Open russellseymour opened 7 months ago
show the provider block...
Not sure about the OP, but here is my provider block. I have the same issue when using version 1.30.0. The reason I am using an older version is due to other issues regarding USGovernment. I think this is a sequencing error internal to Terraform databricks.
provider "databricks" { alias = "databricks_workspace1" host = length(module.databricks) > 0 ? module.databricks[local.databricks_keys[0]].databricks_workspace_url : "empty" azure_workspace_resource_id = length(module.databricks) > 0 ? module.databricks[local.databricks_keys[0]].databricks_workspace.id : "empty" azure_environment = "usgovernment" }
For additional context I have two modules, one which creates the Databricks Workspace in Azure, and then another which configures the workspace using the values from the Databricks Workspace and configuring the provider above.
We have written a module that creates an Azure Databricks Workspace. The output of this module is the host
and the azure_workspace_resource_id
which we reference in the provider:
provider "databricks" {
host = module.adb.databricks_hosturl
azure_workspace_resource_id = module.adb.adb_databricks_id
auth_type = "azure-client-secret"
}
However we had a thought that when being destroyed the module information is being removed before we get to these resources, so the host
and azure_workspace_resource_id
is no longer valid. So as a test we changed it to this:
provider "databricks" {
host = module.adb.databricks_hosturl != "" ? module.adb.databricks_hosturl : var.adb_databricks_hosturl
azure_workspace_resource_id = module.adb.adb_databricks_id != "" ? module.adb.adb_databricks_id : var.adb_databricks_id
auth_type = "azure-client-secret"
}
Now when we run the destroy
we set the variables accordingly so they do not come from the module output anymore. This has changed the error we get to:
infra:destroy:plan: │ Error: cannot read token: Invalid resource ID
infra:destroy:plan: │
infra:destroy:plan: │ with databricks_token.pat,
infra:destroy:plan: │ on main.tf line 359, in resource "databricks_token" "pat":
infra:destroy:plan: │ 359: resource "databricks_token" "pat" {
infra:destroy:plan: │
infra:destroy:plan: ╵
infra:destroy:plan: ╷
infra:destroy:plan: │ Error: cannot read secret scope: Invalid resource ID
infra:destroy:plan: │
infra:destroy:plan: │ with databricks_secret_scope.kv,
infra:destroy:plan: │ on main.tf line 381, in resource "databricks_secret_scope" "kv":
infra:destroy:plan: │ 381: resource "databricks_secret_scope" "kv" {
infra:destroy:plan: │
infra:destroy:plan: ╵
infra:destroy:plan: ╷
infra:destroy:plan: │ Error: cannot read workspace conf: Invalid resource ID
infra:destroy:plan: │
infra:destroy:plan: │ with databricks_workspace_conf.this[0],
infra:destroy:plan: │ on main.tf line 391, in resource "databricks_workspace_conf" "this":
infra:destroy:plan: │ 391: resource "databricks_workspace_conf" "this" {
There does not appear to be a way to provide additional properties that may make this work.
Is it possible to actually destroy Databricks resources using Terraform?
Configuration
The databricks module that we have created looks like:
Expected Behavior
When running
terraform destroy
the resources should be removed from AzureActual Behavior
Although the provider was able to create the resources using a Service Principal with Contributor access it is not able to delete them. We get the following error messages:
Steps to Reproduce
Create an Azure Data Bricks instance in Azure using Terraform and create the toke, secret_scope and workspace_conf resources, then run
Terraform and provider versions
Is it a regression?
Not that I am aware of
Debug Output
https://gist.github.com/russellseymour/cfd4df94f6fc5a0300bd7337528fa6fb
Important Factoids
No
Would you like to implement a fix?
No as I do not knoww what the issue is