Allow installation of plugins from arbitrary URLs

[siegenthalerroger]

Is your feature request related to a problem? Please describe. I want to install the "explore-logs" experimental Grafana plugin. This isn't available on Grafana's "store" and must be loaded from a provided URL. This isn't possible as the Datasource and Dashboard CRs don't expose a URL field for the plugins. Further it isn't possible to set the GF_INSTALL_PLUGINS env variable manually, as the operator overrides this.

(If applicable)If your feature request solves a bug please provide a link to the community issue https://github.com/grafana/grafana-operator/issues/1393#issuecomment-2014853775

Describe the solution you'd like A few variants of solutions I'd consider functional:

• Extend the Dashboard and Datasource CRDs to allow a URL to also be defined for plugins
• Extend the Grafana CRD to allow the definition of plugins with URLs (more secure as doesn't allow arbitrary URLs from decentral sources)
• Allow the definition of the GF_INSTALL_PLUGINS env variable in the Grafana CRD and merge the result instead of overriding it.

Describe alternatives you've considered / Additional context I'm not sure how this would interop with the "app" plugins problems with enablement (doesn't seem to effect the explore-logs plugin despite this being described as an "app") - https://github.com/grafana/grafana-operator/issues/1392

[NissesSenap]

So a person in our community managed to get this to work 2 months ago. He described it like this in slack:

    - name: https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/grafana-lokiexplore-app-latest.zip;grafana-lokiexplore-app
      version: 0.0.4

https://grafana.slack.com/archives/C0692KN29K3/p1712822506034589?thread_ts=1712776016.988039&cid=C0692KN29K3

I would assume the whole example could be something like this

apiVersion: grafana.integreatly.org/v1beta1
kind: GrafanaDatasource
metadata:
  name: example-grafanadatasource
spec:
  datasource:
    access: proxy
    type: prometheus
    jsonData:
      timeInterval: 5s
      tlsSkipVerify: true
    name: Prometheus
    url: http://prometheus-service:9090
  instanceSelector:
    matchLabels:
      dashboards: grafana
  plugins:
    - name: https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/grafana-lokiexplore-app-latest.zip;grafana-lokiexplore-app
      version: 0.0.4

[siegenthalerroger]

Ah yes, that could actually work assuming the operator treats the name as a raw string and just concats it all to the GF_INSTALL_PLUGINS env variable.

In which case honestly the feature request would be a much more pertinent "prevent random third party code from being loaded" :/

[theSuess]

I've created a proposal in #1577 to address your concerns. Will close this as the specific issue has been resolved