feat: add disableProvenance option to GrafanaAlertRuleGroupSpec

api/v1beta1/grafanaalertrulegroup_types.go

@@ -58,6 +58,11 @@ type GrafanaAlertRuleGroupSpec struct {
 
 	// +optional
 	AllowCrossNamespaceImport *bool `json:"allowCrossNamespaceImport,omitempty"`
+
+	// Whether to enable or disable editing of the alert rule group in Grafana UI
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
+	// +optional
+	Editable *bool `json:"editable,omitempty"`
 }
 
 // AlertRule defines a specific rule to be evaluated. It is based on the upstream model with some k8s specific type mappings

config/crd/bases/grafana.integreatly.org_grafanaalertrulegroups.yaml

@@ -44,6 +44,13 @@ spec:
             properties:
               allowCrossNamespaceImport:
                 type: boolean
+              editable:
+                description: Whether to enable or disable editing of the alert rule
+                  group in Grafana UI
+                type: boolean
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               folderRef:
                 description: Match GrafanaFolders CRs to infer the uid
                 type: string

controllers/grafanaalertrulegroup_controller.go

@@ -162,7 +162,12 @@ func (r *GrafanaAlertRuleGroupReconciler) reconcileWithInstance(ctx context.Cont
 	if err != nil {
 		return fmt.Errorf("building grafana client: %w", err)
 	}
-	strue := "true"
+
+	trueRef := "true"
+	editable := true
+	if group.Spec.Editable != nil && !*group.Spec.Editable {
+		editable = false
+	}
 
 	_, err = cl.Folders.GetFolderByUID(folderUID) //nolint:errcheck
 	if err != nil {
@@ -225,16 +230,20 @@ func (r *GrafanaAlertRuleGroupReconciler) reconcileWithInstance(ctx context.Cont
 		if _, ok := currentRules[rule.UID]; ok {
 			params := provisioning.NewPutAlertRuleParams().
 				WithBody(apiRule).
-				WithXDisableProvenance(&strue).
 				WithUID(rule.UID)
+			if editable {
+				params.SetXDisableProvenance(&trueRef)
+			}
 			_, err := cl.Provisioning.PutAlertRule(params) //nolint:errcheck
 			if err != nil {
 				return fmt.Errorf("updating rule: %w", err)
 			}
 		} else {
 			params := provisioning.NewPostAlertRuleParams().
-				WithBody(apiRule).
-				WithXDisableProvenance(&strue)
+				WithBody(apiRule)
+			if editable {
+				params.SetXDisableProvenance(&trueRef)
+			}
 			_, err = cl.Provisioning.PostAlertRule(params) //nolint:errcheck
 			if err != nil {
 				return fmt.Errorf("creating rule: %w", err)
@@ -247,8 +256,10 @@ func (r *GrafanaAlertRuleGroupReconciler) reconcileWithInstance(ctx context.Cont
 	for uid, present := range currentRules {
 		if !present {
 			params := provisioning.NewDeleteAlertRuleParams().
-				WithUID(uid).
-				WithXDisableProvenance(&strue)
+				WithUID(uid)
+			if editable {
+				params.SetXDisableProvenance(&trueRef)
+			}
 			_, err := cl.Provisioning.DeleteAlertRule(params) //nolint:errcheck
 			if err != nil {
 				return fmt.Errorf("deleting old alert rule %s: %w", uid, err)
@@ -265,8 +276,10 @@ func (r *GrafanaAlertRuleGroupReconciler) reconcileWithInstance(ctx context.Cont
 	params := provisioning.NewPutAlertRuleGroupParams().
 		WithBody(mGroup).
 		WithGroup(groupName).
-		WithFolderUID(folderUID).
-		WithXDisableProvenance(&strue)
+		WithFolderUID(folderUID)
+	if editable {
+		params.SetXDisableProvenance(&trueRef)
+	}
 	_, err = cl.Provisioning.PutAlertRuleGroup(params) //nolint:errcheck
 	if err != nil {
 		return fmt.Errorf("updating group: %s", err.Error())

deploy/helm/grafana-operator/crds/grafana.integreatly.org_grafanaalertrulegroups.yaml

@@ -44,6 +44,13 @@ spec:
             properties:
               allowCrossNamespaceImport:
                 type: boolean
+              editable:
+                description: Whether to enable or disable editing of the alert rule
+                  group in Grafana UI
+                type: boolean
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               folderRef:
                 description: Match GrafanaFolders CRs to infer the uid
                 type: string

deploy/kustomize/base/crds.yaml

@@ -43,6 +43,13 @@ spec:
             properties:
               allowCrossNamespaceImport:
                 type: boolean
+              editable:
+                description: Whether to enable or disable editing of the alert rule
+                  group in Grafana UI
+                type: boolean
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               folderRef:
                 description: Match GrafanaFolders CRs to infer the uid
                 type: string

docs/docs/api.md

@@ -132,6 +132,15 @@ GrafanaAlertRuleGroupSpec defines the desired state of GrafanaAlertRuleGroup
           <br/>
         </td>
         <td>false</td>
+      </tr><tr>
+        <td><b>editable</b></td>
+        <td>boolean</td>
+        <td>
+          Whether to enable or disable editing of the alert rule group in Grafana UI<br/>
+          <br/>
+            <i>Validations</i>:<li>self == oldSelf: Value is immutable</li>
+        </td>
+        <td>false</td>
       </tr><tr>
         <td><b>folderRef</b></td>
         <td>string</td>