Show actionable errors for collaborative deployment scenarios by lennartkats-db · Pull Request #1386 · databricks/cli

lennartkats-db · 2024-04-22T07:42:10Z

Changes

This adds diagnostics for collaborative (production) deployment scenarios, including:

Bob deploys a bundle that is normally deployed by Alice, but this fails because Bob can't write to /Users/Alice/.bundle.
Charlie deploys a bundle that is normally deployed by Alice, but this fails because he can't create a new pipeline where Alice would be the owner.
Alice deploys a bundle where she didn't list herself as one of the CAN_MANAGE users in permissions. That can work, but is probably a mistake.

Tests

Unit tests, manual testing.

codecov-commenter · 2024-06-02T12:55:44Z

Codecov Report

Attention: Patch coverage is 75.56818% with 43 lines in your changes are missing coverage. Please review.

Project coverage is 53.75%. Comparing base (e22dd8a) to head (0b9feab).
Report is 125 commits behind head on main.

Files	Patch %	Lines
bundle/permissions/permission_diagnostics.go	87.60%	11 Missing and 4 partials ⚠️
libs/filer/workspace_files_client.go	0.00%	14 Missing ⚠️
bundle/config/mutator/run_as.go	81.81%	6 Missing ⚠️
bundle/deploy/terraform/apply.go	0.00%	4 Missing ⚠️
libs/filer/filer.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #1386 +/- ##
==========================================
+ Coverage 52.25% 53.75% +1.50% 
==========================================
Files 317 352 +35 Lines 18004 20410 +2406 ==========================================
+ Hits 9408 10972 +1564 - Misses 7903 8636 +733 - Partials 693 802 +109

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

lennartkats-db · 2024-07-11T13:37:04Z

@pietern could you take another look?

pietern · 2024-07-15T07:21:10Z

+
+	assistance := "For assistance, contact the owners of this project."
+	if len(managersSlice) > 0 {
+ assistance = fmt.Sprintf("For assistance, users or groups with appropriate permissions may include: %s.", strings.Join(managersSlice, ", "))


pietern · 2024-07-15T07:22:56Z

+}
+
+func ReportPermissionDenied(ctx context.Context, b *bundle.Bundle, path string) diag.Diagnostics {
+	log.Errorf(ctx, "Failed to update %v", path)


Ping. If this is not the case, please include a comment stating why this log statement shouldn't be removed.

pietern · 2024-07-15T07:41:46Z

@shreyas-goenka Can you take a pass as this as well?

shreyas-goenka · 2024-07-22T09:54:15Z

Missed the ping, taking a look.

shreyas-goenka

Does this work end to end? Can Bob collaborate on a DAB deployed by Alice if he has CAN_MANAGE?

I recall there being some validation on the Terraform provider side that would fail even if Bob has CAN_MANAGE permissions set.

lennartkats-db · 2024-09-09T07:42:17Z

@pietern Updated the PR, processing all the new comments. I'd really like to get this merged.

This was working a bit better before 26c3b42

pietern · 2024-09-23T09:56:12Z

+	if otherManagers.Size() > 0 {
+ assistance = fmt.Sprintf(
+ "For assistance, users or groups with appropriate permissions may include: %s.",
+ strings.Join(otherManagers.Values(), ", "),


This is not sorted and is the cause of the test assertion failure in the latest test run.

Good find, fixed!

pietern · 2024-10-10T11:18:20Z

I'll submit a separate PR to remove the remaining IS_OWNER.

## Changes Leftover from #1386. ## Tests All tests pass (indicating it really wasn't used).

CLI: * Added JSON input validation for CLI commands ([#1771](#1771)). Bundles: * Support Git worktrees for `sync` ([#1831](#1831)). * Add `bundle summary` to display URLs for deployed resources ([#1731](#1731)). * Added a warning when incorrect permissions used for `/Workspace/Shared` bundle root ([#1821](#1821)). * Show actionable errors for collaborative deployment scenarios ([#1386](#1386)). * Fix path to repository-wide exclude file ([#1837](#1837)). * Fixed typo in converting cluster permissions ([#1826](#1826)). * Ignore metastore permission error during template generation ([#1819](#1819)). * Handle normalization of `dyn.KindTime` into an any type ([#1836](#1836)). * Added support for pip options in environment dependencies ([#1842](#1842)). * Fix race condition when restarting continuous jobs ([#1849](#1849)). * Fix pipeline in default-python template not working for certain workspaces ([#1854](#1854)). * Add "output" flag to the bundle sync command ([#1853](#1853)). Internal: * Move utility functions dealing with IAM to libs/iamutil ([#1820](#1820)). * Remove unused `IS_OWNER` constant ([#1823](#1823)). * Assert SDK version is consistent in the CLI generation process ([#1814](#1814)). * Fixed unmarshalling json input into `interface{}` type ([#1832](#1832)). * Fix `TestAccFsMkdirWhenFileExistsAtPath` in isolated Azure environments ([#1833](#1833)). * Add behavioral tests for examples from the YAML spec ([#1835](#1835)). * Remove Terraform conversion function that's no longer used ([#1840](#1840)). * Encode assumptions about the dashboards API in a test ([#1839](#1839)). * Add script to make testing of code on branches easier ([#1844](#1844)). API Changes: * Added `databricks disable-legacy-dbfs` command group. OpenAPI commit cf9c61453990df0f9453670f2fe68e1b128647a2 (2024-10-14) Dependency updates: * Upgrade TF provider to 1.54.0 ([#1852](#1852)). * Bump github.com/databricks/databricks-sdk-go from 0.48.0 to 0.49.0 ([#1843](#1843)).

CLI: * Added JSON input validation for CLI commands ([#1771](#1771)). * Support Git worktrees for `sync` ([#1831](#1831)). Bundles: * Add `bundle summary` to display URLs for deployed resources ([#1731](#1731)). * Added a warning when incorrect permissions used for `/Workspace/Shared` bundle root ([#1821](#1821)). * Show actionable errors for collaborative deployment scenarios ([#1386](#1386)). * Fix path to repository-wide exclude file ([#1837](#1837)). * Fixed typo in converting cluster permissions ([#1826](#1826)). * Ignore metastore permission error during template generation ([#1819](#1819)). * Handle normalization of `dyn.KindTime` into an any type ([#1836](#1836)). * Added support for pip options in environment dependencies ([#1842](#1842)). * Fix race condition when restarting continuous jobs ([#1849](#1849)). * Fix pipeline in default-python template not working for certain workspaces ([#1854](#1854)). * Add "output" flag to the bundle sync command ([#1853](#1853)). Internal: * Move utility functions dealing with IAM to libs/iamutil ([#1820](#1820)). * Remove unused `IS_OWNER` constant ([#1823](#1823)). * Assert SDK version is consistent in the CLI generation process ([#1814](#1814)). * Fixed unmarshalling json input into `interface{}` type ([#1832](#1832)). * Fix `TestAccFsMkdirWhenFileExistsAtPath` in isolated Azure environments ([#1833](#1833)). * Add behavioral tests for examples from the YAML spec ([#1835](#1835)). * Remove Terraform conversion function that's no longer used ([#1840](#1840)). * Encode assumptions about the dashboards API in a test ([#1839](#1839)). * Add script to make testing of code on branches easier ([#1844](#1844)). API Changes: * Added `databricks disable-legacy-dbfs` command group. OpenAPI commit cf9c61453990df0f9453670f2fe68e1b128647a2 (2024-10-14) Dependency updates: * Upgrade TF provider to 1.54.0 ([#1852](#1852)). * Bump github.com/databricks/databricks-sdk-go from 0.48.0 to 0.49.0 ([#1843](#1843)).

## Changes This updates the templates to include a `permissions` section. Having a permissions section is a best practice, is helpful to understand the notion of permissions, and helps diagnose permission errors (#1386). This is a cherry-pick from #1387. This change was verified to work both in dev and prod. Existing unit tests validate the validity of the templates in these modes.

## Changes This adds diagnostics for collaborative (production) deployment scenarios, including: - Bob deploys a bundle that is normally deployed by Alice, but this fails because Bob can't write to `/Users/Alice/.bundle`. - Charlie deploys a bundle that is normally deployed by Alice, but this fails because he can't create a new pipeline where Alice would be the owner. - Alice deploys a bundle where she didn't list herself as one of the CAN_MANAGE users in permissions. That can work, but is probably a mistake. ## Tests Unit tests, manual testing.

## Changes Leftover from #1386. ## Tests All tests pass (indicating it really wasn't used).

CLI: * Added JSON input validation for CLI commands ([#1771](#1771)). * Support Git worktrees for `sync` ([#1831](#1831)). Bundles: * Add `bundle summary` to display URLs for deployed resources ([#1731](#1731)). * Added a warning when incorrect permissions used for `/Workspace/Shared` bundle root ([#1821](#1821)). * Show actionable errors for collaborative deployment scenarios ([#1386](#1386)). * Fix path to repository-wide exclude file ([#1837](#1837)). * Fixed typo in converting cluster permissions ([#1826](#1826)). * Ignore metastore permission error during template generation ([#1819](#1819)). * Handle normalization of `dyn.KindTime` into an any type ([#1836](#1836)). * Added support for pip options in environment dependencies ([#1842](#1842)). * Fix race condition when restarting continuous jobs ([#1849](#1849)). * Fix pipeline in default-python template not working for certain workspaces ([#1854](#1854)). * Add "output" flag to the bundle sync command ([#1853](#1853)). Internal: * Move utility functions dealing with IAM to libs/iamutil ([#1820](#1820)). * Remove unused `IS_OWNER` constant ([#1823](#1823)). * Assert SDK version is consistent in the CLI generation process ([#1814](#1814)). * Fixed unmarshalling json input into `interface{}` type ([#1832](#1832)). * Fix `TestAccFsMkdirWhenFileExistsAtPath` in isolated Azure environments ([#1833](#1833)). * Add behavioral tests for examples from the YAML spec ([#1835](#1835)). * Remove Terraform conversion function that's no longer used ([#1840](#1840)). * Encode assumptions about the dashboards API in a test ([#1839](#1839)). * Add script to make testing of code on branches easier ([#1844](#1844)). API Changes: * Added `databricks disable-legacy-dbfs` command group. OpenAPI commit cf9c61453990df0f9453670f2fe68e1b128647a2 (2024-10-14) Dependency updates: * Upgrade TF provider to 1.54.0 ([#1852](#1852)). * Bump github.com/databricks/databricks-sdk-go from 0.48.0 to 0.49.0 ([#1843](#1843)).

Diagnostics for collaborative deployment scenarios
2cea265

lennartkats-db mentioned this pull request Apr 22, 2024
Support IS_OWNER as a top-level permission #1387
Closed

lennartkats-db added 4 commits April 25, 2024 09:33

Merge remote-tracking branch 'databricks/main' into cp-better-errors
7cdfc8d

Merge remote-tracking branch 'databricks/main' into cp-better-errors
fc07725

Add missing file
4aa38b8

Add Lakehouse monitoring
c46ecde

lennartkats-db force-pushed the cp-better-errors branch from dc33b28 to c46ecdeCompare June 2, 2024 11:22

Cleanup
0b9feab

lennartkats-db changed the title ~~[WIP] Show better errors for collaborative deployment scenarios~~Show better errors for collaborative deployment scenariosJun 3, 2024

lennartkats-db changed the title ~~Show better errors for collaborative deployment scenarios~~Show actionable errors for collaborative deployment scenariosJun 3, 2024

lennartkats-db requested review from andrewnester and pietern June 3, 2024 07:03

lennartkats-db commented Jun 21, 2024
View reviewed changes

Comment threadbundle/deploy/lock/acquire.go Outdated

pietern reviewed Jun 24, 2024
View reviewed changes

lennartkats-db force-pushed the cp-better-errors branch 2 times, most recently from 8d26485 to 16b80eaCompare July 6, 2024 19:37

Cleanup
7fff4bc

lennartkats-db force-pushed the cp-better-errors branch from 16b80ea to 7fff4bcCompare July 6, 2024 19:40

Refactor
c222ba3

lennartkats-db requested a review from pietern July 6, 2024 19:48

lennartkats-db force-pushed the cp-better-errors branch from 737f02f to 3c20decCompare July 6, 2024 20:02

Merge remote-tracking branch 'databricks/main' into cp-better-errors
b384b36

lennartkats-db force-pushed the cp-better-errors branch from 3c20dec to b384b36Compare July 8, 2024 06:51

pietern reviewed Jul 15, 2024
View reviewed changes

pietern requested a review from shreyas-goenka July 15, 2024 07:41

shreyas-goenka reviewed Jul 22, 2024
View reviewed changes

lennartkats-db added 3 commits September 9, 2024 09:30

Cleanup
4c06a34

Extract function to separate module
e533dd0

Add comment
3b33d8c

lennartkats-db requested a review from pietern September 9, 2024 07:42

Rework error now that we can no longer detect permission errors
bfe36fc
This was working a bit better before 26c3b42

pietern reviewed Sep 13, 2024
View reviewed changes

Comment threadbundle/permissions/permission_diagnostics.go Outdated
Comment threadbundle/permissions/permission_diagnostics_test.go Outdated
Comment threadbundle/permissions/permission_report.go

Process PR feedback
bde209c

lennartkats-db force-pushed the cp-better-errors branch from fbf3c9d to bde209cCompare September 22, 2024 14:15

Show email addresses for regular users
a39457e

lennartkats-db requested a review from pietern September 23, 2024 06:41

Merge remote-tracking branch 'databricks/main' into cp-better-errors
c850cfb

pietern reviewed Sep 23, 2024
View reviewed changes

Make sure list of managers is deterministic
763bcd5

lennartkats-db requested a review from pietern October 5, 2024 04:09

pietern approved these changes Oct 10, 2024
View reviewed changes

pietern added this pull request to the merge queue Oct 10, 2024

Merged via the queue into databricks:main with commit e885794Oct 10, 2024

This was referenced Oct 10, 2024
Move utility functions dealing with IAM to libs/iamutil #1820
Merged
Remove unused IS_OWNER constant #1823
Merged

github-merge-queueBot pushed a commit that referenced this pull request Oct 10, 2024
Remove unusedIS_OWNERconstant (#1823)
b9085de
## Changes Leftover from #1386. ## Tests All tests pass (indicating it really wasn't used).

andrewnester mentioned this pull request Oct 23, 2024
[Release] Release v0.231.0 #1856
Merged

denik pushed a commit that referenced this pull request May 20, 2026
Remove unusedIS_OWNERconstant (#1823)
44c2412
## Changes Leftover from #1386. ## Tests All tests pass (indicating it really wasn't used).

Uh oh!

Conversation

lennartkats-db commented Apr 22, 2024

Changes

Tests

Uh oh!

codecov-commenter commented Jun 2, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lennartkats-db commented Jul 11, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pieternJul 15, 2024

Choose a reason for hiding this comment

Uh oh!

pieternJul 15, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pietern commented Jul 15, 2024

Uh oh!

shreyas-goenka commented Jul 22, 2024

Uh oh!

shreyas-goenka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lennartkats-db commented Sep 9, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pieternSep 23, 2024

Choose a reason for hiding this comment

Uh oh!

lennartkats-dbOct 5, 2024

Choose a reason for hiding this comment

Uh oh!

pietern commented Oct 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Jun 2, 2024•
edited
Loading