Merge pull request #14 from data-platform-hq/workspace_bindings_and_managed_locations

feat: workspace bindings support; catalog's managed locations support

Author: owlleg6

README.md

@@ -70,13 +70,13 @@ module "unity_catalog" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.0.0 |
-| <a name="requirement_databricks"></a> [databricks](#requirement\_databricks) | >=1.14.2 |
+| <a name="requirement_databricks"></a> [databricks](#requirement\_databricks) | >=1.38.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_databricks"></a> [databricks](#provider\_databricks) | >=1.14.2 |
+| <a name="provider_databricks"></a> [databricks](#provider\_databricks) | >=1.38.0 |
 
 ## Modules
 
@@ -87,6 +87,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [databricks_catalog.this](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/catalog) | resource |
+| [databricks_catalog_workspace_binding.this](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/catalog_workspace_binding) | resource |
 | [databricks_grants.catalog](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants) | resource |
 | [databricks_grants.metastore](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants) | resource |
 | [databricks_grants.schema](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants) | resource |
@@ -96,10 +97,11 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_catalog"></a> [catalog](#input\_catalog) | Map of catalog name and its parameters | <pre>map(object({<br>    catalog_grants     = optional(map(list(string)))<br>    catalog_owner      = optional(string)<br>    catalog_comment    = optional(string)<br>    catalog_properties = optional(map(string))<br>    schema_name        = optional(list(string))<br>    schema_grants      = optional(map(list(string)))<br>    schema_owner       = optional(string)<br>    schema_comment     = optional(string)<br>    schema_properties  = optional(map(string))<br>  }))</pre> | `{}` | no |
-| <a name="input_env"></a> [env](#input\_env) | Environment name | `string` | n/a | yes |
-| <a name="input_metastore_grants"></a> [metastore\_grants](#input\_metastore\_grants) | Permissions to give on metastore to group | <pre>set(object({<br>    principal  = string<br>    privileges = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_catalog"></a> [catalog](#input\_catalog) | Map of catalog name and its parameters | <pre>map(object({<br>    catalog_grants         = optional(map(list(string)))<br>    catalog_owner          = optional(string)         # Username/groupname/sp application_id of the catalog owner.<br>    catalog_storage_root   = optional(string)         # Location in cloud storage where data for managed tables will be stored<br>    catalog_isolation_mode = optional(string, "OPEN") # Whether the catalog is accessible from all workspaces or a specific set of workspaces. Can be ISOLATED or OPEN.<br>    catalog_comment        = optional(string)         # User-supplied free-form text<br>    catalog_properties     = optional(map(string))    # Extensible Catalog Tags.<br>    schema_name            = optional(list(string))   # List of Schema names relative to parent catalog.<br>    schema_grants          = optional(map(list(string)))<br>    schema_owner           = optional(string) # Username/groupname/sp application_id of the schema owner.<br>    schema_comment         = optional(string)<br>    schema_properties      = optional(map(string))<br>  }))</pre> | `{}` | no |
+| <a name="input_isolated_unmanaged_catalog_bindings"></a> [isolated\_unmanaged\_catalog\_bindings](#input\_isolated\_unmanaged\_catalog\_bindings) | List of objects with parameters to configure Catalog Bindings | <pre>list(object({<br>    catalog_name = string                                      # Name of ISOLATED catalog<br>    binding_type = optional(string, "BINDING_TYPE_READ_WRITE") # Binding mode. Possible values are BINDING_TYPE_READ_ONLY, BINDING_TYPE_READ_WRITE<br>  }))</pre> | `[]` | no |
+| <a name="input_metastore_grants"></a> [metastore\_grants](#input\_metastore\_grants) | Permissions to give on metastore to user, group or service principal | <pre>set(object({<br>    principal  = string<br>    privileges = list(string)<br>  }))</pre> | `[]` | no |
 | <a name="input_metastore_id"></a> [metastore\_id](#input\_metastore\_id) | Unity Catalog Metastore Id that is located in separate environment. Provide this value to associate Databricks Workspace with target Metastore | `string` | n/a | yes |
+| <a name="input_workspace_id"></a> [workspace\_id](#input\_workspace\_id) | ID of the target workspace. | `string` | `null` | no |
 
 ## Outputs
 

main.tf

@@ -23,12 +23,14 @@ resource "databricks_grants" "metastore" {
 resource "databricks_catalog" "this" {
   for_each = var.catalog
 
-  metastore_id  = var.metastore_id
-  name          = each.key
-  owner         = each.value.catalog_owner
-  comment       = lookup(each.value, "catalog_comment", "default comment")
-  properties    = merge(lookup(each.value, "catalog_properties", {}), { env = var.env })
-  force_destroy = true
+  metastore_id   = var.metastore_id
+  name           = each.key
+  owner          = each.value.catalog_owner
+  storage_root   = each.value.catalog_storage_root
+  isolation_mode = each.value.catalog_isolation_mode
+  comment        = lookup(each.value, "catalog_comment", "default comment")
+  properties     = lookup(each.value, "catalog_properties", {})
+  force_destroy  = true
 }
 
 # Catalog grants
@@ -72,7 +74,7 @@ resource "databricks_schema" "this" {
   name          = each.value.schema
   owner         = each.value.owner
   comment       = each.value.comment
-  properties    = merge(each.value.properties, { env = var.env })
+  properties    = each.value.properties
   force_destroy = true
 }
 
@@ -99,3 +101,14 @@ resource "databricks_grants" "schema" {
     privileges = each.value.permission
   }
 }
+
+# ISOLATED Catalogs binding
+resource "databricks_catalog_workspace_binding" "this" {
+  for_each = {
+    for object in var.isolated_unmanaged_catalog_bindings : object.catalog_name => object
+  }
+
+  workspace_id   = var.workspace_id
+  securable_name = each.value.catalog_name
+  binding_type   = each.value.binding_type
+}

variables.tf

@@ -1,8 +1,3 @@
-variable "env" {
-  type        = string
-  description = "Environment name"
-}
-
 variable "metastore_id" {
   type        = string
   description = "Unity Catalog Metastore Id that is located in separate environment. Provide this value to associate Databricks Workspace with target Metastore"
@@ -19,22 +14,39 @@ variable "metastore_grants" {
     principal  = string
     privileges = list(string)
   }))
-  description = "Permissions to give on metastore to group"
+  description = "Permissions to give on metastore to user, group or service principal"
   default     = []
 }
 
 variable "catalog" {
   type = map(object({
-    catalog_grants     = optional(map(list(string)))
-    catalog_owner      = optional(string)
-    catalog_comment    = optional(string)
-    catalog_properties = optional(map(string))
-    schema_name        = optional(list(string))
-    schema_grants      = optional(map(list(string)))
-    schema_owner       = optional(string)
-    schema_comment     = optional(string)
-    schema_properties  = optional(map(string))
+    catalog_grants         = optional(map(list(string)))
+    catalog_owner          = optional(string)         # Username/groupname/sp application_id of the catalog owner.
+    catalog_storage_root   = optional(string)         # Location in cloud storage where data for managed tables will be stored
+    catalog_isolation_mode = optional(string, "OPEN") # Whether the catalog is accessible from all workspaces or a specific set of workspaces. Can be ISOLATED or OPEN.
+    catalog_comment        = optional(string)         # User-supplied free-form text
+    catalog_properties     = optional(map(string))    # Extensible Catalog Tags.
+    schema_name            = optional(list(string))   # List of Schema names relative to parent catalog.
+    schema_grants          = optional(map(list(string)))
+    schema_owner           = optional(string) # Username/groupname/sp application_id of the schema owner.
+    schema_comment         = optional(string)
+    schema_properties      = optional(map(string))
   }))
   description = "Map of catalog name and its parameters"
   default     = {}
 }
+
+variable "isolated_unmanaged_catalog_bindings" {
+  type = list(object({
+    catalog_name = string                                      # Name of ISOLATED catalog
+    binding_type = optional(string, "BINDING_TYPE_READ_WRITE") # Binding mode. Possible values are BINDING_TYPE_READ_ONLY, BINDING_TYPE_READ_WRITE
+  }))
+  description = "List of objects with parameters to configure Catalog Bindings"
+  default     = []
+}
+
+variable "workspace_id" {
+  type        = string
+  description = "ID of the target workspace."
+  default     = null
+}

versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     databricks = {
       source  = "databricks/databricks"
-      version = ">=1.14.2"
+      version = ">=1.38.0"
     }
   }
 }