Skip to content

Commit eb2a2f7

Browse files
authored
direct: when deleting resources, treat 403 as 404 (#3931)
## Changes During "bundle destroy" or "bundle deploy" with resource deleted, 403 errors will result in warning rather than hard error. This does not affect recreate, which still results in hard error. ## Why If users don't have permissions to a resource for whatever reason, they need to unbind it in order to make their bundle usable or destroyable. This automatically unbinds. We also saw that jobs service maintains permissions for deleted jobs, so even if job does not exist, deleting it still results in 403 error. Aborting "bundle destroy" in this case does not seem helpful. ## Tests Existing integration test added in #3922
1 parent 59c609e commit eb2a2f7

File tree

11 files changed

+21
-86
lines changed

11 files changed

+21
-86
lines changed

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy1.direct.txt renamed to acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.direct.txt

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,12 @@
11

2-
>>> musterr as-test-sp [CLI] bundle destroy --auto-approve
2+
>>> errcode as-test-sp [CLI] bundle destroy --auto-approve
33
Warn: cannot read resources.jobs.foo id="[NUMID]": User [UUID] does not have View or Admin or Manage Run or Owner permissions on job [NUMID]
44
Warn: cannot read resources.jobs.foo.permissions id="/jobs/[NUMID]": [UUID] does not have Manage permissions on Job with ID: ElasticJobId([NUMID]). Please contact the owner or an administrator for access.
55
The following resources will be deleted:
66
delete job foo
77

88
All files and directories at the following location will be deleted: /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default
99

10-
Error: cannot delete resources.jobs.foo: deleting id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID] (403 PERMISSION_DENIED)
11-
12-
Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/delete
13-
HTTP Status: 403 Forbidden
14-
API error_code: PERMISSION_DENIED
15-
API message: User [UUID] does not have Admin or Owner permissions on job [NUMID]
16-
10+
Warn: Ignoring permission error when deleting resources.jobs.foo id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID]
11+
Deleting files...
12+
Destroy complete!

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy2.terraform.txt renamed to acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.terraform.txt

File renamed without changes.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy1.terraform.txt

Lines changed: 0 additions & 12 deletions
This file was deleted.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy2.direct.txt

Lines changed: 0 additions & 17 deletions
This file was deleted.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/script

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,8 @@ job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
1515

1616
trace $CLI permissions set jobs $job_id --json @take_ownership.json > /dev/null
1717

18-
trace musterr as-test-sp $CLI bundle destroy --auto-approve &> out.destroy1.$DATABRICKS_BUNDLE_ENGINE.txt
19-
2018
trace $CLI jobs delete $job_id
2119
trace musterr $CLI jobs get $job_id
2220

2321
# This shows that even if job is deleted, you still get permission error when trying to delete it.
24-
trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy2.$DATABRICKS_BUNDLE_ENGINE.txt
22+
trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy2.direct.txt renamed to acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.direct.txt

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,6 @@ The following resources will be deleted:
66

77
All files and directories at the following location will be deleted: /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default
88

9-
Error: cannot delete resources.jobs.foo: deleting id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID] (403 PERMISSION_DENIED)
10-
11-
Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/delete
12-
HTTP Status: 403 Forbidden
13-
API error_code: PERMISSION_DENIED
14-
API message: User [UUID] does not have Admin or Owner permissions on job [NUMID]
15-
16-
17-
Exit code: 1
9+
Warn: Ignoring permission error when deleting resources.jobs.foo id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID]
10+
Deleting files...
11+
Destroy complete!

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy2.terraform.txt renamed to acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.terraform.txt

File renamed without changes.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy1.direct.txt

Lines changed: 0 additions & 15 deletions
This file was deleted.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy1.terraform.txt

Lines changed: 0 additions & 12 deletions
This file was deleted.

acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/script

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,8 @@ job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
1515

1616
trace $CLI permissions set jobs $job_id --json @take_ownership.json > /dev/null
1717

18-
trace musterr as-test-sp $CLI bundle destroy --auto-approve &> out.destroy1.$DATABRICKS_BUNDLE_ENGINE.txt
19-
2018
trace $CLI jobs delete $job_id
2119
trace musterr $CLI jobs get $job_id
2220

2321
# This shows that even if job is deleted, you still get permission error when trying to delete it.
24-
trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy2.$DATABRICKS_BUNDLE_ENGINE.txt
22+
trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt

0 commit comments

Comments
 (0)