Skip to content

Commit b14d81c

Browse files
anton-107shreyas-goenka
anton-107
and
shreyas-goenka
authored
Add secret scopes support in assets bundling (#2744)
## Changes <!-- Brief summary of your changes that is easy to understand --> 1. Defined `SecretScope` as a new resource 1. Added `SecretScope` into supported resource types 2. Generated docs and schema ## Why <!-- Why are these changes needed? Provide the context that the reviewer might be missing. For example, were there any decisions behind the change that are not reflected in the code itself? --> This change allows users to define secret scopes as part of their assets bundle: ``` ... resources: ... secret_scopes: my_secret_scope: name: my_secret_scope ... ``` Setting custom ACL is supported via `permissions` field: ``` resources: secret_scopes: my_secret_scope: name: my_secret_scope permissions: - user_name: admins level: WRITE - user_name: users level: READ ``` ## Tests <!-- How have you tested the changes? --> 1. Added acceptance tests for secret scope deployments and binding 4. Added unit tests <!-- If your PR needs to be included in the release notes for next release, add a separate entry in NEXT_CHANGELOG.md as part of your PR. --> --------- Co-authored-by: shreyas-goenka <88374338+shreyas-goenka@users.noreply.github.com>
1 parent 2be5d8f commit b14d81c

File tree

31 files changed

+1338
-491
lines changed

31 files changed

+1338
-491
lines changed

‎NEXT_CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,6 @@
1515
* Fixed normalising requirements file path in dependencies section ([#2861](https://github.com/databricks/cli/pull/2861))
1616
* Fix default-python template not to add environments when serverless=yes and include\_python=no ([#2866](https://github.com/databricks/cli/pull/2866))
1717
* Fixed handling of Unicode characters in Python support ([#2873](https://github.com/databricks/cli/pull/2873))
18+
* Added support for secret scopes in DABs ([#2744](https://github.com/databricks/cli/pull/2744))
1819

1920
### API Changes

‎acceptance/bundle/deploy/secret-scope/backend-type/databricks.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
bundle:
2+
name: deploy-secret-scope-azure-backend
3+
4+
resources:
5+
secret_scopes:
6+
secret_scope_azure:
7+
name: test-secrets-azure-backend
8+
backend_type: "AZURE_KEYVAULT"
9+
keyvault_metadata:
10+
resource_id: my_azure_keyvault_id
11+
dns_name: my_azure_keyvault_dns_name

‎acceptance/bundle/deploy/secret-scope/backend-type/output.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
>>> [CLI] bundle deploy
3+
Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-secret-scope-azure-backend/default/files...
4+
Deploying resources...
5+
Updating deployment state...
6+
Deployment complete!
7+
8+
>>> jq -s .[] | select(.path=="/api/2.0/secrets/scopes/create") | .body out.requests.txt
9+
{
10+
"backend_azure_keyvault": {
11+
"dns_name": "my_azure_keyvault_dns_name",
12+
"resource_id": "my_azure_keyvault_id"
13+
},
14+
"scope": "test-secrets-azure-backend",
15+
"scope_backend_type": "AZURE_KEYVAULT"
16+
}

‎acceptance/bundle/deploy/secret-scope/backend-type/script‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
trace $CLI bundle deploy
2+
trace jq -s '.[] | select(.path=="/api/2.0/secrets/scopes/create") | .body' out.requests.txt
3+
rm out.requests.txt

‎acceptance/bundle/deploy/secret-scope/backend-type/test.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Local = true
2+
Cloud = false
3+
4+
RecordRequests = true

‎acceptance/bundle/deploy/secret-scope/databricks.yml.tmpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
bundle:
2+
name: deploy-secret-scope-test-$UNIQUE_NAME
3+
4+
resources:
5+
secret_scopes:
6+
secret_scope1:
7+
name: $SECRET_SCOPE_NAME
8+
backend_type: "DATABRICKS"
9+
permissions:
10+
- user_name: admins
11+
level: WRITE
12+
- user_name: users
13+
level: READ

‎acceptance/bundle/deploy/secret-scope/output.txt‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
2+
>>> [CLI] bundle deploy
3+
Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-secret-scope-test-[UNIQUE_NAME]/default/files...
4+
Deploying resources...
5+
Updating deployment state...
6+
Deployment complete!
7+
8+
>>> [CLI] bundle summary --output json
9+
{
10+
"backend_type": "DATABRICKS",
11+
"modified_status": "created",
12+
"name": "my-secrets-[UUID]",
13+
"permissions": [
14+
{
15+
"level": "WRITE",
16+
"user_name": "admins"
17+
},
18+
{
19+
"level": "READ",
20+
"user_name": "users"
21+
}
22+
]
23+
}
24+
25+
>>> [CLI] secrets list-scopes -o json
26+
{
27+
"backend_type": "DATABRICKS",
28+
"name": "my-secrets-[UUID]"
29+
}
30+
31+
>>> [CLI] secrets list-acls my-secrets-[UUID]
32+
{"permission":"MANAGE","principal":"[USERNAME]"}
33+
{"permission":"READ","principal":"users"}
34+
{"permission":"WRITE","principal":"admins"}
35+
36+
>>> [CLI] secrets put-secret my-secrets-[UUID] my-key --string-value my-secret-value
37+
38+
>>> [CLI] secrets get-secret my-secrets-[UUID] my-key
39+
{
40+
"key":"my-key",
41+
"value":"bXktc2VjcmV0LXZhbHVl"
42+
}
43+
44+
>>> [CLI] bundle destroy --auto-approve
45+
The following resources will be deleted:
46+
delete secret_acl secret_acl_secret_scope1_0
47+
delete secret_acl secret_acl_secret_scope1_1
48+
delete secret_scope secret_scope1
49+
50+
All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-secret-scope-test-[UNIQUE_NAME]/default
51+
52+
Deleting files...
53+
Destroy complete!

‎acceptance/bundle/deploy/secret-scope/permissions/databricks.yml.tmpl‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
bundle:
2+
name: deploy-secret-scope-with-permissions
3+
4+
resources:
5+
secret_scopes:
6+
secret_scope_azure:
7+
name: test-secrets-permissions
8+
9+
permissions:
10+
- user_name: $CURRENT_USER_NAME
11+
level: CAN_MANAGE
12+
- group_name: users
13+
level: CAN_VIEW
14+
- group_name: admins
15+
level: CAN_MANAGE

‎acceptance/bundle/deploy/secret-scope/permissions/output.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
>>> [CLI] bundle deploy
3+
Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-secret-scope-with-permissions/default/files...
4+
Deploying resources...
5+
Updating deployment state...
6+
Deployment complete!
7+
8+
>>> jq -s -c .[] | select(.path=="/api/2.0/secrets/acls/put") | .body out.requests.txt
9+
{"permission":"MANAGE","principal":"admins","scope":"test-secrets-permissions"}
10+
{"permission":"READ","principal":"users","scope":"test-secrets-permissions"}

‎acceptance/bundle/deploy/secret-scope/permissions/script‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
envsubst < databricks.yml.tmpl > databricks.yml
2+
trace $CLI bundle deploy #--log-level TRACE
3+
trace jq -s -c '.[] | select(.path=="/api/2.0/secrets/acls/put") | .body' out.requests.txt | sort
4+
rm out.requests.txt

0 commit comments

Comments
 (0)