Bump Terraform provider to v1.115.0 by simonfaltum · Pull Request #5238 · databricks/cli

simonfaltum · 2026-05-11T20:16:57Z

Why

Keep the CLI's Terraform schema in sync with the latest provider release (v1.115.0, published 2026-05-11).

Changes

Bumps the provider version from 1.113.0 to 1.115.0 and regenerates the Go schema types using go run . in bundle/internal/tf/codegen.

Also bumps hc-install in the codegen module from 0.9.2 to 0.9.4 so codegen can verify the Terraform download checksum signature on current toolchains.

New resources (added in v1.114.0, still present in v1.115.0):

databricks_disaster_recovery_failover_group
databricks_disaster_recovery_stable_url
databricks_secret_uc
databricks_supervisor_agent
databricks_supervisor_agent_tool

New data sources for each of the above (singular and plural).

Acceptance test outputs that capture the provider user-agent string or terraform state shape were regenerated:

bundle/user_agent, bundle/state/state_present
bundle/migrate/{basic,dashboards,default-python,grants,permissions,runas}
bundle/resources/jobs/update
bundle/resources/postgres_projects/update_display_name
bundle/deployment/bind/{dashboard/recreation,pipelines/recreate,pipelines/update}

The schema-driven changes are: a populated provider_config.workspace_id on jobs and pipelines, and update_mask: initial_endpoint_spec,spec on postgres project PATCH requests.

Test plan

./task checks passes
go build ./... passes
Affected acceptance tests regenerated locally
CI passes on the PR

## Why Keep the CLI's Terraform schema in sync with the latest provider release ([v1.115.0](https://github.com/databricks/terraform-provider-databricks/releases/tag/v1.115.0), published 2026-05-11). ## Changes Bumps the provider version from 1.113.0 to 1.115.0 and regenerates the Go schema types using `go run .` in `bundle/internal/tf/codegen`. Also fixes `openpgp: key expired` from hc-install's embedded HashiCorp pubkey on the codegen path: the refreshed key block is now passed via `releases.ExactVersion.ArmoredPublicKey`, mirroring the runtime install fix in PR #5021. Required to run codegen at all on current toolchains. New resources (added in v1.114.0, still present in v1.115.0): - `databricks_disaster_recovery_failover_group` - `databricks_disaster_recovery_stable_url` - `databricks_secret_uc` - `databricks_supervisor_agent` - `databricks_supervisor_agent_tool` New data sources for each of the above (singular and plural). Acceptance test outputs that capture the provider user-agent string or terraform state shape were regenerated: - `bundle/user_agent`, `bundle/state/state_present` - `bundle/migrate/{basic,dashboards,default-python,grants,permissions,runas}` - `bundle/resources/jobs/update` - `bundle/resources/postgres_projects/update_display_name` - `bundle/deployment/bind/{dashboard/recreation,pipelines/recreate,pipelines/update}` The schema-driven changes are: a populated `provider_config.workspace_id` on jobs and pipelines, and `update_mask: initial_endpoint_spec,spec` on postgres project PATCH requests. ## Test plan - [x] `./task checks` passes - [x] `go build ./...` passes - [x] Affected acceptance tests regenerated locally - [ ] CI passes on the PR Co-authored-by: Isaac

simonfaltum

Most of this PR is mechanical: a version.go bump and the regenerated bundle/internal/tf/schema/*.go files. Four things are not routine and worth a closer look — flagged inline below.

Embedded HashiCorp pubkey (new file bundle/internal/tf/codegen/schema/pubkey.go) — required to make codegen run at all on current toolchains.
provider_config.workspace_id now populated on many state fixtures — schema-driven, not a CLI behavior change.
Postgres update_mask gained initial_endpoint_spec on PATCH requests — schema-driven, may want backend confirmation.
Version jump skips v1.114.x entirely (1.113.0 → 1.115.0). Three patch releases plus v1.115.0 shipped since the previous bump on 2026-04-16.

simonfaltum · 2026-05-11T20:21:46Z

+// Source: https://github.com/hashicorp/hc-install/blob/main/internal/pubkey/pubkey.go
+//
+//	(second -----BEGIN PGP PUBLIC KEY BLOCK----- block, added in PR #355)
+const hashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----


Please double-check this file. New embedded HashiCorp pubkey, needed because the key block bundled in hc-install v0.9.4 has a UserID self-signature that expired on 2026-04-18 — codegen otherwise fails with openpgp: key expired (releases.hashicorp.com/...SHA256SUMS.72D7468F.sig).

The armored block here was copied verbatim from hc-install#355 (the second -----BEGIN PGP PUBLIC KEY BLOCK----- block, refreshed 2026-02-19, expiration extended ~2035). We can't just rely on the upstream fix because go-crypto v1 only reads the first armored block and keeps one SelfSignature per Identity, so the refreshed second block is a no-op when read via the bundled pubkey.Read.

This duplicates the same key that lives in bundle/deploy/terraform/install.go (added in #5021 for the runtime install path). The codegen module has its own go.mod, so we can't import the runtime copy. Worth confirming you're OK with the duplication — alternative is to factor the key into a shared module, but that's a bigger refactor.

Reviewer checklist:

Source link points to the right upstream block.

Key fingerprint matches 34365D9472D7468F (HashiCorp Security).

The duplication vs. bundle/deploy/terraform/install.go is acceptable.

Can you bump to hc install 0.9.4 instead?

I'm updating this.

simonfaltum · 2026-05-11T20:21:46Z

+		Product:          product.Terraform,
+		Version:          version.Must(version.NewVersion("1.5.5")),
+		InstallDir:       installDir,
+		ArmoredPublicKey: hashicorpPublicKey,


This is the line that actually wires in the refreshed key from pubkey.go. Without ArmoredPublicKey set, releases.ExactVersion falls back to the (now-expired) key embedded inside hc-install — see comment on pubkey.go for the full story.

simonfaltum · 2026-05-11T20:21:46Z

-            "provider_config": [],
+            "provider_config": [
+              {
+                "workspace_id": "[NUMID]"


Schema-driven change from v1.115 (technically already in v1.114): provider_config is no longer an empty list for jobs and pipelines — it now contains { workspace_id: ... }. Appears across many state fixtures in this PR (all acceptance/bundle/migrate/* state files, bundle/resources/jobs/update/out.state.terraform.json, and the deployment/bind/* outputs).

Not a CLI behavior change; the provider is just emitting the field now. Flagging so you don't have to chase down where it came from.

simonfaltum · 2026-05-11T20:21:46Z

  "path": "/api/2.0/postgres/[MY_PROJECT_ID]",
  "q": {
-    "update_mask": "spec"
+    "update_mask": "initial_endpoint_spec,spec"


Schema-driven change: v1.115 sends update_mask: "initial_endpoint_spec,spec" for databricks_postgres_project PATCH instead of just "spec". New provider behavior — worth confirming the backend accepts the expanded mask on a display_name-only update (this test only changes the display name; initial_endpoint_spec is unchanged but now included in the mask).

Confirmed this is not an issue.

tanmay-db · 2026-05-12T12:16:01Z


 type DataSourceAlertV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
+	WorkspaceId string `json:"workspace_id,omitempty"`


In Terraform, provider_config and workspace_id are made as optional+computed so every workspace resource in terraform will now have this set in the state.

I don't have context on the dabs side, does something similar need to happen here?

Would users see this diff when deploying bundles?

How are schemas/diff which are customized in terraform get translated in dabs?

Also does something needs to be done for direct mode?

pietern · 2026-05-12T11:13:18Z

+// Source: https://github.com/hashicorp/hc-install/blob/main/internal/pubkey/pubkey.go
+//
+//	(second -----BEGIN PGP PUBLIC KEY BLOCK----- block, added in PR #355)
+const hashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----


Can you bump to hc install 0.9.4 instead?

pietern · 2026-05-12T11:14:37Z

+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}


Are these additional calls expected?

For reference, the previous SDK bump removed them (the short circuit), so it makes sense they come back now that the short circuit is gone again: https://github.com/databricks/cli/pull/5031/changes

Similar comment thread in #5237.

hc-install 0.9.4 replaces the expired embedded HashiCorp pubkey (hashicorp/hc-install#372), so the codegen-local key override added in this PR is no longer needed. Co-authored-by: Isaac

pietern · 2026-05-13T09:37:43Z

  "path": "/api/2.0/postgres/[MY_PROJECT_ID]",
  "q": {
-    "update_mask": "spec"
+    "update_mask": "initial_endpoint_spec,spec"


Confirmed this is not an issue.

simonfaltum temporarily deployed to test-trigger-is May 11, 2026 20:17 — with GitHub Actions Inactive

simonfaltum commented May 11, 2026

View reviewed changes

simonfaltum mentioned this pull request May 11, 2026

Bump databricks-sdk-go to v0.132.0 #5237

Merged

7 tasks

tanmay-db reviewed May 12, 2026

View reviewed changes

Merge branch 'main' into simonfaltum/bump-tf-provider-1.115.0

411c90f

pietern temporarily deployed to test-trigger-is May 13, 2026 08:02 — with GitHub Actions Inactive

pietern reviewed May 13, 2026

View reviewed changes

codegen: bump hc-install 0.9.2 -> 0.9.4 and drop pubkey workaround

0584f02

hc-install 0.9.4 replaces the expired embedded HashiCorp pubkey (hashicorp/hc-install#372), so the codegen-local key override added in this PR is no longer needed. Co-authored-by: Isaac

pietern temporarily deployed to test-trigger-is May 13, 2026 08:14 — with GitHub Actions Inactive

Merge branch 'main' into simonfaltum/bump-tf-provider-1.115.0

a8513ee

pietern temporarily deployed to test-trigger-is May 13, 2026 09:26 — with GitHub Actions Inactive

pietern approved these changes May 13, 2026

View reviewed changes

pietern merged commit bbdf050 into main May 13, 2026
22 of 23 checks passed

pietern deleted the simonfaltum/bump-tf-provider-1.115.0 branch May 13, 2026 09:38

Conversation

simonfaltum commented May 11, 2026 • edited by pietern Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Changes

Test plan

Uh oh!

simonfaltum left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

simonfaltum commented May 11, 2026 •

edited by pietern

Loading