Support Databricks Workload Identity Federation for GitHub tokens #423
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
e72af31 to
c89cdb0
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
c89cdb0 to
11d23fd
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
11d23fd to
d2c0c40
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
commented
Mar 27, 2025
|
|
||
| public ClientCredentials build() { | ||
| Objects.requireNonNull(this.clientId, "clientId must be specified"); | ||
| Objects.requireNonNull(this.clientSecret, "clientSecret must be specified"); |
Contributor
Author
There was a problem hiding this comment.
Not required for WIF/OIDC
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
d2c0c40 to
8c7bf80
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
8c7bf80 to
09796a2
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
changed the title
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
requested changes
Apr 7, 2025
databricks-sdk-java/src/main/java/com/databricks/sdk/core/oauth/ClientCredentials.java
Show resolved
Hide resolved
...s-sdk-java/src/main/java/com/databricks/sdk/core/oauth/DatabricksWifCredentialsProvider.java
Outdated
Show resolved
Hide resolved
databricks-sdk-java/src/main/java/com/databricks/sdk/core/oauth/GitHubOidcTokenSupplier.java
Outdated
Show resolved
Hide resolved
hectorcast-db
force-pushed
the
hectorcast-db/databricks-wif
branch
from
0f167b6 to
fc39a52
Compare
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
hectorcast-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
|
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
renaudhartert-db
approved these changes
Apr 29, 2025
deco-sdk-tagging bot
added a commit
that referenced
this pull request
Apr 30, 2025
## Release v0.48.0 ### New Features and Improvements * Introduce support for Databricks Workload Identity Federation in GitHub workflows ([423](#423)). See README.md for instructions. * [Breaking] Users running their workflows in GitHub Actions, which use Cloud native authentication and also have a `DATABRICKS_CLIENT_ID` and `DATABRICKS_HOST` environment variables set may see their authentication start failing due to the order in which the SDK tries different authentication methods. ### API Changes * Added `workspaceClient.alertsV2()` service. * Added `updateNccAzurePrivateEndpointRulePublic()` method for `accountClient.networkConnectivity()` service. * Added `createdAt`, `createdBy` and `metastoreId` fields for `com.databricks.sdk.service.catalog.SetArtifactAllowlist`. * [Breaking] Added `networkConnectivityConfig` field for `com.databricks.sdk.service.settings.CreateNetworkConnectivityConfigRequest`. * [Breaking] Added `privateEndpointRule` field for `com.databricks.sdk.service.settings.CreatePrivateEndpointRuleRequest`. * Added `domainNames` field for `com.databricks.sdk.service.settings.NccAzurePrivateEndpointRule`. * Added `autoResolveDisplayName` field for `com.databricks.sdk.service.sql.CreateAlertRequest`. * Added `autoResolveDisplayName` field for `com.databricks.sdk.service.sql.CreateQueryRequest`. * Added `CREATE_CLEAN_ROOM`, `EXECUTE_CLEAN_ROOM_TASK` and `MODIFY_CLEAN_ROOM` enum values for `com.databricks.sdk.service.catalog.Privilege`. * Added `DNS_RESOLUTION_ERROR` and `GCP_DENIED_BY_ORG_POLICY` enum values for `com.databricks.sdk.service.compute.TerminationReasonCode`. * Added `EXPIRED` enum value for `com.databricks.sdk.service.settings.NccAzurePrivateEndpointRuleConnectionState`. * [Breaking] Changed `createNetworkConnectivityConfiguration()` and `createPrivateEndpointRule()` methods for `accountClient.networkConnectivity()` service with new required argument order. * [Breaking] Changed `workloadSize` field for `com.databricks.sdk.service.serving.ServedModelInput` to type `String` class. * [Breaking] Changed `groupId` field for `com.databricks.sdk.service.settings.NccAzurePrivateEndpointRule` to type `String` class. * [Breaking] Changed `targetServices` field for `com.databricks.sdk.service.settings.NccAzureServiceEndpointRule` to type `com.databricks.sdk.service.settings.EgressResourceTypeList` class. * [Breaking] Removed `name` and `region` fields for `com.databricks.sdk.service.settings.CreateNetworkConnectivityConfigRequest`. * [Breaking] Removed `groupId` and `resourceId` fields for `com.databricks.sdk.service.settings.CreatePrivateEndpointRuleRequest`. * [Breaking] Removed `LARGE`, `MEDIUM` and `SMALL` enum values for `com.databricks.sdk.service.serving.ServedModelInputWorkloadSize`. * [Breaking] Removed `BLOB`, `DFS`, `MYSQL_SERVER` and `SQL_SERVER` enum values for `com.databricks.sdk.service.settings.NccAzurePrivateEndpointRuleGroupId`.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are proposed in this pull request?
This PR adds support for Databricks Workload Identity Federation using GitHub tokens. This allows users to use WIF from their GitHub Workflows and authenticate their workloads without long lived secrets.
This new credentials strategy is added to the DefaultCredentialsStrategy after the other Databricks Credentials Strategy and before cloud specific authentication methods.
WIF credentials uses a subset of configuration values of other Databricks authentication methods. By being added after them it ensures that WIF is not used when other Databricks authentication methods are configured.
WIF uses the Databricks client id, which is not used by cloud specific authentication methods. Therefore, it will not be used when cloud specific authentication methods are configured.
How is this tested?
Added tests.