From 1b7a8c5e8a8d39d4092135b82bc4acc97a8059ac Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 13 Nov 2024 17:37:57 +0400 Subject: [PATCH 1/3] feat: databricks integration --- docs/resources/integration_databricks.md | 59 ++++ .../resource.tf | 26 ++ internal/client/integrations_auth.go | 1 + internal/client/model.go | 1 + internal/provider/provider.go | 1 + .../resource/integration_databricks.go | 309 ++++++++++++++++++ 6 files changed, 397 insertions(+) create mode 100644 docs/resources/integration_databricks.md create mode 100644 examples/resources/infisical_integration_databricks/resource.tf create mode 100644 internal/provider/resource/integration_databricks.go diff --git a/docs/resources/integration_databricks.md b/docs/resources/integration_databricks.md new file mode 100644 index 0000000..7c56dcf --- /dev/null +++ b/docs/resources/integration_databricks.md @@ -0,0 +1,59 @@ +--- +# generated by https://github.com/hashicorp/terraform-plugin-docs +page_title: "infisical_integration_databricks Resource - terraform-provider-infisical" +subcategory: "" +description: |- + Create Databricks integration & save to Infisical. Only Machine Identity authentication is supported for this data source +--- + +# infisical_integration_databricks (Resource) + +Create Databricks integration & save to Infisical. Only Machine Identity authentication is supported for this data source + +## Example Usage + +```terraform +terraform { + required_providers { + infisical = { + # version = + source = "infisical/infisical" + } + } +} + +provider "infisical" { + host = "https://app.infisical.com" # Only required if using self hosted instance of Infisical, default is https://app.infisical.com + client_id = "" + client_secret = "" +} + +resource "infisical_integration_databricks" "db-integration" { + project_id = "" + environment = "" + + databricks_host = "" # Example: https://afc-2a42f142-bb11.cloud.databricks.com + databricks_token = "" + databricks_secret_scope = "" + + secret_path = "/some/infisical/folder" # "/" is the root folder + +} +``` + + +## Schema + +### Required + +- `databricks_host` (String) The Databricks host URL. +- `databricks_secret_scope` (String) The Databricks secret scope. Example: your-secret-scope +- `databricks_token` (String) The Databricks access token. +- `environment` (String) The slug of the environment to sync to Databricks (prod, dev, staging, etc). +- `project_id` (String) The ID of your Infisical project. +- `secret_path` (String) The secret path in Infisical to sync secrets from. + +### Read-Only + +- `integration_auth_id` (String) The ID of the integration auth, used internally by Infisical. +- `integration_id` (String) The ID of the integration, used internally by Infisical. diff --git a/examples/resources/infisical_integration_databricks/resource.tf b/examples/resources/infisical_integration_databricks/resource.tf new file mode 100644 index 0000000..01d267a --- /dev/null +++ b/examples/resources/infisical_integration_databricks/resource.tf @@ -0,0 +1,26 @@ +terraform { + required_providers { + infisical = { + # version = + source = "infisical/infisical" + } + } +} + +provider "infisical" { + host = "https://app.infisical.com" # Only required if using self hosted instance of Infisical, default is https://app.infisical.com + client_id = "" + client_secret = "" +} + +resource "infisical_integration_databricks" "db-integration" { + project_id = "" + environment = "" + + databricks_host = "" # Example: https://afc-2a42f142-bb11.cloud.databricks.com + databricks_token = "" + databricks_secret_scope = "" + + secret_path = "/some/infisical/folder" # "/" is the root folder + +} \ No newline at end of file diff --git a/internal/client/integrations_auth.go b/internal/client/integrations_auth.go index 7e9374c..cb4fdc9 100644 --- a/internal/client/integrations_auth.go +++ b/internal/client/integrations_auth.go @@ -10,6 +10,7 @@ type IntegrationAuthType string const ( IntegrationAuthTypeGcpSecretManager IntegrationAuthType = "gcp-secret-manager" IntegrationAuthTypeAwsParameterStore IntegrationAuthType = "aws-parameter-store" + IntegrationAuthTypeDatabricks IntegrationAuthType = "databricks" IntegrationAuthTypeAwsSecretsManager IntegrationAuthType = "aws-secret-manager" IntegrationAuthTypeCircleCi IntegrationAuthType = "circleci" ) diff --git a/internal/client/model.go b/internal/client/model.go index 2454733..57c33a4 100644 --- a/internal/client/model.go +++ b/internal/client/model.go @@ -1548,6 +1548,7 @@ type CreateIntegrationAuthRequest struct { RefreshToken string `json:"refreshToken"` ProjectID string `json:"workspaceId"` Integration IntegrationAuthType `json:"integration"` + URL string `json:"url"` } type CreateIntegrationAuthResponse struct { diff --git a/internal/provider/provider.go b/internal/provider/provider.go index a44fc7e..e8897cf 100644 --- a/internal/provider/provider.go +++ b/internal/provider/provider.go @@ -254,6 +254,7 @@ func (p *infisicalProvider) Resources(_ context.Context) []func() resource.Resou infisicalResource.NewIntegrationAwsParameterStoreResource, infisicalResource.NewIntegrationAwsSecretsManagerResource, infisicalResource.NewIntegrationCircleCiResource, + infisicalResource.NewIntegrationDatabricksResource, infisicalResource.NewSecretApprovalPolicyResource, infisicalResource.NewAccessApprovalPolicyResource, infisicalResource.NewProjectSecretImportResource, diff --git a/internal/provider/resource/integration_databricks.go b/internal/provider/resource/integration_databricks.go new file mode 100644 index 0000000..e3a9f4a --- /dev/null +++ b/internal/provider/resource/integration_databricks.go @@ -0,0 +1,309 @@ +package resource + +import ( + "context" + "fmt" + infisical "terraform-provider-infisical/internal/client" + + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +// Ensure the implementation satisfies the expected interfaces. +var ( + _ resource.Resource = &IntegrationDatabricksResource{} +) + +// IntegrationDatabricksResource is a helper function to simplify the provider implementation. +func NewIntegrationDatabricksResource() resource.Resource { + return &IntegrationDatabricksResource{} +} + +// IntegrationDatabricksResource is the resource implementation. +type IntegrationDatabricksResource struct { + client *infisical.Client +} + +// IntegrationDatabricksResourceModel describes the data source data model. +type IntegrationDatabricksResourceModel struct { + ProjectID types.String `tfsdk:"project_id"` + Environment types.String `tfsdk:"environment"` + SecretPath types.String `tfsdk:"secret_path"` + + DatabricksHostURL types.String `tfsdk:"databricks_host"` + DatabricksAccessToken types.String `tfsdk:"databricks_token"` + DatabricksSecretScope types.String `tfsdk:"databricks_secret_scope"` + + IntegrationAuthID types.String `tfsdk:"integration_auth_id"` + IntegrationID types.String `tfsdk:"integration_id"` +} + +// Metadata returns the resource type name. +func (r *IntegrationDatabricksResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_integration_databricks" +} + +// Schema defines the schema for the resource. +func (r *IntegrationDatabricksResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "Create Databricks integration & save to Infisical. Only Machine Identity authentication is supported for this data source", + Attributes: map[string]schema.Attribute{ + "integration_auth_id": schema.StringAttribute{ + Computed: true, + Description: "The ID of the integration auth, used internally by Infisical.", + PlanModifiers: []planmodifier.String{stringplanmodifier.UseStateForUnknown()}, + }, + + "integration_id": schema.StringAttribute{ + Computed: true, + Description: "The ID of the integration, used internally by Infisical.", + PlanModifiers: []planmodifier.String{stringplanmodifier.UseStateForUnknown()}, + }, + + "project_id": schema.StringAttribute{ + Required: true, + Description: "The ID of your Infisical project.", + PlanModifiers: []planmodifier.String{stringplanmodifier.RequiresReplace()}, + }, + + "environment": schema.StringAttribute{ + Required: true, + Description: "The slug of the environment to sync to Databricks (prod, dev, staging, etc).", + }, + + "secret_path": schema.StringAttribute{ + Required: true, + Description: "The secret path in Infisical to sync secrets from.", + }, + + "databricks_host": schema.StringAttribute{ + Required: true, + Description: "The Databricks host URL.", + PlanModifiers: []planmodifier.String{stringplanmodifier.RequiresReplace()}, + }, + + "databricks_token": schema.StringAttribute{ + Required: true, + Description: "The Databricks access token.", + PlanModifiers: []planmodifier.String{stringplanmodifier.RequiresReplace()}, + }, + + "databricks_secret_scope": schema.StringAttribute{ + Required: true, + Description: "The Databricks secret scope. Example: your-secret-scope", + PlanModifiers: []planmodifier.String{stringplanmodifier.RequiresReplace()}, + }, + }, + } +} + +// Configure adds the provider configured client to the resource. +func (r *IntegrationDatabricksResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + if req.ProviderData == nil { + return + } + + client, ok := req.ProviderData.(*infisical.Client) + + if !ok { + resp.Diagnostics.AddError( + "Unexpected Resource Source Configure Type", + fmt.Sprintf("Expected *http.Client, got: %T. Please report this issue to the provider developers.", req.ProviderData), + ) + + return + } + + r.client = client +} + +// Create creates the resource and sets the initial Terraform state. +func (r *IntegrationDatabricksResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + if !r.client.Config.IsMachineIdentityAuth { + resp.Diagnostics.AddError( + "Unable to create integration", + "Only Machine Identity authentication is supported for this operation", + ) + return + } + + // Retrieve values from plan + var plan IntegrationDatabricksResourceModel + diags := req.Plan.Get(ctx, &plan) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + + // Create integration auth first + auth, err := r.client.CreateIntegrationAuth(infisical.CreateIntegrationAuthRequest{ + AccessToken: plan.DatabricksAccessToken.ValueString(), + URL: plan.DatabricksHostURL.ValueString(), + ProjectID: plan.ProjectID.ValueString(), + Integration: infisical.IntegrationAuthTypeDatabricks, + }) + + if err != nil { + resp.Diagnostics.AddError( + "Unable to create integration auth", + err.Error(), + ) + return + } + + // Create the integration + integration, err := r.client.CreateIntegration(infisical.CreateIntegrationRequest{ + IntegrationAuthID: auth.IntegrationAuth.ID, + App: plan.DatabricksSecretScope.ValueString(), + SourceEnvironment: plan.Environment.ValueString(), + SecretPath: plan.SecretPath.ValueString(), + }) + + if err != nil { + resp.Diagnostics.AddError( + "Unable to create integration", + err.Error(), + ) + return + } + + plan.IntegrationAuthID = types.StringValue(auth.IntegrationAuth.ID) + plan.IntegrationID = types.StringValue(integration.Integration.ID) + plan.Environment = types.StringValue(integration.Integration.Environment.Slug) + + diags = resp.State.Set(ctx, plan) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } +} + +// Read refreshes the Terraform state with the latest data. +func (r *IntegrationDatabricksResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + + if !r.client.Config.IsMachineIdentityAuth { + resp.Diagnostics.AddError( + "Unable to read integration", + "Only Machine Identity authentication is supported for this operation", + ) + return + } + + // Get current state + var state IntegrationDatabricksResourceModel + diags := req.State.Get(ctx, &state) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + + integration, err := r.client.GetIntegration(infisical.GetIntegrationRequest{ + ID: state.IntegrationID.ValueString(), + }) + + if err != nil { + if err == infisical.ErrNotFound { + resp.State.RemoveResource(ctx) + } else { + resp.Diagnostics.AddError( + "Unable to get integration", + err.Error(), + ) + } + return + } + state.SecretPath = types.StringValue(integration.Integration.SecretPath) + state.IntegrationAuthID = types.StringValue(integration.Integration.IntegrationAuthID) + state.Environment = types.StringValue(integration.Integration.Environment.Slug) + + diags = resp.State.Set(ctx, state) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + +} + +// Update updates the resource and sets the updated Terraform state on success. +func (r *IntegrationDatabricksResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + if !r.client.Config.IsMachineIdentityAuth { + resp.Diagnostics.AddError( + "Unable to update integration", + "Only Machine Identity authentication is supported for this operation", + ) + return + } + + // Retrieve values from plan + var plan IntegrationDatabricksResourceModel + diags := req.Plan.Get(ctx, &plan) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + + var state IntegrationDatabricksResourceModel + diags = req.State.Get(ctx, &state) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + + // Update the integration + updatedIntegration, err := r.client.UpdateIntegration(infisical.UpdateIntegrationRequest{ + ID: state.IntegrationID.ValueString(), + Environment: plan.Environment.ValueString(), + SecretPath: plan.SecretPath.ValueString(), + }) + + if err != nil { + resp.Diagnostics.AddError( + "Error updating integration", + err.Error(), + ) + return + } + + plan.SecretPath = types.StringValue(updatedIntegration.Integration.SecretPath) + plan.IntegrationAuthID = types.StringValue(updatedIntegration.Integration.IntegrationAuthID) + plan.Environment = types.StringValue(updatedIntegration.Integration.Environment.Slug) + + diags = resp.State.Set(ctx, plan) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + +} + +func (r *IntegrationDatabricksResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + if !r.client.Config.IsMachineIdentityAuth { + resp.Diagnostics.AddError( + "Unable to delete Databricks Store integration", + "Only Machine Identity authentication is supported for this operation", + ) + return + } + + var state IntegrationDatabricksResourceModel + diags := req.State.Get(ctx, &state) + resp.Diagnostics.Append(diags...) + if resp.Diagnostics.HasError() { + return + } + + _, err := r.client.DeleteIntegrationAuth(infisical.DeleteIntegrationAuthRequest{ + ID: state.IntegrationAuthID.ValueString(), + }) + + if err != nil { + resp.Diagnostics.AddError( + "Error deleting Databricks Integration", + "Couldn't delete Databricks integration from your Infiscial project, unexpected error: "+err.Error(), + ) + return + } +} From d0c54c9d49a3877549569fd4dfce469f9f4e6ced Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 14 Nov 2024 16:33:57 +0400 Subject: [PATCH 2/3] fix: implemented requested changes --- docs/resources/integration_databricks.md | 2 +- internal/provider/resource/integration_databricks.go | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/resources/integration_databricks.md b/docs/resources/integration_databricks.md index 7c56dcf..1c78407 100644 --- a/docs/resources/integration_databricks.md +++ b/docs/resources/integration_databricks.md @@ -48,7 +48,7 @@ resource "infisical_integration_databricks" "db-integration" { - `databricks_host` (String) The Databricks host URL. - `databricks_secret_scope` (String) The Databricks secret scope. Example: your-secret-scope -- `databricks_token` (String) The Databricks access token. +- `databricks_token` (String, Sensitive) The Databricks access token. - `environment` (String) The slug of the environment to sync to Databricks (prod, dev, staging, etc). - `project_id` (String) The ID of your Infisical project. - `secret_path` (String) The secret path in Infisical to sync secrets from. diff --git a/internal/provider/resource/integration_databricks.go b/internal/provider/resource/integration_databricks.go index e3a9f4a..3350d45 100644 --- a/internal/provider/resource/integration_databricks.go +++ b/internal/provider/resource/integration_databricks.go @@ -87,6 +87,7 @@ func (r *IntegrationDatabricksResource) Schema(_ context.Context, _ resource.Sch "databricks_token": schema.StringAttribute{ Required: true, + Sensitive: true, Description: "The Databricks access token.", PlanModifiers: []planmodifier.String{stringplanmodifier.RequiresReplace()}, }, From c2d8ea433fff4e6c88202a59a54e660b7cff53ce Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 14 Nov 2024 18:46:53 +0400 Subject: [PATCH 3/3] Update model.go --- internal/client/model.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/client/model.go b/internal/client/model.go index 1f83207..8e3fc87 100644 --- a/internal/client/model.go +++ b/internal/client/model.go @@ -1549,7 +1549,7 @@ type CreateIntegrationAuthRequest struct { RefreshToken string `json:"refreshToken,omitempty"` ProjectID string `json:"workspaceId"` Integration IntegrationAuthType `json:"integration"` - URL string `json:"url"` + URL string `json:"url"` } type CreateIntegrationAuthResponse struct {