Skip to content

Commit 15573dd

Browse files
owlleg6owlleg6
authored
Merge pull request #22 from data-platform-hq/feat/secret_scope
feat: azure backed databricks secret scope
2 parents 4f8dba6 + dd85f6b commit 15573dd

File tree

4 files changed

+40
-30
lines changed

4 files changed

+40
-30
lines changed

‎README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -251,14 +251,14 @@ module "databricks_runtime_premium" {
251251
| Name | Version |
252252
| ---------------------------------------------------------------------------- | --------- |
253253
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
254-
| <a name="requirement_databricks"></a> [databricks](#requirement\_databricks) | >= 1.9.2 |
254+
| <a name="requirement_databricks"></a> [databricks](#requirement\_databricks) | >= 1.14.2 |
255255
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 3.40.0 |
256256

257257
## Providers
258258

259259
| Name | Version |
260260
| ---------------------------------------------------------------------- | ------- |
261-
| <a name="provider_databricks"></a> [databricks](#provider\_databricks) | 1.9.2 |
261+
| <a name="provider_databricks"></a> [databricks](#provider\_databricks) | 1.14.2 |
262262
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.40.0 |
263263

264264
## Modules
@@ -302,7 +302,8 @@ No modules.
302302
| [databricks_secret_scope.main](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/secret_scope) | resource |
303303
| [databricks_secret_scope.this](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/secret_scope) | resource |
304304
| [databricks_secret.this](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/secret) | resource |
305-
305+
| [azurerm_key_vault_access_policy.databricks](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource |
306+
| [databricks_secret_scope.external](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/secret_scope) | resource |
306307

307308

308309

@@ -338,6 +339,7 @@ No modules.
338339
| <a name="input_pat_token_lifetime_seconds"></a> [pat\_token\_lifetime\_seconds](#input\_pat\_token\_lifetime\_seconds) | The lifetime of the token, in seconds. If no lifetime is specified, the token remains valid indefinitely | `number` | 315569520 | no |
339340
| <a name="input_mount_adls_passthrough"></a> [mount\_adls\_passthrough](#input\_mount\_adls\_passthrough) | Boolean flag to use mount options for credentals passthrough. Should be used with mount_cluster_name, specified cluster should have option cluster_conf_passthrought == true | `bool` | false | no |
340341
| <a name="input_mount_cluster_name"></a> [mount\_cluster\_name](#input\_mount\_cluster\_name) | Name of the cluster that will be used during storage mounting. If mount_adls_passthrough == true, cluster should also have option cluster_conf_passthrought == true. When mount_cluster_name is not specified, it will create the smallest possible cluster in the default availability zone with name equal to or starting with terraform-mount for the shortest possible amount of time. | `string` | null | no |
342+
| <a name="input_key_vault_secret_scope"></a> [key\_vault\_secret\_scope](#input\_key\_vault\_secret\_scope) | Object with Azure Key Vault parameters required for creation of Azure-backed Databricks Secret scope. | <pre>object({<br> key_vault_id = string<br> dns_name = string<br>})<br></pre> | <pre>{<br> key_vault_id = null<br> dns_name = null<br>}</pre> | no |
341343

342344

343345

‎secrets.tf

Lines changed: 22 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -44,31 +44,27 @@ resource "databricks_secret" "this" {
4444
scope = databricks_secret_scope.this[each.value.scope_name].id
4545
}
4646

47-
# At the nearest future, Azure will allow acquiring AAD tokens by service principals,
48-
# thus providing an ability to create Azure backed Key Vault with Terraform
49-
# https://github.com/databricks/terraform-provider-databricks/pull/1965
47+
# Azure Key Vault-backed Scope
48+
resource "azurerm_key_vault_access_policy" "databricks" {
49+
count = var.key_vault_secret_scope.key_vault_id != null ? 1 : 0
5050

51-
## Azure Key Vault-backed Scope
52-
#resource "azurerm_key_vault_access_policy" "databricks" {
53-
# count = var.key_vault_secret_scope.key_vault_id != null ? 1 : 0
51+
key_vault_id = var.key_vault_secret_scope.key_vault_id
52+
object_id = "9b38785a-6e08-4087-a0c4-20634343f21f" # Global 'AzureDatabricks' SP object id
53+
tenant_id = data.azurerm_key_vault_secret.tenant_id.value
5454

55-
# key_vault_id = var.key_vault_secret_scope.key_vault_id
56-
# object_id = "9b38785a-6e08-4087-a0c4-20634343f21f" # Global 'AzureDatabricks' SP object id
57-
# tenant_id = data.azurerm_key_vault_secret.tenant_id.value
58-
#
59-
# secret_permissions = [
60-
# "Get",
61-
# "List",
62-
# ]
63-
#}
64-
#
65-
#resource "databricks_secret_scope" "external" {
66-
# count = var.key_vault_secret_scope.key_vault_id != null ? 1 : 0
67-
#
68-
# name = "external"
69-
# keyvault_metadata {
70-
# resource_id = var.key_vault_secret_scope.key_vault_id
71-
# dns_name = var.key_vault_secret_scope.dns_name
72-
# }
73-
# depends_on = [azurerm_key_vault_access_policy.databricks]
74-
#}
55+
secret_permissions = [
56+
"Get",
57+
"List",
58+
]
59+
}
60+
61+
resource "databricks_secret_scope" "external" {
62+
count = var.key_vault_secret_scope.key_vault_id != null ? 1 : 0
63+
64+
name = "external"
65+
keyvault_metadata {
66+
resource_id = var.key_vault_secret_scope.key_vault_id
67+
dns_name = var.key_vault_secret_scope.dns_name
68+
}
69+
depends_on = [azurerm_key_vault_access_policy.databricks]
70+
}

‎variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,3 +265,15 @@ variable "mount_cluster_name" {
265265
description = "Name of the cluster that will be used during storage mounting. If mount_adls_passthrough == true, cluster should also have option cluster_conf_passthrought == true"
266266
default = null
267267
}
268+
269+
variable "key_vault_secret_scope" {
270+
type = object({
271+
key_vault_id = string
272+
dns_name = string
273+
})
274+
description = "Object with Azure Key Vault parameters required for creation of Azure-backed Databricks Secret scope"
275+
default = {
276+
key_vault_id = null
277+
dns_name = null
278+
}
279+
}

‎versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
databricks = {
1010
source = "databricks/databricks"
11-
version = ">=1.9.2"
11+
version = ">=1.14.2"
1212
}
1313
}
1414
}

0 commit comments

Comments
 (0)