Don't fetch armv7

2023-09-29 13:08:07 -05:00 · 2023-09-29 12:55:45 -05:00 · 2023-09-29 12:49:10 -05:00 · 2023-09-29 12:45:31 -05:00 · 2023-09-29 12:37:49 -05:00 · 2023-09-29 16:58:29 +03:00
88 changed files with 630 additions and 331 deletions
--- a/.drone.yml
+++ b/.drone.yml
@@ -17,14 +17,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-drone
@@ -67,14 +67,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build verify-starlark .
@@ -116,11 +116,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -219,7 +219,7 @@ steps:
  name: clone-enterprise
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - yarn install --immutable
@@ -306,14 +306,14 @@ steps:
  name: clone-enterprise
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -392,14 +392,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - is_fork=$(curl "https://$GITHUB_TOKEN@api.github.com/repos/grafana/grafana/pulls/$DRONE_PULL_REQUEST"
@@ -433,12 +433,12 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: lint-backend
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
  failure: ignore
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: validate-modfile
 trigger:
  event:
@@ -481,11 +481,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -494,7 +494,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -894,7 +894,7 @@ steps:
  name: clone-enterprise
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -903,11 +903,11 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1051,7 +1051,7 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - yarn install --immutable
@@ -1123,7 +1123,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build shellcheck
@@ -1225,7 +1225,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1328,7 +1328,7 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - yarn install --immutable
@@ -1398,11 +1398,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -1460,7 +1460,7 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - yarn install --immutable
@@ -1526,14 +1526,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -1607,14 +1607,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - make gen-go
@@ -1628,12 +1628,12 @@ steps:
  - wire-install
  environment:
    CGO_ENABLED: "1"
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: lint-backend
 - commands:
  - go run scripts/modowners/modowners.go check go.mod
  failure: ignore
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: validate-modfile
 - commands:
  - ./bin/build verify-drone
@@ -1676,11 +1676,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -1689,7 +1689,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -2150,7 +2150,7 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -2159,11 +2159,11 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -2310,7 +2310,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  image: grafana/ci-wix:0.1.1
  name: windows-init
@@ -2466,11 +2466,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -2479,7 +2479,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts docker fetch --edition oss
@@ -2575,7 +2575,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build artifacts packages --tag $${DRONE_TAG} --src-bucket $${PRERELEASE_BUCKET}
@@ -2644,7 +2644,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - yarn install --immutable
@@ -2709,7 +2709,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - depends_on:
  - compile-build-cmd
@@ -2797,13 +2797,13 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build whatsnew-checker
  depends_on:
  - compile-build-cmd
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: whats-new-checker
 trigger:
  event:
@@ -2838,11 +2838,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -2898,14 +2898,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -3092,7 +3092,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  failure: ignore
  image: grafana/ci-wix:0.1.1
@@ -3252,11 +3252,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -3285,7 +3285,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build build-backend --jobs 8 --edition oss --build-id ${DRONE_BUILD_NUMBER}
@@ -3536,11 +3536,11 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
@@ -3590,14 +3590,14 @@ services: []
 steps:
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -3703,13 +3703,13 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -3846,7 +3846,7 @@ steps:
  name: identify-runner
 - commands:
  - $$ProgressPreference = "SilentlyContinue"
-  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/windows/grabpl.exe
+  - Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/windows/grabpl.exe
    -OutFile grabpl.exe
  image: grafana/ci-wix:0.1.1
  name: windows-init
@@ -3936,13 +3936,13 @@ services:
 steps:
 - commands:
  - mkdir -p bin
-  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.41/grabpl
+  - curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.42/grabpl
  - chmod +x bin/grabpl
  image: byrnedo/alpine-curl:0.1.8
  name: grabpl
 - commands:
  - echo $DRONE_RUNNER_NAME
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: identify-runner
 - commands:
  - '# It is required that code generated from Thema/CUE be committed and in sync
@@ -4122,7 +4122,7 @@ steps:
 - commands:
  - if [ -z "${BUILD_CONTAINER_VERSION}" ]; then echo Missing BUILD_CONTAINER_VERSION;
    false; fi
-  image: alpine:3.17.1
+  image: alpine:3.18.3
  name: validate-version
 - commands:
  - printenv GCP_KEY > /tmp/key.json
@@ -4408,9 +4408,9 @@ steps:
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/build-container:1.7.5
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-deploy:1.3.3
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine:3.17.1
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine:3.18.3
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.20.6
+  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.20.8
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM plugins/slack
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM postgres:12.3-alpine
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM mysql:5.7.39
@@ -4435,9 +4435,9 @@ steps:
  - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0
  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/build-container:1.7.5
  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-deploy:1.3.3
-  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine:3.17.1
+  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine:3.18.3
  - trivy --exit-code 1 --severity HIGH,CRITICAL byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.20.6
+  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.20.8
  - trivy --exit-code 1 --severity HIGH,CRITICAL plugins/slack
  - trivy --exit-code 1 --severity HIGH,CRITICAL postgres:12.3-alpine
  - trivy --exit-code 1 --severity HIGH,CRITICAL mysql:5.7.39
@@ -4489,7 +4489,7 @@ steps:
  depends_on: []
  environment:
    CGO_ENABLED: 0
-  image: golang:1.20.6
+  image: golang:1.20.8
  name: compile-build-cmd
 - commands:
  - ./bin/build publish grafana-com --edition oss
@@ -4553,6 +4553,18 @@ get:
 kind: secret
 name: prerelease_bucket
 ---
+get:
+  name: username
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_username
+---
+get:
+  name: password
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_password
+---
 get:
  name: credentials.json
  path: infra/data/ci/grafana/releng/artifacts-uploader-service-account
@@ -4686,6 +4698,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: aeae9ce425a35443ceb460a7bd475d151fbb74465ff121c6302817c1a10a0f37
+hmac: 365d54fd374968bdd07a6aca5db6b9668a171906fe85e86fbf2ea82e2d01e944

 ...
--- a/.github/workflows/alerting-swagger-gen.yml
+++ b/.github/workflows/alerting-swagger-gen.yml
@@ -16,7 +16,7 @@ jobs:
      - name: Set go version
        uses: actions/setup-go@v4
        with:
-          go-version: '1.20.6'
+          go-version: '1.20.8'
      - name: Build swagger
        run: |
          make -C pkg/services/ngalert/api/tooling post.json api.json
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -44,7 +44,7 @@ jobs:
      name: Set go version
      uses: actions/setup-go@v4
      with:
-        go-version: '1.20.6'
+        go-version: '1.20.8'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
--- a/.github/workflows/pr-codeql-analysis-go.yml
+++ b/.github/workflows/pr-codeql-analysis-go.yml
@@ -23,7 +23,7 @@ jobs:
    - name: Set go version
      uses: actions/setup-go@v4
      with:
-        go-version: '1.20.6'
+        go-version: '1.20.8'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
--- a/.github/workflows/publish-kinds-next.yml
+++ b/.github/workflows/publish-kinds-next.yml
@@ -20,7 +20,7 @@ jobs:
      - name: "Setup Go"
        uses: "actions/setup-go@v4"
        with:
-          go-version: '1.20.6'
+          go-version: '1.20.8'

      - name: "Verify kinds"
        run: go run .github/workflows/scripts/kinds/verify-kinds.go
--- a/.github/workflows/publish-kinds-release.yml
+++ b/.github/workflows/publish-kinds-release.yml
@@ -23,7 +23,7 @@ jobs:
      - name: "Setup Go"
        uses: "actions/setup-go@v4"
        with:
-          go-version: '1.20.6'
+          go-version: '1.20.8'

      - name: "Verify kinds"
        run: go run .github/workflows/scripts/kinds/verify-kinds.go
--- a/.github/workflows/verify-kinds.yml
+++ b/.github/workflows/verify-kinds.yml
@@ -18,7 +18,7 @@ jobs:
      - name: "Setup Go"
        uses: "actions/setup-go@v4"
        with:
-          go-version: '1.20.6'
+          go-version: '1.20.8'

      - name: "Verify kinds"
        run: go run .github/workflows/scripts/kinds/verify-kinds.go
--- a/6
+++ b/6
@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1

-ARG BASE_IMAGE=alpine:3.17
-ARG JS_IMAGE=node:18-alpine3.17
+ARG BASE_IMAGE=alpine:3.18.3
+ARG JS_IMAGE=node:18-alpine3.18
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.20.6-alpine3.17
+ARG GO_IMAGE=golang:1.20.8-alpine3.18

 ARG GO_SRC=go-builder
 ARG JS_SRC=js-builder
--- a/2
+++ b/2
@@ -206,7 +206,7 @@ build-docker-full-ubuntu: ## Build Docker image based on Ubuntu for development.
 	--build-arg COMMIT_SHA=$$(git rev-parse --short HEAD) \
 	--build-arg BUILD_BRANCH=$$(git rev-parse --abbrev-ref HEAD) \
 	--build-arg BASE_IMAGE=ubuntu:20.04 \
-	--build-arg GO_IMAGE=golang:1.20.6 \
+	--build-arg GO_IMAGE=golang:1.20.8 \
 	--tag grafana/grafana$(TAG_SUFFIX):dev-ubuntu \
 	$(DOCKER_BUILD_ARGS)

--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -845,6 +845,24 @@ managed_identity_enabled = false
 # Should be set for user-assigned identity and should be empty for system-assigned identity
 managed_identity_client_id =

+# Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it
+# For more documentation on Azure AD Workload Identity, review this documentation:
+# https://azure.github.io/azure-workload-identity/docs/
+# Disabled by default, needs to be explicitly enabled
+workload_identity_enabled = false
+
+# Tenant ID of the Azure AD Workload Identity
+# Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account
+workload_identity_tenant_id =
+
+# Client ID of the Azure AD Workload Identity
+# Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account
+workload_identity_client_id =
+
+# Custom path to token file for the Azure AD Workload Identity
+# Allows to set a custom path to the projected service account token file
+workload_identity_token_file =
+
 # Specifies whether user identity authentication (on behalf of currently signed-in user) should be enabled in datasources
 # that support it (requires AAD authentication)
 # Disabled by default, needs to be explicitly enabled
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -797,6 +797,24 @@
 # Should be set for user-assigned identity and should be empty for system-assigned identity
 ;managed_identity_client_id =

+# Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it
+# For more documentation on Azure AD Workload Identity, review this documentation:
+# https://azure.github.io/azure-workload-identity/docs/
+# Disabled by default, needs to be explicitly enabled
+;workload_identity_enabled = false
+
+# Tenant ID of the Azure AD Workload Identity
+# Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account
+;workload_identity_tenant_id =
+
+# Client ID of the Azure AD Workload Identity
+# Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account
+;workload_identity_client_id =
+
+# Custom path to token file for the Azure AD Workload Identity
+# Allows to set a custom path to the projected service account token file
+;workload_identity_token_file =
+
 # Specifies whether user identity authentication (on behalf of currently signed-in user) should be enabled in datasources
 # that support it (requires AAD authentication)
 # Disabled by default, needs to be explicitly enabled
--- a/docs/sources/datasources/azure-monitor/_index.md
+++ b/docs/sources/datasources/azure-monitor/_index.md
@@ -63,6 +63,9 @@ For more information, refer to [Azure documentation for role assignments](https:
 If you host Grafana in Azure, such as in App Service or Azure Virtual Machines, you can configure the Azure Monitor data source to use Managed Identity for secure authentication without entering credentials into Grafana.
 For details, refer to [Configuring using Managed Identity](#configuring-using-managed-identity).

+You can configure the Azure Monitor data source to use Workload Identity for secure authentication without entering credentials into Grafana if you host Grafana in a Kubernetes environment, such as AKS, and require access to Azure resources.
+For details, refer to [Configuring using Workload Identity](#configuring-using-workload-identity).
+
 | Name                        | Description                                                                                                                                                                                                                                                                                           |
 | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Authentication**          | Enables Managed Identity. Selecting Managed Identity hides many of the other fields. For details, see [Configuring using Managed Identity](#configuring-using-managed-identity).                                                                                                                      |
@@ -114,6 +117,21 @@ datasources:
    version: 1
 ```

+**Workload Identity:**
+
+```yaml
+apiVersion: 1 # config file version
+
+datasources:
+  - name: Azure Monitor
+    type: grafana-azure-monitor-datasource
+    access: proxy
+    jsonData:
+      azureAuthType: workloadidentity
+      subscriptionId: <subscription-id> # Optional, default subscription
+    version: 1
+```
+
 #### Supported cloud names

 | Azure Cloud                          | `cloudName` Value          |
@@ -124,8 +142,8 @@ datasources:

 ### Configure Managed Identity

-If you host Grafana in Azure, such as an App Service or with Azure Virtual Machines, and have managed identity enabled on your VM, you can use managed identity to configure Azure Monitor in Grafana.
-This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations for each.
+You can use managed identity to configure Azure Monitor in Grafana if you host Grafana in Azure (such as an App Service or with Azure Virtual Machines) and have managed identity enabled on your VM.
+This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations.
 For details on Azure managed identities, refer to the [Azure documentation](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).

 **To enable managed identity for Grafana:**
@@ -141,7 +159,46 @@ For details on Azure managed identities, refer to the [Azure documentation](http

   This hides the directory ID, application ID, and client secret fields, and the data source uses managed identity to authenticate to Azure Monitor Metrics and Logs, and Azure Resource Graph.

-   {{< figure src="/media/docs/grafana/data-sources/screenshot-managed-identity.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor Metrics screenshot showing Dimensions" >}}
+   {{< figure src="/media/docs/grafana/data-sources/screenshot-managed-identity-2.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor screenshot showing Managed Identity authentication" >}}
+
+3. You can set the `managed_identity_client_id` field in the `[azure]` section of the [Grafana server configuration][configure-grafana-azure] to allow a user-assigned managed identity to be used instead of the default system-assigned identity.
+
+```ini
+[azure]
+managed_identity_enabled = true
+managed_identity_client_id = USER_ASSIGNED_IDENTITY_CLIENT_ID
+```
+
+### Configure Workload Identity
+
+You can use workload identity to configure Azure Monitor in Grafana if you host Grafana in a Kubernetes environment, such as AKS, in conjunction with managed identities.
+This lets you securely authenticate data sources without manually configuring credentials via Azure AD App Registrations.
+For details on workload identity, refer to the [Azure workload identity documentation](https://azure.github.io/azure-workload-identity/docs/).
+
+**To enable workload identity for Grafana:**
+
+1. Set the `workload_identity_enabled` flag in the `[azure]` section of the [Grafana server configuration][configure-grafana-azure].
+
+   ```ini
+   [azure]
+   workload_identity_enabled = true
+   ```
+
+2. In the Azure Monitor data source configuration, set **Authentication** to **Workload Identity**.
+
+   This hides the directory ID, application ID, and client secret fields, and the data source uses workload identity to authenticate to Azure Monitor Metrics and Logs, and Azure Resource Graph.
+
+   {{< figure src="/media/docs/grafana/data-sources/screenshot-workload-identity.png" max-width="800px" class="docs-image--no-shadow" caption="Azure Monitor screenshot showing Workload Identity authentication" >}}
+
+3. There are additional configuration variables that can control the authentication method.`workload_identity_tenant_id` represents the Azure AD tenant that contains the managed identity, `workload_identity_client_id` represents the client ID of the managed identity if it differs from the default client ID, `workload_identity_token_file` represents the path to the token file. Refer to the [documentation](https://azure.github.io/azure-workload-identity/docs/) for more information on what values these variables should use, if any.
+
+   ```ini
+   [azure]
+   workload_identity_enabled = true
+   workload_identity_tenant_id = IDENTITY_TENANT_ID
+   workload_identity_client_id = IDENTITY_CLIENT_ID
+   workload_identity_token_file = TOKEN_FILE_PATH
+   ```

 ## Query the data source

--- a/docs/sources/setup-grafana/configure-grafana/_index.md
+++ b/docs/sources/setup-grafana/configure-grafana/_index.md
@@ -1152,6 +1152,32 @@ The client ID to use for user-assigned managed identity.

 Should be set for user-assigned identity and should be empty for system-assigned identity.

+### workload_identity_enabled
+
+Specifies whether Azure AD Workload Identity authentication should be enabled in datasources that support it.
+
+For more documentation on Azure AD Workload Identity, review [Azure AD Workload Identity](https://azure.github.io/azure-workload-identity/docs/) documentation.
+
+Disabled by default, needs to be explicitly enabled.
+
+### workload_identity_tenant_id
+
+Tenant ID of the Azure AD Workload Identity.
+
+Allows to override default tenant ID of the Azure AD identity associated with the Kubernetes service account.
+
+### workload_identity_client_id
+
+Client ID of the Azure AD Workload Identity.
+
+Allows to override default client ID of the Azure AD identity associated with the Kubernetes service account.
+
+### workload_identity_token_file
+
+Custom path to token file for the Azure AD Workload Identity.
+
+Allows to set a custom path to the projected service account token file.
+
 ### user_identity_enabled

 Specifies whether user identity authentication (on behalf of currently signed-in user) should be enabled in datasources that support it (requires AAD authentication).
--- a/go.mod
+++ b/go.mod
@@ -66,7 +66,7 @@ require (
 	github.com/grafana/alerting v0.0.0-20230606080147-55b8d71c7890 // @grafana/alerting-squad-backend
 	github.com/grafana/cuetsy v0.1.10 // @grafana/grafana-as-code
 	github.com/grafana/grafana-aws-sdk v0.16.1 // @grafana/aws-datasources
-	github.com/grafana/grafana-azure-sdk-go v1.7.0 // @grafana/backend-platform
+	github.com/grafana/grafana-azure-sdk-go v1.9.0 // @grafana/backend-platform
 	github.com/grafana/grafana-plugin-sdk-go v0.172.0 // @grafana/plugins-platform-backend
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // @grafana/backend-platform
 	github.com/hashicorp/go-hclog v1.5.0 // @grafana/plugins-platform-backend
@@ -131,7 +131,7 @@ require (
 )

 require (
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
@@ -228,7 +228,7 @@ require (

 require (
 	cloud.google.com/go/kms v1.10.1 // @grafana/backend-platform
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 // @grafana/backend-platform
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 // @grafana/backend-platform
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 // @grafana/backend-platform
 	github.com/Azure/azure-storage-blob-go v0.15.0 // @grafana/backend-platform
 	github.com/Azure/go-autorest/autorest/adal v0.9.22 // @grafana/backend-platform
@@ -414,9 +414,9 @@ require (
 	cloud.google.com/go/compute v1.19.0 // indirect
 	cloud.google.com/go/iam v0.13.0 // indirect
 	filippo.io/age v1.1.1 // @grafana/grafana-authnz-team
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.2 // @grafana/backend-platform
 	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230426101702-58e86b294756 // @grafana/plugins-platform-backend
--- a/go.sum
+++ b/go.sum
@@ -558,10 +558,16 @@ github.com/Azure/azure-sdk-for-go v65.0.0+incompatible h1:HzKLt3kIwMm4KeJYTdx9Eb
 github.com/Azure/azure-sdk-for-go v65.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 h1:sVW/AFBTGyJxDaMYlq0ct3jUXTtj12tQ6zE2GZUgVQw=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1 h1:SEy2xmstIphdPwNBUi7uhvjyjhVKISfwjfOJmuy7kg4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.1/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 h1:t/W5MYAuQy81cvM8VUNfRLzhtKpXhVUAN7Cd7KVbTyc=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0/go.mod h1:NBanQUfSWiWn3QEpWDTCU0IjBECKOYvl2R8xdRtMtiM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0 h1:jp0dGvZ7ZK0mgqnTSClMxa5xuRL7NZgHameVYF6BurY=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 h1:TOFrNxfjslms5nLLIMjW7N0+zSALX4KiGsptmpb16AA=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0/go.mod h1:EAyXOW1F6BTJPiK2pDvmnvxOHPxoTYWoqBeIlql+QhI=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 h1:Lg6BW0VPmCwcMlvOviL3ruHFO+H9tZNqscK0AeuFjGM=
@@ -608,6 +614,8 @@ github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft
 github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 h1:VgSJlZH5u0k2qxSpqyghcFQKmvYckj46uymKK5XzkBM=
 github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
@@ -1783,6 +1791,8 @@ github.com/grafana/grafana-aws-sdk v0.16.1 h1:R/hMtQP7H0+8nWFoIOApaZj0qstmZM+5Pw
 github.com/grafana/grafana-aws-sdk v0.16.1/go.mod h1:rCXLYoMpPqF90U7XqgVJ1HIAopFVF0bB3SXBVEJIm3I=
 github.com/grafana/grafana-azure-sdk-go v1.7.0 h1:2EAPwNl/qsDMHwKjlzaHif+H+bHcF1W7sM8/jAcxVcI=
 github.com/grafana/grafana-azure-sdk-go v1.7.0/go.mod h1:X4PdEQIYgHfn0KTa2ZTKvufhNz6jbCEKUQPZIlcyOGw=
+github.com/grafana/grafana-azure-sdk-go v1.9.0 h1:4JRwlqgUtPRAQSoiV4DFZDQ3lbNsauHqj9kC6SMR9Ak=
+github.com/grafana/grafana-azure-sdk-go v1.9.0/go.mod h1:1vBa0KOl+/Kcm7V888OyMXDSFncmek14q7XhEkrcSaA=
 github.com/grafana/grafana-google-sdk-go v0.1.0 h1:LKGY8z2DSxKjYfr2flZsWgTRTZ6HGQbTqewE3JvRaNA=
 github.com/grafana/grafana-google-sdk-go v0.1.0/go.mod h1:Vo2TKWfDVmNTELBUM+3lkrZvFtBws0qSZdXhQxRdJrE=
 github.com/grafana/grafana-plugin-sdk-go v0.94.0/go.mod h1:3VXz4nCv6wH5SfgB3mlW39s+c+LetqSCjFj7xxPC5+M=
--- a/lerna.json
+++ b/lerna.json
@@ -2,5 +2,5 @@
  "npmClient": "yarn",
  "useWorkspaces": true,
  "packages": ["packages/*"],
-  "version": "10.1.1"
+  "version": "10.1.4"
 }
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
  "license": "AGPL-3.0-only",
  "private": true,
  "name": "grafana",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "repository": "github:grafana/grafana",
  "scripts": {
    "build": "yarn i18n:compile && NODE_ENV=production webpack --progress --config scripts/webpack/webpack.prod.js",
@@ -55,7 +55,7 @@
    "betterer:issues": "ts-node --transpile-only --project ./scripts/cli/tsconfig.json ./scripts/cli/generateBettererIssues.ts"
  },
  "grafana": {
-    "whatsNewUrl": "https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/",
+    "whatsNewUrl": "https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/",
    "releaseNotesUrl": "https://grafana.com/docs/grafana/next/release-notes/"
  },
  "lint-staged": {
--- a/packages/grafana-data/package.json
+++ b/packages/grafana-data/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/data",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana Data Library",
  "keywords": [
    "typescript"
@@ -36,7 +36,7 @@
  },
  "dependencies": {
    "@braintree/sanitize-url": "6.0.2",
-    "@grafana/schema": "10.1.1",
+    "@grafana/schema": "10.1.4",
    "@types/d3-interpolate": "^3.0.0",
    "@types/string-hash": "1.1.1",
    "d3-interpolate": "3.0.1",
--- a/packages/grafana-e2e-selectors/package.json
+++ b/packages/grafana-e2e-selectors/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/e2e-selectors",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana End-to-End Test Selectors Library",
  "keywords": [
    "cli",
--- a/packages/grafana-e2e/package.json
+++ b/packages/grafana-e2e/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/e2e",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana End-to-End Test Library",
  "keywords": [
    "cli",
@@ -63,7 +63,7 @@
    "@babel/core": "7.22.1",
    "@babel/preset-env": "7.22.4",
    "@cypress/webpack-preprocessor": "5.17.0",
-    "@grafana/e2e-selectors": "10.1.1",
+    "@grafana/e2e-selectors": "10.1.4",
    "@grafana/tsconfig": "^1.2.0-rc1",
    "@mochajs/json-file-reporter": "^1.2.0",
    "babel-loader": "9.1.2",
--- a/packages/grafana-eslint-rules/package.json
+++ b/packages/grafana-eslint-rules/package.json
@@ -1,7 +1,7 @@
 {
  "name": "@grafana/eslint-plugin",
  "description": "ESLint rules for use within the Grafana repo. Not suitable (or supported) for external use.",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "main": "./index.cjs",
  "author": "Grafana Labs",
  "license": "Apache-2.0",
--- a/packages/grafana-runtime/package.json
+++ b/packages/grafana-runtime/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/runtime",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana Runtime Library",
  "keywords": [
    "grafana",
@@ -37,10 +37,10 @@
    "postpack": "mv package.json.bak package.json"
  },
  "dependencies": {
-    "@grafana/data": "10.1.1",
-    "@grafana/e2e-selectors": "10.1.1",
+    "@grafana/data": "10.1.4",
+    "@grafana/e2e-selectors": "10.1.4",
    "@grafana/faro-web-sdk": "1.1.0",
-    "@grafana/ui": "10.1.1",
+    "@grafana/ui": "10.1.4",
    "history": "4.10.1",
    "lodash": "4.17.21",
    "rxjs": "7.8.0",
--- a/packages/grafana-runtime/src/config.ts
+++ b/packages/grafana-runtime/src/config.ts
@@ -21,6 +21,7 @@ import {
 export interface AzureSettings {
  cloud?: string;
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
  userIdentityEnabled: boolean;
 }

@@ -124,6 +125,7 @@ export class GrafanaBootConfig implements GrafanaConfig {
  awsAssumeRoleEnabled = false;
  azure: AzureSettings = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
    userIdentityEnabled: false,
  };
  caching = {
--- a/packages/grafana-schema/package.json
+++ b/packages/grafana-schema/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/schema",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana Schema Library",
  "keywords": [
    "typescript"
--- a/packages/grafana-schema/src/raw/composable/alertgroups/panelcfg/x/AlertGroupsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/alertgroups/panelcfg/x/AlertGroupsPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/annotationslist/panelcfg/x/AnnotationsListPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/annotationslist/panelcfg/x/AnnotationsListPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  limit: number;
--- a/packages/grafana-schema/src/raw/composable/barchart/panelcfg/x/BarChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/barchart/panelcfg/x/BarChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.OptionsWithLegend, common.OptionsWithTooltip, common.OptionsWithTextFormatting {
  /**
--- a/packages/grafana-schema/src/raw/composable/bargauge/panelcfg/x/BarGaugePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/bargauge/panelcfg/x/BarGaugePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.SingleStatBaseOptions {
  displayMode: common.BarGaugeDisplayMode;
--- a/packages/grafana-schema/src/raw/composable/candlestick/panelcfg/x/CandlestickPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/candlestick/panelcfg/x/CandlestickPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum VizDisplayMode {
  Candles = 'candles',
--- a/packages/grafana-schema/src/raw/composable/canvas/panelcfg/x/CanvasPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/canvas/panelcfg/x/CanvasPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum HorizontalConstraint {
  Center = 'center',
--- a/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface MetricStat {
  /**
--- a/packages/grafana-schema/src/raw/composable/dashboardlist/panelcfg/x/DashboardListPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/dashboardlist/panelcfg/x/DashboardListPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  folderId?: number;
--- a/packages/grafana-schema/src/raw/composable/datagrid/panelcfg/x/DatagridPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/datagrid/panelcfg/x/DatagridPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  selectedSeries: number;
--- a/packages/grafana-schema/src/raw/composable/debug/panelcfg/x/DebugPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/debug/panelcfg/x/DebugPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export type UpdateConfig = {
  render: boolean,
--- a/packages/grafana-schema/src/raw/composable/elasticsearch/dataquery/x/ElasticsearchDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/elasticsearch/dataquery/x/ElasticsearchDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export type BucketAggregation = (DateHistogram | Histogram | Terms | Filters | GeoHashGrid | Nested);

--- a/packages/grafana-schema/src/raw/composable/gauge/panelcfg/x/GaugePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/gauge/panelcfg/x/GaugePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.SingleStatBaseOptions {
  showThresholdLabels: boolean;
--- a/packages/grafana-schema/src/raw/composable/geomap/panelcfg/x/GeomapPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/geomap/panelcfg/x/GeomapPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  basemap: ui.MapLayerOptions;
--- a/packages/grafana-schema/src/raw/composable/grafanapyroscope/dataquery/x/GrafanaPyroscopeDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/grafanapyroscope/dataquery/x/GrafanaPyroscopeDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export type PhlareQueryType = ('metrics' | 'profile' | 'both');

--- a/packages/grafana-schema/src/raw/composable/heatmap/panelcfg/x/HeatmapPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/heatmap/panelcfg/x/HeatmapPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 /**
 * Controls the color mode of the heatmap
--- a/packages/grafana-schema/src/raw/composable/histogram/panelcfg/x/HistogramPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/histogram/panelcfg/x/HistogramPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.OptionsWithLegend, common.OptionsWithTooltip {
  /**
--- a/packages/grafana-schema/src/raw/composable/logs/panelcfg/x/LogsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/logs/panelcfg/x/LogsPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  dedupStrategy: common.LogsDedupStrategy;
--- a/packages/grafana-schema/src/raw/composable/loki/dataquery/x/LokiDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/loki/dataquery/x/LokiDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum QueryEditorMode {
  Builder = 'builder',
--- a/packages/grafana-schema/src/raw/composable/news/panelcfg/x/NewsPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/news/panelcfg/x/NewsPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/nodegraph/panelcfg/x/NodeGraphPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/nodegraph/panelcfg/x/NodeGraphPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface ArcOption {
  /**
--- a/packages/grafana-schema/src/raw/composable/parca/dataquery/x/ParcaDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/parca/dataquery/x/ParcaDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export type ParcaQueryType = ('metrics' | 'profile' | 'both');

--- a/packages/grafana-schema/src/raw/composable/piechart/panelcfg/x/PieChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/piechart/panelcfg/x/PieChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 /**
 * Select the pie chart display style.
--- a/packages/grafana-schema/src/raw/composable/prometheus/dataquery/x/PrometheusDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/prometheus/dataquery/x/PrometheusDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum QueryEditorMode {
  Builder = 'builder',
--- a/packages/grafana-schema/src/raw/composable/stat/panelcfg/x/StatPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/stat/panelcfg/x/StatPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.SingleStatBaseOptions {
  colorMode: common.BigValueColorMode;
--- a/packages/grafana-schema/src/raw/composable/statetimeline/panelcfg/x/StateTimelinePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/statetimeline/panelcfg/x/StateTimelinePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends ui.OptionsWithLegend, ui.OptionsWithTooltip, ui.OptionsWithTimezones {
  /**
--- a/packages/grafana-schema/src/raw/composable/statushistory/panelcfg/x/StatusHistoryPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/statushistory/panelcfg/x/StatusHistoryPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends ui.OptionsWithLegend, ui.OptionsWithTooltip, ui.OptionsWithTimezones {
  /**
--- a/packages/grafana-schema/src/raw/composable/table/panelcfg/x/TablePanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/table/panelcfg/x/TablePanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as ui from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options {
  /**
--- a/packages/grafana-schema/src/raw/composable/tempo/dataquery/x/TempoDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/tempo/dataquery/x/TempoDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface TempoQuery extends common.DataQuery {
  filters: Array<TraceqlFilter>;
--- a/packages/grafana-schema/src/raw/composable/testdata/dataquery/x/TestDataDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/testdata/dataquery/x/TestDataDataQuery_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum TestDataQueryType {
  Annotations = 'annotations',
--- a/packages/grafana-schema/src/raw/composable/text/panelcfg/x/TextPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/text/panelcfg/x/TextPanelCfg_types.gen.ts
@@ -9,7 +9,7 @@
 //
 // Run 'make gen-cue' from repository root to regenerate.

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum TextMode {
  Code = 'code',
--- a/packages/grafana-schema/src/raw/composable/timeseries/panelcfg/x/TimeSeriesPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/timeseries/panelcfg/x/TimeSeriesPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export interface Options extends common.OptionsWithTimezones {
  legend: common.VizLegendOptions;
--- a/packages/grafana-schema/src/raw/composable/trend/panelcfg/x/TrendPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/trend/panelcfg/x/TrendPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 /**
 * Identical to timeseries... except it does not have timezone settings
--- a/packages/grafana-schema/src/raw/composable/xychart/panelcfg/x/XYChartPanelCfg_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/xychart/panelcfg/x/XYChartPanelCfg_types.gen.ts
@@ -11,7 +11,7 @@

 import * as common from '@grafana/schema';

-export const pluginVersion = "10.1.1";
+export const pluginVersion = "10.1.4";

 export enum SeriesMapping {
  Auto = 'auto',
--- a/packages/grafana-toolkit/package.json
+++ b/packages/grafana-toolkit/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/toolkit",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana Toolkit",
  "keywords": [
    "grafana",
--- a/packages/grafana-ui/package.json
+++ b/packages/grafana-ui/package.json
@@ -2,7 +2,7 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "name": "@grafana/ui",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Grafana Components Library",
  "keywords": [
    "grafana",
@@ -49,10 +49,10 @@
  "dependencies": {
    "@emotion/css": "11.11.2",
    "@emotion/react": "11.11.1",
-    "@grafana/data": "10.1.1",
-    "@grafana/e2e-selectors": "10.1.1",
+    "@grafana/data": "10.1.4",
+    "@grafana/e2e-selectors": "10.1.4",
    "@grafana/faro-web-sdk": "1.1.0",
-    "@grafana/schema": "10.1.1",
+    "@grafana/schema": "10.1.4",
    "@leeoniya/ufuzzy": "1.0.8",
    "@monaco-editor/react": "4.5.1",
    "@popperjs/core": "2.11.6",
--- a/packaging/docker/build.sh
+++ b/packaging/docker/build.sh
@@ -59,7 +59,7 @@ docker_build () {
  esac
  if [ $UBUNTU_BASE = "0" ]; then
    libc="-musl"
-    base_image="${base_arch}alpine:3.17"
+    base_image="${base_arch}alpine:3.18.3"
  else
    libc=""
    base_image="${base_arch}ubuntu:20.04"
--- a/pkg/api/dtos/frontend_settings.go
+++ b/pkg/api/dtos/frontend_settings.go
@@ -45,9 +45,10 @@ type FrontendSettingsLicenseInfoDTO struct {
 }

 type FrontendSettingsAzureDTO struct {
-	Cloud                  string `json:"cloud"`
-	ManagedIdentityEnabled bool   `json:"managedIdentityEnabled"`
-	UserIdentityEnabled    bool   `json:"userIdentityEnabled"`
+	Cloud                   string `json:"cloud"`
+	ManagedIdentityEnabled  bool   `json:"managedIdentityEnabled"`
+	WorkloadIdentityEnabled bool   `json:"workloadIdentityEnabled"`
+	UserIdentityEnabled     bool   `json:"userIdentityEnabled"`
 }

 type FrontendSettingsCachingDTO struct {
--- a/pkg/api/frontendsettings.go
+++ b/pkg/api/frontendsettings.go
@@ -205,9 +205,10 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
 		SupportBundlesEnabled:            isSupportBundlesEnabled(hs),

 		Azure: dtos.FrontendSettingsAzureDTO{
-			Cloud:                  hs.Cfg.Azure.Cloud,
-			ManagedIdentityEnabled: hs.Cfg.Azure.ManagedIdentityEnabled,
-			UserIdentityEnabled:    hs.Cfg.Azure.UserIdentityEnabled,
+			Cloud:                   hs.Cfg.Azure.Cloud,
+			ManagedIdentityEnabled:  hs.Cfg.Azure.ManagedIdentityEnabled,
+			WorkloadIdentityEnabled: hs.Cfg.Azure.WorkloadIdentityEnabled,
+			UserIdentityEnabled:     hs.Cfg.Azure.UserIdentityEnabled,
 		},

 		Caching: dtos.FrontendSettingsCachingDTO{
--- a/pkg/build/config/variant.go
+++ b/pkg/build/config/variant.go
@@ -16,9 +16,9 @@ const (
 )

 var AllVariants = []Variant{
-	VariantArmV6,
-	VariantArmV7,
-	VariantArmV7Musl,
+	// VariantArmV6,
+	// VariantArmV7,
+	// VariantArmV7Musl,
 	VariantArm64,
 	VariantArm64Musl,
 	VariantDarwinAmd64,
--- a/pkg/build/config/versions.go
+++ b/pkg/build/config/versions.go
@@ -1,7 +1,5 @@
 package config

-const PublicBucket = "grafana-downloads"
-
 var Versions = VersionMap{
 	PullRequestMode: {
 		Variants: []Variant{
@@ -9,8 +7,9 @@ var Versions = VersionMap{
 			VariantLinuxAmd64Musl,
 			VariantDarwinAmd64,
 			VariantWindowsAmd64,
-			VariantArm64,
-			VariantArm64Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArm64,
+			// VariantArm64Musl,
 		},
 		PluginSignature: PluginSignature{
 			Sign:      false,
@@ -29,9 +28,10 @@ var Versions = VersionMap{
 	},
 	MainMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -48,7 +48,8 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
+				// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+				// ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -64,9 +65,10 @@ var Versions = VersionMap{
 	},
 	DownstreamMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			//VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -83,7 +85,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
+				// ArchARMv7, // GOARCH=ARM is used for both armv6 and armv7. They are differentiated by the GOARM variable.
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -98,9 +100,9 @@ var Versions = VersionMap{
 	},
 	ReleaseBranchMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -117,7 +119,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -133,9 +135,9 @@ var Versions = VersionMap{
 	},
 	TagMode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -152,7 +154,7 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
@@ -171,9 +173,10 @@ var Versions = VersionMap{
 	},
 	Enterprise2Mode: {
 		Variants: []Variant{
-			VariantArmV6,
-			VariantArmV7,
-			VariantArmV7Musl,
+			// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+			// VariantArmV6,
+			// VariantArmV7,
+			// VariantArmV7Musl,
 			VariantArm64,
 			VariantArm64Musl,
 			VariantDarwinAmd64,
@@ -190,7 +193,8 @@ var Versions = VersionMap{
 			Architectures: []Architecture{
 				ArchAMD64,
 				ArchARM64,
-				ArchARMv7,
+				// https://github.com/golang/go/issues/58425 disabling arm builds until go issue is resolved
+				// ArchARMv7,
 			},
 			Distribution: []Distribution{
 				Alpine,
--- a/pkg/build/docker/build.go
+++ b/pkg/build/docker/build.go
@@ -70,7 +70,7 @@ func BuildImage(version string, arch config.Architecture, grafanaDir string, use
 	}

 	libc := "-musl"
-	baseImage := fmt.Sprintf("%salpine:3.17", baseArch)
+	baseImage := fmt.Sprintf("%salpine:3.18.3", baseArch)
 	tagSuffix := ""
 	if useUbuntu {
 		libc = ""
--- a/pkg/build/docker/init.go
+++ b/pkg/build/docker/init.go
@@ -8,7 +8,7 @@ import (
 )

 // AllArchs is a list of all supported Docker image architectures.
-var AllArchs = []string{"amd64", "armv7", "arm64"}
+var AllArchs = []string{"amd64", "arm64"}

 // emulatorImage is the docker image used as the cross-platform emulator
 var emulatorImage = "tonistiigi/binfmt:qemu-v7.0.0"
--- a/pkg/build/packaging/artifacts.go
+++ b/pkg/build/packaging/artifacts.go
@@ -81,32 +81,32 @@ var ArtifactConfigs = []buildArtifact{
 		Arch:       "arm64",
 		urlPostfix: ".linux-arm64.tar.gz",
 	},
-	{
-		Os:         debOS,
-		Arch:       "armv7",
-		urlPostfix: "_armhf.deb",
-	},
-	{
-		Os:             debOS,
-		Arch:           "armv6",
-		packagePostfix: "-rpi",
-		urlPostfix:     "_armhf.deb",
-	},
-	{
-		Os:         rhelOS,
-		Arch:       "armv7",
-		urlPostfix: ".armhfp.rpm",
-	},
-	{
-		Os:         "linux",
-		Arch:       "armv6",
-		urlPostfix: ".linux-armv6.tar.gz",
-	},
-	{
-		Os:         "linux",
-		Arch:       "armv7",
-		urlPostfix: ".linux-armv7.tar.gz",
-	},
+	// {
+	// 	Os:         debOS,
+	// 	Arch:       "armv7",
+	// 	urlPostfix: "_armhf.deb",
+	// },
+	// {
+	// 	Os:             debOS,
+	// 	Arch:           "armv6",
+	// 	packagePostfix: "-rpi",
+	// 	urlPostfix:     "_armhf.deb",
+	// },
+	// {
+	// 	Os:         rhelOS,
+	// 	Arch:       "armv7",
+	// 	urlPostfix: ".armhfp.rpm",
+	// },
+	// {
+	// 	Os:         "linux",
+	// 	Arch:       "armv6",
+	// 	urlPostfix: ".linux-armv6.tar.gz",
+	// },
+	// {
+	// 	Os:         "linux",
+	// 	Arch:       "armv7",
+	// 	urlPostfix: ".linux-armv7.tar.gz",
+	// },
 	{
 		Os:         "darwin",
 		Arch:       "amd64",
--- a/pkg/setting/setting_azure.go
+++ b/pkg/setting/setting_azure.go
@@ -17,6 +17,24 @@ func (cfg *Cfg) readAzureSettings() {
 	azureSettings.ManagedIdentityEnabled = azureSection.Key("managed_identity_enabled").MustBool(false)
 	azureSettings.ManagedIdentityClientId = azureSection.Key("managed_identity_client_id").String()

+	// Workload Identity authentication
+	if azureSection.Key("workload_identity_enabled").MustBool(false) {
+		azureSettings.WorkloadIdentityEnabled = true
+		workloadIdentitySettings := &azsettings.WorkloadIdentitySettings{}
+
+		if val := azureSection.Key("workload_identity_tenant_id").String(); val != "" {
+			workloadIdentitySettings.TenantId = val
+		}
+		if val := azureSection.Key("workload_identity_client_id").String(); val != "" {
+			workloadIdentitySettings.ClientId = val
+		}
+		if val := azureSection.Key("workload_identity_token_file").String(); val != "" {
+			workloadIdentitySettings.TokenFile = val
+		}
+
+		azureSettings.WorkloadIdentitySettings = workloadIdentitySettings
+	}
+
 	// User Identity authentication
 	if azureSection.Key("user_identity_enabled").MustBool(false) {
 		azureSettings.UserIdentityEnabled = true
--- a/pkg/tsdb/azuremonitor/credentials.go
+++ b/pkg/tsdb/azuremonitor/credentials.go
@@ -31,10 +31,14 @@ func getAuthType(cfg *setting.Cfg, jsonData *types.AzureClientSettings) string {
 			return azcredentials.AzureAuthClientSecret
 		}

-		// For newly created datasource with no configuration, managed identity is the default authentication type
-		// if they are enabled in Grafana config
+		// For newly created datasource with no configuration the order is as follows:
+		// Managed identity is the default if enabled
+		// Workload identity is the next option if enabled
+		// Client secret is the final fallback
 		if cfg.Azure.ManagedIdentityEnabled {
 			return azcredentials.AzureAuthManagedIdentity
+		} else if cfg.Azure.WorkloadIdentityEnabled {
+			return azcredentials.AzureAuthWorkloadIdentity
 		} else {
 			return azcredentials.AzureAuthClientSecret
 		}
@@ -84,8 +88,8 @@ func normalizeAzureCloud(cloudName string) (string, error) {
 func getAzureCloud(cfg *setting.Cfg, jsonData *types.AzureClientSettings) (string, error) {
 	authType := getAuthType(cfg, jsonData)
 	switch authType {
-	case azcredentials.AzureAuthManagedIdentity:
-		// In case of managed identity, the cloud is always same as where Grafana is hosted
+	case azcredentials.AzureAuthManagedIdentity, azcredentials.AzureAuthWorkloadIdentity:
+		// In case of managed identity and workload identity, the cloud is always same as where Grafana is hosted
 		return getDefaultAzureCloud(cfg)
 	case azcredentials.AzureAuthClientSecret:
 		if cloud := jsonData.CloudName; cloud != "" {
@@ -106,7 +110,9 @@ func getAzureCredentials(cfg *setting.Cfg, jsonData *types.AzureClientSettings,
 	case azcredentials.AzureAuthManagedIdentity:
 		credentials := &azcredentials.AzureManagedIdentityCredentials{}
 		return credentials, nil
-
+	case azcredentials.AzureAuthWorkloadIdentity:
+		credentials := &azcredentials.AzureWorkloadIdentityCredentials{}
+		return credentials, nil
 	case azcredentials.AzureAuthClientSecret:
 		cloud, err := getAzureCloud(cfg, jsonData)
 		if err != nil {
--- a/pkg/tsdb/azuremonitor/credentials_test.go
+++ b/pkg/tsdb/azuremonitor/credentials_test.go
@@ -77,6 +77,66 @@ func TestCredentials_getAuthType(t *testing.T) {
 			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
 		})
 	})
+
+	t.Run("when workload identities enabled", func(t *testing.T) {
+		cfg.Azure.WorkloadIdentityEnabled = true
+
+		t.Run("should be client secret if auth type is set to client secret", func(t *testing.T) {
+			jsonData := &types.AzureClientSettings{
+				AzureAuthType: azcredentials.AzureAuthClientSecret,
+			}
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+
+		t.Run("should be workload identity if datasource not configured and managed identity is disabled", func(t *testing.T) {
+			jsonData := &types.AzureClientSettings{
+				AzureAuthType: "",
+			}
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthWorkloadIdentity, authType)
+		})
+
+		t.Run("should be client secret if auth type not specified but credentials configured", func(t *testing.T) {
+			jsonData := &types.AzureClientSettings{
+				AzureAuthType: "",
+				TenantId:      "9b9d90ee-a5cc-49c2-b97e-0d1b0f086b5c",
+				ClientId:      "849ccbb0-92eb-4226-b228-ef391abd8fe6",
+			}
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+	})
+
+	t.Run("when workload identities disabled", func(t *testing.T) {
+		cfg.Azure.WorkloadIdentityEnabled = false
+
+		t.Run("should be workload identity if auth type is set to workload identity", func(t *testing.T) {
+			jsonData := &types.AzureClientSettings{
+				AzureAuthType: azcredentials.AzureAuthWorkloadIdentity,
+			}
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthWorkloadIdentity, authType)
+		})
+
+		t.Run("should be client secret if datasource not configured", func(t *testing.T) {
+			jsonData := &types.AzureClientSettings{
+				AzureAuthType: "",
+			}
+
+			authType := getAuthType(cfg, jsonData)
+
+			assert.Equal(t, azcredentials.AzureAuthClientSecret, authType)
+		})
+	})
 }

 func TestCredentials_getAzureCloud(t *testing.T) {
--- a/pkg/tsdb/prometheus/azureauth/azure.go
+++ b/pkg/tsdb/prometheus/azureauth/azure.go
@@ -77,7 +77,7 @@ func getOverriddenScopes(jsonData map[string]interface{}) ([]string, error) {

 func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) ([]string, error) {
 	// Extract cloud from credentials
-	azureCloud, err := getAzureCloudFromCredentials(settings, credentials)
+	azureCloud, err := azcredentials.GetAzureCloud(settings, credentials)
 	if err != nil {
 		return nil, err
 	}
@@ -90,26 +90,3 @@ func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcrede
 		return scopes, nil
 	}
 }
-
-// To be part of grafana-azure-sdk-go
-func getAzureCloudFromCredentials(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) (string, error) {
-	switch c := credentials.(type) {
-	case *azcredentials.AzureManagedIdentityCredentials:
-		// In case of managed identity, the cloud is always same as where Grafana is hosted
-		return getDefaultAzureCloud(settings), nil
-	case *azcredentials.AzureClientSecretCredentials:
-		return c.AzureCloud, nil
-	default:
-		err := fmt.Errorf("the Azure credentials of type '%s' not supported by Prometheus datasource", c.AzureAuthType())
-		return "", err
-	}
-}
-
-// To be part of grafana-azure-sdk-go
-func getDefaultAzureCloud(settings *azsettings.AzureSettings) string {
-	cloudName := settings.Cloud
-	if cloudName == "" {
-		return azsettings.AzurePublic
-	}
-	return cloudName
-}
--- a/plugins-bundled/internal/input-datasource/package.json
+++ b/plugins-bundled/internal/input-datasource/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@grafana-plugins/input-datasource",
-  "version": "10.1.1",
+  "version": "10.1.4",
  "description": "Input Datasource",
  "private": true,
  "repository": {
@@ -28,8 +28,8 @@
    "webpack": "5.76.0"
  },
  "dependencies": {
-    "@grafana/data": "10.1.1",
-    "@grafana/ui": "10.1.1",
+    "@grafana/data": "10.1.4",
+    "@grafana/ui": "10.1.4",
    "react": "18.2.0",
    "tslib": "2.5.0"
  }
--- a/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.test.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.test.tsx
@@ -6,6 +6,7 @@ import AzureCredentialsForm, { Props } from './AzureCredentialsForm';
 const setup = (propsFunc?: (props: Props) => Props) => {
  let props: Props = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
    credentials: {
      authType: 'clientsecret',
      azureCloud: 'azuremonitor',
--- a/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx
@@ -1,4 +1,4 @@
-import React, { ChangeEvent } from 'react';
+import React, { ChangeEvent, useMemo } from 'react';

 import { SelectableValue } from '@grafana/data';
 import { LegacyForms, Button, Select, InlineField } from '@grafana/ui';
@@ -10,41 +10,66 @@ const { Input } = LegacyForms;

 export interface Props {
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
  credentials: AzureCredentials;
  azureCloudOptions?: SelectableValue[];
-  onCredentialsChange?: (updatedCredentials: AzureCredentials) => void;
+  onCredentialsChange: (updatedCredentials: AzureCredentials) => void;
  disabled?: boolean;
  children?: JSX.Element;
 }

-const authTypeOptions: Array<SelectableValue<AzureAuthType>> = [
-  {
-    value: 'msi',
-    label: 'Managed Identity',
-  },
-  {
-    value: 'clientsecret',
-    label: 'App Registration',
-  },
-];
-
 const LABEL_WIDTH = 18;

 export const AzureCredentialsForm = (props: Props) => {
-  const { credentials, azureCloudOptions, onCredentialsChange, disabled, managedIdentityEnabled } = props;
+  const {
+    credentials,
+    azureCloudOptions,
+    onCredentialsChange,
+    disabled,
+    managedIdentityEnabled,
+    workloadIdentityEnabled,
+  } = props;
+
+  const authTypeOptions = useMemo(() => {
+    let opts: Array<SelectableValue<AzureAuthType>> = [
+      {
+        value: 'clientsecret',
+        label: 'App Registration',
+      },
+    ];
+
+    if (managedIdentityEnabled) {
+      opts.push({
+        value: 'msi',
+        label: 'Managed Identity',
+      });
+    }
+
+    if (workloadIdentityEnabled) {
+      opts.push({
+        value: 'workloadidentity',
+        label: 'Workload Identity',
+      });
+    }
+
+    return opts;
+  }, [managedIdentityEnabled, workloadIdentityEnabled]);

  const onAuthTypeChange = (selected: SelectableValue<AzureAuthType>) => {
-    if (onCredentialsChange) {
-      const updated: AzureCredentials = {
-        ...credentials,
-        authType: selected.value || 'msi',
-      };
-      onCredentialsChange(updated);
-    }
+    const defaultAuthType = managedIdentityEnabled
+      ? 'msi'
+      : workloadIdentityEnabled
+      ? 'workloadidentity'
+      : 'clientsecret';
+    const updated: AzureCredentials = {
+      ...credentials,
+      authType: selected.value || defaultAuthType,
+    };
+    onCredentialsChange(updated);
  };

  const onAzureCloudChange = (selected: SelectableValue<string>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        azureCloud: selected.value,
@@ -54,7 +79,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onTenantIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        tenantId: event.target.value,
@@ -64,7 +89,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientId: event.target.value,
@@ -74,7 +99,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientSecret: event.target.value,
@@ -84,7 +109,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretReset = () => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      const updated: AzureCredentials = {
        ...credentials,
        clientSecret: '',
@@ -95,7 +120,7 @@ export const AzureCredentialsForm = (props: Props) => {

  return (
    <div className="gf-form-group">
-      {managedIdentityEnabled && (
+      {authTypeOptions.length > 1 && (
        <InlineField
          label="Authentication"
          labelWidth={LABEL_WIDTH}
--- a/public/app/plugins/datasource/azuremonitor/components/MonitorConfig.tsx
+++ b/public/app/plugins/datasource/azuremonitor/components/MonitorConfig.tsx
@@ -46,6 +46,7 @@ export const MonitorConfig = (props: Props) => {
      <h3 className="page-heading">Authentication</h3>
      <AzureCredentialsForm
        managedIdentityEnabled={config.azure.managedIdentityEnabled}
+        workloadIdentityEnabled={config.azure.workloadIdentityEnabled}
        credentials={credentials}
        azureCloudOptions={azureClouds}
        onCredentialsChange={onCredentialsChange}
--- a/public/app/plugins/datasource/azuremonitor/credentials.ts
+++ b/public/app/plugins/datasource/azuremonitor/credentials.ts
@@ -59,7 +59,8 @@ export function getAzureCloud(options: AzureDataSourceSettings | AzureDataSource
  const authType = getAuthType(options);
  switch (authType) {
    case 'msi':
-      // In case of managed identity, the cloud is always same as where Grafana is hosted
+    case 'workloadidentity':
+      // In case of managed identity and workload identity, the cloud is always same as where Grafana is hosted
      return getDefaultAzureCloud();
    case 'clientsecret':
      return options.jsonData.cloudName || getDefaultAzureCloud();
@@ -79,6 +80,7 @@ function getSecret(options: AzureDataSourceSettings): undefined | string | Conce
 export function isCredentialsComplete(credentials: AzureCredentials): boolean {
  switch (credentials.authType) {
    case 'msi':
+    case 'workloadidentity':
      return true;
    case 'clientsecret':
      return !!(credentials.azureCloud && credentials.tenantId && credentials.clientId && credentials.clientSecret);
@@ -89,12 +91,16 @@ export function getCredentials(options: AzureDataSourceSettings): AzureCredentia
  const authType = getAuthType(options);
  switch (authType) {
    case 'msi':
-      if (config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (
+        (authType === 'msi' && config.azure.managedIdentityEnabled) ||
+        (authType === 'workloadidentity' && config.azure.workloadIdentityEnabled)
+      ) {
        return {
-          authType: 'msi',
+          authType,
        };
      } else {
-        // If authentication type is managed identity but managed identities were disabled in Grafana config,
+        // If authentication type is managed identity or workload identity but either method is disabled in Grafana config,
        // then we should fallback to an empty app registration (client secret) configuration
        return {
          authType: 'clientsecret',
@@ -118,15 +124,19 @@ export function updateCredentials(
 ): AzureDataSourceSettings {
  switch (credentials.authType) {
    case 'msi':
-      if (!config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (credentials.authType === 'msi' && !config.azure.managedIdentityEnabled) {
        throw new Error('Managed Identity authentication is not enabled in Grafana config.');
      }
+      if (credentials.authType === 'workloadidentity' && !config.azure.workloadIdentityEnabled) {
+        throw new Error('Workload Identity authentication is not enabled in Grafana config.');
+      }

      options = {
        ...options,
        jsonData: {
          ...options.jsonData,
-          azureAuthType: 'msi',
+          azureAuthType: credentials.authType,
        },
      };

--- a/public/app/plugins/datasource/azuremonitor/types/types.ts
+++ b/public/app/plugins/datasource/azuremonitor/types/types.ts
@@ -29,7 +29,7 @@ export enum AzureCloud {
  None = '',
 }

-export type AzureAuthType = 'msi' | 'clientsecret';
+export type AzureAuthType = 'msi' | 'clientsecret' | 'workloadidentity';

 export type ConcealedSecret = symbol;

@@ -41,6 +41,10 @@ export interface AzureManagedIdentityCredentials extends AzureCredentialsBase {
  authType: 'msi';
 }

+export interface AzureWorkloadIdentityCredentials extends AzureCredentialsBase {
+  authType: 'workloadidentity';
+}
+
 export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  authType: 'clientsecret';
  azureCloud?: string;
@@ -49,7 +53,10 @@ export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  clientSecret?: string | ConcealedSecret;
 }

-export type AzureCredentials = AzureManagedIdentityCredentials | AzureClientSecretCredentials;
+export type AzureCredentials =
+  | AzureManagedIdentityCredentials
+  | AzureClientSecretCredentials
+  | AzureWorkloadIdentityCredentials;

 export interface AzureDataSourceJsonData extends DataSourceJsonData {
  cloudName: string;
--- a/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
+++ b/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
@@ -17,7 +17,7 @@ jest.mock('@grafana/data', () => ({

 const now = dateTime().valueOf();
 const intervalInSeconds = 60 * 5;
-const endInput = encodeURIComponent(dateTime(now).add(6, 'hours').format('Y-MM-DD HH:mm'));
+const endInput = encodeURIComponent(dateTime(now).add(5, 'hours').format('Y-MM-DD HH:mm'));

 const getPanelData = (panelDataOverrides?: Partial<PanelData>) => {
  const panelData = {
--- a/public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureAuthSettings.tsx
@@ -50,6 +50,7 @@ export const AzureAuthSettings = (props: HttpSettingsBaseProps) => {
      <h6>Azure authentication</h6>
      <AzureCredentialsForm
        managedIdentityEnabled={config.azure.managedIdentityEnabled}
+        workloadIdentityEnabled={config.azure.workloadIdentityEnabled}
        credentials={credentials}
        azureCloudOptions={KnownAzureClouds}
        onCredentialsChange={onCredentialsChange}
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentials.ts
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentials.ts
@@ -13,7 +13,7 @@ export const KnownAzureClouds: Array<SelectableValue<AzureCloud>> = [
  { value: AzureCloud.USGovernment, label: 'Azure US Government' },
 ];

-export type AzureAuthType = 'msi' | 'clientsecret';
+export type AzureAuthType = 'msi' | 'clientsecret' | 'workloadidentity';

 export type ConcealedSecret = symbol;

@@ -26,6 +26,10 @@ export interface AzureManagedIdentityCredentials extends AzureCredentialsBase {
  authType: 'msi';
 }

+export interface AzureWorkloadIdentityCredentials extends AzureCredentialsBase {
+  authType: 'workloadidentity';
+}
+
 export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  authType: 'clientsecret';
  azureCloud?: string;
@@ -34,11 +38,15 @@ export interface AzureClientSecretCredentials extends AzureCredentialsBase {
  clientSecret?: string | ConcealedSecret;
 }

-export type AzureCredentials = AzureManagedIdentityCredentials | AzureClientSecretCredentials;
+export type AzureCredentials =
+  | AzureManagedIdentityCredentials
+  | AzureClientSecretCredentials
+  | AzureWorkloadIdentityCredentials;

 export function isCredentialsComplete(credentials: AzureCredentials): boolean {
  switch (credentials.authType) {
    case 'msi':
+    case 'workloadidentity':
      return true;
    case 'clientsecret':
      return !!(credentials.azureCloud && credentials.tenantId && credentials.clientId && credentials.clientSecret);
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsConfig.ts
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsConfig.ts
@@ -42,12 +42,16 @@ export function getCredentials(options: DataSourceSettings<any, any>): AzureCred

  switch (credentials.authType) {
    case 'msi':
-      if (config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (
+        (credentials.authType === 'msi' && config.azure.managedIdentityEnabled) ||
+        (credentials.authType === 'workloadidentity' && config.azure.workloadIdentityEnabled)
+      ) {
        return {
-          authType: 'msi',
+          authType: credentials.authType,
        };
      } else {
-        // If authentication type is managed identity but managed identities were disabled in Grafana config,
+        // If authentication type is managed identity or workload identity but either method is disabled in Grafana config,
        // then we should fallback to an empty app registration (client secret) configuration
        return {
          authType: 'clientsecret',
@@ -71,16 +75,21 @@ export function updateCredentials(
 ): DataSourceSettings<any, any> {
  switch (credentials.authType) {
    case 'msi':
-      if (!config.azure.managedIdentityEnabled) {
+    case 'workloadidentity':
+      if (credentials.authType === 'msi' && !config.azure.managedIdentityEnabled) {
        throw new Error('Managed Identity authentication is not enabled in Grafana config.');
      }
+      if (credentials.authType === 'workloadidentity' && !config.azure.workloadIdentityEnabled) {
+        throw new Error('Workload Identity authentication is not enabled in Grafana config.');
+      }

      options = {
        ...options,
        jsonData: {
          ...options.jsonData,
+          azureAuthType: credentials.authType,
          azureCredentials: {
-            authType: 'msi',
+            authType: credentials.authType,
          },
        },
      };
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.test.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.test.tsx
@@ -6,6 +6,7 @@ import AzureCredentialsForm, { Props } from './AzureCredentialsForm';
 const setup = (propsFunc?: (props: Props) => Props) => {
  let props: Props = {
    managedIdentityEnabled: false,
+    workloadIdentityEnabled: false,
    credentials: {
      authType: 'clientsecret',
      azureCloud: 'azuremonitor',
--- a/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.tsx
+++ b/public/app/plugins/datasource/prometheus/configuration/AzureCredentialsForm.tsx
@@ -1,5 +1,5 @@
 import { cx } from '@emotion/css';
-import React, { ChangeEvent, useEffect, useReducer, useState } from 'react';
+import React, { ChangeEvent, useEffect, useMemo, useReducer, useState } from 'react';

 import { SelectableValue } from '@grafana/data';
 import { config } from '@grafana/runtime';
@@ -11,6 +11,7 @@ import { AzureAuthType, AzureCredentials, isCredentialsComplete } from './AzureC

 export interface Props {
  managedIdentityEnabled: boolean;
+  workloadIdentityEnabled: boolean;
  credentials: AzureCredentials;
  azureCloudOptions?: SelectableValue[];
  onCredentialsChange: (updatedCredentials: AzureCredentials) => void;
@@ -18,23 +19,45 @@ export interface Props {
  disabled?: boolean;
 }

-const authTypeOptions: Array<SelectableValue<AzureAuthType>> = [
-  {
-    value: 'msi',
-    label: 'Managed Identity',
-  },
-  {
-    value: 'clientsecret',
-    label: 'App Registration',
-  },
-];
-
 export const AzureCredentialsForm = (props: Props) => {
-  const { credentials, azureCloudOptions, onCredentialsChange, getSubscriptions, disabled } = props;
+  const {
+    credentials,
+    azureCloudOptions,
+    onCredentialsChange,
+    getSubscriptions,
+    disabled,
+    managedIdentityEnabled,
+    workloadIdentityEnabled,
+  } = props;
  const hasRequiredFields = isCredentialsComplete(credentials);

  const [subscriptions, setSubscriptions] = useState<Array<SelectableValue<string>>>([]);
  const [loadSubscriptionsClicked, onLoadSubscriptions] = useReducer((val) => val + 1, 0);
+
+  const authTypeOptions = useMemo(() => {
+    let opts: Array<SelectableValue<AzureAuthType>> = [
+      {
+        value: 'clientsecret',
+        label: 'App Registration',
+      },
+    ];
+
+    if (managedIdentityEnabled) {
+      opts.push({
+        value: 'msi',
+        label: 'Managed Identity',
+      });
+    }
+
+    if (workloadIdentityEnabled) {
+      opts.push({
+        value: 'workloadidentity',
+        label: 'Workload Identity',
+      });
+    }
+    return opts;
+  }, [managedIdentityEnabled, workloadIdentityEnabled]);
+
  useEffect(() => {
    if (!getSubscriptions || !hasRequiredFields) {
      updateSubscriptions([]);
@@ -70,19 +93,22 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onAuthTypeChange = (selected: SelectableValue<AzureAuthType>) => {
-    if (onCredentialsChange) {
-      setSubscriptions([]);
-      const updated: AzureCredentials = {
-        ...credentials,
-        authType: selected.value || 'msi',
-        defaultSubscriptionId: undefined,
-      };
-      onCredentialsChange(updated);
-    }
+    setSubscriptions([]);
+    const defaultAuthType = managedIdentityEnabled
+      ? 'msi'
+      : workloadIdentityEnabled
+      ? 'workloadidentity'
+      : 'clientsecret';
+    const updated: AzureCredentials = {
+      ...credentials,
+      authType: selected.value || defaultAuthType,
+      defaultSubscriptionId: undefined,
+    };
+    onCredentialsChange(updated);
  };

  const onAzureCloudChange = (selected: SelectableValue<string>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -94,7 +120,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onTenantIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -106,7 +132,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientIdChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -118,7 +144,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretChange = (event: ChangeEvent<HTMLInputElement>) => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -130,7 +156,7 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onClientSecretReset = () => {
-    if (onCredentialsChange && credentials.authType === 'clientsecret') {
+    if (credentials.authType === 'clientsecret') {
      setSubscriptions([]);
      const updated: AzureCredentials = {
        ...credentials,
@@ -142,19 +168,17 @@ export const AzureCredentialsForm = (props: Props) => {
  };

  const onSubscriptionChange = (selected: SelectableValue<string> | undefined) => {
-    if (onCredentialsChange) {
-      const updated: AzureCredentials = {
-        ...credentials,
-        defaultSubscriptionId: selected?.value,
-      };
-      onCredentialsChange(updated);
-    }
+    const updated: AzureCredentials = {
+      ...credentials,
+      defaultSubscriptionId: selected?.value,
+    };
+    onCredentialsChange(updated);
  };
  const prometheusConfigOverhaulAuth = config.featureToggles.prometheusConfigOverhaulAuth;

  return (
    <div className="gf-form-group">
-      {props.managedIdentityEnabled && (
+      {authTypeOptions.length > 1 && (
        <div className="gf-form-inline">
          <div className="gf-form">
            <InlineFormLabel className="width-12" tooltip="Choose the type of authentication to Azure services">
--- a/scripts/build/ci-build/Dockerfile
+++ b/scripts/build/ci-build/Dockerfile
@@ -108,7 +108,7 @@ RUN rm dockerize-linux-amd64-v${DOCKERIZE_VERSION}.tar.gz
 # Use old Debian (LTS into 2024) in order to ensure binary compatibility with older glibc's.
 FROM debian:buster-20220822

-ENV GOVERSION=1.20.6 \
+ENV GOVERSION=1.20.8 \
    PATH=/usr/local/go/bin:$PATH \
    GOPATH=/go \
    NODEVERSION=18.12.0-1nodesource1 \
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@@ -20,7 +20,7 @@ load(
    "windows_images",
 )

-grabpl_version = "v3.0.41"
+grabpl_version = "v3.0.42"

 trigger_oss = {
    "repo": [
--- a/scripts/drone/utils/images.star
+++ b/scripts/drone/utils/images.star
@@ -6,9 +6,9 @@ images = {
    "cloudsdk_image": "google/cloud-sdk:431.0.0",
    "build_image": "grafana/build-container:1.7.5",
    "publish_image": "grafana/grafana-ci-deploy:1.3.3",
-    "alpine_image": "alpine:3.17.1",
+    "alpine_image": "alpine:3.18.3",
    "curl_image": "byrnedo/alpine-curl:0.1.8",
-    "go_image": "golang:1.20.6",
+    "go_image": "golang:1.20.8",
    "plugins_slack_image": "plugins/slack",
    "postgres_alpine_image": "postgres:12.3-alpine",
    "mysql5_image": "mysql:5.7.39",
--- a/scripts/drone/vault.star
+++ b/scripts/drone/vault.star
@@ -41,6 +41,8 @@ def secrets():
        vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
        vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
        vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),
+        vault_secret("docker_username", "infra/data/ci/grafanaci-docker-hub", "username"),
+        vault_secret("docker_password", "infra/data/ci/grafanaci-docker-hub", "password"),
        vault_secret(
            gcp_upload_artifacts_key,
            "infra/data/ci/grafana/releng/artifacts-uploader-service-account",
--- a/yarn.lock
+++ b/yarn.lock
@@ -3678,9 +3678,9 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@grafana-plugins/input-datasource@workspace:plugins-bundled/internal/input-datasource"
  dependencies:
-    "@grafana/data": 10.1.1
+    "@grafana/data": 10.1.4
    "@grafana/tsconfig": ^1.2.0-rc1
-    "@grafana/ui": 10.1.1
+    "@grafana/ui": 10.1.4
    "@types/jest": 26.0.15
    "@types/react": 18.0.28
    copy-webpack-plugin: 11.0.0
@@ -3716,12 +3716,12 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/data@10.1.1, @grafana/data@workspace:*, @grafana/data@workspace:packages/grafana-data":
+"@grafana/data@10.1.4, @grafana/data@workspace:*, @grafana/data@workspace:packages/grafana-data":
  version: 0.0.0-use.local
  resolution: "@grafana/data@workspace:packages/grafana-data"
  dependencies:
    "@braintree/sanitize-url": 6.0.2
-    "@grafana/schema": 10.1.1
+    "@grafana/schema": 10.1.4
    "@grafana/tsconfig": ^1.2.0-rc1
    "@rollup/plugin-commonjs": 25.0.2
    "@rollup/plugin-json": 6.0.0
@@ -3783,7 +3783,7 @@ __metadata:
  languageName: unknown
  linkType: soft

-"@grafana/e2e-selectors@10.1.1, @grafana/e2e-selectors@workspace:*, @grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors":
+"@grafana/e2e-selectors@10.1.4, @grafana/e2e-selectors@workspace:*, @grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors":
  version: 0.0.0-use.local
  resolution: "@grafana/e2e-selectors@workspace:packages/grafana-e2e-selectors"
  dependencies:
@@ -3820,7 +3820,7 @@ __metadata:
    "@babel/core": 7.22.1
    "@babel/preset-env": 7.22.4
    "@cypress/webpack-preprocessor": 5.17.0
-    "@grafana/e2e-selectors": 10.1.1
+    "@grafana/e2e-selectors": 10.1.4
    "@grafana/tsconfig": ^1.2.0-rc1
    "@mochajs/json-file-reporter": ^1.2.0
    "@rollup/plugin-node-resolve": 15.1.0
@@ -3981,11 +3981,11 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@grafana/runtime@workspace:packages/grafana-runtime"
  dependencies:
-    "@grafana/data": 10.1.1
-    "@grafana/e2e-selectors": 10.1.1
+    "@grafana/data": 10.1.4
+    "@grafana/e2e-selectors": 10.1.4
    "@grafana/faro-web-sdk": 1.1.0
    "@grafana/tsconfig": ^1.2.0-rc1
-    "@grafana/ui": 10.1.1
+    "@grafana/ui": 10.1.4
    "@rollup/plugin-commonjs": 25.0.2
    "@rollup/plugin-node-resolve": 15.1.0
    "@testing-library/dom": 9.3.0
@@ -4038,7 +4038,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/schema@10.1.1, @grafana/schema@workspace:*, @grafana/schema@workspace:packages/grafana-schema":
+"@grafana/schema@10.1.4, @grafana/schema@workspace:*, @grafana/schema@workspace:packages/grafana-schema":
  version: 0.0.0-use.local
  resolution: "@grafana/schema@workspace:packages/grafana-schema"
  dependencies:
@@ -4088,17 +4088,17 @@ __metadata:
  languageName: node
  linkType: hard

-"@grafana/ui@10.1.1, @grafana/ui@workspace:*, @grafana/ui@workspace:packages/grafana-ui":
+"@grafana/ui@10.1.4, @grafana/ui@workspace:*, @grafana/ui@workspace:packages/grafana-ui":
  version: 0.0.0-use.local
  resolution: "@grafana/ui@workspace:packages/grafana-ui"
  dependencies:
    "@babel/core": 7.22.1
    "@emotion/css": 11.11.2
    "@emotion/react": 11.11.1
-    "@grafana/data": 10.1.1
-    "@grafana/e2e-selectors": 10.1.1
+    "@grafana/data": 10.1.4
+    "@grafana/e2e-selectors": 10.1.4
    "@grafana/faro-web-sdk": 1.1.0
-    "@grafana/schema": 10.1.1
+    "@grafana/schema": 10.1.4
    "@grafana/tsconfig": ^1.2.0-rc1
    "@leeoniya/ufuzzy": 1.0.8
    "@mdx-js/react": 1.6.22
Author	SHA1	Message	Date
Kevin Minehart	ac024bfca1	Don't fetch armv7	2023-09-29 13:08:07 -05:00
Kevin Minehart	dd9d68449a	Don't fetch armv7	2023-09-29 12:55:45 -05:00
Kevin Minehart	fc308fbfc4	Don't fetch armv7	2023-09-29 12:49:10 -05:00
Kevin Minehart	ae905ca50c	Don't fetch armv7	2023-09-29 12:45:31 -05:00
Dimitris Sotirakis	d32201b617	Bug: Exclude 32-bit `arm` builds (#75448 ) * Exclude 32 bit arm builds * Bump grabpl - remove arm/v7 from build.star	2023-09-29 12:37:49 -05:00
grafana-delivery-bot[bot]	a676a96d91	Release: Bump version to 10.1.4 (#51 ) Co-authored-by: grafana-delivery-bot[bot] <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>	2023-09-29 16:58:29 +03:00
Andreas Christou	6df640d3aa	[v10.1.x] Azure: Settings for Azure AD Workload Identity (#75683 ) * Azure: Settings for Azure AD Workload Identity (#75283) * Settings for Azure AD Workload Identity * Update dependency on Grafana Azure SDK * Documentation * Fix JS code * Cleanup Prometheus backend code * Making prettier happy (cherry picked from commit `3ee40d3a5a`) # Conflicts: # go.mod # go.sum # public/app/plugins/datasource/mssql/azureauth/AzureAuth.testMocks.ts * Fix go.sum --------- Co-authored-by: Sergey Kostrukov <sekost@microsoft.com> (cherry picked from commit `6445e1f907`)	2023-09-29 16:45:51 +03:00
Andreas Christou	a968ee0e21	[v10.1.x] Azure: Add support for Workload Identity authentication (#75733 ) Azure: Add support for Workload Identity authentication (#75681) * Update Azure Monitor * Update Prometheus * Update README * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Andrew Hackmann <5140848+bossinc@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * Update docs/sources/datasources/azure-monitor/_index.md Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> * README updates * Fix prettier * memoize options --------- Co-authored-by: Andrew Hackmann <5140848+bossinc@users.noreply.github.com> Co-authored-by: Beverly <131809838+BeverlyJaneJ@users.noreply.github.com> (cherry picked from commit `5796836662`) # Conflicts: # public/app/plugins/datasource/azuremonitor/components/AzureCredentialsForm.tsx (cherry picked from commit `28d2423050`)	2023-09-29 16:45:47 +03:00
Kevin Minehart	8e428858dd	get docker_username and docker_password from vault	2023-09-18 15:34:15 -05:00
grafana-delivery-bot[bot]	2b2d40ba32	[v10.1.x] PromLink: Fixes promlink test failing in CI and locally (#74361 ) PromLink: Fixes promlink test failing in CI and locally (#74299) (cherry picked from commit `39b3b08926`) Co-authored-by: Torkel Ödegaard <torkel@grafana.com>	2023-09-18 13:40:45 +02:00
grafana-delivery-bot[bot]	93364cd6a6	"Release: Updated versions in package to 10.1.2" (#44 ) Co-authored-by: grafana-delivery-bot[bot] <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>	2023-09-18 13:25:37 +02:00
Horst Gutmann	43dd7fc687	[v10.1.x] Chore: Upgrade Alpine base image to 3.18.3 (#74993 ) Chore: Upgrade Alpine base image to 3.18.3 (#74984) (cherry picked from commit `85abf2bebd`)	2023-09-18 13:16:58 +02:00
grafana-delivery-bot[bot]	aa64d0e30b	[v10.1.x] Chore: Upgrade Go to 1.20.8 (#74980 ) Chore: Upgrade Go to 1.20.8 (#74978) chore: Update to Go 1.20.8 (cherry picked from commit `39dbd98458`) Co-authored-by: Horst Gutmann <horst.gutmann@grafana.com>	2023-09-18 13:16:15 +02:00
Kevin Minehart	0cfa76b22d	update whatsnew	2023-08-30 14:22:26 -05:00