +694,38 @@ func (g *GrafanaLive) handleOnRPC(clientContextWithSpan context.Context, client
 		return centrifuge.RPCReply{}, centrifuge.ErrorExpired
 	}
 
-	// RPC events not available
-	return centrifuge.RPCReply{}, centrifuge.ErrorNotAvailable
+	var req dtos.MetricRequest
+	err := json.Unmarshal(e.Data, &req)
+	if err != nil {
+		return centrifuge.RPCReply{}, centrifuge.ErrorBadRequest
+	}
+	resp, err := g.queryDataService.QueryData(clientContextWithSpan, user, false, req)
+	if err != nil {
+		logger.Error("Error query data", "user", client.UserID(), "client", client.ID(), "method", e.Method, "error", err)
+		if errors.Is(err, datasources.ErrDataSourceAccessDenied) {
+			return centrifuge.RPCReply{}, &centrifuge.Error{Code: uint32(http.StatusForbidden), Message: http.StatusText(http.StatusForbidden)}
+		}
+		var gfErr errutil.Error
+		if errors.As(err, &gfErr) && gfErr.Reason.Status() == errutil.StatusBadRequest {
+			return centrifuge.RPCReply{}, &centrifuge.Error{Code: uint32(http.StatusBadRequest), Message: http.StatusText(http.StatusBadRequest)}
+		}
+		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
+	}
+	data, err := jsonStd.Marshal(resp)
+	if err != nil {
+		logger.Error("Error marshaling query response", "user", client.UserID(), "client", client.ID(), "method", e.Method, "error", err)
+		return centrifuge.RPCReply{}, centrifuge.ErrorInternal
+	}
+	return centrifuge.RPCReply{
+		Data: data,
+	}, nil
 }
 
 func (g *GrafanaLive) handleOnSubscribe(clientContextWithSpan context.Context, client *centrifuge.Client, e centrifuge.SubscribeEvent) (centrifuge.SubscribeReply, error) {
 	logger.Debug("Client wants to subscribe", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 
-	user, err := identity.GetRequester(clientContextWithSpan)
-	if err != nil {
+	user, ok := livecontext.GetContextSignedUser(clientContextWithSpan)
+	if !ok {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 		return centrifuge.SubscribeReply{}, centrifuge.ErrorInternal
 	}
@@ -788,8 +830,8 @@ func (g *GrafanaLive) handleOnSubscribe(clientContextWithSpan context.Context, c
 func (g *GrafanaLive) handleOnPublish(clientCtxWithSpan context.Context, client *centrifuge.Client, e centrifuge.PublishEvent) (centrifuge.PublishReply, error) {
 	logger.Debug("Client wants to publish", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 
-	user, err := identity.GetRequester(clientCtxWithSpan)
-	if err != nil {
+	user, ok := livecontext.GetContextSignedUser(clientCtxWithSpan)
+	if !ok {
 		logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "channel", e.Channel)
 		return centrifuge.PublishReply{}, centrifuge.ErrorInternal
 	}
@@ -1041,7 +1083,7 @@ func (g *GrafanaLive) ClientCount(orgID int64, channel string) (int, error) {
 }
 
 func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.Response {
-	cmd := model.LivePublishCmd{}
+	cmd := dtos.LivePublishCmd{}
 	if err := web.Bind(ctx.Req, &cmd); err != nil {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
@@ -1080,7 +1122,7 @@ func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.R
 				logger.Error("Error processing input", "user", user, "channel", channel, "error", err)
 				return response.Error(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError), nil)
 			}
-			return response.JSON(http.StatusOK, model.LivePublishResponse{})
+			return response.JSON(http.StatusOK, dtos.LivePublishResponse{})
 		}
 	}
 
@@ -1108,7 +1150,7 @@ func (g *GrafanaLive) HandleHTTPPublish(ctx *contextmodel.ReqContext) response.R
 		}
 	}
 	logger.Debug("Publication successful", "identity", ctx.GetID(), "channel", cmd.Channel)
-	return response.JSON(http.StatusOK, model.LivePublishResponse{})
+	return response.JSON(http.StatusOK, dtos.LivePublishResponse{})
 }
 
 type streamChannelListResponse struct {

pkg/services/live/live_test.go

@@ -11,17 +11,20 @@ import (
 	"testing"
 	"time"
 
-	"github.com/centrifugal/centrifuge"
 	"github.com/go-jose/go-jose/v4"
 	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/stretchr/testify/require"
 
+	"github.com/centrifugal/centrifuge"
+
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/usagestats"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tests/testsuite"
 	"github.com/grafana/grafana/pkg/util/testutil"
@@ -242,7 +245,7 @@ func Test_handleOnPublish_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnPublish(ctx, client, centrifuge.PublishEvent{
 			Channel: "test",
 			Data:    []byte("test"),
@@ -254,7 +257,7 @@ func Test_handleOnPublish_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnPublish(ctx, client, centrifuge.PublishEvent{
 			Channel: "test",
 			Data:    []byte("test"),
@@ -277,7 +280,7 @@ func Test_handleOnRPC_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnRPC(ctx, client, centrifuge.RPCEvent{
 			Method: "grafana.query",
 			Data:   []byte("test"),
@@ -289,7 +292,7 @@ func Test_handleOnRPC_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnRPC(ctx, client, centrifuge.RPCEvent{
 			Method: "grafana.query",
 			Data:   []byte("test"),
@@ -312,7 +315,7 @@ func Test_handleOnSubscribe_IDTokenExpiration(t *testing.T) {
 	t.Run("expired token", func(t *testing.T) {
 		expiration := time.Now().Add(-time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnSubscribe(ctx, client, centrifuge.SubscribeEvent{
 			Channel: "test",
 		})
@@ -323,7 +326,7 @@ func Test_handleOnSubscribe_IDTokenExpiration(t *testing.T) {
 	t.Run("unexpired token", func(t *testing.T) {
 		expiration := time.Now().Add(time.Hour)
 		token := createToken(t, &expiration)
-		ctx := identity.WithRequester(context.Background(), &identity.StaticRequester{IDToken: token})
+		ctx := livecontext.SetContextSignedUser(context.Background(), &identity.StaticRequester{IDToken: token})
 		reply, err := g.handleOnSubscribe(ctx, client, centrifuge.SubscribeEvent{
 			Channel: "test",
 		})
@@ -344,8 +347,10 @@ func setupLiveService(cfg *setting.Cfg, t *testing.T) (*GrafanaLive, error) {
 		cfg,
 		routing.NewRouteRegister(),
 		nil, nil, nil, nil,
+		db.InitTestDB(t),
 		nil,
 		&usagestats.UsageStatsMock{T: t},
+		nil,
 		featuremgmt.WithFeatures(),
 		acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		&dashboards.FakeDashboardService{},
@@ -356,12 +361,7 @@ type dummyTransport struct {
 	name string
 }
 
-var (
-	_ centrifuge.Transport = (*dummyTransport)(nil)
-)
-
 func (t *dummyTransport) Name() string                      { return t.name }
-func (t *dummyTransport) AcceptProtocol() string            { return "" }
 func (t *dummyTransport) Protocol() centrifuge.ProtocolType { return centrifuge.ProtocolTypeJSON }
 func (t *dummyTransport) ProtocolVersion() centrifuge.ProtocolVersion {
 	return centrifuge.ProtocolVersion2

pkg/services/live/livecontext/context.go

@@ -2,8 +2,27 @@ package livecontext
 
 import (
 	"context"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 )
 
+type signedUserContextKeyType int
+
+var signedUserContextKey signedUserContextKeyType
+
+func SetContextSignedUser(ctx context.Context, user identity.Requester) context.Context {
+	ctx = context.WithValue(ctx, signedUserContextKey, user)
+	return ctx
+}
+
+func GetContextSignedUser(ctx context.Context) (identity.Requester, bool) {
+	if val := ctx.Value(signedUserContextKey); val != nil {
+		user, ok := val.(identity.Requester)
+		return user, ok
+	}
+	return nil, false
+}
+
 type streamIDContextKey struct{}
 
 func SetContextStreamID(ctx context.Context, streamID string) context.Context {

pkg/services/live/model/model.go

@@ -67,9 +67,21 @@ type ChannelHandlerFactory interface {
 	GetHandlerForPath(path string) (ChannelHandler, error)
 }
 
-type LivePublishCmd struct {
-	Channel string          `json:"channel"`
-	Data    json.RawMessage `json:"data,omitempty"`
+type LiveMessage struct {
+	ID        int64 `xorm:"pk autoincr 'id'"`
+	OrgID     int64 `xorm:"org_id"`
+	Channel   string
+	Data      json.RawMessage
+	Published time.Time
 }
 
-type LivePublishResponse struct{}
+type SaveLiveMessageQuery struct {
+	OrgID   int64 `xorm:"org_id"`
+	Channel string
+	Data    json.RawMessage
+}
+
+type GetLiveMessageQuery struct {
+	OrgID   int64 `xorm:"org_id"`
+	Channel string
+}

pkg/services/live/pipeline/data_output_builtin.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 
@@ -25,8 +25,8 @@ func (s *BuiltinDataOutput) Type() string {
 }
 
 func (s *BuiltinDataOutput) OutputData(ctx context.Context, vars Vars, data []byte) ([]*ChannelData, error) {
-	u, err := identity.GetRequester(ctx)
-	if err != nil {
+	u, ok := livecontext.GetContextSignedUser(ctx)
+	if !ok {
 		return nil, errors.New("user not found in context")
 	}
 	handler, _, err := s.channelHandlerGetter.GetChannelHandler(ctx, u, vars.Channel)

pkg/services/live/pipeline/subscribe_builtin.go

@@ -7,6 +7,7 @@ import (
 	"github.com/grafana/grafana-plugin-sdk-go/live"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 
@@ -29,8 +30,8 @@ func (s *BuiltinSubscriber) Type() string {
 }
 
 func (s *BuiltinSubscriber) Subscribe(ctx context.Context, vars Vars, data []byte) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
-	u, err := identity.GetRequester(ctx)
-	if err != nil {
+	u, ok := livecontext.GetContextSignedUser(ctx)
+	if !ok {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, nil
 	}
 	handler, _, err := s.channelHandlerGetter.GetChannelHandler(ctx, u, vars.Channel)

pkg/services/live/pipeline/subscribe_managed_stream.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/managedstream"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
@@ -30,8 +30,8 @@ func (s *ManagedStreamSubscriber) Subscribe(ctx context.Context, vars Vars, _ []
 		logger.Error("Error getting managed stream", "error", err)
 		return model.SubscribeReply{}, 0, err
 	}
-	u, err := identity.GetRequester(ctx)
-	if err != nil {
+	u, ok := livecontext.GetContextSignedUser(ctx)
+	if !ok {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, nil
 	}
 	return stream.OnSubscribe(ctx, u, model.SubscribeEvent{

pkg/services/live/pipeline/subscribe_multiple.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
+
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 

pkg/services/live/pushws/push_pipeline.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/live/convert"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/pipeline"
@@ -45,8 +44,8 @@ func (s *PipelinePushHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	user, err := identity.GetRequester(r.Context())
-	if err != nil {
+	user, ok := livecontext.GetContextSignedUser(r.Context())
+	if !ok {
 		logger.Error("No user found in context")
 		rw.WriteHeader(http.StatusInternalServerError)
 		return

pkg/services/live/pushws/push_stream.go

@@ -5,9 +5,8 @@ import (
 	"time"
 
 	"github.com/gorilla/websocket"
-
 	liveDto "github.com/grafana/grafana-plugin-sdk-go/live"
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
+
 	"github.com/grafana/grafana/pkg/services/live/convert"
 	"github.com/grafana/grafana/pkg/services/live/livecontext"
 	"github.com/grafana/grafana/pkg/services/live/managedstream"
@@ -48,8 +47,8 @@ func (s *Handler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	user, err := identity.GetRequester(r.Context())
-	if err != nil {
+	user, ok := livecontext.GetContextSignedUser(r.Context())
+	if !ok {
 		logger.Error("No user found in context")
 		rw.WriteHeader(http.StatusInternalServerError)
 		return

pkg/services/setting/service.go

@@ -2,26 +2,27 @@ package setting
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"time"
 
+	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/trace"
 	"gopkg.in/ini.v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/runtime/serializer"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
 	"k8s.io/apiserver/pkg/endpoints/request"
-	"k8s.io/client-go/rest"
+	"k8s.io/client-go/dynamic"
+	clientrest "k8s.io/client-go/rest"
 	"k8s.io/client-go/transport"
 
 	authlib "github.com/grafana/authlib/authn"
 	logging "github.com/grafana/grafana/pkg/infra/log"
-	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/semconv"
 )
 
@@ -37,11 +38,18 @@ const (
 	ApiGroup   = "setting.grafana.app"
 	apiVersion = "v0alpha1"
 	resource   = "settings"
+	kind       = "Setting"
+	listKind   = "SettingList"
 )
 
-var settingGroupVersion = schema.GroupVersion{
-	Group:   ApiGroup,
-	Version: apiVersion,
+var settingGroupVersion = schema.GroupVersionResource{
+	Group:    ApiGroup,
+	Version:  apiVersion,
+	Resource: resource,
+}
+
+var settingGroupListKind = map[schema.GroupVersionResource]string{
+	settingGroupVersion: listKind,
 }
 
 type remoteSettingServiceMetrics struct {
@@ -98,10 +106,10 @@ type Service interface {
 }
 
 type remoteSettingService struct {
-	restClient *rest.RESTClient
-	log        logging.Logger
-	pageSize   int64
-	metrics    remoteSettingServiceMetrics
+	dynamicClient dynamic.Interface
+	log           logging.Logger
+	pageSize      int64
+	metrics       remoteSettingServiceMetrics
 }
 
 var _ Service = (*remoteSettingService)(nil)
@@ -118,7 +126,7 @@ type Config struct {
 	// At least one of WrapTransport or TokenExchangeClient is required.
 	WrapTransport transport.WrapperFunc
 	// TLSClientConfig configures TLS for the client connection.
-	TLSClientConfig rest.TLSClientConfig
+	TLSClientConfig clientrest.TLSClientConfig
 	// QPS limits requests per second (defaults to DefaultQPS).
 	QPS float32
 	// Burst allows request bursts above QPS (defaults to DefaultBurst).
@@ -137,39 +145,29 @@ type Setting struct {
 	Value string `json:"value"`
 }
 
-// settingResource represents a single Setting resource from the K8s API.
-type settingResource struct {
-	Spec Setting `json:"spec"`
-}
-
-// settingListMetadata contains pagination info from the K8s list response.
-type settingListMetadata struct {
-	Continue string `json:"continue,omitempty"`
-}
-
 // New creates a Service from the provided configuration.
 func New(config Config) (Service, error) {
 	log := logging.New(LogPrefix)
-
-	restClient, err := getRestClient(config, log)
+	dynamicClient, err := getDynamicClient(config, log)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create REST client: %w", err)
+		return nil, err
 	}
-
 	pageSize := DefaultPageSize
 	if config.PageSize > 0 {
 		pageSize = config.PageSize
 	}
 
+	metrics := initMetrics()
+
 	return &remoteSettingService{
-		restClient: restClient,
-		log:        log,
-		pageSize:   pageSize,
-		metrics:    initMetrics(),
+		dynamicClient: dynamicClient,
+		pageSize:      pageSize,
+		log:           log,
+		metrics:       metrics,
 	}, nil
 }
 
-func (s *remoteSettingService) ListAsIni(ctx context.Context, labelSelector metav1.LabelSelector) (*ini.File, error) {
+func (m *remoteSettingService) ListAsIni(ctx context.Context, labelSelector metav1.LabelSelector) (*ini.File, error) {
 	namespace, ok := request.NamespaceFrom(ctx)
 	ns := semconv.GrafanaNamespaceName(namespace)
 	ctx, span := tracer.Start(ctx, "remoteSettingService.ListAsIni",
@@ -180,34 +178,33 @@ func (s *remoteSettingService) ListAsIni(ctx context.Context, labelSelector meta
 		return nil, tracing.Errorf(span, "missing namespace in context")
 	}
 
-	settings, err := s.List(ctx, labelSelector)
+	settings, err := m.List(ctx, labelSelector)
 	if err != nil {
 		return nil, err
 	}
-	iniFile, err := toIni(settings)
+	iniFile, err := m.toIni(settings)
 	if err != nil {
 		return nil, tracing.Error(span, err)
 	}
 	return iniFile, nil
 }
 
-func (s *remoteSettingService) List(ctx context.Context, labelSelector metav1.LabelSelector) ([]*Setting, error) {
+func (m *remoteSettingService) List(ctx context.Context, labelSelector metav1.LabelSelector) ([]*Setting, error) {
 	namespace, ok := request.NamespaceFrom(ctx)
 	ns := semconv.GrafanaNamespaceName(namespace)
 	ctx, span := tracer.Start(ctx, "remoteSettingService.List",
 		trace.WithAttributes(ns))
 	defer span.End()
-
 	if !ok || namespace == "" {
 		return nil, tracing.Errorf(span, "missing namespace in context")
 	}
-	log := s.log.FromContext(ctx).New(ns.Key, ns.Value, "function", "remoteSettingService.List", "traceId", span.SpanContext().TraceID())
+	log := m.log.FromContext(ctx).New(ns.Key, ns.Value, "function", "remoteSettingService.List", "traceId", span.SpanContext().TraceID())
 
 	startTime := time.Now()
 	var status string
 	defer func() {
 		duration := time.Since(startTime).Seconds()
-		s.metrics.listDuration.WithLabelValues(status).Observe(duration)
+		m.metrics.listDuration.WithLabelValues(status).Observe(duration)
 	}()
 
 	selector, err := metav1.LabelSelectorAsSelector(&labelSelector)
@@ -219,142 +216,64 @@ func (s *remoteSettingService) List(ctx context.Context, labelSelector metav1.La
 		log.Debug("empty selector. Fetching all settings")
 	}
 
-	// Pre-allocate with estimated capacity
-	allSettings := make([]*Setting, 0, s.pageSize*8)
+	var allSettings []*Setting
 	var continueToken string
 	hasNext := true
 	totalPages := 0
 	// Using an upper limit to prevent infinite loops
 	for hasNext && totalPages < 1000 {
 		totalPages++
+		opts := metav1.ListOptions{
+			Limit:    m.pageSize,
+			Continue: continueToken,
+		}
+		if !selector.Empty() {
+			opts.LabelSelector = selector.String()
+		}
 
-		settings, nextToken, lErr := s.fetchPage(ctx, namespace, selector.String(), continueToken)
+		settingsList, lErr := m.dynamicClient.Resource(settingGroupVersion).Namespace(namespace).List(ctx, opts)
 		if lErr != nil {
 			status = "error"
 			return nil, tracing.Error(span, lErr)
 		}
-
-		allSettings = append(allSettings, settings...)
-		continueToken = nextToken
+		for i := range settingsList.Items {
+			setting, pErr := parseSettingResource(&settingsList.Items[i])
+			if pErr != nil {
+				status = "error"
+				return nil, tracing.Error(span, pErr)
+			}
+			allSettings = append(allSettings, setting)
+		}
+		continueToken = settingsList.GetContinue()
 		if continueToken == "" {
 			hasNext = false
 		}
 	}
 
 	status = "success"
-	s.metrics.listResultSize.WithLabelValues(status).Observe(float64(len(allSettings)))
+	m.metrics.listResultSize.WithLabelValues(status).Observe(float64(len(allSettings)))
 
 	return allSettings, nil
 }
 
-func (s *remoteSettingService) fetchPage(ctx context.Context, namespace, labelSelector, continueToken string) ([]*Setting, string, error) {
-	req := s.restClient.Get().
-		Resource(resource).
-		Namespace(namespace).
-		Param("limit", fmt.Sprintf("%d", s.pageSize))
-
-	if labelSelector != "" {
-		req = req.Param("labelSelector", labelSelector)
-	}
-	if continueToken != "" {
-		req = req.Param("continue", continueToken)
-	}
-
-	stream, err := req.Stream(ctx)
+func parseSettingResource(setting *unstructured.Unstructured) (*Setting, error) {
+	spec, found, err := unstructured.NestedMap(setting.Object, "spec")
 	if err != nil {
-		return nil, "", fmt.Errorf("request failed: %w", err)
+		return nil, fmt.Errorf("failed to get spec from setting: %w", err)
+	}
+	if !found {
+		return nil, fmt.Errorf("spec not found in setting %s", setting.GetName())
 	}
-	defer func() { _ = stream.Close() }()
 
-	return parseSettingList(stream)
+	var result Setting
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(spec, &result); err != nil {
+		return nil, fmt.Errorf("failed to convert spec to Setting: %w", err)
+	}
+
+	return &result, nil
 }
 
-// parseSettingList parses a SettingList JSON response using token-by-token streaming.
-func parseSettingList(r io.Reader) ([]*Setting, string, error) {
-	decoder := json.NewDecoder(r)
-	// Currently, first page may have a large number of items.
-	settings := make([]*Setting, 0, 1600)
-	var continueToken string
-
-	// Skip to the start of the object
-	if _, err := decoder.Token(); err != nil {
-		return nil, "", fmt.Errorf("expected start of object: %w", err)
-	}
-
-	for decoder.More() {
-		// Read field name
-		tok, err := decoder.Token()
-		if err != nil {
-			return nil, "", fmt.Errorf("failed to read field name: %w", err)
-		}
-
-		fieldName, ok := tok.(string)
-		if !ok {
-			continue
-		}
-
-		switch fieldName {
-		case "metadata":
-			var meta settingListMetadata
-			if err := decoder.Decode(&meta); err != nil {
-				return nil, "", fmt.Errorf("failed to decode metadata: %w", err)
-			}
-			continueToken = meta.Continue
-
-		case "items":
-			// Parse items array token-by-token
-			itemSettings, err := parseItems(decoder)
-			if err != nil {
-				return nil, "", err
-			}
-			settings = append(settings, itemSettings...)
-
-		default:
-			// Skip unknown fields
-			var skip json.RawMessage
-			if err := decoder.Decode(&skip); err != nil {
-				return nil, "", fmt.Errorf("failed to skip field %s: %w", fieldName, err)
-			}
-		}
-	}
-
-	return settings, continueToken, nil
-}
-
-func parseItems(decoder *json.Decoder) ([]*Setting, error) {
-	// Expect start of array
-	tok, err := decoder.Token()
-	if err != nil {
-		return nil, fmt.Errorf("expected start of items array: %w", err)
-	}
-	if tok != json.Delim('[') {
-		return nil, fmt.Errorf("expected '[', got %v", tok)
-	}
-
-	settings := make([]*Setting, 0, DefaultPageSize)
-
-	// Parse each item
-	for decoder.More() {
-		var item settingResource
-		if err := decoder.Decode(&item); err != nil {
-			return nil, fmt.Errorf("failed to decode setting item: %w", err)
-		}
-		settings = append(settings, &Setting{
-			Section: item.Spec.Section,
-			Key:     item.Spec.Key,
-			Value:   item.Spec.Value,
-		})
-	}
-
-	// Consume end of array
-	if _, err := decoder.Token(); err != nil {
-		return nil, fmt.Errorf("expected end of items array: %w", err)
-	}
-
-	return settings, nil
-}
-
-func toIni(settings []*Setting) (*ini.File, error) {
+func (m *remoteSettingService) toIni(settings []*Setting) (*ini.File, error) {
 	conf := ini.Empty()
 	for _, setting := range settings {
 		if !conf.HasSection(setting.Section) {
@@ -368,7 +287,7 @@ func toIni(settings []*Setting) (*ini.File, error) {
 	return conf, nil
 }
 
-func getRestClient(config Config, log logging.Logger) (*rest.RESTClient, error) {
+func getDynamicClient(config Config, log logging.Logger) (dynamic.Interface, error) {
 	if config.URL == "" {
 		return nil, fmt.Errorf("URL cannot be empty")
 	}
@@ -377,7 +296,7 @@ func getRestClient(config Config, log logging.Logger) (*rest.RESTClient, error)
 	}
 
 	wrapTransport := config.WrapTransport
-	if wrapTransport == nil {
+	if config.WrapTransport == nil {
 		log.Debug("using default wrapTransport with TokenExchangeClient")
 		wrapTransport = func(rt http.RoundTripper) http.RoundTripper {
 			return &authRoundTripper{
@@ -397,21 +316,13 @@ func getRestClient(config Config, log logging.Logger) (*rest.RESTClient, error)
 		burst = config.Burst
 	}
 
-	restConfig := &rest.Config{
+	return dynamic.NewForConfig(&clientrest.Config{
 		Host:            config.URL,
-		TLSClientConfig: config.TLSClientConfig,
 		WrapTransport:   wrapTransport,
+		TLSClientConfig: config.TLSClientConfig,
 		QPS:             qps,
 		Burst:           burst,
-		// Configure for our API group
-		APIPath: "/apis",
-		ContentConfig: rest.ContentConfig{
-			GroupVersion:         &settingGroupVersion,
-			NegotiatedSerializer: serializer.NewCodecFactory(nil).WithoutConversion(),
-		},
-	}
-
-	return rest.RESTClientFor(restConfig)
+	})
 }
 
 // authRoundTripper wraps an HTTP transport with token-based authentication.
@@ -430,9 +341,10 @@ func (a *authRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	if err != nil {
 		return nil, fmt.Errorf("failed to exchange token: %w", err)
 	}
-	reqCopy := req.Clone(req.Context())
-	reqCopy.Header.Set("X-Access-Token", fmt.Sprintf("Bearer %s", token.Token))
-	return a.transport.RoundTrip(reqCopy)
+	req = utilnet.CloneRequest(req)
+
+	req.Header.Set("X-Access-Token", fmt.Sprintf("Bearer %s", token.Token))
+	return a.transport.RoundTrip(req)
 }
 
 func initMetrics() remoteSettingServiceMetrics {
@@ -461,12 +373,12 @@ func initMetrics() remoteSettingServiceMetrics {
 	return metrics
 }
 
-func (s *remoteSettingService) Describe(descs chan<- *prometheus.Desc) {
-	s.metrics.listDuration.Describe(descs)
-	s.metrics.listResultSize.Describe(descs)
+func (m *remoteSettingService) Describe(descs chan<- *prometheus.Desc) {
+	m.metrics.listDuration.Describe(descs)
+	m.metrics.listResultSize.Describe(descs)
 }
 
-func (s *remoteSettingService) Collect(metrics chan<- prometheus.Metric) {
-	s.metrics.listDuration.Collect(metrics)
-	s.metrics.listResultSize.Collect(metrics)
+func (m *remoteSettingService) Collect(metrics chan<- prometheus.Metric) {
+	m.metrics.listDuration.Collect(metrics)
+	m.metrics.listResultSize.Collect(metrics)
 }

pkg/services/setting/service_test.go

@@ -1,36 +1,69 @@
 package setting
 
 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/endpoints/request"
+	"k8s.io/client-go/dynamic/fake"
+	k8testing "k8s.io/client-go/testing"
+
+	authlib "github.com/grafana/authlib/authn"
+	"github.com/grafana/grafana/pkg/infra/log"
 )
 
 func TestRemoteSettingService_ListAsIni(t *testing.T) {
-	t.Run("should return all settings with empty selector", func(t *testing.T) {
-		settings := []Setting{
-			{Section: "server", Key: "port", Value: "3000"},
-			{Section: "database", Key: "type", Value: "mysql"},
+	t.Run("should filter settings by label selector", func(t *testing.T) {
+		// Create multiple settings, only some matching the selector
+		setting1 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "postgres"})
+		setting2 := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
+		setting3 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "host", Value: "localhost"})
+
+		client := newTestClient(500, setting1, setting2, setting3)
+
+		// Create a selector that should match only database settings
+		selector := metav1.LabelSelector{
+			MatchLabels: map[string]string{
+				"section": "database",
+			},
 		}
-		server := newTestServer(t, settings, "")
-		defer server.Close()
 
-		client := newTestClient(t, server.URL, 500)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
-
-		result, err := client.ListAsIni(ctx, metav1.LabelSelector{})
+		result, err := client.ListAsIni(ctx, selector)
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
+		// Should only have database settings, not server settings
+		assert.True(t, result.HasSection("database"))
+		assert.Equal(t, "postgres", result.Section("database").Key("type").String())
+		assert.Equal(t, "localhost", result.Section("database").Key("host").String())
+		// Should NOT have server settings
+		assert.False(t, result.HasSection("server"))
+	})
+
+	t.Run("should return all settings with empty selector", func(t *testing.T) {
+		// Create multiple settings across different sections
+		setting1 := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
+		setting2 := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "mysql"})
+
+		client := newTestClient(500, setting1, setting2)
+
+		// Empty selector should select everything
+		selector := metav1.LabelSelector{}
+
+		ctx := request.WithNamespace(context.Background(), "test-namespace")
+		result, err := client.ListAsIni(ctx, selector)
+
+		require.NoError(t, err)
+		assert.NotNil(t, result)
+		// Should have all settings from all sections
 		assert.True(t, result.HasSection("server"))
 		assert.Equal(t, "3000", result.Section("server").Key("port").String())
 		assert.True(t, result.HasSection("database"))
@@ -40,168 +73,209 @@ func TestRemoteSettingService_ListAsIni(t *testing.T) {
 
 func TestRemoteSettingService_List(t *testing.T) {
 	t.Run("should handle single page response", func(t *testing.T) {
-		settings := []Setting{
-			{Section: "server", Key: "port", Value: "3000"},
-		}
-		server := newTestServer(t, settings, "")
-		defer server.Close()
+		setting := newUnstructuredSetting("test-namespace", Setting{Section: "server", Key: "port", Value: "3000"})
+
+		client := newTestClient(500, setting)
 
-		client := newTestClient(t, server.URL, 500)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
-
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
 		assert.Len(t, result, 1)
-		assert.Equal(t, "server", result[0].Section)
-		assert.Equal(t, "port", result[0].Key)
-		assert.Equal(t, "3000", result[0].Value)
+
+		spec := result[0]
+		assert.Equal(t, "server", spec.Section)
+		assert.Equal(t, "port", spec.Key)
+		assert.Equal(t, "3000", spec.Value)
 	})
 
-	t.Run("should handle multiple settings", func(t *testing.T) {
-		settings := []Setting{
-			{Section: "server", Key: "port", Value: "3000"},
-			{Section: "database", Key: "host", Value: "localhost"},
-			{Section: "database", Key: "port", Value: "5432"},
-		}
-		server := newTestServer(t, settings, "")
-		defer server.Close()
+	t.Run("should handle multiple pages", func(t *testing.T) {
+		totalPages := 3
+		pageSize := 5
 
-		client := newTestClient(t, server.URL, 500)
-		ctx := request.WithNamespace(context.Background(), "test-namespace")
-
-		result, err := client.List(ctx, metav1.LabelSelector{})
-
-		require.NoError(t, err)
-		assert.Len(t, result, 3)
-	})
-
-	t.Run("should handle pagination with continue token", func(t *testing.T) {
-		// First page
-		page1Settings := []Setting{
-			{Section: "section-0", Key: "key-0", Value: "value-0"},
-			{Section: "section-0", Key: "key-1", Value: "value-1"},
-		}
-		// Second page
-		page2Settings := []Setting{
-			{Section: "section-1", Key: "key-0", Value: "value-2"},
-			{Section: "section-1", Key: "key-1", Value: "value-3"},
+		pages := make([][]*unstructured.Unstructured, totalPages)
+		for pageNum := 0; pageNum < totalPages; pageNum++ {
+			for idx := 0; idx < pageSize; idx++ {
+				item := newUnstructuredSetting(
+					"test-namespace",
+					Setting{
+						Section: fmt.Sprintf("section-%d", pageNum),
+						Key:     fmt.Sprintf("key-%d", idx),
+						Value:   fmt.Sprintf("val-%d-%d", pageNum, idx),
+					},
+				)
+				pages[pageNum] = append(pages[pageNum], item)
+			}
 		}
 
-		requestCount := 0
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			requestCount++
-			continueToken := r.URL.Query().Get("continue")
+		scheme := runtime.NewScheme()
+		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
+		listCallCount := 0
+		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
+			listCallCount++
 
-			var settings []Setting
-			var nextContinue string
-
-			if continueToken == "" {
-				settings = page1Settings
-				nextContinue = "page2"
-			} else {
-				settings = page2Settings
-				nextContinue = ""
+			continueToken := fmt.Sprintf("continue-%d", listCallCount)
+			if listCallCount == totalPages {
+				continueToken = ""
 			}
 
-			w.Header().Set("Content-Type", "application/json")
-			_, _ = w.Write([]byte(generateSettingsJSON(settings, nextContinue)))
-		}))
-		defer server.Close()
+			if listCallCount <= totalPages {
+				list := &unstructured.UnstructuredList{
+					Object: map[string]interface{}{
+						"apiVersion": ApiGroup + "/" + apiVersion,
+						"kind":       listKind,
+					},
+				}
+				list.SetContinue(continueToken)
+				for _, item := range pages[listCallCount-1] {
+					list.Items = append(list.Items, *item)
+				}
+				return true, list, nil
+			}
+
+			return false, nil, nil
+		})
+
+		client := &remoteSettingService{
+			dynamicClient: dynamicClient,
+			pageSize:      int64(pageSize),
+			log:           log.NewNopLogger(),
+			metrics:       initMetrics(),
+		}
 
-		client := newTestClient(t, server.URL, 2)
 		ctx := request.WithNamespace(context.Background(), "test-namespace")
-
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.NoError(t, err)
-		assert.Len(t, result, 4)
-		assert.Equal(t, 2, requestCount)
+		assert.Len(t, result, totalPages*pageSize)
+		assert.Equal(t, totalPages, listCallCount)
 	})
 
-	t.Run("should return error when namespace is missing", func(t *testing.T) {
-		server := newTestServer(t, nil, "")
-		defer server.Close()
+	t.Run("should pass label selector when provided", func(t *testing.T) {
+		scheme := runtime.NewScheme()
+		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
+		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
+			listAction := action.(k8testing.ListActionImpl)
+			assert.Equal(t, "app=grafana", listAction.ListOptions.LabelSelector)
+			return true, &unstructured.UnstructuredList{}, nil
+		})
 
-		client := newTestClient(t, server.URL, 500)
-		ctx := context.Background() // No namespace
+		client := &remoteSettingService{
+			dynamicClient: dynamicClient,
+			pageSize:      500,
+			log:           log.NewNopLogger(),
+			metrics:       initMetrics(),
+		}
 
+		ctx := request.WithNamespace(context.Background(), "test-namespace")
+		_, err := client.List(ctx, metav1.LabelSelector{MatchLabels: map[string]string{"app": "grafana"}})
+
+		require.NoError(t, err)
+	})
+
+	t.Run("should stop pagination at 1000 pages", func(t *testing.T) {
+		scheme := runtime.NewScheme()
+		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
+		listCallCount := 0
+		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
+			listCallCount++
+			// Always return a continue token to simulate infinite pagination
+			list := &unstructured.UnstructuredList{}
+			list.SetContinue("continue-forever")
+			return true, list, nil
+		})
+
+		client := &remoteSettingService{
+			dynamicClient: dynamicClient,
+			pageSize:      10,
+			log:           log.NewNopLogger(),
+			metrics:       initMetrics(),
+		}
+
+		ctx := request.WithNamespace(context.Background(), "test-namespace")
+		_, err := client.List(ctx, metav1.LabelSelector{})
+
+		require.NoError(t, err)
+		assert.Equal(t, 1000, listCallCount, "Should stop at 1000 pages to prevent infinite loops")
+	})
+
+	t.Run("should return error when parsing setting fails", func(t *testing.T) {
+		scheme := runtime.NewScheme()
+		dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind)
+		dynamicClient.PrependReactor("list", "settings", func(action k8testing.Action) (handled bool, ret runtime.Object, err error) {
+			// Return a malformed setting without spec
+			list := &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": ApiGroup + "/" + apiVersion,
+					"kind":       listKind,
+				},
+			}
+			malformedSetting := &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": ApiGroup + "/" + apiVersion,
+					"kind":       kind,
+					"metadata": map[string]interface{}{
+						"name":      "malformed",
+						"namespace": "test-namespace",
+					},
+					// Missing spec
+				},
+			}
+			list.Items = append(list.Items, *malformedSetting)
+			return true, list, nil
+		})
+
+		client := &remoteSettingService{
+			dynamicClient: dynamicClient,
+			pageSize:      500,
+			log:           log.NewNopLogger(),
+			metrics:       initMetrics(),
+		}
+
+		ctx := request.WithNamespace(context.Background(), "test-namespace")
 		result, err := client.List(ctx, metav1.LabelSelector{})
 
 		require.Error(t, err)
 		assert.Nil(t, result)
-		assert.Contains(t, err.Error(), "missing namespace")
+		assert.Contains(t, err.Error(), "spec not found")
+	})
+}
+
+func TestParseSettingResource(t *testing.T) {
+	t.Run("should parse valid setting resource", func(t *testing.T) {
+		setting := newUnstructuredSetting("test-namespace", Setting{Section: "database", Key: "type", Value: "postgres"})
+
+		result, err := parseSettingResource(setting)
+
+		require.NoError(t, err)
+		assert.NotNil(t, result)
+		assert.Equal(t, "database", result.Section)
+		assert.Equal(t, "type", result.Key)
+		assert.Equal(t, "postgres", result.Value)
 	})
 
-	t.Run("should return error on HTTP error", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusInternalServerError)
-			_, _ = w.Write([]byte("internal server error"))
-		}))
-		defer server.Close()
+	t.Run("should return error when spec is missing", func(t *testing.T) {
+		setting := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": ApiGroup + "/" + apiVersion,
+				"kind":       kind,
+				"metadata": map[string]interface{}{
+					"name":      "test-setting",
+					"namespace": "test-namespace",
+				},
+				// No spec
+			},
+		}
 
-		client := newTestClient(t, server.URL, 500)
-		ctx := request.WithNamespace(context.Background(), "test-namespace")
-
-		result, err := client.List(ctx, metav1.LabelSelector{})
+		result, err := parseSettingResource(setting)
 
 		require.Error(t, err)
 		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "spec not found")
 	})
 }
 
-func TestParseSettingList(t *testing.T) {
-	t.Run("should parse valid settings list", func(t *testing.T) {
-		jsonData := `{
-			"apiVersion": "setting.grafana.app/v0alpha1",
-			"kind": "SettingList",
-			"metadata": {"continue": ""},
-			"items": [
-				{"spec": {"section": "database", "key": "type", "value": "postgres"}},
-				{"spec": {"section": "server", "key": "port", "value": "3000"}}
-			]
-		}`
-
-		settings, continueToken, err := parseSettingList(strings.NewReader(jsonData))
-
-		require.NoError(t, err)
-		assert.Len(t, settings, 2)
-		assert.Equal(t, "", continueToken)
-		assert.Equal(t, "database", settings[0].Section)
-		assert.Equal(t, "type", settings[0].Key)
-		assert.Equal(t, "postgres", settings[0].Value)
-	})
-
-	t.Run("should parse continue token", func(t *testing.T) {
-		jsonData := `{
-			"apiVersion": "setting.grafana.app/v0alpha1",
-			"kind": "SettingList",
-			"metadata": {"continue": "next-page-token"},
-			"items": []
-		}`
-
-		_, continueToken, err := parseSettingList(strings.NewReader(jsonData))
-
-		require.NoError(t, err)
-		assert.Equal(t, "next-page-token", continueToken)
-	})
-
-	t.Run("should handle empty items", func(t *testing.T) {
-		jsonData := `{
-			"apiVersion": "setting.grafana.app/v0alpha1",
-			"kind": "SettingList",
-			"metadata": {},
-			"items": []
-		}`
-
-		settings, _, err := parseSettingList(strings.NewReader(jsonData))
-
-		require.NoError(t, err)
-		assert.Len(t, settings, 0)
-	})
-}
-
-func TestToIni(t *testing.T) {
+func TestRemoteSettingService_ToIni(t *testing.T) {
 	t.Run("should convert settings to ini format", func(t *testing.T) {
 		settings := []*Setting{
 			{Section: "database", Key: "type", Value: "postgres"},
@@ -209,7 +283,12 @@ func TestToIni(t *testing.T) {
 			{Section: "server", Key: "http_port", Value: "3000"},
 		}
 
-		result, err := toIni(settings)
+		client := &remoteSettingService{
+			pageSize: 500,
+			log:      log.NewNopLogger(),
+		}
+
+		result, err := client.toIni(settings)
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
@@ -223,7 +302,12 @@ func TestToIni(t *testing.T) {
 	t.Run("should handle empty settings list", func(t *testing.T) {
 		var settings []*Setting
 
-		result, err := toIni(settings)
+		client := &remoteSettingService{
+			pageSize: 500,
+			log:      log.NewNopLogger(),
+		}
+
+		result, err := client.toIni(settings)
 
 		require.NoError(t, err)
 		assert.NotNil(t, result)
@@ -231,13 +315,35 @@ func TestToIni(t *testing.T) {
 		assert.Len(t, sections, 1) // Only default section
 	})
 
+	t.Run("should create section if it does not exist", func(t *testing.T) {
+		settings := []*Setting{
+			{Section: "new_section", Key: "new_key", Value: "new_value"},
+		}
+
+		client := &remoteSettingService{
+			pageSize: 500,
+			log:      log.NewNopLogger(),
+		}
+
+		result, err := client.toIni(settings)
+
+		require.NoError(t, err)
+		assert.True(t, result.HasSection("new_section"))
+		assert.Equal(t, "new_value", result.Section("new_section").Key("new_key").String())
+	})
+
 	t.Run("should handle multiple keys in same section", func(t *testing.T) {
 		settings := []*Setting{
 			{Section: "auth", Key: "disable_login_form", Value: "false"},
 			{Section: "auth", Key: "disable_signout_menu", Value: "true"},
 		}
 
-		result, err := toIni(settings)
+		client := &remoteSettingService{
+			pageSize: 500,
+			log:      log.NewNopLogger(),
+		}
+
+		result, err := client.toIni(settings)
 
 		require.NoError(t, err)
 		assert.True(t, result.HasSection("auth"))
@@ -277,23 +383,24 @@ func TestNew(t *testing.T) {
 		assert.Equal(t, int64(100), remoteClient.pageSize)
 	})
 
-	t.Run("should create client with custom QPS and Burst", func(t *testing.T) {
+	t.Run("should use default page size when zero is provided", func(t *testing.T) {
 		config := Config{
 			URL:           "https://example.com",
 			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-			QPS:           50.0,
-			Burst:         100,
+			PageSize:      0,
 		}
 
 		client, err := New(config)
 
 		require.NoError(t, err)
 		assert.NotNil(t, client)
+		remoteClient := client.(*remoteSettingService)
+		assert.Equal(t, DefaultPageSize, remoteClient.pageSize)
 	})
 
-	t.Run("should return error when URL is empty", func(t *testing.T) {
+	t.Run("should return error when config is invalid", func(t *testing.T) {
 		config := Config{
-			URL: "",
+			URL: "", // Invalid: empty URL
 		}
 
 		client, err := New(config)
@@ -302,126 +409,134 @@ func TestNew(t *testing.T) {
 		assert.Nil(t, client)
 		assert.Contains(t, err.Error(), "URL cannot be empty")
 	})
+}
 
-	t.Run("should return error when auth is not configured", func(t *testing.T) {
+func TestGetDynamicClient(t *testing.T) {
+	logger := log.NewNopLogger()
+
+	t.Run("should return error when SettingServiceURL is empty", func(t *testing.T) {
+		config := Config{
+			URL:           "",
+			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
+		}
+
+		client, err := getDynamicClient(config, logger)
+
+		require.Error(t, err)
+		assert.Nil(t, client)
+		assert.Contains(t, err.Error(), "URL cannot be empty")
+	})
+
+	t.Run("should return error when both TokenExchangeClient and WrapTransport are nil", func(t *testing.T) {
 		config := Config{
 			URL:                 "https://example.com",
 			TokenExchangeClient: nil,
 			WrapTransport:       nil,
 		}
 
-		client, err := New(config)
+		client, err := getDynamicClient(config, logger)
 
 		require.Error(t, err)
 		assert.Nil(t, client)
 		assert.Contains(t, err.Error(), "must set either TokenExchangeClient or WrapTransport")
 	})
 
-	t.Run("should use WrapTransport when provided", func(t *testing.T) {
+	t.Run("should create client with WrapTransport", func(t *testing.T) {
+		config := Config{
+			URL:           "https://example.com",
+			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
+		}
+
+		client, err := getDynamicClient(config, logger)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+	})
+
+	t.Run("should not fail when QPS and Burst are not provided", func(t *testing.T) {
+		config := Config{
+			URL:           "https://example.com",
+			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
+		}
+
+		client, err := getDynamicClient(config, logger)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+	})
+
+	t.Run("should not fail when custom QPS and Burst are provided", func(t *testing.T) {
+		config := Config{
+			URL:           "https://example.com",
+			WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
+			QPS:           10.0,
+			Burst:         20,
+		}
+
+		client, err := getDynamicClient(config, logger)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+	})
+
+	t.Run("should use WrapTransport when both WrapTransport and TokenExchangeClient are provided", func(t *testing.T) {
 		wrapTransportCalled := false
+		tokenExchangeClient := &authlib.TokenExchangeClient{}
 
 		config := Config{
-			URL: "https://example.com",
+			URL:                 "https://example.com",
+			TokenExchangeClient: tokenExchangeClient,
 			WrapTransport: func(rt http.RoundTripper) http.RoundTripper {
 				wrapTransportCalled = true
 				return rt
 			},
 		}
 
-		client, err := New(config)
+		client, err := getDynamicClient(config, logger)
 
 		require.NoError(t, err)
 		assert.NotNil(t, client)
-		assert.True(t, wrapTransportCalled)
+		assert.True(t, wrapTransportCalled, "WrapTransport should be called and take precedence over TokenExchangeClient")
 	})
 }
 
-// Helper functions
+// Helper function to create an unstructured Setting object for tests
+func newUnstructuredSetting(namespace string, spec Setting) *unstructured.Unstructured {
+	// Generate resource name in the format {section}--{key}
+	name := fmt.Sprintf("%s--%s", spec.Section, spec.Key)
 
-func newTestServer(t *testing.T, settings []Setting, continueToken string) *httptest.Server {
-	t.Helper()
-	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(generateSettingsJSON(settings, continueToken)))
-	}))
-}
-
-func newTestClient(t *testing.T, serverURL string, pageSize int64) Service {
-	t.Helper()
-	config := Config{
-		URL:           serverURL,
-		WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return rt },
-		PageSize:      pageSize,
+	obj := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": ApiGroup + "/" + apiVersion,
+			"kind":       kind,
+			"metadata": map[string]interface{}{
+				"name":      name,
+				"namespace": namespace,
+			},
+			"spec": map[string]interface{}{
+				"section": spec.Section,
+				"key":     spec.Key,
+				"value":   spec.Value,
+			},
+		},
 	}
-	client, err := New(config)
-	require.NoError(t, err)
-	return client
+	// Always set section and key labels
+	obj.SetLabels(map[string]string{
+		"section": spec.Section,
+		"key":     spec.Key,
+	})
+	return obj
 }
 
-func generateSettingsJSON(settings []Setting, continueToken string) string {
-	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf(`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"SettingList","metadata":{"continue":"%s"},"items":[`, continueToken))
+// Helper function to create a test client with the dynamic fake client
+func newTestClient(pageSize int64, objects ...runtime.Object) *remoteSettingService {
+	scheme := runtime.NewScheme()
+	dynamicClient := fake.NewSimpleDynamicClientWithCustomListKinds(scheme, settingGroupListKind, objects...)
 
-	for i, s := range settings {
-		if i > 0 {
-			sb.WriteString(",")
-		}
-		sb.WriteString(fmt.Sprintf(
-			`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"Setting","metadata":{"name":"%s--%s","namespace":"test-namespace"},"spec":{"section":"%s","key":"%s","value":"%s"}}`,
-			s.Section, s.Key, s.Section, s.Key, s.Value,
-		))
-	}
-
-	sb.WriteString(`]}`)
-	return sb.String()
-}
-
-// Benchmark tests for streaming JSON parser
-
-func BenchmarkParseSettingList(b *testing.B) {
-	jsonData := generateSettingListJSON(4000, 100)
-	jsonBytes := []byte(jsonData)
-
-	b.ResetTimer()
-	b.ReportAllocs()
-	for i := 0; i < b.N; i++ {
-		reader := bytes.NewReader(jsonBytes)
-		_, _, _ = parseSettingList(reader)
+	return &remoteSettingService{
+		dynamicClient: dynamicClient,
+		pageSize:      pageSize,
+		log:           log.NewNopLogger(),
+		metrics:       initMetrics(),
 	}
 }
-
-func BenchmarkParseSettingList_SinglePage(b *testing.B) {
-	jsonData := generateSettingListJSON(500, 50)
-	jsonBytes := []byte(jsonData)
-
-	b.ResetTimer()
-	b.ReportAllocs()
-	for i := 0; i < b.N; i++ {
-		reader := bytes.NewReader(jsonBytes)
-		_, _, _ = parseSettingList(reader)
-	}
-}
-
-// generateSettingListJSON generates a K8s-style SettingList JSON response for benchmarks
-func generateSettingListJSON(totalSettings, numSections int) string {
-	var sb strings.Builder
-	sb.WriteString(`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"SettingList","metadata":{"continue":""},"items":[`)
-
-	settingsPerSection := totalSettings / numSections
-	first := true
-	for section := 0; section < numSections; section++ {
-		for key := 0; key < settingsPerSection; key++ {
-			if !first {
-				sb.WriteString(",")
-			}
-			first = false
-			sb.WriteString(fmt.Sprintf(
-				`{"apiVersion":"setting.grafana.app/v0alpha1","kind":"Setting","metadata":{"name":"section-%03d--key-%03d","namespace":"bench-ns"},"spec":{"section":"section-%03d","key":"key-%03d","value":"value-for-section-%d-key-%d"}}`,
-				section, key, section, key, section, key,
-			))
-		}
-	}
-
-	sb.WriteString(`]}`)
-	return sb.String()
-}

pkg/services/sqlstore/migrations/migrations.go

@@ -165,7 +165,5 @@ func (oss *OSSMigrations) AddMigration(mg *Migrator) {
 
 	ualert.AddStateAnnotationsColumn(mg)
 
-	ualert.CollateBinAlertRuleNamespace(mg)
-
 	ualert.CollateBinAlertRuleGroup(mg)
 }

pkg/services/sqlstore/migrations/ualert/alert_rule_namespace_collation.go

@@ -1,10 +0,0 @@
-package ualert
-
-import "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
-
-// CollateBinAlertRuleNamespace ensures that namespace_uid column collates in the same way go sorts strings.
-func CollateBinAlertRuleNamespace(mg *migrator.Migrator) {
-	mg.AddMigration("ensure namespace_uid column sorts the same way as golang", migrator.NewRawSQLMigration("").
-		Mysql("ALTER TABLE alert_rule MODIFY namespace_uid VARCHAR(40) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL;").
-		Postgres(`ALTER TABLE alert_rule ALTER COLUMN namespace_uid SET DATA TYPE varchar(40) COLLATE "C";`))
-}

pkg/setting/setting_plugins.go

@@ -102,7 +102,7 @@ func (cfg *Cfg) processPreinstallPlugins(rawInstallPlugins []string, preinstallP
 		if len(parts) > 1 {
 			version = parts[1]
 			if len(parts) > 2 {
-				url = strings.Join(parts[2:], "@")
+				url = parts[2]
 			}
 		}
 

pkg/setting/setting_plugins_test.go

@@ -210,11 +210,6 @@ func Test_readPluginSettings(t *testing.T) {
 				rawInput: "plugin1@@https://example.com/plugin1.tar.gz",
 				expected: append(defaultPreinstallPluginsList, InstallPlugin{ID: "plugin1", Version: "", URL: "https://example.com/plugin1.tar.gz"}),
 			},
-			{
-				name:     "should parse a plugin with credentials in the URL",
-				rawInput: "plugin1@@https://username:password@example.com/plugin1.tar.gz",
-				expected: append(defaultPreinstallPluginsList, InstallPlugin{ID: "plugin1", Version: "", URL: "https://username:password@example.com/plugin1.tar.gz"}),
-			},
 			{
 				name:         "when preinstall_async is false, should add all plugins to preinstall_sync",
 				rawInput:     "plugin1",

pkg/setting/settings_zanzana.go

@@ -110,24 +110,15 @@ func (cfg *Cfg) readZanzanaSettings() {
 		zc.Mode = "embedded"
 	}
 
+	zc.Token = clientSec.Key("token").MustString("")
+	zc.TokenExchangeURL = clientSec.Key("token_exchange_url").MustString("")
 	zc.Addr = clientSec.Key("address").MustString("")
 	zc.ServerCertFile = clientSec.Key("tls_cert").MustString("")
 
+	// TODO: read Token and TokenExchangeURL from grpc_client_authentication section
 	grpcClientAuthSection := cfg.SectionWithEnvOverrides("grpc_client_authentication")
-	zc.Token = grpcClientAuthSection.Key("token").MustString("")
-	zc.TokenExchangeURL = grpcClientAuthSection.Key("token_exchange_url").MustString("")
 	zc.TokenNamespace = grpcClientAuthSection.Key("token_namespace").MustString("stacks-" + cfg.StackID)
 
-	// TODO: remove old settings when migrated
-	token := clientSec.Key("token").MustString("")
-	tokenExchangeURL := clientSec.Key("token_exchange_url").MustString("")
-	if token != "" {
-		zc.Token = token
-	}
-	if tokenExchangeURL != "" {
-		zc.TokenExchangeURL = tokenExchangeURL
-	}
-
 	cfg.ZanzanaClient = zc
 
 	zs := ZanzanaServerSettings{}

pkg/storage/unified/apistore/restoptions.go

@@ -79,7 +79,7 @@ func NewRESTOptionsGetterMemory(originalStorageConfig storagebackend.Config, sec
 	}
 
 	return NewRESTOptionsGetterForClient(
-		resource.NewLocalResourceClient(server),
+		resource.NewLocalResourceClient(server, nil),
 		secrets,
 		originalStorageConfig,
 		nil,
@@ -118,7 +118,7 @@ func NewRESTOptionsGetterForFileXX(path string,
 	}
 
 	return NewRESTOptionsGetterForClient(
-		resource.NewLocalResourceClient(server),
+		resource.NewLocalResourceClient(server, nil),
 		nil, // secrets
 		originalStorageConfig,
 		nil,

pkg/storage/unified/apistore/watcher_test.go

@@ -156,7 +156,7 @@ func testSetup(t testing.TB, opts ...setupOption) (context.Context, storage.Inte
 	default:
 		t.Fatalf("unsupported storage type: %s", setupOpts.storageType)
 	}
-	client := resource.NewLocalResourceClient(server)
+	client := resource.NewLocalResourceClient(server, nil)
 
 	config := storagebackend.NewDefaultConfig(setupOpts.prefix, setupOpts.codec)
 	store, destroyFunc, err := apistore.NewStorage(

pkg/storage/unified/client.go

@@ -21,6 +21,7 @@ import (
 	"github.com/grafana/dskit/grpcclient"
 	"github.com/grafana/dskit/middleware"
 	"github.com/grafana/dskit/services"
+
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
 	infraDB "github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/tracing"
@@ -135,7 +136,7 @@ func newClient(opts options.StorageOptions,
 		if err != nil {
 			return nil, err
 		}
-		return resource.NewLocalResourceClient(server), nil
+		return resource.NewLocalResourceClient(server, nil), nil
 
 	case options.StorageTypeUnifiedGrpc:
 		if opts.Address == "" {
@@ -224,11 +225,11 @@ func newClient(opts options.StorageOptions,
 			serverOptions.OverridesService = overridesSvc
 		}
 
-		server, err := sql.NewResourceServer(serverOptions)
+		server, searchServer, err := sql.NewResourceServer(serverOptions)
 		if err != nil {
 			return nil, err
 		}
-		return resource.NewLocalResourceClient(server), nil
+		return resource.NewLocalResourceClient(server, searchServer), nil
 	}
 }
 

pkg/storage/unified/resource/client.go

@@ -31,11 +31,14 @@ import (
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
+type SearchClient interface {
+	resourcepb.ResourceIndexClient
+	resourcepb.ManagedObjectIndexClient
+}
+
 //go:generate mockery --name ResourceClient --structname MockResourceClient --inpackage --filename client_mock.go --with-expecter
 type ResourceClient interface {
 	resourcepb.ResourceStoreClient
-	resourcepb.ResourceIndexClient
-	resourcepb.ManagedObjectIndexClient
 	resourcepb.BulkStoreClient
 	resourcepb.BlobStoreClient
 	resourcepb.DiagnosticsClient
@@ -100,8 +103,6 @@ func NewLocalResourceClient(server ResourceServer) ResourceClient {
 	grpcAuthInt := grpcutils.NewUnsafeAuthenticator(tracer)
 	for _, desc := range []*grpc.ServiceDesc{
 		&resourcepb.ResourceStore_ServiceDesc,
-		&resourcepb.ResourceIndex_ServiceDesc,
-		&resourcepb.ManagedObjectIndex_ServiceDesc,
 		&resourcepb.BlobStore_ServiceDesc,
 		&resourcepb.BulkStore_ServiceDesc,
 		&resourcepb.Diagnostics_ServiceDesc,

pkg/storage/unified/resource/document.go

@@ -3,9 +3,11 @@ package resource
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"strings"
 	"sync"
 
+	"github.com/grafana/grafana-app-sdk/app"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
@@ -101,6 +103,9 @@ type IndexableDocument struct {
 	// metadata, annotations, or external data linked at index time
 	Fields map[string]any `json:"fields,omitempty"`
 
+	// Automatically indexed selectable fields, used for field-based filtering when listing.
+	SelectableFields map[string]string `json:"selectable_fields,omitempty"`
+
 	// Maintain a list of resource references.
 	// Someday this will likely be part of https://github.com/grafana/gamma
 	References ResourceReferences `json:"references,omitempty"`
@@ -175,7 +180,7 @@ func (m ResourceReferences) Less(i, j int) bool {
 }
 
 // Create a new indexable document based on a generic k8s resource
-func NewIndexableDocument(key *resourcepb.ResourceKey, rv int64, obj utils.GrafanaMetaAccessor) *IndexableDocument {
+func NewIndexableDocument(key *resourcepb.ResourceKey, rv int64, obj utils.GrafanaMetaAccessor, selectableFields map[string]string) *IndexableDocument {
 	title := obj.FindTitle(key.Name)
 	if title == key.Name {
 		// TODO: something wrong with FindTitle
@@ -191,14 +196,15 @@ func NewIndexableDocument(key *resourcepb.ResourceKey, rv int64, obj utils.Grafa
 		}
 	}
 	doc := &IndexableDocument{
-		Key:       key,
-		RV:        rv,
-		Name:      key.Name,
-		Title:     title, // We always want *something* to display
-		Labels:    obj.GetLabels(),
-		Folder:    obj.GetFolder(),
-		CreatedBy: obj.GetCreatedBy(),
-		UpdatedBy: obj.GetUpdatedBy(),
+		Key:              key,
+		RV:               rv,
+		Name:             key.Name,
+		Title:            title, // We always want *something* to display
+		Labels:           obj.GetLabels(),
+		Folder:           obj.GetFolder(),
+		CreatedBy:        obj.GetCreatedBy(),
+		UpdatedBy:        obj.GetUpdatedBy(),
+		SelectableFields: selectableFields,
 	}
 	m, ok := obj.GetManagerProperties()
 	if ok {
@@ -220,11 +226,14 @@ func NewIndexableDocument(key *resourcepb.ResourceKey, rv int64, obj utils.Grafa
 	return doc.UpdateCopyFields()
 }
 
-func StandardDocumentBuilder() DocumentBuilder {
-	return &standardDocumentBuilder{}
+func StandardDocumentBuilder(manifests []app.Manifest) DocumentBuilder {
+	return &standardDocumentBuilder{selectableFields: SelectableFieldsForManifests(manifests)}
 }
 
-type standardDocumentBuilder struct{}
+type standardDocumentBuilder struct {
+	// Maps "group/resource" (in lowercase) to list of selectable fields.
+	selectableFields map[string][]string
+}
 
 func (s *standardDocumentBuilder) BuildDocument(ctx context.Context, key *resourcepb.ResourceKey, rv int64, value []byte) (*IndexableDocument, error) {
 	tmp := &unstructured.Unstructured{}
@@ -238,10 +247,36 @@ func (s *standardDocumentBuilder) BuildDocument(ctx context.Context, key *resour
 		return nil, err
 	}
 
-	doc := NewIndexableDocument(key, rv, obj)
+	sfKey := strings.ToLower(key.GetGroup() + "/" + key.GetResource())
+	selectableFields := buildSelectableFields(tmp, s.selectableFields[sfKey])
+
+	doc := NewIndexableDocument(key, rv, obj, selectableFields)
 	return doc, nil
 }
 
+func buildSelectableFields(tmp *unstructured.Unstructured, fields []string) map[string]string {
+	result := map[string]string{}
+
+	for _, field := range fields {
+		path := strings.Split(field, ".")
+		val, ok, err := unstructured.NestedFieldNoCopy(tmp.Object, path...)
+		if err != nil || !ok {
+			continue
+		}
+
+		switch v := val.(type) {
+		case string:
+			result[field] = v
+		case bool:
+			result[field] = strconv.FormatBool(v)
+		case int, float64:
+			result[field] = fmt.Sprintf("%v", v)
+		}
+	}
+
+	return result
+}
+
 type searchableDocumentFields struct {
 	names  []string
 	fields map[string]*resourceTableColumn

pkg/storage/unified/resource/document_test.go

@@ -14,7 +14,7 @@ import (
 
 func TestStandardDocumentBuilder(t *testing.T) {
 	ctx := context.Background()
-	builder := StandardDocumentBuilder()
+	builder := StandardDocumentBuilder(nil)
 
 	body, err := os.ReadFile("testdata/playlist-resource.json")
 	require.NoError(t, err)

pkg/storage/unified/resource/search.go

@@ -127,7 +127,10 @@ type SearchBackend interface {
 	GetOpenIndexes() []NamespacedResource
 }
 
-// This supports indexing+search regardless of implementation
+var _ SearchServer = &searchSupport{}
+
+// This supports indexing+search regardless of implementation.
+// Implements SearchServer interface.
 type searchSupport struct {
 	log          log.Logger
 	storage      StorageBackend
@@ -160,6 +163,10 @@ var (
 	_ resourcepb.ManagedObjectIndexServer = (*searchSupport)(nil)
 )
 
+func NewSearchServer(opts SearchOptions, storage StorageBackend, access types.AccessClient, blob BlobSupport, indexMetrics *BleveIndexMetrics, ownsIndexFn func(key NamespacedResource) (bool, error)) (SearchServer, error) {
+	return newSearchSupport(opts, storage, access, blob, indexMetrics, ownsIndexFn)
+}
+
 func newSearchSupport(opts SearchOptions, storage StorageBackend, access types.AccessClient, blob BlobSupport, indexMetrics *BleveIndexMetrics, ownsIndexFn func(key NamespacedResource) (bool, error)) (support *searchSupport, err error) {
 	// No backend search support
 	if opts.Backend == nil {
@@ -598,6 +605,15 @@ func (s *searchSupport) buildIndexes(ctx context.Context) (int, error) {
 	return totalBatchesIndexed, nil
 }
 
+func (s *searchSupport) Init(ctx context.Context) error {
+	return s.init(ctx)
+}
+
+func (s *searchSupport) Stop(_ context.Context) error {
+	s.stop()
+	return nil
+}
+
 func (s *searchSupport) init(ctx context.Context) error {
 	origCtx := ctx
 

pkg/storage/unified/resource/search_server_distributor.go

@@ -60,7 +60,7 @@ func ProvideSearchDistributorServer(cfg *setting.Cfg, features featuremgmt.Featu
 }
 
 type RingClient struct {
-	Client ResourceClient
+	Client SearchClient
 	grpc_health_v1.HealthClient
 	Conn *grpc.ClientConn
 }
@@ -99,7 +99,7 @@ var (
 func (ds *distributorServer) Search(ctx context.Context, r *resourcepb.ResourceSearchRequest) (*resourcepb.ResourceSearchResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.Search")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Options.Key.Namespace, "Search")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Options.Key.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +110,7 @@ func (ds *distributorServer) Search(ctx context.Context, r *resourcepb.ResourceS
 func (ds *distributorServer) GetStats(ctx context.Context, r *resourcepb.ResourceStatsRequest) (*resourcepb.ResourceStatsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.GetStats")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "GetStats")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -215,7 +215,7 @@ func (ds *distributorServer) RebuildIndexes(ctx context.Context, r *resourcepb.R
 func (ds *distributorServer) CountManagedObjects(ctx context.Context, r *resourcepb.CountManagedObjectsRequest) (*resourcepb.CountManagedObjectsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.CountManagedObjects")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "CountManagedObjects")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -226,7 +226,7 @@ func (ds *distributorServer) CountManagedObjects(ctx context.Context, r *resourc
 func (ds *distributorServer) ListManagedObjects(ctx context.Context, r *resourcepb.ListManagedObjectsRequest) (*resourcepb.ListManagedObjectsResponse, error) {
 	ctx, span := ds.tracing.Start(ctx, "distributor.ListManagedObjects")
 	defer span.End()
-	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace, "ListManagedObjects")
+	ctx, client, err := ds.getClientToDistributeRequest(ctx, r.Namespace)
 	if err != nil {
 		return nil, err
 	}
@@ -234,7 +234,7 @@ func (ds *distributorServer) ListManagedObjects(ctx context.Context, r *resource
 	return client.ListManagedObjects(ctx, r)
 }
 
-func (ds *distributorServer) getClientToDistributeRequest(ctx context.Context, namespace string, methodName string) (context.Context, ResourceClient, error) {
+func (ds *distributorServer) getClientToDistributeRequest(ctx context.Context, namespace string) (context.Context, SearchClient, error) {
 	ringHasher := fnv.New32a()
 	_, err := ringHasher.Write([]byte(namespace))
 	if err != nil {

pkg/storage/unified/resource/selectable_fields.go

@@ -0,0 +1,45 @@
+package resource
+
+import (
+	"strings"
+
+	"github.com/grafana/grafana-app-sdk/app"
+
+	folder "github.com/grafana/grafana/apps/folder/pkg/apis/manifestdata"
+	iam "github.com/grafana/grafana/apps/iam/pkg/apis"
+)
+
+func AppManifests() []app.Manifest {
+	return []app.Manifest{
+		iam.LocalManifest(),
+		folder.LocalManifest(),
+	}
+}
+
+func SelectableFields() map[string][]string {
+	return SelectableFieldsForManifests(AppManifests())
+}
+
+// SelectableFieldsForManifests returns map of <group/kind> to list of selectable fields.
+// Also <group/plural> is included as a key, pointing to the same fields.
+func SelectableFieldsForManifests(manifests []app.Manifest) map[string][]string {
+	fields := map[string][]string{}
+
+	for _, m := range manifests {
+		group := m.ManifestData.Group
+
+		for _, version := range m.ManifestData.Versions {
+			for _, kind := range version.Kinds {
+				key := strings.ToLower(group + "/" + kind.Kind)
+				keyPlural := strings.ToLower(group + "/" + kind.Plural)
+
+				if len(kind.SelectableFields) > 0 {
+					fields[key] = kind.SelectableFields
+					fields[keyPlural] = kind.SelectableFields
+				}
+			}
+		}
+	}
+
+	return fields
+}

pkg/storage/unified/resource/server.go

@@ -12,6 +12,8 @@ import (
 
 	"github.com/Masterminds/semver"
 	"github.com/google/uuid"
+	claims "github.com/grafana/authlib/types"
+	"github.com/grafana/dskit/backoff"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
@@ -20,9 +22,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
-	claims "github.com/grafana/authlib/types"
-	"github.com/grafana/dskit/backoff"
-
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/apimachinery/validation"
 	"github.com/grafana/grafana/pkg/infra/log"
@@ -33,12 +32,17 @@ import (
 
 var tracer = otel.Tracer("github.com/grafana/grafana/pkg/storage/unified/resource")
 
+type SearchServer interface {
+	LifecycleHooks
+
+	resourcepb.ResourceIndexServer
+	resourcepb.ManagedObjectIndexServer
+}
+
 // ResourceServer implements all gRPC services
 type ResourceServer interface {
 	resourcepb.ResourceStoreServer
 	resourcepb.BulkStoreServer
-	resourcepb.ResourceIndexServer
-	resourcepb.ManagedObjectIndexServer
 	resourcepb.BlobStoreServer
 	resourcepb.DiagnosticsServer
 	resourcepb.QuotasServer
@@ -221,7 +225,8 @@ type ResourceServerOptions struct {
 	Blob BlobConfig
 
 	// Search options
-	Search SearchOptions
+	SearchOptions SearchOptions // TODO: needed?
+	Search        SearchServer
 
 	// Quota service
 	OverridesService *OverridesService
@@ -250,16 +255,12 @@ type ResourceServerOptions struct {
 
 	storageMetrics *StorageMetrics
 
-	IndexMetrics *BleveIndexMetrics
-
 	// MaxPageSizeBytes is the maximum size of a page in bytes.
 	MaxPageSizeBytes int
 
 	// QOSQueue is the quality of service queue used to enqueue
 	QOSQueue  QOSEnqueuer
 	QOSConfig QueueConfig
-
-	OwnsIndexFn func(key NamespacedResource) (bool, error)
 }
 
 func NewResourceServer(opts ResourceServerOptions) (*server, error) {
@@ -342,23 +343,25 @@ func NewResourceServer(opts ResourceServerOptions) (*server, error) {
 		ctx:              ctx,
 		cancel:           cancel,
 		storageMetrics:   opts.storageMetrics,
-		indexMetrics:     opts.IndexMetrics,
 		maxPageSizeBytes: opts.MaxPageSizeBytes,
 		reg:              opts.Reg,
 		queue:            opts.QOSQueue,
 		queueConfig:      opts.QOSConfig,
 		overridesService: opts.OverridesService,
+		search:           opts.Search,
 
-		artificialSuccessfulWriteDelay: opts.Search.IndexMinUpdateInterval,
+		artificialSuccessfulWriteDelay: opts.SearchOptions.IndexMinUpdateInterval,
 	}
 
-	if opts.Search.Resources != nil {
-		var err error
-		s.search, err = newSearchSupport(opts.Search, s.backend, s.access, s.blob, opts.IndexMetrics, opts.OwnsIndexFn)
-		if err != nil {
-			return nil, err
+	/*
+		if opts.Search.Resources != nil {
+			var err error
+			s.search, err = newSearchSupport(opts.Search, s.backend, s.access, s.blob, opts.IndexMetrics, opts.OwnsIndexFn)
+			if err != nil {
+				return nil, err
+			}
 		}
-	}
+	*/
 
 	err := s.Init(ctx)
 	if err != nil {
@@ -376,7 +379,7 @@ type server struct {
 	backend          StorageBackend
 	blob             BlobSupport
 	secure           secrets.InlineSecureValueSupport
-	search           *searchSupport
+	search           SearchServer
 	diagnostics      resourcepb.DiagnosticsServer
 	access           claims.AccessClient
 	writeHooks       WriteAccessHooks
@@ -423,11 +426,6 @@ func (s *server) Init(ctx context.Context) error {
 			s.initErr = s.overridesService.init(ctx)
 		}
 
-		// initialize the search index
-		if s.initErr == nil && s.search != nil {
-			s.initErr = s.search.init(ctx)
-		}
-
 		// Start watching for changes
 		if s.initErr == nil {
 			s.initErr = s.initWatcher()
@@ -452,10 +450,6 @@ func (s *server) Stop(ctx context.Context) error {
 		}
 	}
 
-	if s.search != nil {
-		s.search.stop()
-	}
-
 	if s.overridesService != nil {
 		if err := s.overridesService.stop(ctx); err != nil {
 			stopFailed = true
@@ -1043,6 +1037,68 @@ func (s *server) List(ctx context.Context, req *resourcepb.ListRequest) (*resour
 		return rsp, nil
 	}
 
+	// Remove metadata.namespace filter from requirement fields, if it's present.
+	for ix := 0; ix < len(req.Options.Fields); {
+		v := req.Options.Fields[ix]
+		if v.Key == "metadata.namespace" && v.Operator == "=" {
+			if len(v.Values) == 1 && v.Values[0] == req.Options.Key.Namespace {
+				// Remove this requirement from fields, as it's implied by the key.namespace.
+				req.Options.Fields = append(req.Options.Fields[:ix], req.Options.Fields[ix+1:]...)
+				// Don't increment ix, as we're removing an element from the slice.
+				continue
+			}
+		}
+		ix++
+	}
+
+	// TODO: What to do about RV and version_match fields?
+	// If we get here, we're doing list with selectable fields. Let's do search instead, since
+	// we index all selectable fields, and fetch resulting documents one by one.
+	if s.search != nil && req.Source == resourcepb.ListRequest_STORE && (len(req.Options.Fields) > 0) {
+		if req.Options.Key.Namespace == "" {
+			return &resourcepb.ListResponse{
+				Error: NewBadRequestError("namespace must be specified for list with filter"),
+			}, nil
+		}
+
+		srq := &resourcepb.ResourceSearchRequest{
+			Options: req.Options,
+			//Federated: nil,
+			Limit: req.Limit,
+			// Offset:     req.NextPageToken, // TODO
+			// Page:       0,
+			// Permission: 0, // Not needed, default is List
+		}
+
+		searchResp, err := s.search.Search(ctx, srq)
+		if err != nil {
+			return nil, err
+		}
+
+		rsp := &resourcepb.ListResponse{}
+		// Using searchResp.GetResults().GetRows() will not panic if anything is nil on the path.
+		for _, row := range searchResp.GetResults().GetRows() {
+			// TODO: use batch reading
+			val, err := s.Read(ctx, &resourcepb.ReadRequest{
+				Key:             row.Key,
+				ResourceVersion: row.ResourceVersion,
+			})
+			if err != nil {
+				return &resourcepb.ListResponse{Error: AsErrorResult(err)}, nil
+			}
+			if len(val.Value) > 0 {
+				rsp.Items = append(rsp.Items, &resourcepb.ResourceWrapper{
+					Value:           val.Value,
+					ResourceVersion: val.ResourceVersion,
+				})
+				if val.ResourceVersion > rsp.ResourceVersion {
+					rsp.ResourceVersion = val.ResourceVersion
+				}
+			}
+		}
+		return rsp, nil
+	}
+
 	if req.Limit < 1 {
 		req.Limit = 500 // default max 500 items in a page
 	}
@@ -1371,47 +1427,6 @@ func (s *server) Watch(req *resourcepb.WatchRequest, srv resourcepb.ResourceStor
 	}
 }
 
-func (s *server) Search(ctx context.Context, req *resourcepb.ResourceSearchRequest) (*resourcepb.ResourceSearchResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.Search(ctx, req)
-}
-
-// GetStats implements ResourceServer.
-func (s *server) GetStats(ctx context.Context, req *resourcepb.ResourceStatsRequest) (*resourcepb.ResourceStatsResponse, error) {
-	if err := s.Init(ctx); err != nil {
-		return nil, err
-	}
-
-	if s.search == nil {
-		// If the backend implements "GetStats", we can use it
-		srv, ok := s.backend.(resourcepb.ResourceIndexServer)
-		if ok {
-			return srv.GetStats(ctx, req)
-		}
-		return nil, fmt.Errorf("search index not configured")
-	}
-	return s.search.GetStats(ctx, req)
-}
-
-func (s *server) ListManagedObjects(ctx context.Context, req *resourcepb.ListManagedObjectsRequest) (*resourcepb.ListManagedObjectsResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.ListManagedObjects(ctx, req)
-}
-
-func (s *server) CountManagedObjects(ctx context.Context, req *resourcepb.CountManagedObjectsRequest) (*resourcepb.CountManagedObjectsResponse, error) {
-	if s.search == nil {
-		return nil, fmt.Errorf("search index not configured")
-	}
-
-	return s.search.CountManagedObjects(ctx, req)
-}
-
 // IsHealthy implements ResourceServer.
 func (s *server) IsHealthy(ctx context.Context, req *resourcepb.HealthCheckRequest) (*resourcepb.HealthCheckResponse, error) {
 	return s.diagnostics.IsHealthy(ctx, req)

pkg/storage/unified/resource/storage_backend.go

@@ -59,7 +59,6 @@ type kvStorageBackend struct {
 	dataStore                    *dataStore
 	eventStore                   *eventStore
 	notifier                     *notifier
-	builder                      DocumentBuilder
 	log                          logging.Logger
 	withPruner                   bool
 	eventRetentionPeriod         time.Duration
@@ -109,8 +108,7 @@ func NewKVStorageBackend(opts KVBackendOptions) (StorageBackend, error) {
 		eventStore:                   eventStore,
 		notifier:                     newNotifier(eventStore, notifierOptions{}),
 		snowflake:                    s,
-		builder:                      StandardDocumentBuilder(), // For now we use the standard document builder.
-		log:                          &logging.NoOpLogger{},     // Make this configurable
+		log:                          &logging.NoOpLogger{}, // Make this configurable
 		eventRetentionPeriod:         eventRetentionPeriod,
 		eventPruningInterval:         eventPruningInterval,
 		withExperimentalClusterScope: opts.WithExperimentalClusterScope,

pkg/storage/unified/search/bleve.go

@@ -93,6 +93,8 @@ type bleveBackend struct {
 
 	indexMetrics *resource.BleveIndexMetrics
 
+	selectableFields map[string][]string
+
 	bgTasksCancel func()
 	bgTasksWg     sync.WaitGroup
 }
@@ -135,11 +137,12 @@ func NewBleveBackend(opts BleveOptions, indexMetrics *resource.BleveIndexMetrics
 	}
 
 	be := &bleveBackend{
-		log:          l,
-		cache:        map[resource.NamespacedResource]*bleveIndex{},
-		opts:         opts,
-		ownsIndexFn:  ownFn,
-		indexMetrics: indexMetrics,
+		log:              l,
+		cache:            map[resource.NamespacedResource]*bleveIndex{},
+		opts:             opts,
+		ownsIndexFn:      ownFn,
+		indexMetrics:     indexMetrics,
+		selectableFields: resource.SelectableFields(),
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -366,7 +369,9 @@ func (b *bleveBackend) BuildIndex(
 		attribute.String("reason", indexBuildReason),
 	)
 
-	mapper, err := GetBleveMappings(fields)
+	selectableFields := b.selectableFields[fmt.Sprintf("%s/%s", key.Group, key.Resource)]
+
+	mapper, err := GetBleveMappings(fields, selectableFields)
 	if err != nil {
 		return nil, err
 	}
@@ -459,7 +464,7 @@ func (b *bleveBackend) BuildIndex(
 	}
 
 	// Batch all the changes
-	idx := b.newBleveIndex(key, index, newIndexType, fields, allFields, standardSearchFields, updater, b.log.New("namespace", key.Namespace, "group", key.Group, "resource", key.Resource))
+	idx := b.newBleveIndex(key, index, newIndexType, fields, allFields, standardSearchFields, selectableFields, updater, b.log.New("namespace", key.Namespace, "group", key.Group, "resource", key.Resource))
 
 	if build {
 		if b.indexMetrics != nil {
@@ -699,8 +704,9 @@ type bleveIndex struct {
 	// Subsequent update requests only trigger new update if minUpdateInterval has elapsed.
 	nextUpdateTime time.Time
 
-	standard resource.SearchableDocumentFields
-	fields   resource.SearchableDocumentFields
+	standard         resource.SearchableDocumentFields
+	fields           resource.SearchableDocumentFields
+	selectableFields []string
 
 	indexStorage string // memory or file, used when updating metrics
 
@@ -736,6 +742,7 @@ func (b *bleveBackend) newBleveIndex(
 	fields resource.SearchableDocumentFields,
 	allFields []*resourcepb.ResourceTableColumnDefinition,
 	standardSearchFields resource.SearchableDocumentFields,
+	selectableFields []string,
 	updaterFn resource.UpdateFn,
 	logger log.Logger,
 ) *bleveIndex {
@@ -745,6 +752,7 @@ func (b *bleveBackend) newBleveIndex(
 		indexStorage:      newIndexType,
 		fields:            fields,
 		allFields:         allFields,
+		selectableFields:  selectableFields,
 		standard:          standardSearchFields,
 		logger:            logger,
 		updaterFn:         updaterFn,
@@ -1215,7 +1223,11 @@ func (b *bleveIndex) toBleveSearchRequest(ctx context.Context, req *resourcepb.R
 	// filters
 	if len(req.Options.Fields) > 0 {
 		for _, v := range req.Options.Fields {
-			q, err := requirementQuery(v, "")
+			prefix := ""
+			if b.isSelectableField(v.Key) {
+				prefix = "selectable_fields."
+			}
+			q, err := requirementQuery(v, prefix)
 			if err != nil {
 				return nil, err
 			}
@@ -1787,6 +1799,15 @@ func (b *bleveIndex) hitsToTable(ctx context.Context, selectFields []string, hit
 	return table, nil
 }
 
+func (b *bleveIndex) isSelectableField(key string) bool {
+	for _, f := range b.selectableFields {
+		if key == f {
+			return true
+		}
+	}
+	return false
+}
+
 func getAllFields(standard resource.SearchableDocumentFields, custom resource.SearchableDocumentFields) ([]*resourcepb.ResourceTableColumnDefinition, error) {
 	fields := []*resourcepb.ResourceTableColumnDefinition{
 		standard.Field(resource.SEARCH_FIELD_ID),

pkg/storage/unified/search/bleve_mappings.go

@@ -10,19 +10,19 @@ import (
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
-func GetBleveMappings(fields resource.SearchableDocumentFields) (mapping.IndexMapping, error) {
+func GetBleveMappings(fields resource.SearchableDocumentFields, selectableFields []string) (mapping.IndexMapping, error) {
 	mapper := bleve.NewIndexMapping()
 
 	err := RegisterCustomAnalyzers(mapper)
 	if err != nil {
 		return nil, err
 	}
-	mapper.DefaultMapping = getBleveDocMappings(fields)
+	mapper.DefaultMapping = getBleveDocMappings(fields, selectableFields)
 
 	return mapper, nil
 }
 
-func getBleveDocMappings(fields resource.SearchableDocumentFields) *mapping.DocumentMapping {
+func getBleveDocMappings(fields resource.SearchableDocumentFields, selectableFields []string) *mapping.DocumentMapping {
 	mapper := bleve.NewDocumentStaticMapping()
 
 	nameMapping := &mapping.FieldMapping{
@@ -165,5 +165,73 @@ func getBleveDocMappings(fields resource.SearchableDocumentFields) *mapping.Docu
 
 	mapper.AddSubDocumentMapping("fields", fieldMapper)
 
+	selectableFieldsMapper := bleve.NewDocumentStaticMapping()
+	for _, field := range selectableFields {
+		selectableFieldsMapper.AddFieldMappingsAt(field, &mapping.FieldMapping{
+			Name:     field,
+			Type:     "text",
+			Analyzer: keyword.Name,
+			Store:    false,
+			Index:    true,
+		})
+	}
+	mapper.AddSubDocumentMapping("selectable_fields", selectableFieldsMapper)
+
 	return mapper
 }
+
+/*
+Here's a tree representation of the field mappings in pkg/storage/unified/search/bleve_mappings.go:
+
+  Document Root (DefaultMapping)
+  │
+  ├── name [text, keyword analyzer]
+  │
+  ├── title_phrase [keyword, not stored]
+  │
+  ├── title [3 mappings]
+  │   ├── [1] standard analyzer, stored
+  │   ├── [2] TITLE_ANALYZER (edge ngram), not stored
+  │   └── [3] keyword, not stored
+  │
+  ├── description [text, stored]
+  │
+  ├── tags [text, keyword analyzer, stored, includeInAll]
+  │
+  ├── folder [text, keyword analyzer, stored, includeInAll, docValues]
+  │
+  ├── managedBy [text, keyword analyzer, not stored]
+  │
+  ├── source/ [sub-document]
+  │   ├── path [text, keyword analyzer, stored]
+  │   ├── checksum [text, keyword analyzer, stored]
+  │   └── timestampMillis [numeric]
+  │
+  ├── manager/ [sub-document]
+  │   ├── kind [text, keyword analyzer, stored, includeInAll]
+  │   └── id [text, keyword analyzer, stored, includeInAll]
+  │
+  ├── reference/ [sub-document, default analyzer: keyword]
+  │   └── (dynamic fields inherit keyword analyzer)
+  │
+  ├── labels/ [sub-document]
+  │   └── (dynamic fields)
+  │
+  └── fields/ [sub-document]
+      └── (conditional mappings)
+          ├── {filterable string fields} [keyword, stored]
+          └── {other fields} [dynamically mapped by Bleve]
+
+  Key observations:
+
+  - Root level has standard searchable fields (name, title, description, tags, folder)
+  - title has 3 analyzers applied: standard (for word search), edge ngram (for prefix search), and keyword (for phrase sorting)
+  - source/, manager/: Static sub-documents with explicitly mapped fields
+  - reference/: Dynamic sub-document with keyword default analyzer (line 142)
+  - labels/, fields/: Dynamic sub-documents where Bleve auto-detects field types at index time
+
+  References:
+  - Main mapping function: pkg/storage/unified/search/bleve_mappings.go:25-169
+  - Sub-document mappings: lines 88-143
+  - Dynamic fields handling: lines 148-166
+*/

pkg/storage/unified/search/bleve_mappings_test.go

@@ -13,7 +13,7 @@ import (
 )
 
 func TestDocumentMapping(t *testing.T) {
-	mappings, err := search.GetBleveMappings(nil)
+	mappings, err := search.GetBleveMappings(nil, nil)
 	require.NoError(t, err)
 	data := resource.IndexableDocument{
 		Title:       "title",

pkg/storage/unified/search/builders/dashboard.go

@@ -264,7 +264,7 @@ func (s *DashboardDocumentBuilder) BuildDocument(ctx context.Context, key *resou
 	summary.UID = obj.GetName()
 	summary.ID = obj.GetDeprecatedInternalID() // nolint:staticcheck
 
-	doc := resource.NewIndexableDocument(key, rv, obj)
+	doc := resource.NewIndexableDocument(key, rv, obj, nil)
 	doc.Title = summary.Title
 	doc.Description = summary.Description
 	doc.Tags = summary.Tags

pkg/storage/unified/search/builders/document_test.go

@@ -115,7 +115,7 @@ func TestDashboardDocumentBuilder(t *testing.T) {
 		"aaa",
 	})
 
-	builder = resource.StandardDocumentBuilder()
+	builder = resource.StandardDocumentBuilder(nil)
 	doSnapshotTests(t, builder, "folder", &resourcepb.ResourceKey{
 		Namespace: "default",
 		Group:     "folder.grafana.app",

pkg/storage/unified/search/builders/external_group_mapping.go

@@ -66,7 +66,7 @@ func (u *extGroupMappingDocumentBuilder) BuildDocument(ctx context.Context, key
 		return nil, err
 	}
 
-	doc := resource.NewIndexableDocument(key, rv, obj)
+	doc := resource.NewIndexableDocument(key, rv, obj, nil)
 
 	doc.Fields = make(map[string]any)
 	if extGroupMapping.Spec.TeamRef.Name != "" {

pkg/storage/unified/search/builders/team_search.go

@@ -70,7 +70,7 @@ func (t *teamSearchBuilder) BuildDocument(ctx context.Context, key *resourcepb.R
 		return nil, err
 	}
 
-	doc := resource.NewIndexableDocument(key, rv, obj)
+	doc := resource.NewIndexableDocument(key, rv, obj, nil)
 
 	doc.Fields = make(map[string]any)
 	if team.Spec.Email != "" {

pkg/storage/unified/search/builders/user.go

@@ -66,7 +66,7 @@ func (u *userDocumentBuilder) BuildDocument(ctx context.Context, key *resourcepb
 		return nil, err
 	}
 
-	doc := resource.NewIndexableDocument(key, rv, obj)
+	doc := resource.NewIndexableDocument(key, rv, obj, nil)
 
 	doc.Fields = make(map[string]any)
 	if user.Spec.Email != "" {

pkg/storage/unified/search/document.go

@@ -25,7 +25,7 @@ func (s *StandardDocumentBuilders) GetDocumentBuilders() ([]resource.DocumentBui
 
 	result := []resource.DocumentBuilderInfo{
 		{
-			Builder: resource.StandardDocumentBuilder(),
+			Builder: resource.StandardDocumentBuilder(resource.AppManifests()),
 		},
 	}
 	return append(result, all...), nil

pkg/storage/unified/sql/server.go

@@ -46,7 +46,7 @@ type ServerOptions struct {
 	OwnsIndexFn      func(key resource.NamespacedResource) (bool, error)
 }
 
-func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
+func NewResourceServer(opts ServerOptions) (resource.ResourceServer, resource.SearchServer, error) {
 	apiserverCfg := opts.Cfg.SectionWithEnvOverrides("grafana-apiserver")
 
 	if opts.SecureValues == nil && opts.Cfg != nil && opts.Cfg.SecretsManagement.GrpcClientEnable {
@@ -57,7 +57,7 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 			nil, // not needed for gRPC client mode
 		)
 		if err != nil {
-			return nil, fmt.Errorf("failed to create inline secure value service: %w", err)
+			return nil, nil, fmt.Errorf("failed to create inline secure value service: %w", err)
 		}
 		opts.SecureValues = inlineSecureValueService
 	}
@@ -77,7 +77,7 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 		dir := strings.Replace(serverOptions.Blob.URL, "./data", opts.Cfg.DataPath, 1)
 		err := os.MkdirAll(dir, 0700)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		serverOptions.Blob.URL = "file:///" + dir
 	}
@@ -94,7 +94,7 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 	} else {
 		eDB, err := dbimpl.ProvideResourceDB(opts.DB, opts.Cfg, opts.Tracer)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		isHA := isHighAvailabilityEnabled(opts.Cfg.SectionWithEnvOverrides("database"),
@@ -108,20 +108,31 @@ func NewResourceServer(opts ServerOptions) (resource.ResourceServer, error) {
 			LastImportTimeMaxAge: opts.SearchOptions.MaxIndexAge, // No need to keep last_import_times older than max index age.
 		})
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		serverOptions.Backend = backend
 		serverOptions.Diagnostics = backend
 		serverOptions.Lifecycle = backend
 	}
 
-	serverOptions.Search = opts.SearchOptions
-	serverOptions.IndexMetrics = opts.IndexMetrics
+	search, err := resource.NewSearchServer(opts.SearchOptions, opts.Backend, opts.AccessClient, nil, opts.IndexMetrics, opts.OwnsIndexFn)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to initialize search: %w", err)
+	}
+
+	if err := search.Init(context.Background()); err != nil {
+		return nil, nil, fmt.Errorf("failed to initialize search: %w", err)
+	}
+
+	serverOptions.Search = search
 	serverOptions.QOSQueue = opts.QOSQueue
-	serverOptions.OwnsIndexFn = opts.OwnsIndexFn
 	serverOptions.OverridesService = opts.OverridesService
 
-	return resource.NewResourceServer(serverOptions)
+	rs, err := resource.NewResourceServer(serverOptions)
+	if err != nil {
+		_ = search.Stop(context.Background())
+	}
+	return rs, nil, err
 }
 
 // isHighAvailabilityEnabled determines if high availability mode should

pkg/storage/unified/sql/service.go

@@ -291,7 +291,7 @@ func (s *service) starting(ctx context.Context) error {
 		serverOptions.OverridesService = overridesSvc
 	}
 
-	server, err := NewResourceServer(serverOptions)
+	server, searchServer, err := NewResourceServer(serverOptions)
 	if err != nil {
 		return err
 	}
@@ -308,8 +308,8 @@ func (s *service) starting(ctx context.Context) error {
 	srv := s.handler.GetServer()
 	resourcepb.RegisterResourceStoreServer(srv, server)
 	resourcepb.RegisterBulkStoreServer(srv, server)
-	resourcepb.RegisterResourceIndexServer(srv, server)
-	resourcepb.RegisterManagedObjectIndexServer(srv, server)
+	resourcepb.RegisterResourceIndexServer(srv, searchServer)
+	resourcepb.RegisterManagedObjectIndexServer(srv, searchServer)
 	resourcepb.RegisterBlobStoreServer(srv, server)
 	resourcepb.RegisterDiagnosticsServer(srv, server)
 	resourcepb.RegisterQuotasServer(srv, server)

pkg/tests/apis/provisioning/fieldselector_test.go

@@ -1,211 +0,0 @@
-package provisioning
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	"github.com/grafana/grafana/pkg/util/testutil"
-)
-
-// TestIntegrationProvisioning_RepositoryFieldSelector tests that fieldSelector
-// works correctly for Repository resources. This prevents regression where
-// fieldSelector=metadata.name=<name> was not working properly.
-func TestIntegrationProvisioning_RepositoryFieldSelector(t *testing.T) {
-	testutil.SkipIntegrationTestInShortMode(t)
-
-	helper := runGrafana(t)
-	ctx := context.Background()
-
-	// Create multiple repositories for testing
-	repo1Name := "repo-selector-test-1"
-	repo2Name := "repo-selector-test-2"
-	repo3Name := "repo-selector-test-3"
-
-	// Create first repository
-	repo1 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
-		"Name":        repo1Name,
-		"SyncEnabled": false, // Disable sync to speed up test
-	})
-	_, err := helper.Repositories.Resource.Create(ctx, repo1, metav1.CreateOptions{})
-	require.NoError(t, err, "failed to create first repository")
-	helper.WaitForHealthyRepository(t, repo1Name)
-
-	// Create second repository
-	repo2 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
-		"Name":        repo2Name,
-		"SyncEnabled": false,
-	})
-	_, err = helper.Repositories.Resource.Create(ctx, repo2, metav1.CreateOptions{})
-	require.NoError(t, err, "failed to create second repository")
-	helper.WaitForHealthyRepository(t, repo2Name)
-
-	// Create third repository
-	repo3 := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
-		"Name":        repo3Name,
-		"SyncEnabled": false,
-	})
-	_, err = helper.Repositories.Resource.Create(ctx, repo3, metav1.CreateOptions{})
-	require.NoError(t, err, "failed to create third repository")
-	helper.WaitForHealthyRepository(t, repo3Name)
-
-	// Verify all repositories were created
-	allRepos, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{})
-	require.NoError(t, err, "should be able to list all repositories")
-	require.GreaterOrEqual(t, len(allRepos.Items), 3, "should have at least 3 repositories")
-
-	t.Run("should filter by metadata.name and return single repository", func(t *testing.T) {
-		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=" + repo2Name,
-		})
-		require.NoError(t, err, "fieldSelector query should succeed")
-		require.Len(t, list.Items, 1, "should return exactly one repository")
-		require.Equal(t, repo2Name, list.Items[0].GetName(), "should return the correct repository")
-	})
-
-	t.Run("should filter by different metadata.name", func(t *testing.T) {
-		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=" + repo1Name,
-		})
-		require.NoError(t, err, "fieldSelector query should succeed")
-		require.Len(t, list.Items, 1, "should return exactly one repository")
-		require.Equal(t, repo1Name, list.Items[0].GetName(), "should return the first repository")
-	})
-
-	t.Run("should return empty when fieldSelector does not match any repository", func(t *testing.T) {
-		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=non-existent-repository",
-		})
-		require.NoError(t, err, "fieldSelector query should succeed even with no matches")
-		require.Empty(t, list.Items, "should return empty list when no repositories match")
-	})
-
-	t.Run("listing without fieldSelector should return all repositories", func(t *testing.T) {
-		list, err := helper.Repositories.Resource.List(ctx, metav1.ListOptions{})
-		require.NoError(t, err, "should be able to list without fieldSelector")
-		require.GreaterOrEqual(t, len(list.Items), 3, "should return all repositories when no filter is applied")
-
-		// Verify our test repositories are in the list
-		names := make(map[string]bool)
-		for _, item := range list.Items {
-			names[item.GetName()] = true
-		}
-		require.True(t, names[repo1Name], "should contain repo1")
-		require.True(t, names[repo2Name], "should contain repo2")
-		require.True(t, names[repo3Name], "should contain repo3")
-	})
-}
-
-// TestIntegrationProvisioning_JobFieldSelector tests that fieldSelector
-// works correctly for Job resources. This prevents regression where
-// fieldSelector=metadata.name=<name> was not working properly.
-func TestIntegrationProvisioning_JobFieldSelector(t *testing.T) {
-	testutil.SkipIntegrationTestInShortMode(t)
-
-	helper := runGrafana(t)
-	ctx := context.Background()
-
-	// Create a repository to trigger jobs
-	repoName := "job-selector-test-repo"
-	repo := helper.RenderObject(t, "testdata/local-write.json.tmpl", map[string]any{
-		"Name":        repoName,
-		"SyncEnabled": false,
-	})
-	_, err := helper.Repositories.Resource.Create(ctx, repo, metav1.CreateOptions{})
-	require.NoError(t, err, "failed to create repository")
-	helper.WaitForHealthyRepository(t, repoName)
-
-	// Copy some test files to trigger jobs
-	helper.CopyToProvisioningPath(t, "testdata/all-panels.json", "job-test-dashboard-1.json")
-	helper.CopyToProvisioningPath(t, "testdata/text-options.json", "job-test-dashboard-2.json")
-
-	// Trigger multiple jobs to have multiple job resources
-	job1Spec := provisioning.JobSpec{
-		Action: provisioning.JobActionPull,
-		Pull:   &provisioning.SyncJobOptions{},
-	}
-
-	// Trigger first job
-	body1 := asJSON(job1Spec)
-	result1 := helper.AdminREST.Post().
-		Namespace("default").
-		Resource("repositories").
-		Name(repoName).
-		SubResource("jobs").
-		Body(body1).
-		SetHeader("Content-Type", "application/json").
-		Do(ctx)
-	require.NoError(t, result1.Error(), "should be able to trigger first job")
-
-	obj1, err := result1.Get()
-	require.NoError(t, err, "should get first job object")
-	job1 := obj1.(*unstructured.Unstructured)
-	job1Name := job1.GetName()
-	require.NotEmpty(t, job1Name, "first job should have a name")
-
-	// Wait for first job to complete before starting second
-	helper.AwaitJobs(t, repoName)
-
-	// Trigger second job
-	result2 := helper.AdminREST.Post().
-		Namespace("default").
-		Resource("repositories").
-		Name(repoName).
-		SubResource("jobs").
-		Body(body1).
-		SetHeader("Content-Type", "application/json").
-		Do(ctx)
-	require.NoError(t, result2.Error(), "should be able to trigger second job")
-
-	obj2, err := result2.Get()
-	require.NoError(t, err, "should get second job object")
-	job2 := obj2.(*unstructured.Unstructured)
-	job2Name := job2.GetName()
-	require.NotEmpty(t, job2Name, "second job should have a name")
-
-	t.Run("should filter by metadata.name and return single job", func(t *testing.T) {
-		// Note: Jobs are ephemeral and may complete quickly, so we test while they exist
-		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=" + job2Name,
-		})
-		require.NoError(t, err, "fieldSelector query should succeed")
-
-		// The job might have completed already, but if it exists, it should be the only one
-		if len(list.Items) > 0 {
-			require.Len(t, list.Items, 1, "should return at most one job")
-			require.Equal(t, job2Name, list.Items[0].GetName(), "should return the correct job")
-		}
-	})
-
-	t.Run("should filter by different metadata.name", func(t *testing.T) {
-		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=" + job1Name,
-		})
-		require.NoError(t, err, "fieldSelector query should succeed")
-
-		// The job might have completed already, but if it exists, it should be the only one
-		if len(list.Items) > 0 {
-			require.Len(t, list.Items, 1, "should return at most one job")
-			require.Equal(t, job1Name, list.Items[0].GetName(), "should return the first job")
-		}
-	})
-
-	t.Run("should return empty when fieldSelector does not match any job", func(t *testing.T) {
-		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{
-			FieldSelector: "metadata.name=non-existent-job",
-		})
-		require.NoError(t, err, "fieldSelector query should succeed even with no matches")
-		require.Empty(t, list.Items, "should return empty list when no jobs match")
-	})
-
-	t.Run("listing without fieldSelector should work", func(t *testing.T) {
-		list, err := helper.Jobs.Resource.List(ctx, metav1.ListOptions{})
-		require.NoError(t, err, "should be able to list without fieldSelector")
-		// Jobs may have completed, so we don't assert on count, just that the query works
-		t.Logf("Found %d active jobs without filter", len(list.Items))
-	})
-}

public/app/features/alerting/unified/components/assistant/AnalizeRuleButton.tsx

@@ -59,7 +59,7 @@ function AnalyzeRuleButtonView({
     });
 
     openAssistant({
-      origin: 'alerting/analyze-rule-menu-item',
+      origin: 'alerting',
       mode: 'assistant',
       prompt: analyzeRulePrompt,
       context: [alertContext],

public/app/features/alerting/unified/components/rules/RuleDetailsMatchingInstances.tsx

@@ -40,44 +40,26 @@ interface ShowMoreInstancesProps {
   stats: ShowMoreStats;
   onClick?: React.ComponentProps<typeof LinkButton>['onClick'];
   href?: React.ComponentProps<typeof LinkButton>['href'];
-  enableFiltering?: boolean;
-  alertState?: InstanceStateFilter;
 }
 
-function ShowMoreInstances({ stats, onClick, href, enableFiltering, alertState }: ShowMoreInstancesProps) {
+function ShowMoreInstances({ stats, onClick, href }: ShowMoreInstancesProps) {
   const styles = useStyles2(getStyles);
   const { visibleItemsCount, totalItemsCount } = stats;
 
   return (
     <div className={styles.footerRow}>
       <div>
-        {enableFiltering && alertState ? (
-          <Trans
-            i18nKey="alerting.rule-details-matching-instances.showing-count-with-state"
-            values={{ visibleItemsCount, alertState, totalItemsCount }}
-          >
-            Showing {{ visibleItemsCount }} {{ alertState }} out of {{ totalItemsCount }} instances
-          </Trans>
-        ) : (
-          <Trans
-            i18nKey="alerting.rule-details-matching-instances.showing-count"
-            values={{ visibleItemsCount, totalItemsCount }}
-          >
-            Showing {{ visibleItemsCount }} out of {{ totalItemsCount }} instances
-          </Trans>
-        )}
+        <Trans
+          i18nKey="alerting.rule-details-matching-instances.showing-count"
+          values={{ visibleItemsCount, totalItemsCount }}
+        >
+          Showing {{ visibleItemsCount }} out of {{ totalItemsCount }} instances
+        </Trans>
       </div>
       <LinkButton size="sm" variant="secondary" data-testid="show-all" onClick={onClick} href={href}>
-        {enableFiltering ? (
-          <Trans i18nKey="alerting.rule-details-matching-instances.button-show-all">Show all</Trans>
-        ) : (
-          <Trans
-            i18nKey="alerting.rule-details-matching-instances.button-show-all-instances"
-            values={{ totalItemsCount }}
-          >
-            Show all {{ totalItemsCount }} alert instances
-          </Trans>
-        )}
+        <Trans i18nKey="alerting.rule-details-matching-instances.button-show-all" values={{ totalItemsCount }}>
+          Show all {{ totalItemsCount }} alert instances
+        </Trans>
       </LinkButton>
     </div>
   );
@@ -146,8 +128,6 @@ export function RuleDetailsMatchingInstances(props: Props) {
       stats={stats}
       onClick={enableFiltering ? resetFilter : undefined}
       href={!enableFiltering ? ruleViewPageLink : undefined}
-      enableFiltering={enableFiltering}
-      alertState={alertState}
     />
   ) : undefined;
 

public/app/features/dashboard-scene/edit-pane/shared.ts

@@ -245,29 +245,10 @@ export const dashboardEditActions = {
     description: t('dashboard.variable.description.action', 'Change variable description'),
     prop: 'description',
   }),
-  changeVariableHideValue({ source, oldValue, newValue }: EditActionProps<SceneVariable, 'hide'>) {
-    const variableSet = source.parent;
-    const variablesBeforeChange =
-      variableSet instanceof SceneVariableSet ? [...(variableSet.state.variables ?? [])] : undefined;
-
-    dashboardEditActions.edit({
-      description: t('dashboard.variable.hide.action', 'Change variable hide option'),
-      source,
-      perform: () => {
-        source.setState({ hide: newValue });
-        // Updating the variables set since components that show/hide variables subscribe to the variable set, not the individual variables.
-        if (variableSet instanceof SceneVariableSet) {
-          variableSet.setState({ variables: [...(variableSet.state.variables ?? [])] });
-        }
-      },
-      undo: () => {
-        source.setState({ hide: oldValue });
-        if (variableSet instanceof SceneVariableSet && variablesBeforeChange) {
-          variableSet.setState({ variables: variablesBeforeChange });
-        }
-      },
-    });
-  },
+  changeVariableHideValue: makeEditAction<SceneVariable, 'hide'>({
+    description: t('dashboard.variable.hide.action', 'Change variable hide option'),
+    prop: 'hide',
+  }),
 
   moveElement(props: MoveElementActionHelperProps) {
     const { movedObject, source, perform, undo } = props;

public/app/features/dashboard-scene/scene/DataLayerControl.tsx

@@ -64,7 +64,6 @@ const getStyles = (theme: GrafanaTheme2) => ({
     display: 'flex',
     alignItems: 'center',
     gap: theme.spacing(1),
-    padding: theme.spacing(1),
   }),
   controlWrapper: css({
     height: theme.spacing(2),

public/app/features/dashboard-scene/scene/VariableControls.tsx

@@ -82,39 +82,19 @@ export function VariableValueSelectWrapper({ variable, inMenu }: VariableSelectP
   // For switch variables in menu, we want to show the switch on the left and the label on the right
   if (inMenu && sceneUtils.isSwitchVariable(variable)) {
     return (
-      <div
-        className={cx(
-          styles.switchMenuContainer,
-          isSelected && 'dashboard-selected-element',
-          isSelectable && !isSelected && 'dashboard-selectable-element'
-        )}
-        onPointerDown={onPointerDown}
-        data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}
-      >
+      <div className={styles.switchMenuContainer} data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}>
         <div className={styles.switchControl}>
           <variable.Component model={variable} />
         </div>
-        <VariableLabel
-          variable={variable}
-          layout={'vertical'}
-          className={cx(isSelectable && styles.labelSelectable, styles.switchLabel)}
-        />
+        <VariableLabel variable={variable} layout={'vertical'} className={styles.switchLabel} />
       </div>
     );
   }
 
   if (inMenu) {
     return (
-      <div
-        className={cx(
-          styles.verticalContainer,
-          isSelected && 'dashboard-selected-element',
-          isSelectable && !isSelected && 'dashboard-selectable-element'
-        )}
-        onPointerDown={onPointerDown}
-        data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}
-      >
-        <VariableLabel variable={variable} layout={'vertical'} className={cx(isSelectable && styles.labelSelectable)} />
+      <div className={styles.verticalContainer} data-testid={selectors.pages.Dashboard.SubMenu.submenuItem}>
+        <VariableLabel variable={variable} layout={'vertical'} />
         <variable.Component model={variable} />
       </div>
     );
@@ -184,13 +164,11 @@ const getStyles = (theme: GrafanaTheme2) => ({
   verticalContainer: css({
     display: 'flex',
     flexDirection: 'column',
-    padding: theme.spacing(1),
   }),
   switchMenuContainer: css({
     display: 'flex',
     alignItems: 'center',
     gap: theme.spacing(1),
-    padding: theme.spacing(1),
   }),
   switchControl: css({
     '& > div': {

public/app/features/dashboard-scene/scene/dashboard-controls-menu/DashboardControlsMenu.tsx

@@ -1,4 +1,4 @@
-import { css } from '@emotion/css';
+import { css, cx } from '@emotion/css';
 
 import { GrafanaTheme2 } from '@grafana/data';
 import { SceneDataLayerProvider, SceneVariable } from '@grafana/scenes';
@@ -17,6 +17,8 @@ interface DashboardControlsMenuProps {
 }
 
 export function DashboardControlsMenu({ variables, links, annotations, dashboardUID }: DashboardControlsMenuProps) {
+  const styles = useStyles2(getStyles);
+
   return (
     <Box
       minWidth={32}
@@ -27,7 +29,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
       direction={'column'}
       borderRadius={'default'}
       backgroundColor={'primary'}
-      padding={1}
+      padding={1.5}
       gap={0.5}
       onClick={(e) => {
         // Normally, clicking the overlay closes the dropdown.
@@ -37,7 +39,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
     >
       {/* Variables */}
       {variables.map((variable, index) => (
-        <div key={variable.state.key}>
+        <div className={cx({ [styles.menuItem]: index > 0 })} key={variable.state.key}>
           <VariableValueSelectWrapper variable={variable} inMenu />
         </div>
       ))}
@@ -45,7 +47,7 @@ export function DashboardControlsMenu({ variables, links, annotations, dashboard
       {/* Annotation layers */}
       {annotations.length > 0 &&
         annotations.map((layer, index) => (
-          <div key={layer.state.key}>
+          <div className={cx({ [styles.menuItem]: variables.length > 0 || index > 0 })} key={layer.state.key}>
             <DataLayerControl layer={layer} inMenu />
           </div>
         ))}
@@ -77,7 +79,10 @@ function MenuDivider() {
 
 const getStyles = (theme: GrafanaTheme2) => ({
   divider: css({
-    marginTop: theme.spacing(1),
+    marginTop: theme.spacing(2),
     padding: theme.spacing(0, 0.5),
   }),
+  menuItem: css({
+    marginTop: theme.spacing(2),
+  }),
 });

public/app/features/provisioning/GettingStarted/GettingStarted.tsx

@@ -22,6 +22,7 @@ const featureIni = `# In your custom.ini file
 
 [feature_toggles]
 provisioning = true
+kubernetesDashboards = true ; use k8s from browser
 `;
 
 const ngrokExample = `ngrok http 3000
@@ -102,7 +103,7 @@ const getModalContent = (setupType: SetupType) => {
             ),
             description: t(
               'provisioning.getting-started.step-description-enable-feature-toggles',
-              'Add the provisioning feature toggle to your custom.ini file. Note: kubernetesDashboards is enabled by default, but if you have explicitly disabled it, you will need to enable it in your Grafana settings or remove the override from your configuration.'
+              'Add these settings to your custom.ini file to enable necessary features:'
             ),
             code: featureIni,
           },

public/app/features/scopes/ScopesService.test.ts

@@ -22,8 +22,8 @@ describe('ScopesService', () => {
     | undefined;
   let dashboardsStateSubscription:
     | ((
-        state: { navigationScope?: string; drawerOpened: boolean; navScopePath?: string[] },
-        prevState: { navigationScope?: string; drawerOpened: boolean; navScopePath?: string[] }
+        state: { navigationScope?: string; drawerOpened: boolean },
+        prevState: { navigationScope?: string; drawerOpened: boolean }
       ) => void)
     | undefined;
 
@@ -56,7 +56,7 @@ describe('ScopesService', () => {
         selectorStateSubscription = callback;
         return { unsubscribe: jest.fn() };
       }),
-      changeScopes: jest.fn().mockResolvedValue(undefined),
+      changeScopes: jest.fn(),
       resolvePathToRoot: jest.fn().mockResolvedValue({ path: [], tree: {} }),
     } as unknown as jest.Mocked<ScopesSelectorService>;
 
@@ -71,7 +71,6 @@ describe('ScopesService', () => {
         loading: false,
         searchQuery: '',
         navigationScope: undefined,
-        navScopePath: undefined,
       },
       stateObservable: new BehaviorSubject({
         drawerOpened: false,
@@ -83,14 +82,12 @@ describe('ScopesService', () => {
         loading: false,
         searchQuery: '',
         navigationScope: undefined,
-        navScopePath: undefined,
       }),
       subscribeToState: jest.fn((callback) => {
         dashboardsStateSubscription = callback;
         return { unsubscribe: jest.fn() };
       }),
       setNavigationScope: jest.fn(),
-      setNavScopePath: jest.fn(),
     } as unknown as jest.Mocked<ScopesDashboardsService>;
 
     locationService = {
@@ -191,7 +188,7 @@ describe('ScopesService', () => {
 
       service = new ScopesService(selectorService, dashboardsService, locationService);
 
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1');
     });
 
     it('should read navigation_scope along with other scope parameters', () => {
@@ -202,7 +199,7 @@ describe('ScopesService', () => {
 
       service = new ScopesService(selectorService, dashboardsService, locationService);
 
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1');
       expect(selectorService.changeScopes).toHaveBeenCalledWith(['scope1'], undefined, 'node1', false);
     });
 
@@ -216,45 +213,6 @@ describe('ScopesService', () => {
 
       expect(dashboardsService.setNavigationScope).not.toHaveBeenCalled();
     });
-
-    it('should read nav_scope_path along with navigation_scope from URL on init', () => {
-      locationService.getLocation = jest.fn().mockReturnValue({
-        pathname: '/test',
-        search: '?navigation_scope=navScope1&nav_scope_path=mimir%2Cloki',
-      });
-
-      service = new ScopesService(selectorService, dashboardsService, locationService);
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, ['mimir', 'loki']);
-    });
-
-    it('should handle nav_scope_path without navigation_scope by calling setNavScopePath after changeScopes', async () => {
-      locationService.getLocation = jest.fn().mockReturnValue({
-        pathname: '/test',
-        search: '?scopes=scope1&nav_scope_path=mimir',
-      });
-
-      service = new ScopesService(selectorService, dashboardsService, locationService);
-
-      // Wait for the changeScopes promise to resolve
-      await Promise.resolve();
-
-      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir']);
-    });
-
-    it('should handle URL-encoded nav_scope_path values', () => {
-      locationService.getLocation = jest.fn().mockReturnValue({
-        pathname: '/test',
-        search: '?navigation_scope=navScope1&nav_scope_path=' + encodeURIComponent('folder one,folder two'),
-      });
-
-      service = new ScopesService(selectorService, dashboardsService, locationService);
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, [
-        'folder one',
-        'folder two',
-      ]);
-    });
   });
 
   describe('URL synchronization', () => {
@@ -388,22 +346,16 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
-          navScopePath: undefined,
         },
         {
           navigationScope: undefined,
           drawerOpened: false,
-          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: 'navScope1',
-          nav_scope_path: null,
-        },
-        true
-      );
+      expect(locationService.partial).toHaveBeenCalledWith({
+        navigation_scope: 'navScope1',
+      });
     });
 
     it('should update navigation_scope in URL when navigationScope changes', () => {
@@ -415,22 +367,16 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope2',
           drawerOpened: true,
-          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
-          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: 'navScope2',
-          nav_scope_path: null,
-        },
-        true
-      );
+      expect(locationService.partial).toHaveBeenCalledWith({
+        navigation_scope: 'navScope2',
+      });
     });
 
     it('should not update URL when navigationScope has not changed', () => {
@@ -444,12 +390,10 @@ describe('ScopesService', () => {
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
-          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: false,
-          navScopePath: undefined,
         }
       );
 
@@ -465,126 +409,16 @@ describe('ScopesService', () => {
         {
           navigationScope: undefined,
           drawerOpened: false,
-          navScopePath: undefined,
         },
         {
           navigationScope: 'navScope1',
           drawerOpened: true,
-          navScopePath: undefined,
         }
       );
 
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: null,
-          nav_scope_path: null,
-        },
-        true
-      );
-    });
-
-    it('should write nav_scope_path to URL when navScopePath changes', () => {
-      if (!dashboardsStateSubscription) {
-        throw new Error('dashboardsStateSubscription not set');
-      }
-
-      dashboardsStateSubscription(
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: ['mimir', 'loki'],
-        },
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: undefined,
-        }
-      );
-
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: 'navScope1',
-          nav_scope_path: encodeURIComponent('mimir,loki'),
-        },
-        true
-      );
-    });
-
-    it('should update nav_scope_path in URL when navScopePath changes', () => {
-      if (!dashboardsStateSubscription) {
-        throw new Error('dashboardsStateSubscription not set');
-      }
-
-      dashboardsStateSubscription(
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: ['mimir', 'loki', 'tempo'],
-        },
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: ['mimir', 'loki'],
-        }
-      );
-
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: 'navScope1',
-          nav_scope_path: encodeURIComponent('mimir,loki,tempo'),
-        },
-        true
-      );
-    });
-
-    it('should clear nav_scope_path from URL when navScopePath becomes empty', () => {
-      if (!dashboardsStateSubscription) {
-        throw new Error('dashboardsStateSubscription not set');
-      }
-
-      dashboardsStateSubscription(
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: [],
-        },
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: ['mimir'],
-        }
-      );
-
-      expect(locationService.partial).toHaveBeenCalledWith(
-        {
-          navigation_scope: 'navScope1',
-          nav_scope_path: null,
-        },
-        true
-      );
-    });
-
-    it('should not update URL when only drawerOpened changes but navigationScope and navScopePath remain the same', () => {
-      if (!dashboardsStateSubscription) {
-        throw new Error('dashboardsStateSubscription not set');
-      }
-
-      jest.clearAllMocks();
-
-      dashboardsStateSubscription(
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: false,
-          navScopePath: ['mimir'],
-        },
-        {
-          navigationScope: 'navScope1',
-          drawerOpened: true,
-          navScopePath: ['mimir'],
-        }
-      );
-
-      expect(locationService.partial).not.toHaveBeenCalled();
+      expect(locationService.partial).toHaveBeenCalledWith({
+        navigation_scope: undefined,
+      });
     });
   });
 
@@ -623,113 +457,4 @@ describe('ScopesService', () => {
       );
     });
   });
-
-  describe('back/forward navigation handling', () => {
-    let locationSubject: BehaviorSubject<{ pathname: string; search: string }>;
-
-    beforeEach(() => {
-      locationSubject = new BehaviorSubject({
-        pathname: '/test',
-        search: '',
-      });
-
-      locationService.getLocation = jest.fn().mockReturnValue({
-        pathname: '/test',
-        search: '',
-      });
-      locationService.getLocationObservable = jest.fn().mockReturnValue(locationSubject);
-
-      // Set initial state for dashboards service
-      dashboardsService.state.navigationScope = undefined;
-      dashboardsService.state.navScopePath = undefined;
-
-      service = new ScopesService(selectorService, dashboardsService, locationService);
-      service.setEnabled(true);
-
-      jest.clearAllMocks();
-    });
-
-    it('should update navigation scope when URL changes via back/forward', () => {
-      // Simulate URL change (e.g., browser back button)
-      locationSubject.next({
-        pathname: '/test',
-        search: '?navigation_scope=navScope1',
-      });
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope1', undefined, undefined);
-    });
-
-    it('should update nav_scope_path when URL changes via back/forward', () => {
-      // Set current state
-      dashboardsService.state.navigationScope = 'navScope1';
-      dashboardsService.state.navScopePath = undefined;
-
-      // Simulate URL change with nav_scope_path
-      locationSubject.next({
-        pathname: '/test',
-        search: '?navigation_scope=navScope1&nav_scope_path=' + encodeURIComponent('mimir,loki'),
-      });
-
-      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir', 'loki']);
-    });
-
-    it('should clear navigation scope when removed from URL via back/forward', () => {
-      // Set current state
-      dashboardsService.state.navigationScope = 'navScope1';
-      dashboardsService.state.navScopePath = ['mimir'];
-
-      // Simulate URL change (navigation scope removed)
-      locationSubject.next({
-        pathname: '/test',
-        search: '',
-      });
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined);
-    });
-
-    it('should handle navigation scope change along with nav_scope_path', () => {
-      // Set current state
-      dashboardsService.state.navigationScope = 'navScope1';
-      dashboardsService.state.navScopePath = ['mimir'];
-
-      // Simulate URL change to different navigation scope with new path
-      locationSubject.next({
-        pathname: '/test',
-        search: '?navigation_scope=navScope2&nav_scope_path=' + encodeURIComponent('loki,tempo'),
-      });
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('navScope2', undefined, ['loki', 'tempo']);
-    });
-
-    it('should handle URL-encoded navigation_scope from back/forward', () => {
-      // Set current state
-      dashboardsService.state.navigationScope = undefined;
-
-      // Simulate URL change with encoded navigation scope
-      locationSubject.next({
-        pathname: '/test',
-        search: '?navigation_scope=' + encodeURIComponent('scope with spaces'),
-      });
-
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith('scope with spaces', undefined, undefined);
-    });
-
-    it('should handle nav_scope_path change without navigation_scope', async () => {
-      // Set current state - no navigation scope but has nav scope path
-      dashboardsService.state.navigationScope = undefined;
-      dashboardsService.state.navScopePath = undefined;
-      selectorService.state.appliedScopes = [{ scopeId: 'scope1' }];
-
-      // Simulate URL change with only nav_scope_path
-      locationSubject.next({
-        pathname: '/test',
-        search: '?scopes=scope1&nav_scope_path=mimir',
-      });
-
-      // Wait for changeScopes promise
-      await Promise.resolve();
-
-      expect(dashboardsService.setNavScopePath).toHaveBeenCalledWith(['mimir']);
-    });
-  });
 });

public/app/features/scopes/ScopesService.ts

@@ -5,7 +5,6 @@ import { map, distinctUntilChanged } from 'rxjs/operators';
 import { LocationService, ScopesContextValue, ScopesContextValueState } from '@grafana/runtime';
 
 import { ScopesDashboardsService } from './dashboards/ScopesDashboardsService';
-import { deserializeFolderPath, serializeFolderPath } from './dashboards/scopeNavgiationUtils';
 import { ScopesSelectorService } from './selector/ScopesSelectorService';
 
 export interface State {
@@ -73,21 +72,12 @@ export class ScopesService implements ScopesContextValue {
     const queryParams = new URLSearchParams(locationService.getLocation().search);
     const scopeNodeId = queryParams.get('scope_node');
     const navigationScope = queryParams.get('navigation_scope');
-    const navScopePath = queryParams.get('nav_scope_path');
 
     if (navigationScope) {
-      this.dashboardsService.setNavigationScope(
-        navigationScope,
-        undefined,
-        navScopePath ? deserializeFolderPath(navScopePath) : undefined
-      );
+      this.dashboardsService.setNavigationScope(navigationScope);
     }
 
-    this.changeScopes(queryParams.getAll('scopes'), undefined, scopeNodeId ?? undefined).then(() => {
-      if (navScopePath && !navigationScope) {
-        this.dashboardsService.setNavScopePath(deserializeFolderPath(navScopePath));
-      }
-    });
+    this.changeScopes(queryParams.getAll('scopes'), undefined, scopeNodeId ?? undefined);
 
     // Pre-load scope node (which loads parent too)
     const nodeToPreload = scopeNodeId;
@@ -109,9 +99,6 @@ export class ScopesService implements ScopesContextValue {
         const scopes = queryParams.getAll('scopes');
         const scopeNodeId = queryParams.get('scope_node');
 
-        const navigationScope = queryParams.get('navigation_scope');
-        const navScopePath = queryParams.get('nav_scope_path');
-
         // Check if new scopes are different from the old scopes
         const currentScopes = this.selectorService.state.appliedScopes.map((scope) => scope.scopeId);
         if (scopes.length && !isEqual(scopes, currentScopes)) {
@@ -120,31 +107,6 @@ export class ScopesService implements ScopesContextValue {
           // changes the URL directly, it would trigger a reload so scopes would still be reset.
           this.changeScopes(scopes, undefined, scopeNodeId ?? undefined);
         }
-
-        // Handle navigation_scope and nav_scope_path changes from back/forward navigation
-        const currentNavigationScope = this.dashboardsService.state.navigationScope;
-        const currentNavScopePath = this.dashboardsService.state.navScopePath;
-        const newNavScopePath = navScopePath ? deserializeFolderPath(navScopePath) : undefined;
-        const decodedNavigationScope = navigationScope ? decodeURIComponent(navigationScope) : undefined;
-
-        const navigationScopeChanged = decodedNavigationScope !== currentNavigationScope;
-        const navScopePathChanged = !isEqual(newNavScopePath, currentNavScopePath);
-
-        if (navigationScopeChanged) {
-          // Navigation scope changed - do full update
-          if (decodedNavigationScope) {
-            this.dashboardsService.setNavigationScope(decodedNavigationScope, undefined, newNavScopePath);
-          } else if (newNavScopePath?.length) {
-            this.changeScopes(scopes, undefined, scopeNodeId ?? undefined).then(() => {
-              this.dashboardsService.setNavScopePath(newNavScopePath);
-            });
-          } else {
-            this.dashboardsService.setNavigationScope(undefined);
-          }
-        } else if (navScopePathChanged) {
-          // Navigation scope unchanged but path changed
-          this.dashboardsService.setNavScopePath(newNavScopePath);
-        }
       })
     );
 
@@ -175,17 +137,10 @@ export class ScopesService implements ScopesContextValue {
     // Update the URL based on change in the navigation scope
     this.subscriptions.push(
       this.dashboardsService.subscribeToState((state, prevState) => {
-        if (
-          state.navigationScope !== prevState.navigationScope ||
-          !isEqual(state.navScopePath, prevState.navScopePath)
-        ) {
-          this.locationService.partial(
-            {
-              navigation_scope: state.navigationScope ? encodeURIComponent(state.navigationScope) : null,
-              nav_scope_path: state.navScopePath?.length ? serializeFolderPath(state.navScopePath) : null,
-            },
-            true
-          );
+        if (state.navigationScope !== prevState.navigationScope) {
+          this.locationService.partial({
+            navigation_scope: state.navigationScope,
+          });
         }
       })
     );

public/app/features/scopes/dashboards/ScopesDashboards.tsx

@@ -67,12 +67,7 @@ export function ScopesDashboards() {
         />
       ) : filteredFolders[''] ? (
         <ScrollContainer>
-          <ScopesDashboardsTree
-            folders={filteredFolders}
-            folderPath={['']}
-            subScopePath={[]}
-            onFolderUpdate={updateFolder}
-          />
+          <ScopesDashboardsTree folders={filteredFolders} folderPath={['']} onFolderUpdate={updateFolder} />
         </ScrollContainer>
       ) : (
         <p className={styles.noResultsContainer} data-testid="scopes-dashboards-notFoundForFilter">

public/app/features/scopes/dashboards/ScopesDashboardsService.test.ts

@@ -839,52 +839,4 @@ describe('ScopesDashboardsService', () => {
       expect(service.state.drawerOpened).toBe(true);
     });
   });
-
-  describe('setNavScopePath', () => {
-    beforeEach(() => {
-      (locationService.getLocation as jest.Mock).mockReturnValue({ pathname: '/' } as Location);
-    });
-
-    it('should set nav scope path', async () => {
-      await service.setNavScopePath(['mimir']);
-      expect(service.state.navScopePath).toEqual(['mimir']);
-    });
-
-    it('should replace existing path with new path', async () => {
-      await service.setNavScopePath(['mimir']);
-      expect(service.state.navScopePath).toEqual(['mimir']);
-
-      await service.setNavScopePath(['loki']);
-      expect(service.state.navScopePath).toEqual(['loki']);
-    });
-
-    it('should handle multiple scopes in path', async () => {
-      await service.setNavScopePath(['mimir', 'loki']);
-      expect(service.state.navScopePath).toEqual(['mimir', 'loki']);
-    });
-
-    it('should clear path with empty array', async () => {
-      await service.setNavScopePath(['mimir', 'loki']);
-      expect(service.state.navScopePath).toEqual(['mimir', 'loki']);
-
-      await service.setNavScopePath([]);
-      expect(service.state.navScopePath).toEqual([]);
-    });
-
-    it('should handle undefined path as empty array', async () => {
-      await service.setNavScopePath(['mimir']);
-      expect(service.state.navScopePath).toEqual(['mimir']);
-
-      await service.setNavScopePath(undefined);
-      expect(service.state.navScopePath).toEqual([]);
-    });
-
-    it('should not update state if path is unchanged', async () => {
-      await service.setNavScopePath(['mimir']);
-
-      await service.setNavScopePath(['mimir']);
-      // Path should remain the same
-      expect(service.state.navScopePath).toEqual(['mimir']);
-    });
-  });
 });

public/app/features/scopes/dashboards/ScopesDashboardsService.ts

@@ -7,13 +7,8 @@ import { config, locationService } from '@grafana/runtime';
 import { ScopesApiClient } from '../ScopesApiClient';
 import { ScopesServiceBase } from '../ScopesServiceBase';
 
-import { buildSubScopePath, isCurrentPath } from './scopeNavgiationUtils';
-import {
-  ScopeNavigation,
-  SuggestedNavigationsFolder,
-  SuggestedNavigationsFoldersMap,
-  SuggestedNavigationsMap,
-} from './types';
+import { isCurrentPath } from './scopeNavgiationUtils';
+import { ScopeNavigation, SuggestedNavigationsFoldersMap, SuggestedNavigationsMap } from './types';
 
 interface ScopesDashboardsServiceState {
   // State of the drawer showing related dashboards
@@ -29,8 +24,6 @@ interface ScopesDashboardsServiceState {
   loading: boolean;
   searchQuery: string;
   navigationScope?: string;
-  // Path of subScopes which should be expanded
-  navScopePath?: string[];
 }
 
 export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsServiceState> {
@@ -45,7 +38,6 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
       forScopeNames: [],
       loading: false,
       searchQuery: '',
-      navScopePath: undefined,
     });
 
     // Add/ remove location subscribtion based on the drawer opened state
@@ -65,40 +57,9 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     });
   }
 
-  private openSubScopeFolder = (subScopePath: string[]) => {
-    const subScope = subScopePath[subScopePath.length - 1];
-    const path = buildSubScopePath(subScope, this.state.folders);
-
-    // Get path to the folder - path can now be undefined
-    if (path && path.length > 0) {
-      this.updateFolder(path, true);
-    }
-  };
-
-  public setNavScopePath = async (navScopePath?: string[]) => {
-    const navScopePathArray = navScopePath ?? [];
-
-    if (!isEqual(navScopePathArray, this.state.navScopePath)) {
-      this.updateState({ navScopePath: navScopePathArray });
-
-      for (const subScope of navScopePathArray) {
-        // Find the actual path to the folder with this subScopeName
-        const folderPath = buildSubScopePath(subScope, this.state.folders);
-        if (folderPath && folderPath.length > 0) {
-          await this.fetchSubScopeItems(folderPath, subScope);
-          this.openSubScopeFolder([subScope]);
-        }
-      }
-    }
-  };
-
   // The fallbackScopeNames is used to fetch the ScopeNavigations for the current dashboard when the navigationScope is not set.
   // You only need to awaut this function if you need to wait for the dashboards to be fetched before doing something else.
-  public setNavigationScope = async (
-    navigationScope?: string,
-    fallbackScopeNames?: string[],
-    navScopePath?: string[]
-  ) => {
+  public setNavigationScope = async (navigationScope?: string, fallbackScopeNames?: string[]) => {
     if (this.state.navigationScope === navigationScope) {
       return;
     }
@@ -106,7 +67,6 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     const forScopeNames = navigationScope ? [navigationScope] : (fallbackScopeNames ?? []);
     this.updateState({ navigationScope, drawerOpened: forScopeNames.length > 0 });
     await this.fetchDashboards(forScopeNames);
-    await this.setNavScopePath(navScopePath);
   };
 
   // Expand the group that matches the current path, if it is not already expanded
@@ -188,15 +148,6 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
   };
 
   private fetchSubScopeItems = async (path: string[], subScopeName: string) => {
-    // Check if folder already has content - skip fetching to preserve existing state
-    const targetFolder = this.getFolder(path);
-    if (
-      targetFolder &&
-      (Object.keys(targetFolder.folders).length > 0 || Object.keys(targetFolder.suggestedNavigations).length > 0)
-    ) {
-      return;
-    }
-
     let subScopeFolders: SuggestedNavigationsFoldersMap | undefined;
 
     try {
@@ -257,15 +208,6 @@ export class ScopesDashboardsService extends ScopesServiceBase<ScopesDashboardsS
     this.updateState({ folders, filteredFolders });
   };
 
-  // Helper to get a folder at a given path
-  private getFolder = (path: string[]): SuggestedNavigationsFolder | undefined => {
-    let folder: SuggestedNavigationsFoldersMap = this.state.folders;
-    for (let i = 0; i < path.length - 1; i++) {
-      folder = folder[path[i]]?.folders ?? {};
-    }
-    return folder[path[path.length - 1]];
-  };
-
   public changeSearchQuery = (searchQuery: string) => {
     searchQuery = searchQuery ?? '';
 

public/app/features/scopes/dashboards/ScopesDashboardsTree.tsx

@@ -12,17 +12,10 @@ export interface ScopesDashboardsTreeProps {
   subScope?: string;
   folders: SuggestedNavigationsFoldersMap;
   folderPath: string[];
-  subScopePath?: string[];
   onFolderUpdate: OnFolderUpdate;
 }
 
-export function ScopesDashboardsTree({
-  subScopePath,
-  subScope,
-  folders,
-  folderPath,
-  onFolderUpdate,
-}: ScopesDashboardsTreeProps) {
+export function ScopesDashboardsTree({ subScope, folders, folderPath, onFolderUpdate }: ScopesDashboardsTreeProps) {
   const [queryParams] = useQueryParams();
   const styles = useStyles2(getStyles);
 
@@ -61,7 +54,6 @@ export function ScopesDashboardsTree({
       {regularNavigations.map((navigation) => (
         <ScopesNavigationTreeLink
           subScope={subScope}
-          subScopePath={subScopePath}
           key={navigation.id + navigation.title}
           to={urlUtil.renderUrl(navigation.url, queryParams)}
           title={navigation.title}
@@ -76,7 +68,6 @@ export function ScopesDashboardsTree({
       {subScopeFolders.map(([subFolderId, subFolder]) => (
         <ScopesDashboardsTreeFolderItem
           key={subFolderId}
-          subScopePath={[...(subScopePath ?? []), subFolder.subScopeName ?? '']}
           folder={subFolder}
           folders={folder.folders}
           folderPath={[...folderPath, subFolderId]}

public/app/features/scopes/dashboards/ScopesDashboardsTreeFolderItem.test.tsx

@@ -16,9 +16,6 @@ const mockScopesSelectorService = {
 
 const mockScopesDashboardsService = {
   setNavigationScope: jest.fn(),
-  state: {
-    navScopePath: undefined,
-  },
 };
 
 jest.mock('../ScopesContextProvider', () => ({
@@ -136,7 +133,7 @@ describe('ScopesDashboardsTreeFolderItem', () => {
     const exchangeButton = screen.getByRole('button', { name: /change root scope/i });
     await user.click(exchangeButton);
 
-    expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, undefined, []);
+    expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, ['subScope1']);
   });
 
   it('calls changeScopes when exchange icon is clicked', async () => {
@@ -155,7 +152,7 @@ describe('ScopesDashboardsTreeFolderItem', () => {
     const exchangeButton = screen.getByRole('button', { name: /change root scope/i });
     await user.click(exchangeButton);
 
-    expect(mockScopesSelectorService.changeScopes).toHaveBeenCalledWith(['subScope1'], undefined, undefined, false);
+    expect(mockScopesSelectorService.changeScopes).toHaveBeenCalledWith(['subScope1']);
   });
 
   it('passes subScope prop to ScopesDashboardsTree when folder is expanded', () => {

public/app/features/scopes/dashboards/ScopesDashboardsTreeFolderItem.tsx

@@ -14,11 +14,9 @@ export interface ScopesDashboardsTreeFolderItemProps {
   folderPath: string[];
   folders: SuggestedNavigationsFoldersMap;
   onFolderUpdate: OnFolderUpdate;
-  subScopePath?: string[];
 }
 
 export function ScopesDashboardsTreeFolderItem({
-  subScopePath,
   folder,
   folderPath,
   folders,
@@ -55,27 +53,12 @@ export function ScopesDashboardsTreeFolderItem({
               scope: folder.subScopeName || '',
             })}
             name="exchange-alt"
-            onClick={async (e) => {
+            onClick={(e) => {
               e.preventDefault();
               e.stopPropagation();
               if (folder.subScopeName && scopesSelectorService) {
-                const activeSubScopePath = scopesDashboardsService?.state.navScopePath;
-                // Check if the active scope is a child of the current folder's scope
-                const activeScope = activeSubScopePath?.[activeSubScopePath.length - 1];
-                const folderLocationInActivePath = activeSubScopePath?.indexOf(folder.subScopeName) ?? -1;
-
-                await scopesDashboardsService?.setNavigationScope(
-                  folderLocationInActivePath >= 0 ? folder.subScopeName : undefined,
-                  undefined,
-                  activeSubScopePath?.slice(folderLocationInActivePath + 1) ?? []
-                );
-                // Now changeScopes will skip fetchDashboards because navigationScope is set
-                scopesSelectorService.changeScopes(
-                  folderLocationInActivePath >= 0 && activeScope ? [activeScope] : [folder.subScopeName],
-                  undefined,
-                  undefined,
-                  false
-                );
+                scopesDashboardsService?.setNavigationScope(undefined, [folder.subScopeName]);
+                scopesSelectorService.changeScopes([folder.subScopeName]);
               }
             }}
           />
@@ -85,7 +68,6 @@ export function ScopesDashboardsTreeFolderItem({
       {folder.expanded && (
         <div className={styles.children}>
           <ScopesDashboardsTree
-            subScopePath={subScopePath}
             subScope={folder.subScopeName}
             folders={folders}
             folderPath={folderPath}

public/app/features/scopes/dashboards/ScopesNavigationTreeLink.test.tsx

@@ -209,7 +209,7 @@ describe('ScopesNavigationTreeLink', () => {
       const link = screen.getByTestId('scopes-dashboards-test-id');
       await userEvent.click(link);
 
-      expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith('currentScope', undefined, undefined);
+      expect(mockScopesDashboardsService.setNavigationScope).toHaveBeenCalledWith('currentScope');
     });
 
     it('should not set navigation scope when already set', async () => {

public/app/features/scopes/dashboards/ScopesNavigationTreeLink.tsx

@@ -8,17 +8,16 @@ import { Icon, useStyles2 } from '@grafana/ui';
 
 import { useScopesServices } from '../ScopesContextProvider';
 
-import { isCurrentPath, normalizePath, serializeFolderPath } from './scopeNavgiationUtils';
+import { isCurrentPath, normalizePath } from './scopeNavgiationUtils';
 
 export interface ScopesNavigationTreeLinkProps {
   subScope?: string;
   to: string;
   title: string;
   id: string;
-  subScopePath?: string[];
 }
 
-export function ScopesNavigationTreeLink({ subScope, to, title, id, subScopePath }: ScopesNavigationTreeLinkProps) {
+export function ScopesNavigationTreeLink({ subScope, to, title, id }: ScopesNavigationTreeLinkProps) {
   const styles = useStyles2(getStyles);
   const linkIcon = useMemo(() => getLinkIcon(to), [to]);
   const locPathname = useLocation().pathname;
@@ -26,7 +25,7 @@ export function ScopesNavigationTreeLink({ subScope, to, title, id, subScopePath
   // Ignore query params
   const isCurrent = isCurrentPath(locPathname, to);
 
-  const handleClick = async (e: React.MouseEvent<HTMLAnchorElement>) => {
+  const handleClick = (e: React.MouseEvent<HTMLAnchorElement>) => {
     if (subScope) {
       e.preventDefault(); // Prevent default Link navigation
 
@@ -40,18 +39,11 @@ export function ScopesNavigationTreeLink({ subScope, to, title, id, subScopePath
       const searchParams = new URLSearchParams(url.search);
       if (!currentNavigationScope && currentScope) {
         searchParams.set('navigation_scope', currentScope);
-        await services?.scopesDashboardsService?.setNavigationScope(
-          currentScope,
-          undefined,
-          subScopePath && subScopePath.length > 0 ? subScopePath : undefined
-        );
+        services?.scopesDashboardsService?.setNavigationScope(currentScope);
       }
 
       // Update query params with the new subScope
       searchParams.set('scopes', subScope);
-
-      // Set nav_scope_path to the subScopePath
-      searchParams.set('nav_scope_path', subScopePath ? serializeFolderPath(subScopePath) : '');
       // Remove scope_node and scope_parent since we're changing to a subScope
       searchParams.delete('scope_node');
       searchParams.delete('scope_parent');

public/app/features/scopes/dashboards/scopeNavgiationUtils.test.ts

@@ -1,11 +1,4 @@
-import {
-  buildSubScopePath,
-  deserializeFolderPath,
-  getDashboardPathForComparison,
-  isCurrentPath,
-  serializeFolderPath,
-} from './scopeNavgiationUtils';
-import { SuggestedNavigationsFoldersMap } from './types';
+import { getDashboardPathForComparison, isCurrentPath } from './scopeNavgiationUtils';
 
 describe('scopeNavgiationUtils', () => {
   it('should return the correct path for a dashboard', () => {
@@ -35,194 +28,4 @@ describe('scopeNavgiationUtils', () => {
     expect(isCurrentPath('/d/dashboardId/slug', '/d/dashboardId#hash')).toBe(true);
     expect(isCurrentPath('/d/dashboardId', '/d/dashboardId#hash')).toBe(true);
   });
-
-  describe('deserializeFolderPath', () => {
-    it('should return empty array for empty string', () => {
-      expect(deserializeFolderPath('')).toEqual([]);
-    });
-
-    it('should parse a simple comma-separated string', () => {
-      expect(deserializeFolderPath('mimir,loki')).toEqual(['mimir', 'loki']);
-    });
-
-    it('should handle single value', () => {
-      expect(deserializeFolderPath('mimir')).toEqual(['mimir']);
-    });
-
-    it('should trim whitespace around values', () => {
-      expect(deserializeFolderPath(' mimir , loki ')).toEqual(['mimir', 'loki']);
-    });
-
-    it('should handle URL-encoded strings', () => {
-      expect(deserializeFolderPath(encodeURIComponent('mimir,loki'))).toEqual(['mimir', 'loki']);
-    });
-
-    it('should handle URL-encoded strings with special characters', () => {
-      expect(deserializeFolderPath(encodeURIComponent('folder one,folder two'))).toEqual(['folder one', 'folder two']);
-    });
-
-    it('should fallback to split without decoding if decodeURIComponent fails', () => {
-      // Invalid URI sequence that would cause decodeURIComponent to throw
-      const invalidUri = '%E0%A4%A';
-      expect(deserializeFolderPath(invalidUri)).toEqual(['%E0%A4%A']);
-    });
-  });
-
-  describe('serializeFolderPath', () => {
-    it('should return empty string for empty array', () => {
-      expect(serializeFolderPath([])).toBe('');
-    });
-
-    it('should serialize a simple array', () => {
-      expect(serializeFolderPath(['mimir', 'loki'])).toBe(encodeURIComponent('mimir,loki'));
-    });
-
-    it('should handle single value', () => {
-      expect(serializeFolderPath(['mimir'])).toBe('mimir');
-    });
-
-    it('should handle values with spaces', () => {
-      expect(serializeFolderPath(['folder one', 'folder two'])).toBe(encodeURIComponent('folder one,folder two'));
-    });
-
-    it('should return empty string for null/undefined input', () => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      expect(serializeFolderPath(null as any)).toBe('');
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      expect(serializeFolderPath(undefined as any)).toBe('');
-    });
-  });
-
-  describe('serializeFolderPath and deserializeFolderPath round-trip', () => {
-    it('should round-trip simple paths', () => {
-      const original = ['mimir', 'loki'];
-      const serialized = serializeFolderPath(original);
-      const deserialized = deserializeFolderPath(serialized);
-      expect(deserialized).toEqual(original);
-    });
-
-    it('should round-trip paths with spaces', () => {
-      const original = ['folder one', 'folder two'];
-      const serialized = serializeFolderPath(original);
-      const deserialized = deserializeFolderPath(serialized);
-      expect(deserialized).toEqual(original);
-    });
-  });
-
-  describe('buildSubScopePath', () => {
-    it('should return undefined when folders is empty', () => {
-      const folders: SuggestedNavigationsFoldersMap = {};
-      expect(buildSubScopePath('mimir', folders)).toBeUndefined();
-    });
-
-    it('should find subScope at root level', () => {
-      const folders: SuggestedNavigationsFoldersMap = {
-        'Mimir Dashboards': {
-          title: 'Mimir Dashboards',
-          expanded: false,
-          folders: {},
-          suggestedNavigations: {},
-          subScopeName: 'mimir',
-        },
-      };
-      expect(buildSubScopePath('mimir', folders)).toEqual(['Mimir Dashboards']);
-    });
-
-    it('should find subScope in nested folders', () => {
-      const folders: SuggestedNavigationsFoldersMap = {
-        '': {
-          title: '',
-          expanded: true,
-          folders: {
-            'Parent Folder': {
-              title: 'Parent Folder',
-              expanded: false,
-              folders: {
-                'Mimir Dashboards': {
-                  title: 'Mimir Dashboards',
-                  expanded: false,
-                  folders: {},
-                  suggestedNavigations: {},
-                  subScopeName: 'mimir',
-                },
-              },
-              suggestedNavigations: {},
-            },
-          },
-          suggestedNavigations: {},
-        },
-      };
-      expect(buildSubScopePath('mimir', folders)).toEqual(['', 'Parent Folder', 'Mimir Dashboards']);
-    });
-
-    it('should return undefined when subScope is not found', () => {
-      const folders: SuggestedNavigationsFoldersMap = {
-        '': {
-          title: '',
-          expanded: true,
-          folders: {
-            'Loki Dashboards': {
-              title: 'Loki Dashboards',
-              expanded: false,
-              folders: {},
-              suggestedNavigations: {},
-              subScopeName: 'loki',
-            },
-          },
-          suggestedNavigations: {},
-        },
-      };
-      expect(buildSubScopePath('mimir', folders)).toBeUndefined();
-    });
-
-    it('should return first match when multiple folders have the same subScope', () => {
-      const folders: SuggestedNavigationsFoldersMap = {
-        'Mimir Dashboards': {
-          title: 'Mimir Dashboards',
-          expanded: false,
-          folders: {},
-          suggestedNavigations: {},
-          subScopeName: 'mimir',
-        },
-        'Mimir Overview': {
-          title: 'Mimir Overview',
-          expanded: false,
-          folders: {},
-          suggestedNavigations: {},
-          subScopeName: 'mimir',
-        },
-      };
-      // Should return the first one found (order depends on Object.entries)
-      const result = buildSubScopePath('mimir', folders);
-      expect(result).toBeDefined();
-      expect(result?.length).toBe(1);
-    });
-
-    it('should find deeply nested subScope', () => {
-      const folders: SuggestedNavigationsFoldersMap = {
-        level1: {
-          title: 'Level 1',
-          expanded: true,
-          folders: {
-            level2: {
-              title: 'Level 2',
-              expanded: true,
-              folders: {
-                level3: {
-                  title: 'Level 3',
-                  expanded: false,
-                  folders: {},
-                  suggestedNavigations: {},
-                  subScopeName: 'deep-scope',
-                },
-              },
-              suggestedNavigations: {},
-            },
-          },
-          suggestedNavigations: {},
-        },
-      };
-      expect(buildSubScopePath('deep-scope', folders)).toEqual(['level1', 'level2', 'level3']);
-    });
-  });
 });

public/app/features/scopes/dashboards/scopeNavgiationUtils.ts

@@ -1,5 +1,3 @@
-import { SuggestedNavigationsFoldersMap } from './types';
-
 // Helper function to get the base path for a dashboard URL for comparison purposes.
 // e.g., /d/dashboardId/slug -> /d/dashboardId
 //       /d/dashboardId      -> /d/dashboardId
@@ -7,63 +5,12 @@ export function getDashboardPathForComparison(pathname: string): string {
   return pathname.split('/').slice(0, 3).join('/');
 }
 
-/**
- * Finds the path to a folder with the given subScopeName by searching recursively.
- * @param subScope - The subScope name to find
- * @param folders - The root folder structure to search
- * @returns Array representing the path to the folder, or undefined if not found
- */
-export function buildSubScopePath(subScope: string, folders: SuggestedNavigationsFoldersMap): string[] | undefined {
-  function findPath(currentFolders: SuggestedNavigationsFoldersMap, currentPath: string[]): string[] | undefined {
-    for (const [key, folder] of Object.entries(currentFolders)) {
-      const newPath = [...currentPath, key];
-      if (folder.subScopeName === subScope) {
-        return newPath;
-      }
-      // Search in nested folders
-      const nestedPath = findPath(folder.folders, newPath);
-      if (nestedPath) {
-        return nestedPath;
-      }
-    }
-    return undefined;
-  }
-
-  return findPath(folders, []);
-}
-
 export function normalizePath(path: string): string {
   // Remove query + hash + trailing slash (except root)
   const noQuery = path.split('?')[0].split('#')[0];
   return noQuery !== '/' && noQuery.endsWith('/') ? noQuery.slice(0, -1) : noQuery;
 }
 
-/**
- * Deserializes a comma-separated folder path string into an array.
- * Handles URL-encoded strings.
- */
-export function deserializeFolderPath(navScopePath: string): string[] {
-  if (!navScopePath) {
-    return [];
-  }
-  try {
-    const decoded = decodeURIComponent(navScopePath);
-    return decoded.split(',').map((s) => s.trim());
-  } catch {
-    return navScopePath.split(',').map((s) => s.trim());
-  }
-}
-
-/**
- * Serializes a folder path array into a comma-separated string.
- */
-export function serializeFolderPath(path: string[]): string {
-  if (!path) {
-    return '';
-  }
-  return encodeURIComponent(path.join(','));
-}
-
 // Pathname comes from location.pathname
 export function isCurrentPath(pathname: string, to: string): boolean {
   const isDashboard = to.startsWith('/d/');

public/app/features/scopes/selector/ScopesSelectorService.test.ts

@@ -444,7 +444,7 @@ describe('ScopesSelectorService', () => {
       await service.selectScope('test-scope-node');
       await service.apply();
       await service.removeAllScopes();
-      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined, undefined, undefined);
+      expect(dashboardsService.setNavigationScope).toHaveBeenCalledWith(undefined);
     });
   });
 

public/app/features/scopes/selector/ScopesSelectorService.ts

@@ -405,7 +405,7 @@ export class ScopesSelectorService extends ScopesServiceBase<ScopesSelectorServi
 
   public removeAllScopes = () => {
     this.applyScopes([], false);
-    this.dashboardsService.setNavigationScope(undefined, undefined, undefined);
+    this.dashboardsService.setNavigationScope(undefined);
   };
 
   private addRecentScopes = (scopes: Scope[], parentNode?: ScopeNode, scopeNodeId?: string) => {