Fixed bundle deploy to not update permissions for unbound resources by andrewnester · Pull Request #3642 · databricks/cli

andrewnester · 2025-09-22T14:25:07Z

Changes

Fixed bundle deploy to not update permissions for unbound resources

Why

The original issue occurred because we hadn't removed the permissions section for the corresponding resources from the TF state. and therefore, permissions were continued to be managed by TF and, as a result, cleared out.

Tests

Added an acceptance test

andrewnester · 2025-09-22T14:26:46Z

 	}

-	s.Jobs[jobId] = jobs.Job{JobId: jobId, Settings: &jobSettings}
+	s.Jobs[jobId] = jobs.Job{JobId: jobId, Settings: &jobSettings, CreatorUserName: TestUser.UserName}


CreatorUserName field is used by TF to check if the resource exists or not. CreatorUserName should be non-empty for the resource to be considered as "exists"
https://github.com/databricks/terraform-provider-databricks/blob/main/permissions/permission_definitions.go#L108

Useful context, please include as a comment to persist it.

eng-dev-ecosystem-bot · 2025-09-22T14:47:53Z

Run: 17972827773

	Env	✅pass	🙈skip
✅	aws linux	312	530
✅	aws windows	313	529
✅	aws-ucws linux	425	427
✅	aws-ucws windows	426	426
✅	azure linux	312	529
✅	azure windows	313	528
✅	azure-ucws linux	425	426
✅	azure-ucws windows	426	425
✅	gcp linux	311	531
✅	gcp windows	312	530

shreyas-goenka

This PR fixes the issue for all resource types right? Can we fix that in the PR title?

pietern · 2025-09-24T09:31:55Z

 	}

-	s.Jobs[jobId] = jobs.Job{JobId: jobId, Settings: &jobSettings}
+	s.Jobs[jobId] = jobs.Job{JobId: jobId, Settings: &jobSettings, CreatorUserName: TestUser.UserName}


Useful context, please include as a comment to persist it.

pietern

Can you confirm if the acceptance test fails if unbind doesn't remove the permissions from the state? The permissions for the first and second resources are identical, and the resource key in the state is identical as well.

pietern · 2025-09-24T09:51:57Z

 	Monitors map[string]catalog.MonitorInfo
 	Apps map[string]apps.App
 	Schemas map[string]catalog.SchemaInfo
+	SchemasGrants map[string][]catalog.PrivilegeAssignment


Nit: should also be singular, SchemaGrants, as in "grants for a schema".

andrewnester · 2025-09-24T11:20:25Z

@pietern yes, I wrote the acceptance test with this failure first and confirmed that removing the fix makes the test fail

=== NAME TestAccept/bundle/deployment/unbind/permissions
acceptance_test.go:803: Diff:
--- bundle/deployment/unbind/permissions/output.txt
+++ /var/folders/nt/xjv68qzs45319w4k36dhpylc0000gp/T/TestAcceptbundledeploymentunbindpermissions1723835858/001/output.txt
@@ -29,15 +29,6 @@
=== Permissions should be the same as before unbind
>>> [CLI] jobs get-permissions [NUMID] --output json
-{
- "all_permissions": [
- {
- "inherited": false,
- "permission_level": "CAN_MANAGE"
- }
- ],
- "group_name": "users"
-}

 === Grants should be the same as before unbind
>>> [CLI] grants get schema main.test-schema-[UNIQUE_NAME] --output json
-{
- "principal": "account users",
- "privileges": [
- "CREATE_VOLUME",
- "SELECT"
- ]
-}
+jq: error (at <stdin>:1): Cannot iterate over null (null)

## Release v0.270.0 ### Notable Changes * Add 'databricks bundle plan' command. This command shows the deployment plan for the current bundle configuration without making any changes. ([#3530](#3530)) ### Bundles * Add 'databricks bundle plan' command ([#3530](#3530)) * Add new Lakeflow Pipelines support for bundle generate ([#3568](#3568)) * Fix bundle deploy to not update permissions or grants for unbound resources ([#3642](#3642)) * Introduce new bundle variable: `${workspace.current_user.domain_friendly_name}` ([#3623](#3623)) * Improve the output of bundle run when bundle is not deployed ([#3652](#3652))

…3642) ## Changes Fixed bundle deploy to not update permissions for unbound resources ## Why The original issue occurred because we hadn't removed the permissions section for the corresponding resources from the TF state. and therefore, permissions were continued to be managed by TF and, as a result, cleared out. ## Tests Added an acceptance test

## Release v0.270.0 ### Notable Changes * Add 'databricks bundle plan' command. This command shows the deployment plan for the current bundle configuration without making any changes. ([#3530](#3530)) ### Bundles * Add 'databricks bundle plan' command ([#3530](#3530)) * Add new Lakeflow Pipelines support for bundle generate ([#3568](#3568)) * Fix bundle deploy to not update permissions or grants for unbound resources ([#3642](#3642)) * Introduce new bundle variable: `${workspace.current_user.domain_friendly_name}` ([#3623](#3623)) * Improve the output of bundle run when bundle is not deployed ([#3652](#3652))

Fixed bundle deploy to not update permissions for unbound jobs
ba78878

andrewnester requested review from anton-107, denik, pietern and shreyas-goenka as code owners September 22, 2025 14:25

andrewnester temporarily deployed to test-trigger-is September 22, 2025 14:25 — with GitHub Actions Inactive

andrewnester commented Sep 22, 2025
View reviewed changes

fix lint
a52e122

andrewnester temporarily deployed to test-trigger-is September 22, 2025 14:34 — with GitHub Actions Inactive

shreyas-goenka reviewed Sep 23, 2025
View reviewed changes

Comment threadacceptance/bundle/deployment/unbind/permissions/output.txt
Comment threadacceptance/bundle/deployment/unbind/permissions/test.toml Outdated
Comment threadbundle/deploy/terraform/unbind.go Outdated

andrewnester changed the title ~~Fixed bundle deploy to not update permissions for unbound jobs~~Fixed bundle deploy to not update permissions for unbound resourcesSep 23, 2025

run on cloud
a2f9235

andrewnester temporarily deployed to test-trigger-is September 23, 2025 12:10 — with GitHub Actions Inactive

do not change grants as well
b8d4fcf

andrewnester temporarily deployed to test-trigger-is September 23, 2025 13:24 — with GitHub Actions Inactive

andrewnester requested a review from shreyas-goenka September 23, 2025 13:25

fix lint and test
08bf120

andrewnester temporarily deployed to test-trigger-is September 23, 2025 13:54 — with GitHub Actions Inactive

fixed out.test.toml
11acdcc

andrewnester temporarily deployed to test-trigger-is September 23, 2025 14:22 — with GitHub Actions Inactive

use unique path
c04d29b

andrewnester temporarily deployed to test-trigger-is September 23, 2025 15:11 — with GitHub Actions Inactive

andrewnesterand others added 2 commits September 24, 2025 11:06

changelog
1851e47

Merge branch 'main' into fix/unbind-permissions
fc57794

andrewnester temporarily deployed to test-trigger-is September 24, 2025 09:08 — with GitHub Actions Inactive

pietern reviewed Sep 24, 2025
View reviewed changes

fixes
cde762d

andrewnester temporarily deployed to test-trigger-is September 24, 2025 09:42 — with GitHub Actions Inactive

andrewnester requested a review from pietern September 24, 2025 09:42

pietern approved these changes Sep 24, 2025
View reviewed changes

andrewnester added this pull request to the merge queue Sep 24, 2025

Merged via the queue into main with commit 4291bccSep 24, 2025
13 checks passed

andrewnester deleted the fix/unbind-permissions branch September 24, 2025 11:37

github-actionsBot mentioned this pull request Jan 3, 2026
chore(nix): update flake.lock (act, actionlint, awscli2 +25 more) i9wa4/dotfiles#79
Closed

Uh oh!

Conversation

andrewnester commented Sep 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

Tests

Uh oh!

andrewnesterSep 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pieternSep 24, 2025

Choose a reason for hiding this comment

Uh oh!

eng-dev-ecosystem-bot commented Sep 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shreyas-goenka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pieternSep 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pietern left a comment

Choose a reason for hiding this comment

Uh oh!

pieternSep 24, 2025

Choose a reason for hiding this comment

Uh oh!

andrewnester commented Sep 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

andrewnester commented Sep 22, 2025•
edited
Loading

andrewnesterSep 22, 2025•
edited
Loading

eng-dev-ecosystem-bot commented Sep 22, 2025•
edited
Loading