[v10.0.x] Chore: Upgrade Go to 1.20.10 (#76365 )

Chore: Upgrade Go to 1.20.10 (#76355) * [v10.1.x] Chore: Upgrade Go to 1.20.10 * Rebuild .drone.yml (cherry picked from commit 4287686420)
[v10.0.x] Building: Remove dependency to urw-fonts in RPM packages (#76220 )
2023-10-11 18:20:20 +02:00 · 2023-10-11 14:42:54 +02:00 · 2023-10-11 14:14:30 +02:00 · 2023-10-11 13:43:46 +02:00 · 2023-10-11 13:43:13 +02:00 · 2023-10-11 13:42:27 +02:00
83 changed files with 599 additions and 297 deletions
--- a/.drone.yml
+++ b/.drone.yml
@@ -24,7 +24,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-drone
@@ -74,7 +74,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-starlark .
@@ -120,7 +120,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -300,7 +300,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -386,7 +386,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - is_fork=$(curl "https://$GITHUB_TOKEN@api.github.com/repos/grafana/grafana/pulls/$DRONE_PULL_REQUEST"
@@ -420,7 +420,7 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: lint-backend
 trigger:
  event:
@@ -467,7 +467,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -476,7 +476,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -862,7 +862,7 @@ steps:
  name: clone-enterprise
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -871,7 +871,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@@ -1060,7 +1060,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build shellcheck
@@ -1165,7 +1165,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -1279,7 +1279,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1358,7 +1358,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - make gen-go
@@ -1372,7 +1372,7 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: lint-backend
 - commands:
  - ./bin/build verify-drone
@@ -1417,7 +1417,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -1426,7 +1426,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1871,7 +1871,7 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -1880,7 +1880,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
@@ -2009,7 +2009,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  image: grafana/ci-wix:0.1.1
  name: windows-init
@@ -2190,7 +2190,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -2199,7 +2199,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@@ -2295,7 +2295,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts packages --tag $${DRONE_TAG} --src-bucket $${PRERELEASE_BUCKET}
@@ -2364,7 +2364,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - yarn install --immutable
@@ -2429,7 +2429,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - depends_on:
  - compile-build-cmd
@@ -2517,13 +2517,13 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build whatsnew-checker
  depends_on:
  - compile-build-cmd
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: whats-new-checker
 trigger:
  event:
@@ -2562,7 +2562,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -2625,7 +2625,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -2812,7 +2812,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  failure: ignore
  image: grafana/ci-wix:0.1.1
@@ -2976,7 +2976,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -3005,7 +3005,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build build-backend --jobs 8 --edition oss --build-id ${DRONE_BUILD_NUMBER}
@@ -3257,7 +3257,7 @@ steps:
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -3314,7 +3314,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -3406,7 +3406,7 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -3529,7 +3529,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  image: grafana/ci-wix:0.1.1
  name: windows-init
@@ -3605,7 +3605,7 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -4059,7 +4059,7 @@ steps:
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-deploy:1.3.3
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine:3.18.3
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.20.8
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.20.10
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM plugins/slack
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM postgres:12.3-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM mysql:5.7.39
@@ -4086,7 +4086,7 @@ steps:
  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-deploy:1.3.3
  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine:3.18.3
  - trivy --exit-code 1 --severity HIGH,CRITICAL byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.20.8
+  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.20.10
  - trivy --exit-code 1 --severity HIGH,CRITICAL plugins/slack
  - trivy --exit-code 1 --severity HIGH,CRITICAL postgres:12.3-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL mysql:5.7.39
@@ -4138,7 +4138,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.8
+  image: golang:1.20.10
  name: compile-build-cmd
 - commands:
  - ./bin/build publish grafana-com --edition oss
@@ -4341,6 +4341,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 2e8b7d89c34e92802b0bb4b8eaf3625b082986ac2bcee39e54a3bfb52271f3e0
+hmac: 6b83b3ef538b454f16ce109a4bdfd0ef2905f46ffc60dcd02257b3e858f35141

 ...
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -44,7 +44,7 @@ jobs:
      name: Set go version
      uses: actions/setup-go@v3
      with:
-        go-version: '1.20.8'
+        go-version: '1.20.10'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
--- a/.github/workflows/pr-codeql-analysis-go.yml
+++ b/.github/workflows/pr-codeql-analysis-go.yml
@@ -23,7 +23,7 @@ jobs:
    - name: Set go version
      uses: actions/setup-go@v3
      with:
-        go-version: '1.20.8'
+        go-version: '1.20.10'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
--- a/2
+++ b/2
@@ -3,7 +3,7 @@
 ARG BASE_IMAGE=alpine:3.18.3
 ARG JS_IMAGE=node:18-alpine3.18
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.20.8-alpine3.18
+ARG GO_IMAGE=golang:1.20.10-alpine3.18

 ARG GO_SRC=go-builder
 ARG JS_SRC=js-builder
--- a/2
+++ b/2
@@ -207,7 +207,7 @@ build-docker-full-ubuntu: ## Build Docker image based on Ubuntu for development.
 	--build-arg COMMIT_SHA=$$(git rev-parse --short HEAD) \
 	--build-arg BUILD_BRANCH=$$(git rev-parse --abbrev-ref HEAD) \
 	--build-arg BASE_IMAGE=ubuntu:20.04 \
-	--build-arg GO_IMAGE=golang:1.20.8 \
+	--build-arg GO_IMAGE=golang:1.20.10 \
 	--tag grafana/grafana$(TAG_SUFFIX):dev-ubuntu \
 	$(DOCKER_BUILD_ARGS)

--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -806,6 +806,24 @@ managed_identity_enabled = false
 # Should be set for user-assigned identity and should be empty for system-assigned identity
 managed_identity_client_id =

+# Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it
+# For more documentation on Azure AD Workload Identity, review this documentation:
+# https://azure.github.io/azure-workload-identity/docs/
+# Disabled by default, needs to be explicitly enabled
+workload_identity_enabled = false
+
+# Tenant ID of the Azure AD Workload Identity
+# Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account
+workload_identity_tenant_id =
+
+# Client ID of the Azure AD Workload Identity
+# Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account
+workload_identity_client_id =
+
+# Custom path to token file for the Azure AD Workload Identity
+# Allows to set a custom path to the projected service account token file
+workload_identity_token_file =
+
 #################################### Role-based Access Control ###########
 [rbac]
 # If enabled, cache permissions in a in memory cache
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -777,6 +777,24 @@
 # Should be set for user-assigned identity and should be empty for system-assigned identity
 ;managed_identity_client_id =

+# Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it
+# For more documentation on Azure AD Workload Identity, review this documentation:
+# https://azure.github.io/azure-workload-identity/docs/
+# Disabled by default, needs to be explicitly enabled
+;workload_identity_enabled = false
+
+# Tenant ID of the Azure AD Workload Identity
+# Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account
+;workload_identity_tenant_id =
+
+# Client ID of the Azure AD Workload Identity
+# Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account
+;workload_identity_client_id =
+
+# Custom path to token file for the Azure AD Workload Identity
+# Allows to set a custom path to the projected service account token file
+;workload_identity_token_file =
+
 #################################### Role-based Access Control ###########
 [rbac]
 ;permission_cache = true
--- a/docs/sources/datasources/azure-monitor/_index.md
+++ b/docs/sources/datasources/azure-monitor/_index.md
@@ -63,6 +63,9 @@ For more information, refer to [Azure documentation for role assignments](https:
 If you host Grafana in Azure, such as in App Service or Azure Virtual Machines, you can configure the Azure Monitor data source to use Managed Identity for secure authentication without entering credentials into Grafana.
 For details, refer to [Configuring using Managed Identity](#configuring-using-managed-identity).

+You can configure the Azure Monitor data source to use Workload Identity for secure authentication without entering credentials into Grafana if you host Grafana in a Kubernetes environment, such as AKS, and require access to Azure resources.
+For details, refer to [Configuring using Workload Identity](#configuring-using-workload-identity).
+
 | Name                        | Description                                                                                                                                                                                                                                                                                           |
 | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Authentication**          | Enables Managed Identity. Selecting Managed Identity hides many of the other fields. For details, see [Configuring using Managed Identity](#configuring-using-managed-identity).                                                                                                                      |
@@ -114,6 +117,21 @@ datasources:
    version: 1
 ```

+**Workload Identity:**
+
+```yaml
+apiVersion: 1 # config file version
+
+datasources:
+  - name: Azure Monitor
+    type: grafana-azure-monitor-datasource
+    access: proxy
+    jsonData:
+      azureAuthType: workloadidentity
+      subscriptionId: <subscription-id> # Optional, default subscription
+    version: 1
+```
+
 #### Supported cloud names

 | Azure Cloud                          | `cloudName` Value          |
@@ -124,8 +142,8 @@ datasources:

 ### Configure Managed Identity

-If you host Grafana in Azure, such as an App Service or with Azure Virtual Machines, and have managed identity enabled on your VM, you can use managed identity to configure Azure Monitor in Grafana.
-This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations for each.
+You can use managed identity to configure Azure Monitor in Grafana if you host Grafana in Azure (such as an App Service or with Azure Virtual Machines) and have managed identity enabled on your VM.
+This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations.
 For details on Azure managed identities, refer to the [Azure documentation](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).

 **To enable managed identity for Grafana:**
@@ -141,7 +159,46 @@ For details on Azure managed identities, refer to the [Azure documentation](http

   This hides the directory ID, application ID, and client secret fields, and the data source uses managed identity to authenticate to Azure Monitor Metrics and Logs, and Azure Resource Graph.

-   {{< figure src="/media/docs/grafana/data-sources/screenshot-managed-identity.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor Metrics screenshot showing Dimensions" >}}
+   {{< figure src="/media/docs/grafana/data-sources/screenshot-managed-identity-2.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor screenshot showing Managed Identity authentication" >}}
+
+3. You can set the `managed_identity_client_id` field in the `[azure]` section of the [Grafana server configuration][configure-grafana-azure] to allow a user-assigned managed identity to be used instead of the default system-assigned identity.
+
+```ini
+[azure]
+managed_identity_enabled = true
+managed_identity_client_id = USER_ASSIGNED_IDENTITY_CLIENT_ID
+```
+
+### Configure Workload Identity
+
+You can use workload identity to configure Azure Monitor in Grafana if you host Grafana in a Kubernetes environment, such as AKS, in conjunction with managed identities.
+This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations.
+For details on workload identity, refer to the [Azure workload identity documentation](https://azure.github.io/azure-workload-identity/docs/).
+
+**To enable workload identity for Grafana:**
+
+1. Set the `workload_identity_enabled` flag in the `[azure]` section of the [Grafana server configuration][configure-grafana-azure].
+
+   ```ini
+   [azure]
+   workload_identity_enabled = true
+   ```
+
+2. In the Azure Monitor data source configuration, set **Authentication** to **Workload Identity**.
+
+   This hides the directory ID, application ID, and client secret fields, and the data source uses workload identity to authenticate to Azure Monitor Metrics and Logs, and Azure Resource Graph.
+
+   {{< figure src="/media/docs/grafana/data-sources/screenshot-workload-identity.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor screenshot showing Workload Identity authentication" >}}
+
+3. There are additional configuration variables that can control the authentication method.`workload_identity_tenant_id` represents the Azure AD tenant that contains the managed identity, `workload_identity_client_id` represents the client ID of the managed identity if it differs from the default client ID, `workload_identity_token_file` represents the path to the token file. Refer to the [documentation](https://azure.github.io/azure-workload-identity/docs/) for more information on what values these variables should use, if any.
+
+   ```ini
+   [azure]
+   workload_identity_enabled = true
+   workload_identity_tenant_id = IDENTITY_TENANT_ID
+   workload_identity_client_id = IDENTITY_CLIENT_ID
+   workload_identity_token_file = TOKEN_FILE_PATH
+   ```

 ## Query the data source

--- a/docs/sources/setup-grafana/configure-grafana/_index.md
+++ b/docs/sources/setup-grafana/configure-grafana/_index.md
@@ -1140,6 +1140,32 @@ The client ID to use for user-assigned managed identity.

 Should be set for user-assigned identity and should be empty for system-assigned identity.

+### workload_identity_enabled
+
+Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it.
+
+For more documentation on Azure AD Workload Identity, review [Azure AD Workload Identity](https://azure.github.io/azure-workload-identity/docs/) documentation.
+
+Disabled by default, needs to be explicitly enabled.
+
+### workload_identity_tenant_id
+
+Tenant ID of the Azure AD Workload Identity.
+
+Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account.
+
+### workload_identity_client_id
+
+Client ID of the Azure AD Workload Identity.
+
+Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account.
+
+### workload_identity_token_file
+
+Custom path to token file for the Azure AD Workload Identity.
+
+Allows to set a custom path to the projected service account token file.
+
 ## [auth.jwt]

 Refer to [JWT authentication]({{< relref "../configure-security/configure-authentication/jwt" >}}) for more information.
--- a/go.mod
+++ b/go.mod
@@ -60,7 +60,7 @@ require (
 	github.com/grafana/alerting v0.0.0-20230620220549-5169fced2d28
 	github.com/grafana/cuetsy v0.1.9
 	github.com/grafana/grafana-aws-sdk v0.15.0
-	github.com/grafana/grafana-azure-sdk-go v1.6.0
+	github.com/grafana/grafana-azure-sdk-go v1.9.0
 	github.com/grafana/grafana-plugin-sdk-go v0.160.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/hashicorp/go-hclog v1.5.0
@@ -105,9 +105,9 @@ require (
 	go.opentelemetry.io/otel/exporters/jaeger v1.0.0
 	go.opentelemetry.io/otel/sdk v1.14.0
 	go.opentelemetry.io/otel/trace v1.14.0
-	golang.org/x/crypto v0.7.0
+	golang.org/x/crypto v0.12.0
 	golang.org/x/exp v0.0.0-20221211140036-ad323defaf05
-	golang.org/x/net v0.9.0
+	golang.org/x/net v0.14.0
 	golang.org/x/oauth2 v0.6.0
 	golang.org/x/sync v0.1.0
 	golang.org/x/time v0.3.0
@@ -127,7 +127,7 @@ require (
 )

 require (
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
@@ -162,7 +162,7 @@ require (
 	github.com/go-openapi/spec v0.20.8 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-openapi/validate v0.22.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.4.3
+	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe // indirect
 	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
@@ -216,8 +216,8 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/atomic v1.10.0
 	go.uber.org/goleak v1.2.1 // indirect
-	golang.org/x/sys v0.7.0 // indirect
-	golang.org/x/text v0.9.0
+	golang.org/x/sys v0.11.0 // indirect
+	golang.org/x/text v0.12.0
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
@@ -225,7 +225,7 @@ require (

 require (
 	cloud.google.com/go/kms v1.4.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.1
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0
 	github.com/Azure/azure-storage-blob-go v0.15.0
 	github.com/Azure/go-autorest/autorest/adal v0.9.21
@@ -300,6 +300,7 @@ require (
 	github.com/envoyproxy/protoc-gen-validate v0.6.13 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
@@ -344,9 +345,9 @@ require (
 	cloud.google.com/go/compute v1.15.1 // indirect
 	cloud.google.com/go/iam v0.8.0 // indirect
 	filippo.io/age v1.1.1
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.2
 	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7
--- a/go.sum
+++ b/go.sum
@@ -121,10 +121,18 @@ github.com/Azure/azure-sdk-for-go v65.0.0+incompatible h1:HzKLt3kIwMm4KeJYTdx9Eb
 github.com/Azure/azure-sdk-for-go v65.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 h1:sVW/AFBTGyJxDaMYlq0ct3jUXTtj12tQ6zE2GZUgVQw=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.1 h1:/iHxaJhsFr0+xVFfbMr5vxz848jyiWuIEDhYq3y5odY=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.1/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 h1:t/W5MYAuQy81cvM8VUNfRLzhtKpXhVUAN7Cd7KVbTyc=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0/go.mod h1:NBanQUfSWiWn3QEpWDTCU0IjBECKOYvl2R8xdRtMtiM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.1 h1:LNHhpdK7hzUcx/k1LIcuh5k7k1LGIWLQfCjaneSj7Fc=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.1/go.mod h1:uE9zaUfEQT/nbQjVi2IblCG9iaLtZsuYZ8ne+PuQ02M=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0 h1:jp0dGvZ7ZK0mgqnTSClMxa5xuRL7NZgHameVYF6BurY=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 h1:TOFrNxfjslms5nLLIMjW7N0+zSALX4KiGsptmpb16AA=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0/go.mod h1:EAyXOW1F6BTJPiK2pDvmnvxOHPxoTYWoqBeIlql+QhI=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 h1:Lg6BW0VPmCwcMlvOviL3ruHFO+H9tZNqscK0AeuFjGM=
@@ -198,6 +206,9 @@ github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft
 github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 h1:VgSJlZH5u0k2qxSpqyghcFQKmvYckj46uymKK5XzkBM=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1 h1:WpB/QDNLpMw72xHJc34BNNykqSOeEJDAWkhf0u12/Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
@@ -1088,12 +1099,17 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gogo/status v1.0.3/go.mod h1:SavQ51ycCLnc7dGyJxp8YAmudx8xqiVrRf+6IXRsugc=
 github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.4.3 h1:Hxl6lhQFj4AnOX6MLrsCb/+7tCj7DxP7VA+2rDIq5AU=
 github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
+github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs=
 github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
@@ -1295,6 +1311,8 @@ github.com/grafana/grafana-aws-sdk v0.15.0 h1:ZOPHQcC5NUFi1bLTwnju91G0KmGh1z+qXO
 github.com/grafana/grafana-aws-sdk v0.15.0/go.mod h1:rCXLYoMpPqF90U7XqgVJ1HIAopFVF0bB3SXBVEJIm3I=
 github.com/grafana/grafana-azure-sdk-go v1.6.0 h1:lxvH/mVY7gKBtJKhZ4B/6tIZFY7Jth97HxBA38olaxs=
 github.com/grafana/grafana-azure-sdk-go v1.6.0/go.mod h1:X4PdEQIYgHfn0KTa2ZTKvufhNz6jbCEKUQPZIlcyOGw=
+github.com/grafana/grafana-azure-sdk-go v1.9.0 h1:4JRwlqgUtPRAQSoiV4DFZDQ3lbNsauHqj9kC6SMR9Ak=
+github.com/grafana/grafana-azure-sdk-go v1.9.0/go.mod h1:1vBa0KOl+/Kcm7V888OyMXDSFncmek14q7XhEkrcSaA=
 github.com/grafana/grafana-google-sdk-go v0.1.0 h1:LKGY8z2DSxKjYfr2flZsWgTRTZ6HGQbTqewE3JvRaNA=
 github.com/grafana/grafana-google-sdk-go v0.1.0/go.mod h1:Vo2TKWfDVmNTELBUM+3lkrZvFtBws0qSZdXhQxRdJrE=
 github.com/grafana/grafana-plugin-sdk-go v0.94.0/go.mod h1:3VXz4nCv6wH5SfgB3mlW39s+c+LetqSCjFj7xxPC5+M=
@@ -2564,6 +2582,8 @@ golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2720,6 +2740,8 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2943,6 +2965,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2971,6 +2995,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
--- a/lerna.json
+++ b/lerna.json
@@ -2,5 +2,5 @@
  "npmClient": "yarn",
  "useWorkspaces": true,
  "packages": ["packages/*"],
-  "version": "10.0.7"
+  "version": "10.0.9"
 }
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
  "license": "AGPL-3.0-only",
  "private": true,
  "name": "grafana",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "repository": "github:grafana/grafana",
  "scripts": {
    "build": "yarn i18n:compile && NODE_ENV=production webpack --progress --config scripts/webpack/webpack.prod.js",
--- a/packages/grafana-data/package.json
+++ b/packages/grafana-data/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/data",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana Data Library",
  "keywords": [
    "typescript"
@@ -36,7 +36,7 @@
  },
  "dependencies": {
    "@braintree/sanitize-url": "6.0.2",
-    "@grafana/schema": "10.0.7",
+    "@grafana/schema": "10.0.9",
    "@types/d3-interpolate": "^3.0.0",
    "@types/string-hash": "1.1.1",
    "d3-interpolate": "3.0.1",
--- a/packages/grafana-e2e-selectors/package.json
+++ b/packages/grafana-e2e-selectors/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/e2e-selectors",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana End-to-End Test Selectors Library",
  "keywords": [
    "cli",
--- a/packages/grafana-e2e/package.json
+++ b/packages/grafana-e2e/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/e2e",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana End-to-End Test Library",
  "keywords": [
    "cli",
@@ -63,7 +63,7 @@
    "@babel/core": "7.20.5",
    "@babel/preset-env": "7.20.2",
    "@cypress/webpack-preprocessor": "5.17.0",
-    "@grafana/e2e-selectors": "10.0.7",
+    "@grafana/e2e-selectors": "10.0.9",
    "@grafana/tsconfig": "^1.2.0-rc1",
    "@mochajs/json-file-reporter": "^1.2.0",
    "babel-loader": "9.1.2",
--- a/packages/grafana-eslint-rules/package.json
+++ b/packages/grafana-eslint-rules/package.json
@@ -1,7 +1,7 @@
 {
  "name": "@grafana/eslint-plugin",
  "description": "ESLint rules for use within the Grafana repo. Not suitable (or supported) for external use.",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "main": "./index.cjs",
  "author": "Grafana Labs",
  "license": "Apache-2.0",
--- a/packages/grafana-runtime/package.json
+++ b/packages/grafana-runtime/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/runtime",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana Runtime Library",
  "keywords": [
    "grafana",
@@ -37,10 +37,10 @@
    "postpack": "mv package.json.bak package.json"
  },
  "dependencies": {
-    "@grafana/data": "10.0.7",
-    "@grafana/e2e-selectors": "10.0.7",
+    "@grafana/data": "10.0.9",
+    "@grafana/e2e-selectors": "10.0.9",
    "@grafana/faro-web-sdk": "1.0.2",
-    "@grafana/ui": "10.0.7",
+    "@grafana/ui": "10.0.9",
    "@sentry/browser": "6.19.7",
    "history": "4.10.1",
    "lodash": "4.17.21",
--- a/packages/grafana-runtime/src/config.ts
+++ b/packages/grafana-runtime/src/config.ts
@@ -22,6 +22,7 @@ import {
 export interface AzureSettings {
  cloud?: string;
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
 }

 export type AppPluginConfig = {
@@ -128,6 +129,7 @@ export class GrafanaBootConfig implements GrafanaConfig {
  awsAssumeRoleEnabled = false;
  azure: AzureSettings = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
  };
  caching = {
    enabled: false,
--- a/packages/grafana-schema/package.json
+++ b/packages/grafana-schema/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/schema",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana Schema Library",
  "keywords": [
    "typescript"
--- a/packages/grafana-schema/src/raw/composable/alertgroups/panelcfg/x/AlertGroupsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/alertgroups/panelcfg/x/AlertGroupsPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/annotationslist/panelcfg/x/AnnotationsListPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/annotationslist/panelcfg/x/AnnotationsListPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  limit: number;
--- a/packages/grafana-schema/src/raw/composable/barchart/panelcfg/x/BarChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/barchart/panelcfg/x/BarChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.OptionsWithLegend, common.OptionsWithTooltip, common.OptionsWithTextFormatting {
  /**
--- a/packages/grafana-schema/src/raw/composable/bargauge/panelcfg/x/BarGaugePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/bargauge/panelcfg/x/BarGaugePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.SingleStatBaseOptions {
  displayMode: common.BarGaugeDisplayMode;
--- a/packages/grafana-schema/src/raw/composable/candlestick/panelcfg/x/CandlestickPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/candlestick/panelcfg/x/CandlestickPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum VizDisplayMode {
  Candles = 'candles',
--- a/packages/grafana-schema/src/raw/composable/canvas/panelcfg/x/CanvasPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/canvas/panelcfg/x/CanvasPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum HorizontalConstraint {
  Center = 'center',
--- a/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface MetricStat {
  /**
--- a/packages/grafana-schema/src/raw/composable/dashboardlist/panelcfg/x/DashboardListPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/dashboardlist/panelcfg/x/DashboardListPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  folderId?: number;
--- a/packages/grafana-schema/src/raw/composable/datagrid/panelcfg/x/DatagridPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/datagrid/panelcfg/x/DatagridPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  selectedSeries: number;
--- a/packages/grafana-schema/src/raw/composable/debug/panelcfg/x/DebugPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/debug/panelcfg/x/DebugPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export type UpdateConfig = {
  render: boolean,
--- a/packages/grafana-schema/src/raw/composable/elasticsearch/dataquery/x/ElasticsearchDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/elasticsearch/dataquery/x/ElasticsearchDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export type BucketAggregation = (DateHistogram | Histogram | Terms | Filters | GeoHashGrid | Nested);

--- a/packages/grafana-schema/src/raw/composable/gauge/panelcfg/x/GaugePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/gauge/panelcfg/x/GaugePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.SingleStatBaseOptions {
  showThresholdLabels: boolean;
--- a/packages/grafana-schema/src/raw/composable/geomap/panelcfg/x/GeomapPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/geomap/panelcfg/x/GeomapPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  basemap: ui.MapLayerOptions;
--- a/packages/grafana-schema/src/raw/composable/grafanapyroscope/dataquery/x/GrafanaPyroscopeDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/grafanapyroscope/dataquery/x/GrafanaPyroscopeDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export type PhlareQueryType = ('metrics' | 'profile' | 'both');

--- a/packages/grafana-schema/src/raw/composable/heatmap/panelcfg/x/HeatmapPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/heatmap/panelcfg/x/HeatmapPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 /**
 * Controls the color mode of the heatmap
--- a/packages/grafana-schema/src/raw/composable/histogram/panelcfg/x/HistogramPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/histogram/panelcfg/x/HistogramPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.OptionsWithLegend, common.OptionsWithTooltip {
  /**
--- a/packages/grafana-schema/src/raw/composable/logs/panelcfg/x/LogsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/logs/panelcfg/x/LogsPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  dedupStrategy: common.LogsDedupStrategy;
--- a/packages/grafana-schema/src/raw/composable/loki/dataquery/x/LokiDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/loki/dataquery/x/LokiDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum QueryEditorMode {
  Builder = 'builder',
--- a/packages/grafana-schema/src/raw/composable/news/panelcfg/x/NewsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/news/panelcfg/x/NewsPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/nodegraph/panelcfg/x/NodeGraphPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/nodegraph/panelcfg/x/NodeGraphPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface ArcOption {
  /**
--- a/packages/grafana-schema/src/raw/composable/parca/dataquery/x/ParcaDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/parca/dataquery/x/ParcaDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export type ParcaQueryType = ('metrics' | 'profile' | 'both');

--- a/packages/grafana-schema/src/raw/composable/piechart/panelcfg/x/PieChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/piechart/panelcfg/x/PieChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 /**
 * Select the pie chart display style.
--- a/packages/grafana-schema/src/raw/composable/prometheus/dataquery/x/PrometheusDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/prometheus/dataquery/x/PrometheusDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum QueryEditorMode {
  Builder = 'builder',
--- a/packages/grafana-schema/src/raw/composable/stat/panelcfg/x/StatPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/stat/panelcfg/x/StatPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.SingleStatBaseOptions {
  colorMode: common.BigValueColorMode;
--- a/packages/grafana-schema/src/raw/composable/statetimeline/panelcfg/x/StateTimelinePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/statetimeline/panelcfg/x/StateTimelinePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends ui.OptionsWithLegend, ui.OptionsWithTooltip, ui.OptionsWithTimezones {
  /**
--- a/packages/grafana-schema/src/raw/composable/statushistory/panelcfg/x/StatusHistoryPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/statushistory/panelcfg/x/StatusHistoryPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends ui.OptionsWithLegend, ui.OptionsWithTooltip, ui.OptionsWithTimezones {
  /**
--- a/packages/grafana-schema/src/raw/composable/table/panelcfg/x/TablePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/table/panelcfg/x/TablePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/tempo/dataquery/x/TempoDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/tempo/dataquery/x/TempoDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface TempoQuery extends common.DataQuery {
  filters: Array<TraceqlFilter>;
--- a/packages/grafana-schema/src/raw/composable/testdata/dataquery/x/TestDataDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/testdata/dataquery/x/TestDataDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum TestDataQueryType {
  Annotations = 'annotations',
--- a/packages/grafana-schema/src/raw/composable/text/panelcfg/x/TextPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/text/panelcfg/x/TextPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum TextMode {
  Code = 'code',
--- a/packages/grafana-schema/src/raw/composable/timeseries/panelcfg/x/TimeSeriesPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/timeseries/panelcfg/x/TimeSeriesPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export interface Options extends common.OptionsWithTimezones {
  legend: common.VizLegendOptions;
--- a/packages/grafana-schema/src/raw/composable/trend/panelcfg/x/TrendPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/trend/panelcfg/x/TrendPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 /**
 * Identical to timeseries... except it does not have timezone settings
--- a/packages/grafana-schema/src/raw/composable/xychart/panelcfg/x/XYChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/xychart/panelcfg/x/XYChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.0.7";
+export const pluginVersion = "10.0.9";

 export enum SeriesMapping {
  Auto = 'auto',
--- a/packages/grafana-toolkit/package.json
+++ b/packages/grafana-toolkit/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/toolkit",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana Toolkit",
  "keywords": [
    "grafana",
--- a/packages/grafana-ui/package.json
+++ b/packages/grafana-ui/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/ui",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Grafana Components Library",
  "keywords": [
    "grafana",
@@ -49,10 +49,10 @@
  "dependencies": {
    "@emotion/css": "11.10.6",
    "@emotion/react": "11.10.6",
-    "@grafana/data": "10.0.7",
-    "@grafana/e2e-selectors": "10.0.7",
+    "@grafana/data": "10.0.9",
+    "@grafana/e2e-selectors": "10.0.9",
    "@grafana/faro-web-sdk": "1.0.2",
-    "@grafana/schema": "10.0.7",
+    "@grafana/schema": "10.0.9",
    "@leeoniya/ufuzzy": "1.0.6",
    "@monaco-editor/react": "4.4.6",
    "@popperjs/core": "2.11.6",
--- a/pkg/api/dtos/frontend_settings.go
+++ b/pkg/api/dtos/frontend_settings.go
@@ -44,8 +44,9 @@ type FrontendSettingsLicenseInfoDTO struct {
 }

 type FrontendSettingsAzureDTO struct {
-	Cloud                  string `json:"cloud"`
-	ManagedIdentityEnabled bool   `json:"managedIdentityEnabled"`
+	Cloud                   string `json:"cloud"`
+	ManagedIdentityEnabled  bool   `json:"managedIdentityEnabled"`
+	WorkloadIdentityEnabled bool   `json:"workloadIdentityEnabled"`
 }

 type FrontendSettingsCachingDTO struct {
--- a/pkg/api/frontendsettings.go
+++ b/pkg/api/frontendsettings.go
@@ -201,8 +201,9 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
 		SupportBundlesEnabled:            isSupportBundlesEnabled(hs),

 		Azure: dtos.FrontendSettingsAzureDTO{
-			Cloud:                  hs.Cfg.Azure.Cloud,
-			ManagedIdentityEnabled: hs.Cfg.Azure.ManagedIdentityEnabled,
+			Cloud:                   hs.Cfg.Azure.Cloud,
+			ManagedIdentityEnabled:  hs.Cfg.Azure.ManagedIdentityEnabled,
+			WorkloadIdentityEnabled: hs.Cfg.Azure.WorkloadIdentityEnabled,
 		},

 		Caching: dtos.FrontendSettingsCachingDTO{
--- a/pkg/api/pluginproxy/token_provider_azure.go
+++ b/pkg/api/pluginproxy/token_provider_azure.go
@@ -20,7 +20,7 @@ type azureAccessTokenProvider struct {

 func newAzureAccessTokenProvider(ctx context.Context, cfg *setting.Cfg, authParams *plugins.JWTTokenAuth) (*azureAccessTokenProvider, error) {
 	credentials := getAzureCredentials(cfg.Azure, authParams)
-	tokenProvider, err := aztokenprovider.NewAzureAccessTokenProvider(cfg.Azure, credentials)
+	tokenProvider, err := aztokenprovider.NewAzureAccessTokenProvider(cfg.Azure, credentials, false)
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/build/config/variant.go
+++ b/pkg/build/config/variant.go
@@ -16,9 +16,9 @@ const (
 )

 var AllVariants = []Variant{
-	VariantArmV6,
-	VariantArmV7,
-	VariantArmV7Musl,
+	// VariantArmV6,
+	// VariantArmV7,
+	// VariantArmV7Musl,
 	VariantArm64,
 	VariantArm64Musl,
 	VariantDarwinAmd64,
--- a/pkg/build/config/versions.go
+++ b/pkg/build/config/versions.go
@@ -1,7 +1,5 @@
 package config

-const PublicBucket = "grafana-downloads"
-
 var Versions = VersionMap{
 	PullRequestMode: {
 		Variants: []Variant{
@@ -9,8 +7,9 @@ var Versions = VersionMap{
 			VariantLinuxAmd64Musl,
 			VariantDarwinAmd64,
 			VariantWindowsAmd64,
-			VariantArm64,
-			VariantArm64Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArm64,
+			// VariantArm64Musl,
 		},
 		PluginSignature: PluginSignature{
 			Sign:      false,
@@ -29,9 +28,10 @@ var Versions = VersionMap{
 	},
 	MainMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -48,7 +48,8 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
+				// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+				// ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -64,9 +65,10 @@ var Versions = VersionMap{
 	},
 	DownstreamMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			//VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -83,7 +85,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
+				// ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -98,9 +100,9 @@ var Versions = VersionMap{
 	},
 	ReleaseBranchMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -117,7 +119,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -133,9 +135,9 @@ var Versions = VersionMap{
 	},
 	TagMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -152,7 +154,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -171,9 +173,10 @@ var Versions = VersionMap{
 	},
 	Enterprise2Mode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -190,7 +193,8 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
--- a/pkg/build/docker/init.go
+++ b/pkg/build/docker/init.go
@@ -8,7 +8,7 @@ import (
 )

 // AllArchs is a list of all supported Docker image architectures.
-var AllArchs = []string{"amd64", "armv7", "arm64"}
+var AllArchs = []string{"amd64", "arm64"}

 // emulatorImage is the docker image used as the cross-platform emulator
 var emulatorImage = "tonistiigi/binfmt:qemu-v7.0.0"
--- a/pkg/build/packaging/artifacts.go
+++ b/pkg/build/packaging/artifacts.go
@@ -81,32 +81,32 @@ var ArtifactConfigs = []buildArtifact{
 		Arch:       "arm64",
 		urlPostfix: ".linux-arm64.tar.gz",
 	},
-	{
-		Os:         debOS,
-		Arch:       "armv7",
-		urlPostfix: "_armhf.deb",
-	},
-	{
-		Os:             debOS,
-		Arch:           "armv6",
-		packagePostfix: "-rpi",
-		urlPostfix:     "_armhf.deb",
-	},
-	{
-		Os:         rhelOS,
-		Arch:       "armv7",
-		urlPostfix: ".armhfp.rpm",
-	},
-	{
-		Os:         "linux",
-		Arch:       "armv6",
-		urlPostfix: ".linux-armv6.tar.gz",
-	},
-	{
-		Os:         "linux",
-		Arch:       "armv7",
-		urlPostfix: ".linux-armv7.tar.gz",
-	},
+	// {
+	// 	Os:         debOS,
+	// 	Arch:       "armv7",
+	// 	urlPostfix: "_armhf.deb",
+	// },
+	// {
+	// 	Os:             debOS,
+	// 	Arch:           "armv6",
+	// 	packagePostfix: "-rpi",
+	// 	urlPostfix:     "_armhf.deb",
+	// },
+	// {
+	// 	Os:         rhelOS,
+	// 	Arch:       "armv7",
+	// 	urlPostfix: ".armhfp.rpm",
+	// },
+	// {
+	// 	Os:         "linux",
+	// 	Arch:       "armv6",
+	// 	urlPostfix: ".linux-armv6.tar.gz",
+	// },
+	// {
+	// 	Os:         "linux",
+	// 	Arch:       "armv7",
+	// 	urlPostfix: ".linux-armv7.tar.gz",
+	// },
 	{
 		Os:         "darwin",
 		Arch:       "amd64",
--- a/pkg/build/packaging/grafana.go
+++ b/pkg/build/packaging/grafana.go
@@ -771,7 +771,7 @@ func realPackageVariant(ctx context.Context, v config.Variant, edition config.Ed
 		defaultFileSrc:         filepath.Join(grafanaDir, "packaging", "rpm", "sysconfig", "grafana-server"),
 		systemdFileSrc:         filepath.Join(grafanaDir, "packaging", "rpm", "systemd", "grafana-server.service"),
 		wrapperFilePath:        filepath.Join(grafanaDir, "packaging", "wrappers"),
-		depends:                []string{"/sbin/service", "fontconfig", "freetype", "urw-fonts"},
+		depends:                []string{"/sbin/service", "fontconfig", "freetype"},
 	}); err != nil {
 		return err
 	}
--- a/pkg/setting/setting_azure.go
+++ b/pkg/setting/setting_azure.go
@@ -15,5 +15,23 @@ func (cfg *Cfg) readAzureSettings() {
 	azureSettings.ManagedIdentityEnabled = azureSection.Key("managed_identity_enabled").MustBool(false)
 	azureSettings.ManagedIdentityClientId = azureSection.Key("managed_identity_client_id").String()

+	// Workload Identity authentication
+	if azureSection.Key("workload_identity_enabled").MustBool(false) {
+		azureSettings.WorkloadIdentityEnabled = true
+		workloadIdentitySettings := &azsettings.WorkloadIdentitySettings{}
+
+		if val := azureSection.Key("workload_identity_tenant_id").String(); val != "" {
+			workloadIdentitySettings.TenantId = val
+		}
+		if val := azureSection.Key("workload_identity_client_id").String(); val != "" {
+			workloadIdentitySettings.ClientId = val
+		}
+		if val := azureSection.Key("workload_identity_token_file").String(); val != "" {
+			workloadIdentitySettings.TokenFile = val
+		}
+
+		azureSettings.WorkloadIdentitySettings = workloadIdentitySettings
+	}
+
 	cfg.Azure = azureSettings
 }
--- a/pkg/tsdb/azuremonitor/credentials.go
+++ b/pkg/tsdb/azuremonitor/credentials.go
@@ -31,10 +31,14 @@ func getAuthType(cfg *setting.Cfg, jsonData *simplejson.Json) string {
 			return azcredentials.AzureAuthClientSecret
 		}

-		// For newly created datasource with no configuration, managed identity is the default authentication type
-		// if they are enabled in Grafana config
+		// For newly created datasource with no configuration the order is as follows:
+		// Managed identity is the default if enabled
+		// Workload identity is the next option if enabled
+		// Client secret is the final fallback
 		if cfg.Azure.ManagedIdentityEnabled {
 			return azcredentials.AzureAuthManagedIdentity
+		} else if cfg.Azure.WorkloadIdentityEnabled {
+			return azcredentials.AzureAuthWorkloadIdentity
 		} else {
 			return azcredentials.AzureAuthClientSecret
 		}
@@ -84,8 +88,8 @@ func normalizeAzureCloud(cloudName string) (string, error) {
 func getAzureCloud(cfg *setting.Cfg, jsonData *simplejson.Json) (string, error) {
 	authType := getAuthType(cfg, jsonData)
 	switch authType {
-	case azcredentials.AzureAuthManagedIdentity:
-		// In case of managed identity, the cloud is always same as where Grafana is hosted
+	case azcredentials.AzureAuthManagedIdentity, azcredentials.AzureAuthWorkloadIdentity:
+		// In case of managed identity and workload identity, the cloud is always same as where Grafana is hosted
 		return getDefaultAzureCloud(cfg)
 	case azcredentials.AzureAuthClientSecret:
 		if cloud := jsonData.Get("cloudName").MustString(); cloud != "" {
@@ -106,7 +110,9 @@ func getAzureCredentials(cfg *setting.Cfg, jsonData *simplejson.Json, secureJson
 	case azcredentials.AzureAuthManagedIdentity:
 		credentials := &azcredentials.AzureManagedIdentityCredentials{}
 		return credentials, nil
-
+	case azcredentials.AzureAuthWorkloadIdentity:
+		credentials := &azcredentials.AzureWorkloadIdentityCredentials{}
+		return credentials, nil
 	case azcredentials.AzureAuthClientSecret:
 		cloud, err := getAzureCloud(cfg, jsonData)
 		if err != nil {
--- a/pkg/tsdb/azuremonitor/credentials_test.go
+++ b/pkg/tsdb/azuremonitor/credentials_test.go
@@ -76,6 +76,66 @@ func TestCredentials_getAuthType(t *testing.T) {
 			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
 		})
 	})
+
+	t.Run("when workload identities enabled", func(t *testing.T) {
+		cfg.Azure.WorkloadIdentityEnabled = true
+
+		t.Run("should be client secret if auth type is set to client secret", func(t *testing.T) {
+			jsonData := simplejson.NewFromAny(map[string]interface{}{
+				"azureAuthType": azcredentials.AzureAuthClientSecret,
+			})
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+
+		t.Run("should be workload identity if datasource not configured and managed identity is disabled", func(t *testing.T) {
+			jsonData := simplejson.NewFromAny(map[string]interface{}{
+				"azureAuthType": "",
+			})
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthWorkloadIdentity, authType)
+		})
+
+		t.Run("should be client secret if auth type not specified but credentials configured", func(t *testing.T) {
+			jsonData := simplejson.NewFromAny(map[string]interface{}{
+				"azureAuthType": "",
+				"tenantId":      "9b9d90ee-a5cc-49c2-b97e-0d1b0f086b5c",
+				"clientId":      "849ccbb0-92eb-4226-b228-ef391abd8fe6",
+			})
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+	})
+
+	t.Run("when workload identities disabled", func(t *testing.T) {
+		cfg.Azure.WorkloadIdentityEnabled = false
+
+		t.Run("should be workload identity if auth type is set to workload identity", func(t *testing.T) {
+			jsonData := simplejson.NewFromAny(map[string]interface{}{
+				"azureAuthType": azcredentials.AzureAuthWorkloadIdentity,
+			})
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthWorkloadIdentity, authType)
+		})
+
+		t.Run("should be client secret if datasource not configured", func(t *testing.T) {
+			jsonData := simplejson.NewFromAny(map[string]interface{}{
+				"azureAuthType": "",
+			})
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+	})
 }

 func TestCredentials_getAzureCloud(t *testing.T) {
--- a/pkg/tsdb/prometheus/azureauth/azure.go
+++ b/pkg/tsdb/prometheus/azureauth/azure.go
@@ -77,7 +77,7 @@ func getOverriddenScopes(jsonData map[string]interface{}) ([]string, error) {

 func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) ([]string, error) {
 	// Extract cloud from credentials
-	azureCloud, err := getAzureCloudFromCredentials(settings, credentials)
+	azureCloud, err := azcredentials.GetAzureCloud(settings, credentials)
 	if err != nil {
 		return nil, err
 	}
@@ -90,26 +90,3 @@ func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcrede
 		return scopes, nil
 	}
 }
-
-// To be part of grafana-azure-sdk-go
-func getAzureCloudFromCredentials(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) (string, error) {
-	switch c := credentials.(type) {
-	case *azcredentials.AzureManagedIdentityCredentials:
-		// In case of managed identity, the cloud is always same as where Grafana is hosted
-		return getDefaultAzureCloud(settings), nil
-	case *azcredentials.AzureClientSecretCredentials:
-		return c.AzureCloud, nil
-	default:
-		err := fmt.Errorf("the Azure credentials of type '%s' not supported by Prometheus datasource", c.AzureAuthType())
-		return "", err
-	}
-}
-
-// To be part of grafana-azure-sdk-go
-func getDefaultAzureCloud(settings *azsettings.AzureSettings) string {
-	cloudName := settings.Cloud
-	if cloudName == "" {
-		return azsettings.AzurePublic
-	}
-	return cloudName
-}
--- a/plugins-bundled/internal/input-datasource/package.json
+++ b/plugins-bundled/internal/input-datasource/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@grafana-plugins/input-datasource",
-  "version": "10.0.7",
+  "version": "10.0.9",
  "description": "Input Datasource",
  "private": true,
  "repository": {
@@ -28,8 +28,8 @@
    "webpack": "5.76.0"
  },
  "dependencies": {
-    "@grafana/data": "10.0.7",
-    "@grafana/ui": "10.0.7",
+    "@grafana/data": "10.0.9",
+    "@grafana/ui": "10.0.9",
    "react": "18.2.0",
    "tslib": "2.5.0"
  }
--- a/public/app/features/dashboard/state/DashboardModel.ts
+++ b/public/app/features/dashboard/state/DashboardModel.ts
@@ -179,13 +179,13 @@ export class DashboardModel implements TimeModel {

    // Auto-migrate old angular panels
    if (options?.autoMigrateOldPanels || !config.angularSupportEnabled || config.featureToggles.autoMigrateOldPanels) {
-      this.panels.forEach((p) => {
+      for (const p of this.panelIterator()) {
        const newType = autoMigrateAngular[p.type];
        if (!p.autoMigrateFrom && newType) {
          p.autoMigrateFrom = p.type;
          p.type = newType;
        }
-      });
+      }
    }

    this.addBuiltInAnnotationQuery();
--- a/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.test.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.test.tsx
@@ -6,6 +6,7 @@ import AzureCredentialsForm, { Props } from './AzureCredentialsForm';
 const setup = (propsFunc?: (props: Props) => Props) => {
  let props: Props = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
    credentials: {
      authType: 'clientsecret',
      azureCloud: 'azuremonitor',
--- a/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx
@@ -1,4 +1,4 @@
-import React, { ChangeEvent } from 'react';
+import React, { ChangeEvent, useMemo } from 'react';

 import { SelectableValue } from '@grafana/data';
 import { LegacyForms, Button, Select, InlineField } from '@grafana/ui';
@@ -10,41 +10,66 @@ const { Input } = LegacyForms;

 export interface Props {
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
  credentials: AzureCredentials;
  azureCloudOptions?: SelectableValue[];
-  onCredentialsChange?: (updatedCredentials: AzureCredentials) => void;
+  onCredentialsChange: (updatedCredentials: AzureCredentials) => void;
  disabled?: boolean;
  children?: JSX.Element;
 }

-const authTypeOptions: Array<SelectableValue<AzureAuthType>> = [
-  {
-    value: 'msi',
-    label: 'Managed Identity',
-  },
-  {
-    value: 'clientsecret',
-    label: 'App Registration',
-  },
-];
-
 const LABEL_WIDTH = 18;

 export const AzureCredentialsForm = (props: Props) => {
-  const { credentials, azureCloudOptions, onCredentialsChange, disabled, managedIdentityEnabled } = props;
+  const {
+    credentials,
+    azureCloudOptions,
+    onCredentialsChange,
+    disabled,
+    managedIdentityEnabled,
+    workloadIdentityEnabled,
+  } = props;
+
+  const authTypeOptions = useMemo(() => {
+    let opts: Array<SelectableValue<AzureAuthType>> = [
+      {
+        value: 'clientsecret',
+        label: 'App Registration',
+      },
+    ];
+
+    if (managedIdentityEnabled) {
+      opts.push({
+        value: 'msi',
+        label: 'Managed Identity',
+      });
+    }
+
+    if (workloadIdentityEnabled) {
+      opts.push({
+        value: 'workloadidentity',
+        label: 'Workload Identity',
+      });
+    }
+
+    return opts;
+  }, [managedIdentityEnabled, workloadIdentityEnabled]);

  const onAuthTypeChange = (selected: SelectableValue<AzureAuthType>) => {
-    if (onCredentialsChange) {
-      const updated: AzureCredentials = {
-        ...credentials,
-        authType: selected.value || 'msi',
-      };
-      onCredentialsChange(updated);
-    }
+    const defaultAuthType = managedIdentityEnabled
+      ? 'msi'
+      : workloadIdentityEnabled
+      ? 'workloadidentity'
+      : 'clientsecret';
+    const updated: AzureCredentials = {
+      ...credentials,
+      authType: selected.value || defaultAuthType,
+    };
+    onCredentialsChange(updated);
  };

  const onAzureCloudChange = (selected: SelectableValue<string>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        azureCloud: selected.value,
@@ -54,7 +79,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onTenantIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        tenantId: event.target.value,
@@ -64,7 +89,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientId: event.target.value,
@@ -74,7 +99,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientSecret: event.target.value,
@@ -84,7 +109,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretReset = () => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientSecret: '',
@@ -95,7 +120,7 @@ export const AzureCredentialsForm = (props: Props) => {

  return (
    <div className="gf-form-group">
-      {managedIdentityEnabled && (
+      {authTypeOptions.length > 1 && (
        <InlineField
          label="Authentication"
          labelWidth={LABEL_WIDTH}
--- a/public/app/plugins/datasource/azuremonitor/components/MonitorConfig.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/MonitorConfig.tsx
@@ -46,6 +46,7 @@ export const MonitorConfig = (props: Props) => {
      <h3 className="page-heading">Authentication</h3>
      <AzureCredentialsForm
        managedIdentityEnabled={config.azure.managedIdentityEnabled}
+        workloadIdentityEnabled={config.azure.workloadIdentityEnabled}
        credentials={credentials}
        azureCloudOptions={azureClouds}
        onCredentialsChange={onCredentialsChange}
--- a/public/app/plugins/datasource/azuremonitor/credentials.ts
+++ b/public/app/plugins/datasource/azuremonitor/credentials.ts
@@ -59,7 +59,8 @@ export function getAzureCloud(options: AzureDataSourceSettings | AzureDataSource
  const authType = getAuthType(options);
  switch (authType) {
    case 'msi':
-      // In case of managed identity, the cloud is always same as where Grafana is hosted
+    case 'workloadidentity':
+      // In case of managed identity and workload identity, the cloud is always same as where Grafana is hosted
      return getDefaultAzureCloud();
    case 'clientsecret':
      return options.jsonData.cloudName || getDefaultAzureCloud();
@@ -79,6 +80,7 @@ function getSecret(options: AzureDataSourceSettings): undefined | string | Conce
 export function isCredentialsComplete(credentials: AzureCredentials): boolean {
  switch (credentials.authType) {
    case 'msi':
+    case 'workloadidentity':
      return true;
    case 'clientsecret':
      return !!(credentials.azureCloud && credentials.tenantId && credentials.clientId && credentials.clientSecret);
@@ -89,12 +91,16 @@ export function getCredentials(options: AzureDataSourceSettings): AzureCredentia
  const authType = getAuthType(options);
  switch (authType) {
    case 'msi':
-      if (config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (
+        (authType === 'msi' && config.azure.managedIdentityEnabled) ||
+        (authType === 'workloadidentity' && config.azure.workloadIdentityEnabled)
+      ) {
        return {
-          authType: 'msi',
+          authType,
        };
      } else {
-        // If authentication type is managed identity but managed identities were disabled in Grafana config,
+        // If authentication type is managed identity or workload identity but either method is disabled in Grafana config,
        // then we should fallback to an empty app registration (client secret) configuration
        return {
          authType: 'clientsecret',
@@ -118,15 +124,19 @@ export function updateCredentials(
 ): AzureDataSourceSettings {
  switch (credentials.authType) {
    case 'msi':
-      if (!config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (credentials.authType === 'msi' && !config.azure.managedIdentityEnabled) {
        throw new Error('Managed Identity authentication is not enabled in Grafana config.');
      }
+      if (credentials.authType === 'workloadidentity' && !config.azure.workloadIdentityEnabled) {
+        throw new Error('Workload Identity authentication is not enabled in Grafana config.');
+      }

      options = {
        ...options,
        jsonData: {
          ...options.jsonData,
-          azureAuthType: 'msi',
+          azureAuthType: credentials.authType,
        },
      };

--- a/public/app/plugins/datasource/azuremonitor/types/types.ts
+++ b/public/app/plugins/datasource/azuremonitor/types/types.ts
@@ -30,7 +30,7 @@ export enum AzureCloud {
  None = '',
 }

-export type AzureAuthType = 'msi' | 'clientsecret';
+export type AzureAuthType = 'msi' | 'clientsecret' | 'workloadidentity';

 export type ConcealedSecret = symbol;

@@ -42,6 +42,10 @@ export interface AzureManagedIdentityCredentials extends AzureCredentialsBase {
  authType: 'msi';
 }

+export interface AzureWorkloadIdentityCredentials extends AzureCredentialsBase {
+  authType: 'workloadidentity';
+}
+
 export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  authType: 'clientsecret';
  azureCloud?: string;
@@ -50,7 +54,10 @@ export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  clientSecret?: string | ConcealedSecret;
 }

-export type AzureCredentials = AzureManagedIdentityCredentials | AzureClientSecretCredentials;
+export type AzureCredentials =
+  | AzureManagedIdentityCredentials
+  | AzureClientSecretCredentials
+  | AzureWorkloadIdentityCredentials;

 export interface AzureDataSourceJsonData extends DataSourceJsonData {
  cloudName: string;
--- a/public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx
@@ -48,6 +48,7 @@ export const AzureAuthSettings = (props: HttpSettingsBaseProps) => {
      <h6>Azure authentication</h6>
      <AzureCredentialsForm
        managedIdentityEnabled={config.azure.managedIdentityEnabled}
+        workloadIdentityEnabled={config.azure.workloadIdentityEnabled}
        credentials={credentials}
        azureCloudOptions={KnownAzureClouds}
        onCredentialsChange={onCredentialsChange}
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentials.ts
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentials.ts
@@ -13,7 +13,7 @@ export const KnownAzureClouds: Array<SelectableValue<AzureCloud>> = [
  { value: AzureCloud.USGovernment, label: 'Azure US Government' },
 ];

-export type AzureAuthType = 'msi' | 'clientsecret';
+export type AzureAuthType = 'msi' | 'clientsecret' | 'workloadidentity';

 export type ConcealedSecret = symbol;

@@ -26,6 +26,10 @@ export interface AzureManagedIdentityCredentials extends AzureCredentialsBase {
  authType: 'msi';
 }

+export interface AzureWorkloadIdentityCredentials extends AzureCredentialsBase {
+  authType: 'workloadidentity';
+}
+
 export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  authType: 'clientsecret';
  azureCloud?: string;
@@ -34,11 +38,15 @@ export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  clientSecret?: string | ConcealedSecret;
 }

-export type AzureCredentials = AzureManagedIdentityCredentials | AzureClientSecretCredentials;
+export type AzureCredentials =
+  | AzureManagedIdentityCredentials
+  | AzureClientSecretCredentials
+  | AzureWorkloadIdentityCredentials;

 export function isCredentialsComplete(credentials: AzureCredentials): boolean {
  switch (credentials.authType) {
    case 'msi':
+    case 'workloadidentity':
      return true;
    case 'clientsecret':
      return !!(credentials.azureCloud && credentials.tenantId && credentials.clientId && credentials.clientSecret);
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsConfig.ts
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsConfig.ts
@@ -42,12 +42,16 @@ export function getCredentials(options: DataSourceSettings<any, any>): AzureCred

  switch (credentials.authType) {
    case 'msi':
-      if (config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (
+        (credentials.authType === 'msi' && config.azure.managedIdentityEnabled) ||
+        (credentials.authType === 'workloadidentity' && config.azure.workloadIdentityEnabled)
+      ) {
        return {
-          authType: 'msi',
+          authType: credentials.authType,
        };
      } else {
-        // If authentication type is managed identity but managed identities were disabled in Grafana config,
+        // If authentication type is managed identity or workload identity but either method is disabled in Grafana config,
        // then we should fallback to an empty app registration (client secret) configuration
        return {
          authType: 'clientsecret',
@@ -71,16 +75,21 @@ export function updateCredentials(
 ): DataSourceSettings<any, any> {
  switch (credentials.authType) {
    case 'msi':
-      if (!config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (credentials.authType === 'msi' && !config.azure.managedIdentityEnabled) {
        throw new Error('Managed Identity authentication is not enabled in Grafana config.');
      }
+      if (credentials.authType === 'workloadidentity' && !config.azure.workloadIdentityEnabled) {
+        throw new Error('Workload Identity authentication is not enabled in Grafana config.');
+      }

      options = {
        ...options,
        jsonData: {
          ...options.jsonData,
+          azureAuthType: credentials.authType,
          azureCredentials: {
-            authType: 'msi',
+            authType: credentials.authType,
          },
        },
      };
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.test.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.test.tsx
@@ -6,6 +6,7 @@ import AzureCredentialsForm, { Props } from './AzureCredentialsForm';
 const setup = (propsFunc?: (props: Props) => Props) => {
  let props: Props = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
    credentials: {
      authType: 'clientsecret',
      azureCloud: 'azuremonitor',
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.tsx
@@ -1,4 +1,4 @@
-import React, { ChangeEvent, useEffect, useReducer, useState } from 'react';
+import React, { ChangeEvent, useEffect, useMemo, useReducer, useState } from 'react';

 import { SelectableValue } from '@grafana/data';
 import { InlineFormLabel, Button } from '@grafana/ui/src/components';
@@ -9,6 +9,7 @@ import { AzureAuthType, AzureCredentials, isCredentialsComplete } from './AzureC

 export interface Props {
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
  credentials: AzureCredentials;
  azureCloudOptions?: SelectableValue[];
  onCredentialsChange: (updatedCredentials: AzureCredentials) => void;
@@ -16,23 +17,45 @@ export interface Props {
  disabled?: boolean;
 }

-const authTypeOptions: Array<SelectableValue<AzureAuthType>> = [
-  {
-    value: 'msi',
-    label: 'Managed Identity',
-  },
-  {
-    value: 'clientsecret',
-    label: 'App Registration',
-  },
-];
-
 export const AzureCredentialsForm = (props: Props) => {
-  const { credentials, azureCloudOptions, onCredentialsChange, getSubscriptions, disabled } = props;
+  const {
+    credentials,
+    azureCloudOptions,
+    onCredentialsChange,
+    getSubscriptions,
+    disabled,
+    managedIdentityEnabled,
+    workloadIdentityEnabled,
+  } = props;
  const hasRequiredFields = isCredentialsComplete(credentials);

  const [subscriptions, setSubscriptions] = useState<Array<SelectableValue<string>>>([]);
  const [loadSubscriptionsClicked, onLoadSubscriptions] = useReducer((val) => val + 1, 0);
+
+  const authTypeOptions = useMemo(() => {
+    let opts: Array<SelectableValue<AzureAuthType>> = [
+      {
+        value: 'clientsecret',
+        label: 'App Registration',
+      },
+    ];
+
+    if (managedIdentityEnabled) {
+      opts.push({
+        value: 'msi',
+        label: 'Managed Identity',
+      });
+    }
+
+    if (workloadIdentityEnabled) {
+      opts.push({
+        value: 'workloadidentity',
+        label: 'Workload Identity',
+      });
+    }
+    return opts;
+  }, [managedIdentityEnabled, workloadIdentityEnabled]);
+
  useEffect(() => {
    if (!getSubscriptions || !hasRequiredFields) {
      updateSubscriptions([]);
@@ -68,19 +91,22 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onAuthTypeChange = (selected: SelectableValue<AzureAuthType>) => {
-    if (onCredentialsChange) {
-      setSubscriptions([]);
-      const updated: AzureCredentials = {
-        ...credentials,
-        authType: selected.value || 'msi',
-        defaultSubscriptionId: undefined,
-      };
-      onCredentialsChange(updated);
-    }
+    setSubscriptions([]);
+    const defaultAuthType = managedIdentityEnabled
+      ? 'msi'
+      : workloadIdentityEnabled
+      ? 'workloadidentity'
+      : 'clientsecret';
+    const updated: AzureCredentials = {
+      ...credentials,
+      authType: selected.value || defaultAuthType,
+      defaultSubscriptionId: undefined,
+    };
+    onCredentialsChange(updated);
  };

  const onAzureCloudChange = (selected: SelectableValue<string>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -92,7 +118,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onTenantIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -104,7 +130,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -116,7 +142,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -128,7 +154,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretReset = () => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -140,18 +166,16 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onSubscriptionChange = (selected: SelectableValue<string> | undefined) => {
-    if (onCredentialsChange) {
-      const updated: AzureCredentials = {
-        ...credentials,
-        defaultSubscriptionId: selected?.value,
-      };
-      onCredentialsChange(updated);
-    }
+    const updated: AzureCredentials = {
+      ...credentials,
+      defaultSubscriptionId: selected?.value,
+    };
+    onCredentialsChange(updated);
  };

  return (
    <div className="gf-form-group">
-      {props.managedIdentityEnabled && (
+      {authTypeOptions.length > 1 && (
        <div className="gf-form-inline">
          <div className="gf-form">
            <InlineFormLabel className="width-12" tooltip="Choose the type of authentication to Azure services">
--- a/scripts/build/ci-build/Dockerfile
+++ b/scripts/build/ci-build/Dockerfile
@@ -108,7 +108,7 @@ RUN rm dockerize-linux-amd64-v${DOCKERIZE_VERSION}.tar.gz
 # Use old Debian (LTS into 2024) in order to ensure binary compatibility with older glibc's.
 FROM debian:buster-20220822

-ENV GOVERSION=1.20.8 \
+ENV GOVERSION=1.20.10 \
    PATH=/usr/local/go/bin:$PATH \
    GOPATH=/go \
    NODEVERSION=18.12.0-1nodesource1 \
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@@ -20,7 +20,7 @@ load(
    "windows_images",
 )

-grabpl_version = "v3.0.41"
+grabpl_version = "v3.0.42"

 trigger_oss = {
    "repo": [
--- a/scripts/drone/utils/images.star
+++ b/scripts/drone/utils/images.star
@@ -8,7 +8,7 @@ images = {
    "publish_image": "grafana/grafana-ci-deploy:1.3.3",
    "alpine_image": "alpine:3.18.3",
    "curl_image": "byrnedo/alpine-curl:0.1.8",
-    "go_image": "golang:1.20.8",
+    "go_image": "golang:1.20.10",
    "plugins_slack_image": "plugins/slack",
    "postgres_alpine_image": "postgres:12.3-alpine",
    "mysql5_image": "mysql:5.7.39",
--- a/yarn.lock
+++ b/yarn.lock
@@ -2730,9 +2730,9 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@grafana-plugins/input-datasource@workspace:plugins-bundled/internal/input-datasource"
  dependencies:
-    "@grafana/data": 10.0.7
+    "@grafana/data": 10.0.9
    "@grafana/tsconfig": ^1.2.0-rc1
-    "@grafana/ui": 10.0.7
+    "@grafana/ui": 10.0.9
    "@types/jest": 26.0.15
    "@types/react": 18.0.28
    copy-webpack-plugin: 11.0.0
@@ -2768,12 +2768,12 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/data@10.0.7, @grafana/data@workspace:*, @grafana/data@workspace:packages/grafana-data":
+"@grafana/data@10.0.9, @grafana/data@workspace:*, @grafana/data@workspace:packages/grafana-data":
  version: 0.0.0-use.local
  resolution: "@grafana/data@workspace:packages/grafana-data"
  dependencies:
    "@braintree/sanitize-url": 6.0.2
-    "@grafana/schema": 10.0.7
+    "@grafana/schema": 10.0.9
    "@grafana/tsconfig": ^1.2.0-rc1
    "@rollup/plugin-commonjs": 23.0.2
    "@rollup/plugin-json": 5.0.1
@@ -2834,7 +2834,7 @@ __metadata:
  languageName: unknown
  linkType: soft

-"@grafana/e2e-selectors@10.0.7, @grafana/e2e-selectors@workspace:*, @grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors":
+"@grafana/e2e-selectors@10.0.9, @grafana/e2e-selectors@workspace:*, @grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors":
  version: 0.0.0-use.local
  resolution: "@grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors"
  dependencies:
@@ -2871,7 +2871,7 @@ __metadata:
    "@babel/core": 7.20.5
    "@babel/preset-env": 7.20.2
    "@cypress/webpack-preprocessor": 5.17.0
-    "@grafana/e2e-selectors": 10.0.7
+    "@grafana/e2e-selectors": 10.0.9
    "@grafana/tsconfig": ^1.2.0-rc1
    "@mochajs/json-file-reporter": ^1.2.0
    "@rollup/plugin-node-resolve": 15.0.1
@@ -3031,11 +3031,11 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@grafana/runtime@workspace:packages/grafana-runtime"
  dependencies:
-    "@grafana/data": 10.0.7
-    "@grafana/e2e-selectors": 10.0.7
+    "@grafana/data": 10.0.9
+    "@grafana/e2e-selectors": 10.0.9
    "@grafana/faro-web-sdk": 1.0.2
    "@grafana/tsconfig": ^1.2.0-rc1
-    "@grafana/ui": 10.0.7
+    "@grafana/ui": 10.0.9
    "@rollup/plugin-commonjs": 23.0.2
    "@rollup/plugin-node-resolve": 15.0.1
    "@sentry/browser": 6.19.7
@@ -3085,7 +3085,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/schema@10.0.7, @grafana/schema@workspace:*, @grafana/schema@workspace:packages/grafana-schema":
+"@grafana/schema@10.0.9, @grafana/schema@workspace:*, @grafana/schema@workspace:packages/grafana-schema":
  version: 0.0.0-use.local
  resolution: "@grafana/schema@workspace:packages/grafana-schema"
  dependencies:
@@ -3128,17 +3128,17 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/ui@10.0.7, @grafana/ui@workspace:*, @grafana/ui@workspace:packages/grafana-ui":
+"@grafana/ui@10.0.9, @grafana/ui@workspace:*, @grafana/ui@workspace:packages/grafana-ui":
  version: 0.0.0-use.local
  resolution: "@grafana/ui@workspace:packages/grafana-ui"
  dependencies:
    "@babel/core": 7.20.5
    "@emotion/css": 11.10.6
    "@emotion/react": 11.10.6
-    "@grafana/data": 10.0.7
-    "@grafana/e2e-selectors": 10.0.7
+    "@grafana/data": 10.0.9
+    "@grafana/e2e-selectors": 10.0.9
    "@grafana/faro-web-sdk": 1.0.2
-    "@grafana/schema": 10.0.7
+    "@grafana/schema": 10.0.9
    "@grafana/tsconfig": ^1.2.0-rc1
    "@leeoniya/ufuzzy": 1.0.6
    "@mdx-js/react": 1.6.22
Author	SHA1	Message	Date
Horst Gutmann	439bbb4722	[v10.0.x] Chore: Upgrade Go to 1.20.10 (#76365 ) Chore: Upgrade Go to 1.20.10 (#76355) * [v10.1.x] Chore: Upgrade Go to 1.20.10 * Rebuild .drone.yml (cherry picked from commit `4287686420`)	2023-10-11 18:20:20 +02:00
grafana-delivery-bot[bot]	b8364755b2	[v10.0.x] Building: Remove dependency to urw-fonts in RPM packages (#76220 ) Building: Remove dependency to urw-fonts in RPM packages (#76198) (cherry picked from commit `1355660313`) Co-authored-by: Horst Gutmann <horst.gutmann@grafana.com>	2023-10-11 14:42:54 +02:00
Dimitris Sotirakis	586835bd37	Bug: Exclude 32-bit `arm` builds (#75448 ) * Exclude 32 bit arm builds * Bump grabpl - remove arm/v7 from build.star	2023-10-11 14:14:30 +02:00
grafana-delivery-bot[bot]	64e1d6aa13	[v10.0.x] Angular: Fix issue where panels in collapsed rows were not auto-migrated (#75736 ) Angular: Fix issue where panels in collapsed rows were not auto-migrated (#75735) (cherry picked from commit `dc4091bd34`) Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com>	2023-10-11 13:43:46 +02:00
Andreas Christou	cdbb2301c1	[v10.0.x] Azure: Settings for Azure AD Workload Identity (#75686 ) * Azure: Settings for Azure AD Workload Identity (#75283) * Settings for Azure AD Workload Identity * Update dependency on Grafana Azure SDK * Documentation * Fix JS code * Cleanup Prometheus backend code * Making prettier happy (cherry picked from commit `3ee40d3a5a`) # Conflicts: # conf/defaults.ini # conf/sample.ini # docs/sources/setup-grafana/configure-grafana/_index.md # go.mod # go.sum # packages/grafana-runtime/src/config.ts # pkg/api/dtos/frontend_settings.go # pkg/api/frontendsettings.go # pkg/setting/setting_azure.go # public/app/plugins/datasource/mssql/azureauth/AzureAuth.testMocks.ts * Fix build --------- Co-authored-by: Sergey Kostrukov <sekost@microsoft.com>	2023-10-11 13:43:13 +02:00
Andreas Christou	0908615b59	[v10.0.x] Azure: Add support for Workload Identity authentication (#75732 ) * Azure: Add support for Workload Identity authentication (#75681) * Update Azure Monitor * Update Prometheus * Update README * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Andrew Hackmann <5140848+bossinc@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * README updates * Fix prettier * memoize options --------- Co-authored-by: Andrew Hackmann <5140848+bossinc@users.noreply.github.com> Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> (cherry picked from commit `5796836662`) # Conflicts: # public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx # public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.tsx * Fix types	2023-10-11 13:42:27 +02:00
grafana-delivery-bot[bot]	c7a0ac39a0	Release: Bump version to 10.0.9 (#57 ) Co-authored-by: grafana-delivery-bot[bot] <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>	2023-10-11 13:41:27 +02:00