Uh oh!
There was an error while loading. Please reload this page.
direct: Limit server_side_default to regular fields - #4038
Merged
Conversation
Otherwise it is also applied to key-value pairs which is not intended. Regression acceptance test that shows how old behaviour resulted in ignoring extra permissions in remote state on direct.
denik
requested review from
andrewnester, anton-107, pietern and shreyas-goenka
as code ownersDecember 1, 2025 12:18
Collaborator
Commit: 3d18057
15 failing tests:
Top 50 slowest tests (at least 2 minutes):
|
pietern
reviewed
Dec 1, 2025
pietern
left a comment
Contributor
There was a problem hiding this comment.
The PR summary says:
Otherwise it is also applied to key-value pairs which is not intended.
But with this change it is specifically applied only to key/value pairs?
| for _, ch := range diff { | ||
| if ch.Old == nil { | ||
| if ch.Old == nil && ch.Path.IsStringKey() { |
Contributor
There was a problem hiding this comment.
Can you include a comment that explains the reasoning?
This check enforces that server side defaults are only allowed for paths that end with a struct/map key. Is that correct?
ContributorAuthor
No, it's not applied to key/value pairs (which refers to [task_key="mytask"] syntax). It's applied to regular keys (structs fields + maps). See https://github.com/databricks/cli/blob/main/libs/structs/structpath/path.go#L24 tagKeyValue is key-value pair and tagString is regular key. |
| // The field was not set by us, but comes from the remote state. | ||
| // This could either be server-side default or a policy. | ||
| // In any case, this is not a change we should react to. | ||
| // Note, we only consider StringKeys here, because indexes and key-value pairs refer to slices and we want to react to new element in slices. |
Contributor
There was a problem hiding this comment.
Why do key-value pairs refer to slices? Can you extend the comment to explain?
ContributorAuthor
There was a problem hiding this comment.
Key value pairs in paths were added to index slices by key in #4014
| // This could either be server-side default or a policy. | ||
| // In any case, this is not a change we should react to. | ||
| // Note, we only consider StringKeys here, because indexes and key-value pairs refer to slices and we want to react to new element in slices. | ||
| // Note, IsStringKey is also too broad - it currently covers struct fields and map keys, we don't want to include map keys here. |
Contributor
There was a problem hiding this comment.
We might also want to include map keys here. For example tags can have a server side default. See warehouse tags for example:
"tags": {
"custom_tags": [
{
"key":"Owner",
"value":"eng-dev-ecosystem-team_at_databricks.com"
}
]
Eventually we might need to push for proto level annotations for these.
ContributorAuthor
There was a problem hiding this comment.
For now focus is on matching Terraform which AFAIK does not have server side default concept for tags.
| @@ -0,0 +1,5 @@ | |||
| Local = true | |||
| Cloud = false | |||
Contributor
There was a problem hiding this comment.
Can you run this on cloud as well?
ContributorAuthor
There was a problem hiding this comment.
I'm interested in terraform & direct behavior when a permission is added remotely, testserver covers this.
pietern
approved these changes
Dec 1, 2025
pietern
left a comment
Contributor
There was a problem hiding this comment.
I was thinking of regular struct fields as key-value pairs, not the structpath kind.
It now makes sense.
eng-dev-ecosystem-bot
commented
Dec 1, 2025
Collaborator
Commit: 789bb75
22 failing tests:
Top 50 slowest tests (at least 2 minutes):
|
github-merge-queueBot
pushed a commit
that referenced
this pull request
Dec 2, 2025
…ys (#4041) ## Changes - Update structpath to distinguish between fields (.field) and map keys (["field"]). Note, when it comes to references, we still accept any syntax. However, structdiff and structwalk accurately represent map keys now. - Update server_side_default logic to ignore map keys. ## Why It was never the intention for map entries to have "server_side_default" feature. (Similar to slice indices in #4038). Issue appeared when we stopped distinguishing between fields and map keys in struct path #3640 Note, originally the difference between fields and map keys was removed so that a) users can use either syntax without worrying about matching the type. This is still the case, structaccess still treats those two the same way. b) "resources.jobs.foo" is printed with dots and not like 'resources.jobs["foo"]'. This is still the case, we don't use structpath's String() for this. ## Tests New regression test.
denik added a commit
that referenced
this pull request
May 20, 2026
## Why Otherwise it is also applied to key-value pairs which is not intended. This is related and fixes bug introduced in #4014 ## Tests Regression acceptance test that shows how old behaviour resulted in ignoring extra permissions in remote state on direct.
denik added a commit
that referenced
this pull request
May 20, 2026
…ys (#4041) ## Changes - Update structpath to distinguish between fields (.field) and map keys (["field"]). Note, when it comes to references, we still accept any syntax. However, structdiff and structwalk accurately represent map keys now. - Update server_side_default logic to ignore map keys. ## Why It was never the intention for map entries to have "server_side_default" feature. (Similar to slice indices in #4038). Issue appeared when we stopped distinguishing between fields and map keys in struct path #3640 Note, originally the difference between fields and map keys was removed so that a) users can use either syntax without worrying about matching the type. This is still the case, structaccess still treats those two the same way. b) "resources.jobs.foo" is printed with dots and not like 'resources.jobs["foo"]'. This is still the case, we don't use structpath's String() for this. ## Tests New regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Otherwise it is also applied to key-value pairs which is not intended.
This is related and fixes bug introduced in #4014
Tests
Regression acceptance test that shows how old behaviour resulted in ignoring extra permissions in remote state on direct.