Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 215
direct: Add support for secret scopes#3886
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Uh oh!
There was an error while loading. Please reload this page.
Merged
Changes from all commits
Commits
Show all changes
62 commits
Select commit
Hold shift + click to select a range
bbd0a4b
[WIP] direct: secret scopes
shreyas-goenka bf86538
wip fix for the permissions issue. still needs some more work
shreyas-goenka df29329
test stableized
shreyas-goenka b16328a
merge
shreyas-goenka 0da6f68
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka a4ac665
update tests
shreyas-goenka b1e7a45
update tests
shreyas-goenka ba52db8
update-scope
shreyas-goenka 559ca0a
merge
shreyas-goenka df9c9f5
better acl implementation
shreyas-goenka 37e7e22
best tests
shreyas-goenka 7ad9d05
-
shreyas-goenka 0b8aca6
undo key sort';
shreyas-goenka cdec26a
-
shreyas-goenka 50af43a
more robust check
shreyas-goenka 1cc1283
cleanup todos
shreyas-goenka ae2be0f
cleanup
shreyas-goenka bf90ffd
lint
shreyas-goenka d8565d3
update ref schema
shreyas-goenka 9797954
make test all work
shreyas-goenka 07c9b0d
fix TestFieldTriggers
shreyas-goenka def2450
merge
shreyas-goenka 700dd4a
Only add current user manage permissions if missing
shreyas-goenka 46a1ea6
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka b23e59e
fix build
shreyas-goenka 9a98a75
add todo
shreyas-goenka e6342b3
update resources
shreyas-goenka fc53266
add collapse for scope permissions
shreyas-goenka b43a123
add test for permissions collaspe
shreyas-goenka ed28144
fix tests
shreyas-goenka 6a8d847
fix test
shreyas-goenka 83eb2e9
merge
shreyas-goenka 855f24a
-
shreyas-goenka b930e94
update permissions
shreyas-goenka 52e1b49
update test
shreyas-goenka 1522887
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka d21d1af
fix basic tesT
shreyas-goenka eb71e4c
merge test
shreyas-goenka 26f29e6
fix tests
shreyas-goenka 229a17d
disabw the basic test
shreyas-goenka bfbc695
fix out.test.toml
shreyas-goenka 9c3e809
fix direct test
shreyas-goenka 364d6da
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka 18bd490
update after main
shreyas-goenka 50bd6cc
do not print json plan to prevent out of order issues
shreyas-goenka ebdb11c
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka b7c5d35
disable tests on gcp
shreyas-goenka e083ed5
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka 2e33133
fix unit test
shreyas-goenka f29fb8e
fix tests
shreyas-goenka c307c2a
fix permissions test
shreyas-goenka aa8e185
merge
shreyas-goenka af7277b
remove unused arg
shreyas-goenka 4d2fbd3
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka 17bd12c
do not return scopeName in setAcls
shreyas-goenka 39e0c66
merge
shreyas-goenka d7a207b
run tests locally as well
shreyas-goenka db9236b
verify and fix persistent drift
shreyas-goenka 836eb82
update basic test
shreyas-goenka 83a5689
Merge remote-tracking branch 'origin' into direct-secret-scope
shreyas-goenka a789294
run cloud tests again
shreyas-goenka 7e1c917
stop parallelism
shreyas-goenka File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2 acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
18 changes: 11 additions & 7 deletions
18 acceptance/bundle/resources/secret_scopes/backend-type/output.txt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,2 @@ | ||
| trace $CLI bundle deploy | ||
| trace jq -s '.[] | select(.path=="/api/2.0/secrets/scopes/create") | .body' out.requests.txt | ||
| rm out.requests.txt | ||
| trace print_requests.py //secrets |
8 changes: 3 additions & 5 deletions
8 ...sources/secret_scopes/databricks.yml.tmpl → ...s/secret_scopes/basic/databricks.yml.tmpl
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,11 @@ | ||
| bundle: | ||
| name: deploy-secret-scope-test-$UNIQUE_NAME | ||
| name: secret-scope-basic-$UNIQUE_NAME | ||
| resources: | ||
| secret_scopes: | ||
| secret_scope1: | ||
| my_scope: | ||
| name: $SECRET_SCOPE_NAME | ||
| backend_type: "DATABRICKS" | ||
| permissions: | ||
| - user_name: admins | ||
| - user_name: deco-test-user@databricks.com | ||
| level: WRITE | ||
| - user_name: users | ||
| level: READ |
40 changes: 40 additions & 0 deletions
40 acceptance/bundle/resources/secret_scopes/basic/out.plan1.direct.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "create", | ||
| "new_state": { | ||
| "value": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-1", | ||
| "scope_backend_type": "DATABRICKS" | ||
| } | ||
| } | ||
| }, | ||
| "resources.secret_scopes.my_scope.permissions": { | ||
| "depends_on": [ | ||
| { | ||
| "node": "resources.secret_scopes.my_scope", | ||
| "label": "${resources.secret_scopes.my_scope.name}" | ||
| } | ||
| ], | ||
| "action": "create", | ||
| "new_state": { | ||
| "value": { | ||
| "scope_name": "", | ||
| "acls": [ | ||
| { | ||
| "permission": "MANAGE", | ||
| "principal": "[USERNAME]" | ||
| }, | ||
| { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com" | ||
| } | ||
| ] | ||
| }, | ||
| "vars": { | ||
| "scope_name": "${resources.secret_scopes.my_scope.name}" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
7 changes: 7 additions & 0 deletions
7 acceptance/bundle/resources/secret_scopes/basic/out.plan1.terraform.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "create" | ||
| } | ||
| } | ||
| } |
71 changes: 71 additions & 0 deletions
71 acceptance/bundle/resources/secret_scopes/basic/out.plan2.direct.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "recreate", | ||
| "new_state": { | ||
| "value": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-2", | ||
| "scope_backend_type": "DATABRICKS" | ||
| } | ||
| }, | ||
| "changes": { | ||
| "local": { | ||
| "scope": { | ||
| "action": "recreate", | ||
| "old": "test-scope-[UNIQUE_NAME]-1", | ||
| "new": "test-scope-[UNIQUE_NAME]-2" | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "resources.secret_scopes.my_scope.permissions": { | ||
| "depends_on": [ | ||
| { | ||
| "node": "resources.secret_scopes.my_scope", | ||
| "label": "${resources.secret_scopes.my_scope.name}" | ||
| } | ||
| ], | ||
| "action": "update_id", | ||
| "new_state": { | ||
| "value": { | ||
| "scope_name": "", | ||
| "acls": [ | ||
| { | ||
| "permission": "MANAGE", | ||
| "principal": "[USERNAME]" | ||
| }, | ||
| { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com" | ||
| } | ||
| ] | ||
| }, | ||
| "vars": { | ||
| "scope_name": "${resources.secret_scopes.my_scope.name}" | ||
| } | ||
| }, | ||
| "remote_state": { | ||
| "scope_name": "test-scope-[UNIQUE_NAME]-1", | ||
| "acls": [ | ||
| { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com" | ||
| }, | ||
| { | ||
| "permission": "MANAGE", | ||
| "principal": "[USERNAME]" | ||
| } | ||
| ] | ||
| }, | ||
| "changes": { | ||
| "local": { | ||
| "scope_name": { | ||
| "action": "update_id", | ||
| "old": "test-scope-[UNIQUE_NAME]-1", | ||
| "new": "" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
7 changes: 7 additions & 0 deletions
7 acceptance/bundle/resources/secret_scopes/basic/out.plan2.terraform.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "recreate" | ||
| } | ||
| } | ||
| } |
33 changes: 33 additions & 0 deletions
33 acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.direct.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "skip", | ||
| "remote_state": { | ||
| "backend_type": "DATABRICKS", | ||
| "name": "test-scope-[UNIQUE_NAME]-2" | ||
| } | ||
| }, | ||
| "resources.secret_scopes.my_scope.permissions": { | ||
| "depends_on": [ | ||
| { | ||
| "node": "resources.secret_scopes.my_scope", | ||
| "label": "${resources.secret_scopes.my_scope.name}" | ||
| } | ||
| ], | ||
| "action": "skip", | ||
| "remote_state": { | ||
| "scope_name": "test-scope-[UNIQUE_NAME]-2", | ||
| "acls": [ | ||
| { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com" | ||
| }, | ||
| { | ||
| "permission": "MANAGE", | ||
| "principal": "[USERNAME]" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
7 changes: 7 additions & 0 deletions
7 acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.terraform.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| { | ||
| "plan": { | ||
| "resources.secret_scopes.my_scope": { | ||
| "action": "skip" | ||
| } | ||
| } | ||
| } |
24 changes: 24 additions & 0 deletions
24 acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.direct.txt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/scopes/delete", | ||
| "body": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-1" | ||
| } | ||
| } | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/scopes/create", | ||
| "body": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-2", | ||
| "scope_backend_type": "DATABRICKS" | ||
| } | ||
| } | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/acls/put", | ||
| "body": { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com", | ||
| "scope": "test-scope-[UNIQUE_NAME]-2" | ||
| } | ||
| } |
32 changes: 32 additions & 0 deletions
32 acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.terraform.txt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/acls/delete", | ||
| "body": { | ||
| "principal": "deco-test-user@databricks.com", | ||
| "scope": "test-scope-[UNIQUE_NAME]-1" | ||
| } | ||
| } | ||
shreyas-goenka marked this conversation as resolved.
Uh oh!There was an error while loading. Please reload this page. | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/scopes/delete", | ||
| "body": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-1" | ||
| } | ||
| } | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/scopes/create", | ||
| "body": { | ||
| "scope": "test-scope-[UNIQUE_NAME]-2", | ||
| "scope_backend_type": "DATABRICKS" | ||
| } | ||
| } | ||
| { | ||
| "method": "POST", | ||
| "path": "/api/2.0/secrets/acls/put", | ||
| "body": { | ||
| "permission": "WRITE", | ||
| "principal": "deco-test-user@databricks.com", | ||
| "scope": "test-scope-[UNIQUE_NAME]-2" | ||
| } | ||
| } | ||
5 changes: 5 additions & 0 deletions
5 acceptance/bundle/resources/secret_scopes/basic/out.test.toml
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This aliases the other permissions block.
I can see this being a potential issue. Especially because one of them is a slice and the other an object.
@denik
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't follow, what's the issue? The interface is still the same as other resources:
This bit comes from the
[dresources.SecretScopeAclsState]struct which is an internal state used to map the permissions schema to the ACLs schema needed by secret scopes.