Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fix] Tolerate databricks_permissions resources for SQL warehouses with /warehouses/... IDs #4158

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Fix] Tolerate databricks_permissions resources for SQL warehouses with /warehouses/... IDs #4158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 22 additions & 4 deletions internal/acceptance/permissions_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -617,7 +617,16 @@ func TestAccPermissions_SqlWarehouses(t *testing.T) {
resource "databricks_sql_endpoint" "this" {
name = "{var.STICKY_RANDOM}"
cluster_size = "2X-Small"
tags {
custom_tags {
key = "Owner"
value = "eng-dev-ecosystem-team_at_databricks.com"
}
}
Comment on lines +620 to +625
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test wasn't running locally before I added this. I'm not sure how it ran before. Our account requires the Owner tag, so this allows the test to run.

}`
ctx := context.Background()
w := databricks.Must(databricks.NewWorkspaceClient())
var warehouseId string
WorkspaceLevel(t, Step{
Template: sqlWarehouseTemplate + makePermissionsTestStage("sql_endpoint_id", "databricks_sql_endpoint.this.id", groupPermissions("CAN_USE")),
}, Step{
Expand All @@ -638,15 +647,24 @@ func TestAccPermissions_SqlWarehouses(t *testing.T) {
}, Step{
Template: sqlWarehouseTemplate,
Check: func(s *terraform.State) error {
w := databricks.Must(databricks.NewWorkspaceClient())
id := s.RootModule().Resources["databricks_sql_endpoint.this"].Primary.ID
warehouse, err := w.Warehouses.GetById(context.Background(), id)
warehouseId = s.RootModule().Resources["databricks_sql_endpoint.this"].Primary.ID
warehouse, err := w.Warehouses.GetById(ctx, warehouseId)
assert.NoError(t, err)
permissions, err := w.Permissions.GetByRequestObjectTypeAndRequestObjectId(context.Background(), "warehouses", id)
permissions, err := w.Permissions.GetByRequestObjectTypeAndRequestObjectId(context.Background(), "warehouses", warehouseId)
assert.NoError(t, err)
assertContainsPermission(t, permissions, currentPrincipalType(t), warehouse.CreatorName, iam.PermissionLevelIsOwner)
return nil
},
}, Step{
// To test import, a new permission must be added to the warehouse, as it is not possible to import databricks_permissions
// for a warehouse that has the default permissions (i.e. current user has IS_OWNER and admins have CAN_MANAGE).
Template: sqlWarehouseTemplate + makePermissionsTestStage("sql_endpoint_id", "databricks_sql_endpoint.this.id", groupPermissions("CAN_USE")),
}, Step{
Template: sqlWarehouseTemplate + makePermissionsTestStage("sql_endpoint_id", "databricks_sql_endpoint.this.id", groupPermissions("CAN_USE")),
// Verify that we can use "/warehouses/<ID>" instead of "/sql/warehouses/<ID>"
ResourceName: "databricks_permissions.this",
ImportState: true,
ImportStateIdFunc: func(s *terraform.State) (string, error) { return "/warehouses/" + warehouseId, nil },
})
}

Expand Down
5 changes: 5 additions & 0 deletions permissions/permission_definitions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,6 +558,11 @@ func allResourcePermissions() []resourcePermissions {
field: "sql_endpoint_id",
objectType: "warehouses",
requestObjectType: "sql/warehouses",
// ISSUE-4143: some older warehouse permissions have an ID that starts with "/warehouses" instead of "/sql/warehouses"
// Because no idRetriever is defined, any warehouse permissions resources will be created with the "/sql/warehouses" prefix.
idMatcher: func(id string) bool {
return strings.HasPrefix(id, "/sql/warehouses/") || strings.HasPrefix(id, "/warehouses/")
},
allowedPermissionLevels: map[string]permissionLevelOptions{
"CAN_USE": {isManagementPermission: false},
"CAN_MANAGE": {isManagementPermission: true},
Expand Down
Loading