danielrbradley
commented
1 year ago Hi @ahmed-wajid thanks for the detailed writeup.
Yes, I think you've found another interesting example of where Azure's created APIs which have inadvertantly created circular dependencies.
Here's a blog article which discussed addressing these challenges in Pulumi: https://www.pulumi.com/blog/exploring-circular-dependencies/
I think this is solved in the bridged provider by encapsulating multiple steps for the creation of the single resource - so one option could be to special-case how the provider creates this resource if this property is set, but that would be far from ideal solution to maintain. Creating "patch resources" is the more likely way we'll end up going in the futures to solve this - allowing a second operation to be performed on the same resource.
If you want to avoid the problem of modifying your code between the first and second run, you can use the workaround from the beginning of the article where we can reference our own stack's previous state to see if it needs to have the initial or encrypted configuration set.
If you want to avoid a second run of pulumi up then you could do the modification using some custom code within a dynamic provider to modify the Workspace. If using this approach, you'll need to ensure you perform a refresh before the next deployment to ensure that the state is updated to match the actual resource state, and will want to use the self-stack reference above to modify your program so it matches the new state on subsequent deployments.
Hope that gives you some options for working around this issue.
ahmed-wajid
What happened?
When creating a Databricks workspace using the Azure Native v2 Provider, there is no straight forward to encrypt the workspace.
It seems that this can only with a two step approach: First
pulumi upwith:This creates the workspace, and then does the role assignment to the Storage Account Identity, providing access to the KeyVault with the roleassignment of the KeyVault Crypto User.
To finally encrypt it, we need to a second
pulumi upwith:We are actually using Automation API running this in a celery task, and seems that we cannot find a way to achieve this using the Azure Native Provider.
Would you happen to have any suggestions or tricks up your sleeve where you would have potentially already solved such a problem?
Expected Behavior
Expect to be able to Encrypt the Databricks Workspace in one go.
Steps to reproduce
roleassignment = authorization.RoleAssignment( f"Storage Account KeyVault Crypto User - {workspace.storage_account_identity}", principal_id=workspace.storage_account_identity.principal_id, principal_type=authorization.PrincipalType.SERVICE_PRINCIPAL, role_definition_id="/providers/Microsoft.Authorization/roleDefinitions/12338af0-0e69-4776-bea7-57ae8d297424", scope="/subscriptions//resourceGroups/resource_groupe8a30786/providers/Microsoft.KeyVault/vaults/foobar",
)
workspace = databricks.Workspace( "foobar", managed_resource_group_id="/subscriptions//resourceGroups/mg_rg_foobar",
resource_group_name=resource_group.name,
sku=databricks.SkuArgs(
name="premium",
tier="premium"
),
encryption=databricks.WorkspacePropertiesEncryptionArgs(
entities=databricks.EncryptionEntitiesDefinitionArgs(
managed_disk=databricks.ManagedDiskEncryptionArgs(
key_source="Microsoft.Keyvault",
rotation_to_latest_key_version_enabled=False,
key_vault_properties=databricks.ManagedDiskEncryptionKeyVaultPropertiesArgs(
key_name="foobar",
key_version="",
key_vault_uri="https://foobar.vault.azure.net/"
),
),
managed_services=databricks.EncryptionV2Args(
key_source="Microsoft.Keyvault",
key_vault_properties=databricks.EncryptionV2KeyVaultPropertiesArgs(
key_name="foobar",
key_version="",
key_vault_uri="https://foobar.vault.azure.net/"
),
),
),
),
parameters=databricks.WorkspaceCustomParametersArgs(
encryption=databricks.WorkspaceEncryptionParameterArgs(
value=databricks.EncryptionArgs(
key_name="foobar",
key_source="Microsoft.Keyvault",
key_vault_uri="https://foobar.vault.azure.net/",
key_version=""
),
),
prepare_encryption=databricks.WorkspaceCustomBooleanParameterArgs(
value=True,
),
),
)
CLI Version 3.76.0 Go Version go1.20.6 Go Compiler gc
Plugins NAME VERSION azure-native 2.1.1 python unknown
Host OS ubuntu Version 22.04 Arch x86_64
This project is written in python: executable='/usr/bin/python3' version='3.10.6 '
Current Stack: organization/test-stack/dev
Found no resources associated with dev
Found no pending operations associated with dev
Backend Name
URL file://.
User
Organizations
Dependencies: NAME VERSION pip 23.2.1 pulumi-azure-native 2.1.1 setuptools 68.0.0 wheel 0.41.0
Pulumi locates its logs in /tmp by default