Feature Management: Define HideFromAdminPage and AllowSelfServe configs (#77580)

* Feature Management: Define HideFromAdminPage and AllowSelfServe configs

* update tests

* add constraint for self-serve

* Update pkg/services/featuremgmt/models.go

Co-authored-by: Michael Mandrus <41969079+mmandrus@users.noreply.github.com>

---------

Co-authored-by: Michael Mandrus <41969079+mmandrus@users.noreply.github.com>

pkg/api/featuremgmt.go

@@ -98,7 +98,7 @@ func isFeatureHidden(flag featuremgmt.FeatureFlag, hideCfg map[string]struct{})
 	if _, ok := hideCfg[flag.Name]; ok {
 		return true
 	}
-	return flag.Stage == featuremgmt.FeatureStageUnknown || flag.Stage == featuremgmt.FeatureStageExperimental || flag.Stage == featuremgmt.FeatureStagePrivatePreview
+	return flag.Stage == featuremgmt.FeatureStageUnknown || flag.Stage == featuremgmt.FeatureStageExperimental || flag.Stage == featuremgmt.FeatureStagePrivatePreview || flag.HideFromAdminPage
 }
 
 // isFeatureWriteable returns whether a toggle on the admin page can be updated by the user.
@@ -110,7 +110,8 @@ func isFeatureWriteable(flag featuremgmt.FeatureFlag, readOnlyCfg map[string]str
 	if flag.Name == featuremgmt.FlagFeatureToggleAdminPage {
 		return false
 	}
-	return flag.Stage == featuremgmt.FeatureStageGeneralAvailability || flag.Stage == featuremgmt.FeatureStageDeprecated
+	allowSelfServe := flag.AllowSelfServe != nil && *flag.AllowSelfServe
+	return flag.Stage == featuremgmt.FeatureStageGeneralAvailability && allowSelfServe || flag.Stage == featuremgmt.FeatureStageDeprecated
 }
 
 // isFeatureEditingAllowed checks if the backend is properly configured to allow feature toggle changes from the UI

pkg/api/featuremgmt_test.go

@@ -20,6 +20,15 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+var (
+	truePtr  = boolPtr(true)
+	falsePtr = boolPtr(false)
+)
+
 func TestGetFeatureToggles(t *testing.T) {
 	readPermissions := []accesscontrol.Permission{{Action: accesscontrol.ActionFeatureManagementRead}}
 
@@ -109,18 +118,25 @@ func TestGetFeatureToggles(t *testing.T) {
 			}, {
 				Name:           "toggle4",
 				Stage:          featuremgmt.FeatureStagePublicPreview,
+				AllowSelfServe: truePtr,
 			}, {
 				Name:           "toggle5",
 				Stage:          featuremgmt.FeatureStageGeneralAvailability,
+				AllowSelfServe: truePtr,
 			}, {
 				Name:           "toggle6",
 				Stage:          featuremgmt.FeatureStageDeprecated,
+				AllowSelfServe: truePtr,
+			}, {
+				Name:           "toggle7",
+				Stage:          featuremgmt.FeatureStageGeneralAvailability,
+				AllowSelfServe: falsePtr,
 			},
 		}
 
 		t.Run("unknown, experimental, and private preview toggles are hidden by default", func(t *testing.T) {
 			result := runGetScenario(t, features, setting.FeatureMgmtSettings{}, readPermissions, http.StatusOK)
-			assert.Len(t, result, 3)
+			assert.Len(t, result, 4)
 
 			_, ok := findResult(t, result, "toggle1")
 			assert.False(t, ok)
@@ -130,13 +146,13 @@ func TestGetFeatureToggles(t *testing.T) {
 			assert.False(t, ok)
 		})
 
-		t.Run("only public preview and GA are writeable by default", func(t *testing.T) {
+		t.Run("only public preview and GA with AllowSelfServe are writeable", func(t *testing.T) {
 			settings := setting.FeatureMgmtSettings{
 				AllowEditing:  true,
 				UpdateWebhook: "bogus",
 			}
 			result := runGetScenario(t, features, settings, readPermissions, http.StatusOK)
-			assert.Len(t, result, 3)
+			assert.Len(t, result, 4)
 
 			t4, ok := findResult(t, result, "toggle4")
 			assert.True(t, ok)
@@ -155,7 +171,7 @@ func TestGetFeatureToggles(t *testing.T) {
 				UpdateWebhook: "",
 			}
 			result := runGetScenario(t, features, settings, readPermissions, http.StatusOK)
-			assert.Len(t, result, 3)
+			assert.Len(t, result, 4)
 
 			t4, ok := findResult(t, result, "toggle4")
 			assert.True(t, ok)
@@ -308,10 +324,12 @@ func TestSetFeatureToggles(t *testing.T) {
 				Name:           "toggle4",
 				Enabled:        false,
 				Stage:          featuremgmt.FeatureStageGeneralAvailability,
+				AllowSelfServe: truePtr,
 			}, {
 				Name:           "toggle5",
 				Enabled:        false,
 				Stage:          featuremgmt.FeatureStageDeprecated,
+				AllowSelfServe: truePtr,
 			},
 		}
 

pkg/services/featuremgmt/models.go

@@ -114,6 +114,8 @@ type FeatureFlag struct {
 	RequiresLicense   bool  `json:"requiresLicense,omitempty"`   // Must be enabled in the license
 	FrontendOnly      bool  `json:"frontend,omitempty"`          // change is only seen in the frontend
 	HideFromDocs      bool  `json:"hideFromDocs,omitempty"`      // don't add the values to docs
+	HideFromAdminPage bool  `json:"hideFromAdminPage,omitempty"` // don't display the feature in the admin page - add a comment with the reasoning
+	AllowSelfServe    *bool `json:"allowSelfServe,omitempty"`    // allow admin users to toggle the feature state from the admin page; this is required for GA toggles only
 
 	// This field is only for the feature management API. To enable your feature toggle by default, use `Expression`.
 	Enabled bool `json:"enabled,omitempty"`

pkg/services/featuremgmt/registry.go

@@ -7,6 +7,8 @@
 package featuremgmt
 
 var (
+	falsePtr = boolPtr(false)
+	truePtr  = boolPtr(true)
 	// Register each toggle here
 	standardFeatureFlags = []FeatureFlag{
 		{
@@ -14,6 +16,7 @@ var (
 			Description:    "Disable envelope encryption (emergency only)",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaAsCodeSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "live-service-web-worker",
@@ -41,6 +44,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaSharingSquad,
 			Expression:     "true", // enabled by default
+			AllowSelfServe: truePtr,
 		},
 		{
 			Name:            "publicDashboardsEmailSharing",
@@ -61,6 +65,7 @@ var (
 			Description:    "Highlight Grafana Enterprise features",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaAsCodeSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "migrationLocking",
@@ -87,6 +92,7 @@ var (
 			Owner:          grafanaExploreSquad,
 			Expression:     "true", // enabled by default
 			FrontendOnly:   true,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "datasourceQueryMultiStatus",
@@ -154,6 +160,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true", // turned on by default
 			Owner:          grafanaPluginsPlatformSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			// Some plugins rely on topnav feature flag being enabled, so we cannot remove this until we
@@ -190,6 +197,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true", // enabled by default
 			Owner:          awsDatasourcesSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "redshiftAsyncQueryDataSupport",
@@ -197,6 +205,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true", // enabled by default
 			Owner:          awsDatasourcesSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "athenaAsyncQueryDataSupport",
@@ -205,6 +214,7 @@ var (
 			Expression:     "true", // enabled by default
 			FrontendOnly:   true,
 			Owner:          awsDatasourcesSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "cloudwatchNewRegionsHandler",
@@ -243,12 +253,14 @@ var (
 			Owner:          grafanaFrontendPlatformSquad,
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "accessTokenExpirationCheck",
 			Description:    "Enable OAuth access_token expiration check and token refresh using the refresh_token",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          identityAccessTeam,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "emptyDashboardPage",
@@ -257,12 +269,14 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
 			Owner:          grafanaDashboardsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "disablePrometheusExemplarSampling",
 			Description:    "Disable Prometheus exemplar sampling",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "alertingBacktesting",
@@ -291,6 +305,7 @@ var (
 			FrontendOnly:   true,
 			Owner:          grafanaObservabilityLogsSquad,
 			Expression:     "true", // turned on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "lokiQuerySplitting",
@@ -299,6 +314,7 @@ var (
 			FrontendOnly:   true,
 			Owner:          grafanaObservabilityLogsSquad,
 			Expression:     "true", // turned on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "lokiQuerySplittingConfig",
@@ -318,6 +334,7 @@ var (
 			Description:    "Prohibits a user from changing organization roles synced with Grafana Cloud auth provider",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          identityAccessTeam,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "prometheusMetricEncyclopedia",
@@ -326,6 +343,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			FrontendOnly:   true,
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "influxdbBackendMigration",
@@ -334,6 +352,7 @@ var (
 			FrontendOnly:   true,
 			Owner:          grafanaObservabilityMetricsSquad,
 			Expression:     "true", // enabled by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "clientTokenRotation",
@@ -347,6 +366,7 @@ var (
 			Expression:     "true",
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "lokiMetricDataplane",
@@ -354,6 +374,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true",
 			Owner:          grafanaObservabilityLogsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "lokiLogsDataplane",
@@ -368,6 +389,7 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true",
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "disableSSEDataplane",
@@ -388,6 +410,7 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
 			Owner:          grafanaAlertingSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "alertStateHistoryLokiPrimary",
@@ -433,6 +456,7 @@ var (
 			Owner:           grafanaOperatorExperienceSquad,
 			RequiresRestart: true,
 			Expression:      "true", // enabled by default
+			AllowSelfServe:  falsePtr,
 		},
 		{
 			Name:           "enableElasticsearchBackendQuerying",
@@ -440,6 +464,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaObservabilityLogsSquad,
 			Expression:     "true", // enabled by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:           "advancedDataSourcePicker",
@@ -448,6 +473,7 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
 			Owner:          grafanaDashboardsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "faroDatasourceSelector",
@@ -526,6 +552,7 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
 			Owner:          awsDatasourcesSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "exploreScrollableLogsContainer",
@@ -540,6 +567,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true",
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "pluginsDynamicAngularDetectionPatterns",
@@ -582,6 +610,7 @@ var (
 			FrontendOnly:   true,
 			Expression:     "true", // enabled by default
 			Owner:          grafanaObservabilityMetricsSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "mlExpressions",
@@ -646,6 +675,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaPartnerPluginsSquad,
 			Expression:     "true", // on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "traceToProfiles",
@@ -666,6 +696,7 @@ var (
 			Owner:          grafanaObservabilityMetricsSquad,
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true", // on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:            "configurableSchedulerTick",
@@ -707,6 +738,7 @@ var (
 			FrontendOnly:   true,
 			Owner:          grafanaDashboardsSquad,
 			Expression:     "true", // on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:            "reportingRetries",
@@ -723,6 +755,7 @@ var (
 			Owner:          grafanaFrontendPlatformSquad,
 			FrontendOnly:   true,
 			Expression:     "true", // on by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:        "sseGroupByDatasource",
@@ -766,6 +799,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Owner:          grafanaAlertingSquad,
 			Expression:     "true", // enabled by default
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:         "alertingContactPointsV2",
@@ -808,6 +842,7 @@ var (
 			Stage:          FeatureStageGeneralAvailability,
 			Expression:     "true", // enabled by default
 			Owner:          awsDatasourcesSquad,
+			AllowSelfServe: falsePtr,
 		},
 		{
 			Name:            "externalServiceAccounts",
@@ -991,3 +1026,7 @@ var (
 		},
 	}
 )
+
+func boolPtr(b bool) *bool {
+	return &b
+}

pkg/services/featuremgmt/toggles_gen_test.go

@@ -45,6 +45,12 @@ func TestFeatureToggleFiles(t *testing.T) {
 			if flag.Name != strings.TrimSpace(flag.Name) {
 				t.Errorf("flag Name should not start/end with spaces.  See: %s", flag.Name)
 			}
+			if flag.Stage == FeatureStageGeneralAvailability && flag.AllowSelfServe == nil {
+				t.Errorf("feature stage FeatureStageGeneralAvailability should have the AllowSelfServe field defined")
+			}
+			if flag.AllowSelfServe != nil && flag.Stage != FeatureStageGeneralAvailability {
+				t.Errorf("only allow self-serving GA toggles")
+			}
 		}
 	})