Skip to content

Commit 8d41fe3

Browse files
denikdenik
authored
direct: grants support (#3883)
## Changes Add grants support for all resources that have Grants in the schema (schemas, models, registered_models). The approach is different from terraform, rather than doing get + update, we do a single update where we clear all existing permissions. ## Tests Acceptance cloud tests. Since we cannot compare requests between direct and terraform (but still record them), we test by fetching final grants after deploy from the backend. Extended testserver to support grants. Added a bunch of fields to schemas and volumes to make it looks more like real API.
1 parent 0088398 commit 8d41fe3

File tree

69 files changed

+1508
-60
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+1508
-60
lines changed

‎acceptance/bundle/refschema/out.fields.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2932,6 +2932,13 @@ resources.registered_models.*.storage_location string ALL
29322932
resources.registered_models.*.updated_at int64 ALL
29332933
resources.registered_models.*.updated_by string ALL
29342934
resources.registered_models.*.url string INPUT
2935+
resources.registered_models.*.grants.full_name string ALL
2936+
resources.registered_models.*.grants.grants []dresources.GrantAssignment ALL
2937+
resources.registered_models.*.grants.grants[*] dresources.GrantAssignment ALL
2938+
resources.registered_models.*.grants.grants[*].principal string ALL
2939+
resources.registered_models.*.grants.grants[*].privileges []catalog.Privilege ALL
2940+
resources.registered_models.*.grants.grants[*].privileges[*] catalog.Privilege ALL
2941+
resources.registered_models.*.grants.securable_type string ALL
29352942
resources.schemas.*.browse_only bool REMOTE
29362943
resources.schemas.*.catalog_name string ALL
29372944
resources.schemas.*.catalog_type catalog.CatalogType REMOTE
@@ -2964,6 +2971,13 @@ resources.schemas.*.storage_root string ALL
29642971
resources.schemas.*.updated_at int64 REMOTE
29652972
resources.schemas.*.updated_by string REMOTE
29662973
resources.schemas.*.url string INPUT
2974+
resources.schemas.*.grants.full_name string ALL
2975+
resources.schemas.*.grants.grants []dresources.GrantAssignment ALL
2976+
resources.schemas.*.grants.grants[*] dresources.GrantAssignment ALL
2977+
resources.schemas.*.grants.grants[*].principal string ALL
2978+
resources.schemas.*.grants.grants[*].privileges []catalog.Privilege ALL
2979+
resources.schemas.*.grants.grants[*].privileges[*] catalog.Privilege ALL
2980+
resources.schemas.*.grants.securable_type string ALL
29672981
resources.sql_warehouses.*.auto_stop_mins int ALL
29682982
resources.sql_warehouses.*.channel *sql.Channel ALL
29692983
resources.sql_warehouses.*.channel.dbsql_version string ALL
@@ -3114,3 +3128,10 @@ resources.volumes.*.updated_by string REMOTE
31143128
resources.volumes.*.url string INPUT
31153129
resources.volumes.*.volume_id string REMOTE
31163130
resources.volumes.*.volume_type catalog.VolumeType ALL
3131+
resources.volumes.*.grants.full_name string ALL
3132+
resources.volumes.*.grants.grants []dresources.GrantAssignment ALL
3133+
resources.volumes.*.grants.grants[*] dresources.GrantAssignment ALL
3134+
resources.volumes.*.grants.grants[*].principal string ALL
3135+
resources.volumes.*.grants.grants[*].privileges []catalog.Privilege ALL
3136+
resources.volumes.*.grants.grants[*].privileges[*] catalog.Privilege ALL
3137+
resources.volumes.*.grants.securable_type string ALL

‎acceptance/bundle/resources/grants/registered_models/databricks.yml.tmpl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
bundle:
2+
name: deploy-registered-models-basic-$UNIQUE_NAME
3+
4+
resources:
5+
schemas:
6+
my_schema:
7+
catalog_name: main
8+
name: myschema_$UNIQUE_NAME
9+
registered_models:
10+
my_registered_model:
11+
name: mymodel
12+
comment: mycomment
13+
catalog_name: main
14+
# this does not work because we don't create implicit dependency like we do with volumes:
15+
#schema_name: myschema_$UNIQUE_NAME
16+
schema_name: ${resources.schemas.my_schema.name}
17+
grants:
18+
- principal: [email protected]
19+
privileges: ["APPLY_TAG"]

‎acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.direct.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"method": "PATCH",
3+
"path": "/api/2.1/unity-catalog/permissions/function/main.myschema_[UNIQUE_NAME].mymodel",
4+
"body": {
5+
"changes": [
6+
{
7+
"add": [
8+
"APPLY_TAG"
9+
],
10+
"principal": "[email protected]",
11+
"remove": [
12+
"ALL_PRIVILEGES"
13+
]
14+
}
15+
]
16+
}
17+
}

‎acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.terraform.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"method": "PATCH",
3+
"path": "/api/2.1/unity-catalog/permissions/function/main.myschema_[UNIQUE_NAME].mymodel",
4+
"body": {
5+
"changes": [
6+
{
7+
"add": [
8+
"APPLY_TAG"
9+
],
10+
"principal": "[email protected]"
11+
}
12+
]
13+
}
14+
}

‎acceptance/bundle/resources/grants/registered_models/out.destroy.requests.direct.json‎

Whitespace-only changes.

‎acceptance/bundle/resources/grants/registered_models/out.destroy.requests.terraform.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"method": "PATCH",
3+
"path": "/api/2.1/unity-catalog/permissions/function/main.myschema_[UNIQUE_NAME].mymodel",
4+
"body": {
5+
"changes": [
6+
{
7+
"principal": "[email protected]",
8+
"remove": [
9+
"APPLY_TAG"
10+
]
11+
}
12+
]
13+
}
14+
}

‎acceptance/bundle/resources/grants/registered_models/out.plan1.direct.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"plan": {
3+
"resources.registered_models.my_registered_model": {
4+
"depends_on": [
5+
{
6+
"node": "resources.schemas.my_schema",
7+
"label": "${resources.schemas.my_schema.name}"
8+
}
9+
],
10+
"action": "create",
11+
"new_state": {
12+
"config": {
13+
"catalog_name": "main",
14+
"comment": "mycomment",
15+
"name": "mymodel",
16+
"schema_name": "myschema_[UNIQUE_NAME]"
17+
}
18+
}
19+
},
20+
"resources.registered_models.my_registered_model.grants": {
21+
"depends_on": [
22+
{
23+
"node": "resources.registered_models.my_registered_model",
24+
"label": "${resources.registered_models.my_registered_model.id}"
25+
}
26+
],
27+
"action": "create",
28+
"new_state": {
29+
"config": {
30+
"securable_type": "function",
31+
"full_name": "",
32+
"grants": [
33+
{
34+
"principal": "[email protected]",
35+
"privileges": [
36+
"APPLY_TAG"
37+
]
38+
}
39+
]
40+
},
41+
"vars": {
42+
"full_name": "${resources.registered_models.my_registered_model.id}"
43+
}
44+
}
45+
},
46+
"resources.schemas.my_schema": {
47+
"action": "create",
48+
"new_state": {
49+
"config": {
50+
"catalog_name": "main",
51+
"name": "myschema_[UNIQUE_NAME]"
52+
}
53+
}
54+
}
55+
}
56+
}

‎acceptance/bundle/resources/grants/registered_models/out.plan1.terraform.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"plan": {
3+
"resources.registered_models.my_registered_model": {
4+
"action": "create"
5+
},
6+
"resources.schemas.my_schema": {
7+
"action": "create"
8+
}
9+
}
10+
}

‎acceptance/bundle/resources/grants/registered_models/out.test.toml‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/resources/grants/registered_models/output.txt‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
2+
>>> [CLI] bundle debug plan
3+
4+
>>> print_requests.py --get //permissions
5+
6+
>>> [CLI] bundle deploy
7+
Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
8+
Deploying resources...
9+
Updating deployment state...
10+
Deployment complete!
11+
12+
>>> print_requests.py //permissions
13+
14+
>>> [CLI] grants get function main.myschema_[UNIQUE_NAME].mymodel
15+
{
16+
"privilege_assignments": [
17+
{
18+
"principal": "[email protected]",
19+
"privileges": [
20+
"APPLY_TAG"
21+
]
22+
}
23+
]
24+
}
25+
26+
>>> [CLI] bundle destroy --auto-approve
27+
The following resources will be deleted:
28+
delete registered_model my_registered_model
29+
delete schema my_schema
30+
31+
This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
32+
delete schema my_schema
33+
34+
All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default
35+
36+
Deleting files...
37+
Destroy complete!
38+
39+
>>> print_requests.py //permissions

0 commit comments

Comments
 (0)