Skip to content

Commit 5c9ecc9

Browse files
tinglin-dbalexottmgyucht
authored
Add expected_workspace_status in databricks_mws_workspaces to support least-privileged workspaces (#5019)
## Changes In GCP, workspace creation triggers the creation of a service account in the customer's project with heightened permissions. This is necessary for classic workspaces for setting up resources in the customer's project, like virtual networks, storage buckets, etc. Security-conscious customers require that such service accounts never have heightened permissions in order for them to make global statements about the security of their GCP projects. Such workspaces are called "least-privileged workspaces." To support least privileged workspaces on GCP, we add a new field `expected_workspace_status`, which will be translated to `workspace_state` in the API request. Users should create a workspace by setting this value first to `"PROVISIONING"`. After applying their template, they can make any needed changes, such as granting the minimal permissions to this service account in their project. Finally, they can remove the `expected_workspace_status` field or set it explicitly to `"RUNNING"`. ## Tests <!-- How is this tested? Please see the checklist below and also describe any other relevant tests --> Added a unit test `TestResourceWorkspaceCreateGcpWithExpectedProvisioning` and an integration test `TestMwsAccGcpWorkspacesWithExpectedProvisioning` - [x] `make test` run locally - [x] using Go SDK - [x] has entry in `NEXT_CHANGELOG.md` file Tested E2E Locally ``` Terraform will perform the following actions: # databricks_mws_workspaces.this will be created + resource "databricks_mws_workspaces" "this" { + account_id = (sensitive value) + cloud = (known after apply) + creation_time = (known after apply) + effective_compute_mode = (known after apply) + expected_workspace_status = "PROVISIONING" + gcp_workspace_sa = (known after apply) + id = (known after apply) + is_no_public_ip_enabled = true + location = "us-central1" + pricing_tier = (known after apply) + workspace_id = (known after apply) + workspace_name = "tlin-classic-test-tf-1" + workspace_status = (known after apply) + workspace_status_message = (known after apply) + workspace_url = (known after apply) + cloud_resource_container { + gcp { + project_id = "databricks-cal-dev-testing" } } } Plan: 1 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes databricks_mws_workspaces.this: Creating... databricks_mws_workspaces.this: Creation complete after 2s [id=9fcbb245-7c44-4522-9870-e38324104cf8/2181571221551671] Apply complete! Resources: 1 added, 0 changed, 0 destroyed. # databricks_mws_workspaces.this will be updated in-place ~ resource "databricks_mws_workspaces" "this" { - expected_workspace_status = "PROVISIONING" -> null id = "9fcbb245-7c44-4522-9870-e38324104cf8/2181571221551671" + network_id = "a124db3a-0928-4698-97eb-70e751c87934" # (14 unchanged attributes hidden) # (3 unchanged blocks hidden) } Plan: 0 to add, 1 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes databricks_mws_workspaces.this: Modifying... [id=9fcbb245-7c44-4522-9870-e38324104cf8/2181571221551671] databricks_mws_workspaces.this: Modifications complete after 6s [id=9fcbb245-7c44-4522-9870-e38324104cf8/2181571221551671] Apply complete! Resources: 0 added, 1 changed, 0 destroyed. ``` --------- Co-authored-by: Alex Ott <[email protected]> Co-authored-by: Miles Yucht <[email protected]>
1 parent 6e0878b commit 5c9ecc9

File tree

7 files changed

+485
-31
lines changed

7 files changed

+485
-31
lines changed

‎NEXT_CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
### New Features and Improvements
88

9+
* Added `expected_workspace_status` to `databricks_mws_workspaces` to support creating workspaces in provisioning status ([#5019](https://github.com/databricks/terraform-provider-databricks/pull/5019))
10+
911
### Bug Fixes
1012

1113
### Documentation

‎docs/resources/mws_workspaces.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,7 @@ The following arguments are available:
309309
* `custom_tags` - (Optional / AWS only) - The custom tags key-value pairing that is attached to this workspace. These tags will be applied to clusters automatically in addition to any `default_tags` or `custom_tags` on a cluster level. Please note it can take up to an hour for custom_tags to be set due to scheduling on Control Plane. After custom tags are applied, they can be modified however they can never be completely removed.
310310
* `pricing_tier` - (Optional) - The pricing tier of the workspace.
311311
* `compute_mode` - (Optional) - The compute mode for the workspace. When unset, a classic workspace is created, and both `credentials_id` and `storage_configuration_id` must be specified. When set to `SERVERLESS`, the resulting workspace is a serverless workspace, and `credentials_id` and `storage_configuration_id` must not be set. The only allowed value for this is `SERVERLESS`. Changing this field requires recreation of the workspace.
312+
* `expected_workspace_status` - (Optional / GCP only / Private Preview) - The expected status of the workspace. When unset, it defaults to `RUNNING`. When set to `PROVISIONING`, workspace provisioning will pause and not enter `RUNNING` status. The only allowed values for this is `RUNNING` and `PROVISIONING`.
312313

313314
~> Databricks strongly recommends using OAuth instead of PATs for user account client authentication and authorization due to the improved security
314315

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,13 @@ require (
1919
github.com/stretchr/testify v1.11.1
2020
github.com/zclconf/go-cty v1.17.0
2121
golang.org/x/exp v0.0.0-20250911091902-df9299821621
22+
google.golang.org/api v0.252.0
2223
)
2324

2425
require (
25-
cloud.google.com/go/auth v0.16.5 // indirect
26+
cloud.google.com/go/auth v0.17.0 // indirect
2627
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
27-
cloud.google.com/go/compute/metadata v0.8.4 // indirect
28+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
2829
github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
2930
github.com/ProtonMail/go-crypto v1.1.6 // indirect
3031
github.com/agext/levenshtein v1.2.3 // indirect
@@ -92,11 +93,10 @@ require (
9293
golang.org/x/text v0.29.0 // indirect
9394
golang.org/x/time v0.13.0 // indirect
9495
golang.org/x/tools v0.37.0 // indirect
95-
google.golang.org/api v0.249.0 // indirect
9696
google.golang.org/appengine v1.6.8 // indirect
97-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
97+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
9898
google.golang.org/grpc v1.75.1 // indirect
99-
google.golang.org/protobuf v1.36.9 // indirect
99+
google.golang.org/protobuf v1.36.10 // indirect
100100
gopkg.in/ini.v1 v1.67.0 // indirect
101101
gopkg.in/yaml.v3 v3.0.1 // indirect
102102
gotest.tools/gotestsum v1.12.1 // indirect

‎go.sum‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
2-
cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
1+
cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
2+
cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
33
cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
44
cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
5-
cloud.google.com/go/compute/metadata v0.8.4 h1:oXMa1VMQBVCyewMIOm3WQsnVd9FbKBtm8reqWRaXnHQ=
6-
cloud.google.com/go/compute/metadata v0.8.4/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
5+
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
6+
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
77
dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
88
dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
99
github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs=
@@ -283,19 +283,23 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
283283
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
284284
gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
285285
gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
286-
google.golang.org/api v0.249.0 h1:0VrsWAKzIZi058aeq+I86uIXbNhm9GxSHpbmZ92a38w=
287-
google.golang.org/api v0.249.0/go.mod h1:dGk9qyI0UYPwO/cjt2q06LG/EhUpwZGdAbYF14wHHrQ=
286+
google.golang.org/api v0.252.0 h1:xfKJeAJaMwb8OC9fesr369rjciQ704AjU/psjkKURSI=
287+
google.golang.org/api v0.252.0/go.mod h1:dnHOv81x5RAmumZ7BWLShB/u7JZNeyalImxHmtTHxqw=
288288
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
289289
google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
290290
google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
291-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 h1:/OQuEa4YWtDt7uQWHd3q3sUMb+QOLQUg1xa8CEsRv5w=
292-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
291+
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
292+
google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
293+
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU=
294+
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA=
295+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
296+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
293297
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
294298
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
295299
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
296300
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
297-
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
298-
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
301+
google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
302+
google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
299303
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
300304
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
301305
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

0 commit comments

Comments
 (0)