Skip to content

Commit a4ab082

Browse files
shreyas-goenkashreyas-goenka
authored
direct: Add support for secret scopes (#3886)
## Changes Adds direct deployment support for secret scopes. ### Mock Server Fix Fixed `libs/testserver/secret_scopes.go` to automatically grant MANAGE permission to the creator when a scope is created, matching real Databricks behavior. ## Tests New local and cloud acceptance tests.
1 parent 15e6744 commit a4ab082

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1719
-245
lines changed

‎acceptance/bundle/refschema/out.fields.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3480,6 +3480,33 @@ resources.schemas.*.grants.grants[*].principal string ALL
34803480
resources.schemas.*.grants.grants[*].privileges []catalog.Privilege ALL
34813481
resources.schemas.*.grants.grants[*].privileges[*] catalog.Privilege ALL
34823482
resources.schemas.*.grants.securable_type string ALL
3483+
resources.secret_scopes.*.backend_azure_keyvault *workspace.AzureKeyVaultSecretScopeMetadata STATE
3484+
resources.secret_scopes.*.backend_azure_keyvault.dns_name string STATE
3485+
resources.secret_scopes.*.backend_azure_keyvault.resource_id string STATE
3486+
resources.secret_scopes.*.backend_type workspace.ScopeBackendType INPUT REMOTE
3487+
resources.secret_scopes.*.id string INPUT
3488+
resources.secret_scopes.*.initial_manage_principal string STATE
3489+
resources.secret_scopes.*.keyvault_metadata *workspace.AzureKeyVaultSecretScopeMetadata INPUT REMOTE
3490+
resources.secret_scopes.*.keyvault_metadata.dns_name string INPUT REMOTE
3491+
resources.secret_scopes.*.keyvault_metadata.resource_id string INPUT REMOTE
3492+
resources.secret_scopes.*.lifecycle resources.Lifecycle INPUT
3493+
resources.secret_scopes.*.lifecycle.prevent_destroy bool INPUT
3494+
resources.secret_scopes.*.modified_status string INPUT
3495+
resources.secret_scopes.*.name string INPUT REMOTE
3496+
resources.secret_scopes.*.permissions []resources.SecretScopePermission INPUT
3497+
resources.secret_scopes.*.permissions[*] resources.SecretScopePermission INPUT
3498+
resources.secret_scopes.*.permissions[*].group_name string INPUT
3499+
resources.secret_scopes.*.permissions[*].level resources.SecretScopePermissionLevel INPUT
3500+
resources.secret_scopes.*.permissions[*].service_principal_name string INPUT
3501+
resources.secret_scopes.*.permissions[*].user_name string INPUT
3502+
resources.secret_scopes.*.scope string STATE
3503+
resources.secret_scopes.*.scope_backend_type workspace.ScopeBackendType STATE
3504+
resources.secret_scopes.*.url string INPUT
3505+
resources.secret_scopes.*.permissions.acls []workspace.AclItem ALL
3506+
resources.secret_scopes.*.permissions.acls[*] workspace.AclItem ALL
3507+
resources.secret_scopes.*.permissions.acls[*].permission workspace.AclPermission ALL
3508+
resources.secret_scopes.*.permissions.acls[*].principal string ALL
3509+
resources.secret_scopes.*.permissions.scope_name string ALL
34833510
resources.sql_warehouses.*.auto_stop_mins int ALL
34843511
resources.sql_warehouses.*.channel *sql.Channel ALL
34853512
resources.sql_warehouses.*.channel.dbsql_version string ALL

‎acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/resources/secret_scopes/backend-type/output.txt‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,16 @@ Deploying resources...
55
Updating deployment state...
66
Deployment complete!
77

8-
>>> jq -s .[] | select(.path=="/api/2.0/secrets/scopes/create") | .body out.requests.txt
8+
>>> print_requests.py //secrets
99
{
10-
"backend_azure_keyvault": {
11-
"dns_name": "my_azure_keyvault_dns_name",
12-
"resource_id": "my_azure_keyvault_id"
13-
},
14-
"scope": "test-secrets-azure-backend",
15-
"scope_backend_type": "AZURE_KEYVAULT"
10+
"method": "POST",
11+
"path": "/api/2.0/secrets/scopes/create",
12+
"body": {
13+
"backend_azure_keyvault": {
14+
"dns_name": "my_azure_keyvault_dns_name",
15+
"resource_id": "my_azure_keyvault_id"
16+
},
17+
"scope": "test-secrets-azure-backend",
18+
"scope_backend_type": "AZURE_KEYVAULT"
19+
}
1620
}

‎acceptance/bundle/resources/secret_scopes/backend-type/script‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
trace $CLI bundle deploy
2-
trace jq -s '.[] | select(.path=="/api/2.0/secrets/scopes/create") | .body' out.requests.txt
3-
rm out.requests.txt
2+
trace print_requests.py //secrets

acceptance/bundle/resources/secret_scopes/databricks.yml.tmpl renamed to acceptance/bundle/resources/secret_scopes/basic/databricks.yml.tmpl

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,11 @@
11
bundle:
2-
name: deploy-secret-scope-test-$UNIQUE_NAME
2+
name: secret-scope-basic-$UNIQUE_NAME
33

44
resources:
55
secret_scopes:
6-
secret_scope1:
6+
my_scope:
77
name: $SECRET_SCOPE_NAME
88
backend_type: "DATABRICKS"
99
permissions:
10-
- user_name: admins
10+
- user_name: [email protected]
1111
level: WRITE
12-
- user_name: users
13-
level: READ

‎acceptance/bundle/resources/secret_scopes/basic/out.plan1.direct.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"plan": {
3+
"resources.secret_scopes.my_scope": {
4+
"action": "create",
5+
"new_state": {
6+
"value": {
7+
"scope": "test-scope-[UNIQUE_NAME]-1",
8+
"scope_backend_type": "DATABRICKS"
9+
}
10+
}
11+
},
12+
"resources.secret_scopes.my_scope.permissions": {
13+
"depends_on": [
14+
{
15+
"node": "resources.secret_scopes.my_scope",
16+
"label": "${resources.secret_scopes.my_scope.name}"
17+
}
18+
],
19+
"action": "create",
20+
"new_state": {
21+
"value": {
22+
"scope_name": "",
23+
"acls": [
24+
{
25+
"permission": "MANAGE",
26+
"principal": "[USERNAME]"
27+
},
28+
{
29+
"permission": "WRITE",
30+
"principal": "[email protected]"
31+
}
32+
]
33+
},
34+
"vars": {
35+
"scope_name": "${resources.secret_scopes.my_scope.name}"
36+
}
37+
}
38+
}
39+
}
40+
}

‎acceptance/bundle/resources/secret_scopes/basic/out.plan1.terraform.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"plan": {
3+
"resources.secret_scopes.my_scope": {
4+
"action": "create"
5+
}
6+
}
7+
}

‎acceptance/bundle/resources/secret_scopes/basic/out.plan2.direct.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"plan": {
3+
"resources.secret_scopes.my_scope": {
4+
"action": "recreate",
5+
"new_state": {
6+
"value": {
7+
"scope": "test-scope-[UNIQUE_NAME]-2",
8+
"scope_backend_type": "DATABRICKS"
9+
}
10+
},
11+
"changes": {
12+
"local": {
13+
"scope": {
14+
"action": "recreate",
15+
"old": "test-scope-[UNIQUE_NAME]-1",
16+
"new": "test-scope-[UNIQUE_NAME]-2"
17+
}
18+
}
19+
}
20+
},
21+
"resources.secret_scopes.my_scope.permissions": {
22+
"depends_on": [
23+
{
24+
"node": "resources.secret_scopes.my_scope",
25+
"label": "${resources.secret_scopes.my_scope.name}"
26+
}
27+
],
28+
"action": "update_id",
29+
"new_state": {
30+
"value": {
31+
"scope_name": "",
32+
"acls": [
33+
{
34+
"permission": "MANAGE",
35+
"principal": "[USERNAME]"
36+
},
37+
{
38+
"permission": "WRITE",
39+
"principal": "[email protected]"
40+
}
41+
]
42+
},
43+
"vars": {
44+
"scope_name": "${resources.secret_scopes.my_scope.name}"
45+
}
46+
},
47+
"remote_state": {
48+
"scope_name": "test-scope-[UNIQUE_NAME]-1",
49+
"acls": [
50+
{
51+
"permission": "WRITE",
52+
"principal": "[email protected]"
53+
},
54+
{
55+
"permission": "MANAGE",
56+
"principal": "[USERNAME]"
57+
}
58+
]
59+
},
60+
"changes": {
61+
"local": {
62+
"scope_name": {
63+
"action": "update_id",
64+
"old": "test-scope-[UNIQUE_NAME]-1",
65+
"new": ""
66+
}
67+
}
68+
}
69+
}
70+
}
71+
}

‎acceptance/bundle/resources/secret_scopes/basic/out.plan2.terraform.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"plan": {
3+
"resources.secret_scopes.my_scope": {
4+
"action": "recreate"
5+
}
6+
}
7+
}

‎acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.direct.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"plan": {
3+
"resources.secret_scopes.my_scope": {
4+
"action": "skip",
5+
"remote_state": {
6+
"backend_type": "DATABRICKS",
7+
"name": "test-scope-[UNIQUE_NAME]-2"
8+
}
9+
},
10+
"resources.secret_scopes.my_scope.permissions": {
11+
"depends_on": [
12+
{
13+
"node": "resources.secret_scopes.my_scope",
14+
"label": "${resources.secret_scopes.my_scope.name}"
15+
}
16+
],
17+
"action": "skip",
18+
"remote_state": {
19+
"scope_name": "test-scope-[UNIQUE_NAME]-2",
20+
"acls": [
21+
{
22+
"permission": "WRITE",
23+
"principal": "[email protected]"
24+
},
25+
{
26+
"permission": "MANAGE",
27+
"principal": "[USERNAME]"
28+
}
29+
]
30+
}
31+
}
32+
}
33+
}

0 commit comments

Comments
 (0)