Uh oh!
There was an error while loading. Please reload this page.
direct: Fix perpetual update on grants with ALL_PRIVILEGES - #6064
Merged
Conversation
buildGrantChanges now computes a per-principal add/remove diff against remote state (Add = desired - remote, Remove = remote - desired) like the terraform provider's diffPermissions, instead of sending a blanket "remove ALL_PRIVILEGES" to wipe each principal. This lets a principal granted ALL_PRIVILEGES converge when the backend also reports concrete privileges for it, instead of reporting update forever (#6030). Also normalize privileges (uppercase, spaces to underscores) and sort them on both the config and read sides so grants do not drift on case or order, and update the grants testserver to mirror that backend behaviour.
Revert the per-principal grant diff and keep the original buildGrantChanges (ALL_PRIVILEGES still wipes other privileges). Instead fix the false drift at comparison time: normalizeAssignments collapses a principal holding ALL_PRIVILEGES down to just ALL_PRIVILEGES on both the config and read sides, so config granting only ALL_PRIVILEGES matches a backend that also reports the concrete privileges it implies (#6030).
MergeGrants deduplicates the raw config strings before normalization, so distinct spellings of the same privilege (e.g. "use schema" and "USE_SCHEMA") only collide once normalizeAssignments canonicalizes them. Compact after sorting so the config side does not keep a duplicate the backend read side never returns, which would otherwise cause perpetual drift.
Collaborator
Integration test reportCommit: ae25828
10 interesting tests: 4 RECOVERED, 4 SKIP, 2 flaky
Top 11 slowest tests (at least 2 minutes):
|
The readplan grants-remove-principal golden was left with the reverted set-diff request shape; regenerate it to match the current output where each principal is sent with remove:[ALL_PRIVILEGES].
# Conflicts: # acceptance/bundle/invariant/test.toml
Main added the delete_idempotent and destroy_idempotent invariant tests; they inherit the shared INPUT_CONFIG matrix, so their out.test.toml must list the new grants_privilege_normalization config too.
Drop the privilege case/ordering normalization (uppercase, space-to-underscore, dedupe, testserver random order, invariant config) from this PR: the reporter's plan showed the drift is purely ALL_PRIVILEGES coexistence, and both AWS and Azure already return privileges uppercased and sorted, so that normalization is speculative. Keep only normalizeAssignments sorting + collapsing ALL_PRIVILEGES, which is what #6030 needs. The dropped work is preserved on the denik/grants-normalization branch for a follow-up.
Match the repo convention "Fixes [#issue] ... ([#pr])": link the fixed issue up front and the PR as the trailing token.
Add a second deploy + plan so the test proves both engines converge to no changes, not just that their first plan differs.
andrewnester
approved these changes
Jul 27, 2026
eng-dev-ecosystem-bot
commented
Jul 27, 2026
Collaborator
Integration test reportCommit: b355f7d
811 interesting tests: 803 FAIL, 3 KNOWN, 3 RECOVERED, 2 SKIP
Top 9 slowest tests (at least 2 minutes):
|
deco-sdk-taggingBot
added a commit
that referenced
this pull request
Jul 29, 2026
## Release v1.10.0 ### CLI * `ssh connect` now supports specifying a serverless usage policy with `--usage-policy-id` ### Bundles * Fixed `bundle deploy`/`bundle destroy` failing when an app enters the transient DELETING state between plan and apply (e.g. with a saved plan); the delete is now treated as complete instead of erroring (direct engine only). * Fixed `bundle deploy`/`bundle destroy` failing when an app is still in the transient DELETING state; the delete is now treated as complete instead of erroring (direct engine only). * `bundle destroy --force-lock` now proceeds without a deployment lock when the workspace directory is at its child-node limit and cannot accept the lock file, so a deployment can still be torn down when the workspace is full. * Empty-string values on optional (omitempty) resource fields are now dropped before deployment instead of being sent to the backend. This fixes deploys failing with errors like `'' is not a valid cluster policy ID` when a field such as `policy_id` was set to `""` (often via a variable that resolved to an empty string). The behavior now matches between the terraform and direct engines and is reflected in `bundle validate -o json`. * `bundle validate` and `bundle deploy` now reject a grant that is missing a `principal` with an error instead of a warning. Previously the deploy would start and, on the direct engine, create the securable before the grants PATCH failed (`400 INVALID_PARAMETER_VALUE`), leaving a partially-applied deployment. * `bundle validate` and `bundle deploy` now reject a grant with an empty `privileges` list with an error. Previously, on the direct engine, such a grant never converged: the backend drops principals with no privileges, so every subsequent `bundle plan` reported the grant as a perpetual update. * Fixes [#6030](#6030): spurious `update` on catalog/schema/volume grants (direct engine); a principal granted `ALL_PRIVILEGES` no longer drifts when the backend also reports the concrete privileges it implies ([#6064](#6064)). * Use vector search endpoint permission types that are supported by the backend ([#6022](#6022)). ### Dependency Updates * Bump `github.com/databricks/databricks-sdk-go` from v0.160.0 to v0.165.0. * Upgrade Terraform provider to 1.123.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
When a principal is granted
ALL_PRIVILEGES,normalizeAssignmentscollapses its privilege list down to justALL_PRIVILEGES, on both the config side and the value read back from the backend, so the two compare equal.Why
Fixes#6030. On the direct engine
bundle planreportedupdateon every catalog/schema/volume.grantssub-resource that grantedALL_PRIVILEGES: the backend reportsALL_PRIVILEGESplus the concrete privileges it implies, which never matched the config's loneALL_PRIVILEGES, and the deploy never converged.Tests
New acceptance test
grants/schemas/all_privileges_coexist(local + cloud, both engines); verified on aws-prod-ucws.