Skip to content

Commit a31bd0c

Browse files
nkvuongnkvuong
authored
refactor dac (#2713)
1 parent 02122e2 commit a31bd0c

File tree

6 files changed

+81
-84
lines changed

6 files changed

+81
-84
lines changed

‎catalog/resource_metastore_data_access.go‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,21 +22,6 @@ type GcpServiceAccountKey struct {
2222
PrivateKey string `json:"private_key" tf:"sensitive"`
2323
}
2424

25-
type DbGcpServiceAccount struct {
26-
Email string `json:"email,omitempty" tf:"computed"`
27-
}
28-
29-
type DataAccessConfiguration struct {
30-
ID string `json:"id,omitempty" tf:"computed"`
31-
Name string `json:"name"`
32-
ConfigurationType string `json:"configuration_type,omitempty" tf:"computed"`
33-
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
34-
Azure *catalog.AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
35-
AzMI *catalog.AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
36-
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
37-
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"group:access"`
38-
}
39-
4025
var alofCred = []string{"aws_iam_role", "azure_service_principal", "azure_managed_identity",
4126
"gcp_service_account_key", "databricks_gcp_service_account"}
4227

@@ -58,10 +43,15 @@ func adjustDataAccessSchema(m map[string]*schema.Schema) map[string]*schema.Sche
5843

5944
common.MustSchemaPath(m, "azure_managed_identity", "credential_id").Computed = true
6045

46+
m["force_destroy"] = &schema.Schema{
47+
Type: schema.TypeBool,
48+
Optional: true,
49+
}
50+
6151
return m
6252
}
6353

64-
var dacSchema = common.StructToSchema(DataAccessConfiguration{},
54+
var dacSchema = common.StructToSchema(StorageCredentialInfo{},
6555
func(m map[string]*schema.Schema) map[string]*schema.Schema {
6656
m["metastore_id"] = &schema.Schema{
6757
Type: schema.TypeString,
@@ -183,16 +173,21 @@ func ResourceMetastoreDataAccess() *schema.Resource {
183173
},
184174
Delete: func(ctx context.Context, d *schema.ResourceData, c *common.DatabricksClient) error {
185175
metastoreId, dacName, err := p.Unpack(d)
176+
force := d.Get("force_destroy").(bool)
186177
if err != nil {
187178
return err
188179
}
189180
return c.AccountOrWorkspaceRequest(func(acc *databricks.AccountClient) error {
190181
return acc.StorageCredentials.Delete(ctx, catalog.DeleteAccountStorageCredentialRequest{
191182
MetastoreId: metastoreId,
192183
Name: dacName,
184+
Force: force,
193185
})
194186
}, func(w *databricks.WorkspaceClient) error {
195-
return w.StorageCredentials.DeleteByName(ctx, dacName)
187+
return w.StorageCredentials.Delete(ctx, catalog.DeleteStorageCredentialRequest{
188+
Name: dacName,
189+
Force: force,
190+
})
196191
})
197192
},
198193
}.ToResource()

‎catalog/resource_metastore_data_access_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ func TestCreateDac(t *testing.T) {
1818
{
1919
Method: "POST",
2020
Resource: "/api/2.1/unity-catalog/storage-credentials",
21-
ExpectedRequest: DataAccessConfiguration{
21+
ExpectedRequest: catalog.CreateStorageCredential{
2222
Name: "bcd",
23-
Aws: &AwsIamRole{
24-
RoleARN: "def",
23+
AwsIamRole: &catalog.AwsIamRole{
24+
RoleArn: "def",
2525
},
2626
},
2727
Response: catalog.StorageCredentialInfo{
@@ -72,9 +72,9 @@ func TestCreateDacWithAzMI(t *testing.T) {
7272
{
7373
Method: "POST",
7474
Resource: "/api/2.1/unity-catalog/storage-credentials",
75-
ExpectedRequest: DataAccessConfiguration{
75+
ExpectedRequest: catalog.CreateStorageCredential{
7676
Name: "bcd",
77-
AzMI: &catalog.AzureManagedIdentity{
77+
AzureManagedIdentity: &catalog.AzureManagedIdentity{
7878
AccessConnectorId: "def",
7979
ManagedIdentityId: "/..../subscription",
8080
},

‎catalog/resource_storage_credential.go‎

Lines changed: 20 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ import (
1010
)
1111

1212
type StorageCredentialInfo struct {
13-
Name string `json:"name" tf:"force_new"`
14-
Owner string `json:"owner,omitempty" tf:"computed"`
15-
Comment string `json:"comment,omitempty"`
16-
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
17-
Azure *catalog.AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
18-
AzMI *catalog.AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
19-
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
20-
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"computed"`
21-
MetastoreID string `json:"metastore_id,omitempty" tf:"computed"`
22-
ReadOnly bool `json:"read_only,omitempty"`
13+
Name string `json:"name" tf:"force_new"`
14+
Owner string `json:"owner,omitempty" tf:"computed"`
15+
Comment string `json:"comment,omitempty"`
16+
Aws AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
17+
Azure *catalog.AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
18+
AzMI *catalog.AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
19+
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
20+
DBGcpSA *catalog.DatabricksGcpServiceAccountResponse `json:"databricks_gcp_service_account,omitempty" tf:"computed"`
21+
MetastoreID string `json:"metastore_id,omitempty" tf:"computed"`
22+
ReadOnly bool `json:"read_only,omitempty"`
2323
}
2424

2525
func removeGcpSaField(originalSchema map[string]*schema.Schema) map[string]*schema.Schema {
@@ -32,20 +32,17 @@ func removeGcpSaField(originalSchema map[string]*schema.Schema) map[string]*sche
3232
return tmpSchema
3333
}
3434

35+
var storageCredentialSchema = common.StructToSchema(StorageCredentialInfo{},
36+
func(m map[string]*schema.Schema) map[string]*schema.Schema {
37+
return adjustDataAccessSchema(m)
38+
})
39+
3540
func ResourceStorageCredential() *schema.Resource {
36-
s := common.StructToSchema(StorageCredentialInfo{},
37-
func(m map[string]*schema.Schema) map[string]*schema.Schema {
38-
m["force_destroy"] = &schema.Schema{
39-
Type: schema.TypeBool,
40-
Optional: true,
41-
}
42-
return adjustDataAccessSchema(m)
43-
})
4441
return common.Resource{
45-
Schema: s,
42+
Schema: storageCredentialSchema,
4643
Create: func(ctx context.Context, d *schema.ResourceData, c *common.DatabricksClient) error {
4744
metastoreId := d.Get("metastore_id").(string)
48-
tmpSchema := removeGcpSaField(s)
45+
tmpSchema := removeGcpSaField(storageCredentialSchema)
4946

5047
var create catalog.CreateStorageCredential
5148
var update catalog.UpdateStorageCredential
@@ -110,18 +107,18 @@ func ResourceStorageCredential() *schema.Resource {
110107
if err != nil {
111108
return err
112109
}
113-
return common.StructToData(storageCredential, s, d)
110+
return common.StructToData(storageCredential, storageCredentialSchema, d)
114111
}, func(w *databricks.WorkspaceClient) error {
115112
storageCredential, err := w.StorageCredentials.GetByName(ctx, d.Id())
116113
if err != nil {
117114
return err
118115
}
119-
return common.StructToData(storageCredential, s, d)
116+
return common.StructToData(storageCredential, storageCredentialSchema, d)
120117
})
121118
},
122119
Update: func(ctx context.Context, d *schema.ResourceData, c *common.DatabricksClient) error {
123120
var update catalog.UpdateStorageCredential
124-
common.DataToStructPointer(d, s, &update)
121+
common.DataToStructPointer(d, storageCredentialSchema, &update)
125122

126123
return c.AccountOrWorkspaceRequest(func(acc *databricks.AccountClient) error {
127124
_, err := acc.StorageCredentials.Update(ctx, catalog.AccountsUpdateStorageCredential{

‎catalog/resource_storage_credential_test.go‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ func TestCreateStorageCredentials(t *testing.T) {
1717
{
1818
Method: "POST",
1919
Resource: "/api/2.1/unity-catalog/storage-credentials",
20-
ExpectedRequest: StorageCredentialInfo{
20+
ExpectedRequest: catalog.CreateStorageCredential{
2121
Name: "a",
22-
Aws: &AwsIamRole{
23-
RoleARN: "def",
22+
AwsIamRole: &catalog.AwsIamRole{
23+
RoleArn: "def",
2424
},
2525
Comment: "c",
2626
},
@@ -58,10 +58,10 @@ func TestCreateStorageCredentialWithOwner(t *testing.T) {
5858
{
5959
Method: "POST",
6060
Resource: "/api/2.1/unity-catalog/storage-credentials",
61-
ExpectedRequest: StorageCredentialInfo{
61+
ExpectedRequest: catalog.CreateStorageCredential{
6262
Name: "a",
63-
Aws: &AwsIamRole{
64-
RoleARN: "def",
63+
AwsIamRole: &catalog.AwsIamRole{
64+
RoleArn: "def",
6565
},
6666
Comment: "c",
6767
},
@@ -72,10 +72,10 @@ func TestCreateStorageCredentialWithOwner(t *testing.T) {
7272
{
7373
Method: "PATCH",
7474
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
75-
ExpectedRequest: StorageCredentialInfo{
75+
ExpectedRequest: catalog.UpdateStorageCredential{
7676
Name: "a",
77-
Aws: &AwsIamRole{
78-
RoleARN: "def",
77+
AwsIamRole: &catalog.AwsIamRole{
78+
RoleArn: "def",
7979
},
8080
Comment: "c",
8181
Owner: "administrators",
@@ -116,10 +116,10 @@ func TestCreateStorageCredentialsReadOnly(t *testing.T) {
116116
{
117117
Method: "POST",
118118
Resource: "/api/2.1/unity-catalog/storage-credentials",
119-
ExpectedRequest: StorageCredentialInfo{
119+
ExpectedRequest: catalog.CreateStorageCredential{
120120
Name: "a",
121-
Aws: &AwsIamRole{
122-
RoleARN: "def",
121+
AwsIamRole: &catalog.AwsIamRole{
122+
RoleArn: "def",
123123
},
124124
Comment: "c",
125125
ReadOnly: true,
@@ -131,10 +131,10 @@ func TestCreateStorageCredentialsReadOnly(t *testing.T) {
131131
{
132132
Method: "PATCH",
133133
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
134-
ExpectedRequest: StorageCredentialInfo{
134+
ExpectedRequest: catalog.UpdateStorageCredential{
135135
Name: "a",
136-
Aws: &AwsIamRole{
137-
RoleARN: "def",
136+
AwsIamRole: &catalog.AwsIamRole{
137+
RoleArn: "def",
138138
},
139139
Comment: "c",
140140
ReadOnly: true,
@@ -175,23 +175,23 @@ func TestUpdateStorageCredentials(t *testing.T) {
175175
{
176176
Method: "PATCH",
177177
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
178-
ExpectedRequest: StorageCredentialInfo{
178+
ExpectedRequest: catalog.UpdateStorageCredential{
179179
Name: "a",
180-
Aws: &AwsIamRole{
181-
RoleARN: "CHANGED",
180+
AwsIamRole: &catalog.AwsIamRole{
181+
RoleArn: "CHANGED",
182182
},
183183
Comment: "c",
184184
},
185185
},
186186
{
187187
Method: "GET",
188188
Resource: "/api/2.1/unity-catalog/storage-credentials/a?",
189-
Response: StorageCredentialInfo{
189+
Response: catalog.StorageCredentialInfo{
190190
Name: "a",
191-
Aws: &AwsIamRole{
192-
RoleARN: "CHANGED",
191+
AwsIamRole: &catalog.AwsIamRole{
192+
RoleArn: "CHANGED",
193193
},
194-
MetastoreID: "d",
194+
MetastoreId: "d",
195195
Comment: "c",
196196
},
197197
},
@@ -219,9 +219,9 @@ func TestCreateStorageCredentialWithAzMI(t *testing.T) {
219219
{
220220
Method: "POST",
221221
Resource: "/api/2.1/unity-catalog/storage-credentials",
222-
ExpectedRequest: StorageCredentialInfo{
222+
ExpectedRequest: catalog.CreateStorageCredential{
223223
Name: "a",
224-
AzMI: &catalog.AzureManagedIdentity{
224+
AzureManagedIdentity: &catalog.AzureManagedIdentity{
225225
AccessConnectorId: "def",
226226
},
227227
Comment: "c",
@@ -233,9 +233,9 @@ func TestCreateStorageCredentialWithAzMI(t *testing.T) {
233233
{
234234
Method: "PATCH",
235235
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
236-
ExpectedRequest: StorageCredentialInfo{
236+
ExpectedRequest: catalog.UpdateStorageCredential{
237237
Name: "a",
238-
AzMI: &catalog.AzureManagedIdentity{
238+
AzureManagedIdentity: &catalog.AzureManagedIdentity{
239239
AccessConnectorId: "def",
240240
},
241241
Comment: "c",
@@ -274,10 +274,10 @@ func TestUpdateAzStorageCredentials(t *testing.T) {
274274
{
275275
Method: "PATCH",
276276
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
277-
ExpectedRequest: StorageCredentialInfo{
277+
ExpectedRequest: catalog.UpdateStorageCredential{
278278
Name: "a",
279279
Comment: "c",
280-
Azure: &catalog.AzureServicePrincipal{
280+
AzureServicePrincipal: &catalog.AzureServicePrincipal{
281281
DirectoryId: "CHANGED",
282282
ApplicationId: "CHANGED",
283283
ClientSecret: "CHANGED",
@@ -325,8 +325,8 @@ func TestCreateStorageCredentialWithDbGcpSA(t *testing.T) {
325325
Resource: "/api/2.1/unity-catalog/storage-credentials",
326326
ExpectedRequest: catalog.CreateStorageCredential{
327327
Name: "a",
328-
DatabricksGcpServiceAccount: struct{}{},
329328
Comment: "c",
329+
DatabricksGcpServiceAccount: struct{}{},
330330
},
331331
Response: catalog.StorageCredentialInfo{
332332
Name: "a",
@@ -338,7 +338,7 @@ func TestCreateStorageCredentialWithDbGcpSA(t *testing.T) {
338338
{
339339
Method: "PATCH",
340340
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
341-
ExpectedRequest: StorageCredentialInfo{
341+
ExpectedRequest: catalog.UpdateStorageCredential{
342342
Name: "a",
343343
Comment: "c",
344344
},
@@ -377,10 +377,10 @@ func TestUpdateAzStorageCredentialMI(t *testing.T) {
377377
{
378378
Method: "PATCH",
379379
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
380-
ExpectedRequest: StorageCredentialInfo{
380+
ExpectedRequest: catalog.UpdateStorageCredential{
381381
Name: "a",
382382
Comment: "c",
383-
AzMI: &catalog.AzureManagedIdentity{
383+
AzureManagedIdentity: &catalog.AzureManagedIdentity{
384384
AccessConnectorId: "CHANGED",
385385
},
386386
},

‎docs/resources/metastore_data_access.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ The following arguments are required:
5757

5858
* `name` - Name of Data Access Configuration, which must be unique within the [databricks_metastore](metastore.md). Change forces creation of a new resource.
5959
* `metastore_id` - Unique identifier of the parent Metastore
60+
* `owner` - (Optional) Username/groupname/sp application_id of the data access configuration owner.
61+
* `force_destroy` - (Optional) Delete the data access configuration regardless of its dependencies.
6062

6163
`aws_iam_role` optional configuration block for credential details for AWS:
6264

‎docs/resources/storage_credential.md‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ The following arguments are required:
7474
- `name` - Name of Storage Credentials, which must be unique within the [databricks_metastore](metastore.md). Change forces creation of a new resource.
7575
- `metastore_id` - (Required for account-level) Unique identifier of the parent Metastore
7676
- `owner` - (Optional) Username/groupname/sp application_id of the storage credential owner.
77+
- `force_destroy` - (Optional) Delete storage credential regardless of its dependencies.
7778

7879
`aws_iam_role` optional configuration block for credential details for AWS:
7980

@@ -82,24 +83,26 @@ The following arguments are required:
8283
`azure_managed_identity` optional configuration block for using managed identity as credential details for Azure (recommended over service principal):
8384

8485
- `access_connector_id` - The Resource ID of the Azure Databricks Access Connector resource, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Databricks/accessConnectors/connector-name`.
85-
* `managed_identity_id` - (Optional) The Resource ID of the Azure User Assigned Managed Identity associated with Azure Databricks Access Connector, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/user-managed-identity-name`.
8686

87-
`azure_service_principal` optional configuration block to use service principal as credential details for Azure:
88-
89-
- `directory_id` - The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application
90-
- `application_id` - The application ID of the application registration within the referenced AAD tenant
91-
- `client_secret` - The client secret generated for the above app ID in AAD. **This field is redacted on output**
87+
- `managed_identity_id` - (Optional) The Resource ID of the Azure User Assigned Managed Identity associated with Azure Databricks Access Connector, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/user-managed-identity-name`.
9288

9389
`databricks_gcp_service_account` optional configuration block for creating a Databricks-managed GCP Service Account:
9490

9591
- `email` (output only) - The email of the GCP service account created, to be granted access to relevant buckets.
92+
9693
- `read_only` - (Optional) Indicates whether the storage credential is only usable for read operations.
9794

95+
`azure_service_principal` optional configuration block to use service principal as credential details for Azure (Legacy):
96+
97+
- `directory_id` - The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application
98+
- `application_id` - The application ID of the application registration within the referenced AAD tenant
99+
- `client_secret` - The client secret generated for the above app ID in AAD. **This field is redacted on output**
100+
98101
## Attribute Reference
99102

100103
In addition to all arguments above, the following attributes are exported:
101104

102-
* `id` - ID of this storage credential - same as the `name`.
105+
- `id` - ID of this storage credential - same as the `name`.
103106

104107
## Import
105108

0 commit comments

Comments
 (0)