Alerting Rule Groups: Support editing from UI (#1214)

* Alerting Rule Groups: Support editing from UI
Closes #697
Requires grafana/grafana-openapi-client-go#45
There has been informal support through setting the `X-Disable-Provenance` header manually but it doesn't work that well. Notably, it currently fails on updates (see issue)

This adds a field on the rule group to allow editing from UI

Note: The provenance is actually a rule attribute (not group).
Because we manage the rule group as a whole and the setting has to set through a header, I chose to add the setting as a group-scoped attribute because it's easier to manage
Otherwise, we'd have to do POSTs, PUTs and DELETEs for each rule within the group

Also, I added tests to make sure that the provenance is correctly synced from Terraform to the alerting service and that it can be read back

* Remove commented out code

* Update ref

* Rename `allow_editing_from_ui` -> `disable_provenance`

* Update client ref

Author: julienduchesne

docs/resources/rule_group.md

@@ -120,6 +120,7 @@ EOT
 
 ### Optional
 
+- `disable_provenance` (Boolean) Allow modifying the rule group from other sources than Terraform or the Grafana API. Defaults to `false`.
 - `org_id` (String) The Organization ID. If not set, the Org ID defined in the provider block will be used.
 
 ### Read-Only

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/go-openapi/strfmt v0.21.9
 	github.com/grafana/amixr-api-go-client v0.0.11
 	github.com/grafana/grafana-api-golang-client v0.27.0
-	github.com/grafana/grafana-openapi-client-go v0.0.0-20231208125730-b6492d2ae05f
+	github.com/grafana/grafana-openapi-client-go v0.0.0-20231215124113-30c79ed880b9
 	github.com/grafana/machine-learning-go-client v0.5.0
 	github.com/grafana/synthetic-monitoring-agent v0.19.1
 	github.com/grafana/synthetic-monitoring-api-go-client v0.7.0

go.sum

@@ -116,8 +116,8 @@ github.com/grafana/amixr-api-go-client v0.0.11 h1:jlE+5t0tRuCtjbpM81j70Dr2J4eCyS
 github.com/grafana/amixr-api-go-client v0.0.11/go.mod h1:N6x26XUrM5zGtK5zL5vNJnAn2JFMxLFPPLTw/6pDkFE=
 github.com/grafana/grafana-api-golang-client v0.27.0 h1:zIwMXcbCB4n588i3O2N6HfNcQogCNTd/vPkEXTr7zX8=
 github.com/grafana/grafana-api-golang-client v0.27.0/go.mod h1:uNLZEmgKtTjHBtCQMwNn3qsx2mpMb8zU+7T4Xv3NR9Y=
-github.com/grafana/grafana-openapi-client-go v0.0.0-20231208125730-b6492d2ae05f h1:BYEmWlwwy+f8kI1nB4orGxvFQV1P2zXU+M/Xy8y/D/0=
-github.com/grafana/grafana-openapi-client-go v0.0.0-20231208125730-b6492d2ae05f/go.mod h1:LwkzHzVOQG/fFIZmPvLxU2SrtLyxx+YAkx6ykw5sTfQ=
+github.com/grafana/grafana-openapi-client-go v0.0.0-20231215124113-30c79ed880b9 h1:yRvxeTz934brAilk3YaRK0f43Q079rBMU6t81ereQkI=
+github.com/grafana/grafana-openapi-client-go v0.0.0-20231215124113-30c79ed880b9/go.mod h1:wc6Hbh3K2TgCUSfBC/BOzabItujtHMESZeFk5ZhdxhQ=
 github.com/grafana/machine-learning-go-client v0.5.0 h1:Q1K+MPSy8vfMm2jsk3WQ7O77cGr2fM5hxwtPSoPc5NU=
 github.com/grafana/machine-learning-go-client v0.5.0/go.mod h1:QFfZz8NkqVF8++skjkKQXJEZfpCYd8S0yTWJUpsLLTA=
 github.com/grafana/synthetic-monitoring-agent v0.19.1 h1:ImH6JG8ZJ1h+KP7lJV6nkYyImAXtEthMaoLRpP4Hd0M=

internal/resources/grafana/resource_alerting_rule_group.go

@@ -57,6 +57,12 @@ This resource requires Grafana 9.1.0 or later.
 				Required:    true,
 				Description: "The interval, in seconds, at which all rules in the group are evaluated. If a group contains many rules, the rules are evaluated sequentially.",
 			},
+			"disable_provenance": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Allow modifying the rule group from other sources than Terraform or the Grafana API.",
+			},
 			"rule": {
 				Type:        schema.TypeList,
 				Required:    true,
@@ -198,9 +204,30 @@ func readAlertRuleGroup(ctx context.Context, data *schema.ResourceData, meta int
 		return err
 	}
 
-	if err := packRuleGroup(resp.Payload, data); err != nil {
-		return diag.FromErr(err)
+	g := resp.Payload
+	data.Set("name", g.Title)
+	data.Set("folder_uid", g.FolderUID)
+	data.Set("interval_seconds", g.Interval)
+	disableProvenance := true
+	rules := make([]interface{}, 0, len(g.Rules))
+	for _, r := range g.Rules {
+		ruleResp, err := client.Provisioning.GetAlertRule(r.UID) // We need to get the rule through a separate API call to get the provenance.
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		r := ruleResp.Payload
+		data.Set("org_id", strconv.FormatInt(*r.OrgID, 10))
+		packed, err := packAlertRule(r)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		if r.Provenance != "" {
+			disableProvenance = false
+		}
+		rules = append(rules, packed)
 	}
+	data.Set("disable_provenance", disableProvenance)
+	data.Set("rule", rules)
 	data.SetId(MakeOrgResourceID(orgID, packGroupID(key)))
 
 	return nil
@@ -209,16 +236,40 @@ func readAlertRuleGroup(ctx context.Context, data *schema.ResourceData, meta int
 func putAlertRuleGroup(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, orgID := OAPIClientFromNewOrgResource(meta, data)
 
-	group, err := unpackRuleGroup(data)
-	if err != nil {
-		return diag.FromErr(err)
+	group := data.Get("name").(string)
+	folder := data.Get("folder_uid").(string)
+	interval := data.Get("interval_seconds").(int)
+
+	packedRules := data.Get("rule").([]interface{})
+	rules := make([]*models.ProvisionedAlertRule, 0, len(packedRules))
+	for i := range packedRules {
+		rule, err := unpackAlertRule(packedRules[i], group, folder, orgID)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		rules = append(rules, rule)
+	}
+
+	putParams := provisioning.NewPutAlertRuleGroupParams().
+		WithFolderUID(folder).
+		WithGroup(group).WithBody(&models.AlertRuleGroup{
+		Title:     group,
+		FolderUID: folder,
+		Rules:     rules,
+		Interval:  int64(interval),
+	})
+
+	if data.Get("disable_provenance").(bool) {
+		disableProvenance := "disabled" // This can be any non-empty string.
+		putParams.SetXDisableProvenance(&disableProvenance)
 	}
 
-	if _, err = client.Provisioning.PutAlertRuleGroup(group); err != nil {
+	resp, err := client.Provisioning.PutAlertRuleGroup(putParams)
+	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	key := packGroupID(AlertRuleGroupKey{group.FolderUID, group.Group})
+	key := packGroupID(AlertRuleGroupKey{resp.Payload.FolderUID, resp.Payload.Title})
 	data.SetId(MakeOrgResourceID(orgID, key))
 	return readAlertRuleGroup(ctx, data, meta)
 }
@@ -235,7 +286,8 @@ func deleteAlertRuleGroup(ctx context.Context, data *schema.ResourceData, meta i
 	group := resp.Payload
 
 	for _, r := range group.Rules {
-		_, err := client.Provisioning.DeleteAlertRule(r.UID)
+		params := provisioning.NewDeleteAlertRuleParams().WithUID(r.UID)
+		_, err := client.Provisioning.DeleteAlertRule(params)
 		if diag, shouldReturn := common.CheckReadError("rule group", data, err); shouldReturn {
 			return diag
 		}
@@ -257,55 +309,6 @@ func diffSuppressJSON(k, oldValue, newValue string, data *schema.ResourceData) b
 	return reflect.DeepEqual(o, n)
 }
 
-func packRuleGroup(g *models.AlertRuleGroup, data *schema.ResourceData) error {
-	data.Set("name", g.Title)
-	data.Set("folder_uid", g.FolderUID)
-	data.Set("interval_seconds", g.Interval)
-	rules := make([]interface{}, 0, len(g.Rules))
-	for _, r := range g.Rules {
-		data.Set("org_id", strconv.FormatInt(*r.OrgID, 10))
-		packed, err := packAlertRule(r)
-		if err != nil {
-			return err
-		}
-		rules = append(rules, packed)
-	}
-	data.Set("rule", rules)
-	return nil
-}
-
-func unpackRuleGroup(data *schema.ResourceData) (*provisioning.PutAlertRuleGroupParams, error) {
-	group := data.Get("name").(string)
-	folder := data.Get("folder_uid").(string)
-	interval := data.Get("interval_seconds").(int)
-	packedRules := data.Get("rule").([]interface{})
-
-	// org_id is a string to properly support referencing between resources. However, the API expects an int64.
-	orgID, err := strconv.ParseInt(data.Get("org_id").(string), 10, 64)
-	if err != nil {
-		return nil, err
-	}
-
-	rules := make([]*models.ProvisionedAlertRule, 0, len(packedRules))
-	for i := range packedRules {
-		rule, err := unpackAlertRule(packedRules[i], group, folder, orgID)
-		if err != nil {
-			return nil, err
-		}
-		rules = append(rules, rule)
-	}
-
-	return provisioning.NewPutAlertRuleGroupParams().
-		WithFolderUID(folder).
-		WithGroup(group).WithBody(&models.AlertRuleGroup{
-
-		Title:     group,
-		FolderUID: folder,
-		Rules:     rules,
-		Interval:  int64(interval),
-	}), nil
-}
-
 func packAlertRule(r *models.ProvisionedAlertRule) (interface{}, error) {
 	data, err := packRuleData(r.Data)
 	if err != nil {

internal/resources/grafana/resource_alerting_rule_group_test.go

@@ -226,7 +226,7 @@ func TestAccAlertRule_inOrg(t *testing.T) {
 		Steps: []resource.TestStep{
 			// Test creation.
 			{
-				Config: testAccAlertRuleGroupInOrgConfig(name, 240),
+				Config: testAccAlertRuleGroupInOrgConfig(name, 240, false),
 				Check: resource.ComposeTestCheckFunc(
 					alertingRuleGroupCheckExists.exists("grafana_rule_group.test", &group),
 					orgCheckExists.exists("grafana_organization.test", &org),
@@ -239,7 +239,7 @@ func TestAccAlertRule_inOrg(t *testing.T) {
 			},
 			// Test update content.
 			{
-				Config: testAccAlertRuleGroupInOrgConfig(name, 360),
+				Config: testAccAlertRuleGroupInOrgConfig(name, 360, false),
 				Check: resource.ComposeTestCheckFunc(
 					alertingRuleGroupCheckExists.exists("grafana_rule_group.test", &group),
 					orgCheckExists.exists("grafana_organization.test", &org),
@@ -258,7 +258,7 @@ func TestAccAlertRule_inOrg(t *testing.T) {
 			},
 			// Test delete resource, but not org.
 			{
-				Config: testutils.WithoutResource(t, testAccAlertRuleGroupInOrgConfig(name, 360), "grafana_rule_group.test"),
+				Config: testutils.WithoutResource(t, testAccAlertRuleGroupInOrgConfig(name, 360, false), "grafana_rule_group.test"),
 				Check: resource.ComposeTestCheckFunc(
 					orgCheckExists.exists("grafana_organization.test", &org),
 					alertingRuleGroupCheckExists.destroyed(&group, &org),
@@ -268,7 +268,69 @@ func TestAccAlertRule_inOrg(t *testing.T) {
 	})
 }
 
-func testAccAlertRuleGroupInOrgConfig(name string, interval int) string {
+func TestAccAlertRule_disableProvenance(t *testing.T) {
+	testutils.CheckOSSTestsEnabled(t, ">=9.1.0")
+
+	var group models.AlertRuleGroup
+	var org models.OrgDetailsDTO
+	name := acctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProviderFactories: testutils.ProviderFactories,
+		CheckDestroy: resource.ComposeTestCheckFunc(
+			orgCheckExists.destroyed(&org, nil),
+			alertingRuleGroupCheckExists.destroyed(&group, &org),
+		),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlertRuleGroupInOrgConfig(name, 240, false),
+				Check: resource.ComposeTestCheckFunc(
+					alertingRuleGroupCheckExists.exists("grafana_rule_group.test", &group),
+					orgCheckExists.exists("grafana_organization.test", &org),
+					checkResourceIsInOrg("grafana_rule_group.test", "grafana_organization.test"),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "name", name),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "disable_provenance", "false"),
+				),
+			},
+			// Test import.
+			{
+				ResourceName:      "grafana_rule_group.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Enable editing from UI.
+			{
+				Config: testAccAlertRuleGroupInOrgConfig(name, 240, true),
+				Check: resource.ComposeTestCheckFunc(
+					alertingRuleGroupCheckExists.exists("grafana_rule_group.test", &group),
+					orgCheckExists.exists("grafana_organization.test", &org),
+					checkResourceIsInOrg("grafana_rule_group.test", "grafana_organization.test"),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "name", name),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "disable_provenance", "true"),
+				),
+			},
+			// Test import.
+			{
+				ResourceName:      "grafana_rule_group.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Disable editing from UI.
+			{
+				Config: testAccAlertRuleGroupInOrgConfig(name, 240, false),
+				Check: resource.ComposeTestCheckFunc(
+					alertingRuleGroupCheckExists.exists("grafana_rule_group.test", &group),
+					orgCheckExists.exists("grafana_organization.test", &org),
+					checkResourceIsInOrg("grafana_rule_group.test", "grafana_organization.test"),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "name", name),
+					resource.TestCheckResourceAttr("grafana_rule_group.test", "disable_provenance", "false"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAlertRuleGroupInOrgConfig(name string, interval int, disableProvenance bool) string {
 	return fmt.Sprintf(`
 resource "grafana_organization" "test" {
 	name = "%[1]s"
@@ -284,6 +346,7 @@ resource "grafana_rule_group" "test" {
 	name             = "%[1]s"
 	folder_uid       = grafana_folder.test.uid
 	interval_seconds = %[2]d
+	disable_provenance = %[3]t
 	rule {
 		name           = "My Alert Rule 1"
 		for            = "2m"
@@ -308,5 +371,5 @@ resource "grafana_rule_group" "test" {
 		}
 	}
 }
-`, name, interval)
+`, name, interval, disableProvenance)
 }