Add direct-mode bundle support for AI Gateway securables - #6410
Closed
alex-khakhlyuk wants to merge 3 commits into
Closed
Add direct-mode bundle support for AI Gateway securables#6410alex-khakhlyuk wants to merge 3 commits into
alex-khakhlyuk wants to merge 3 commits into
Conversation
Add three Unity Catalog AI Gateway securables as Databricks Asset Bundle
resources on the direct deployment engine: model_service, mcp_service,
and model_provider_service.
Each resource follows the existing direct-engine pattern (cf. volume /
database_instance):
- bundle/config/resources/<r>.go: a flat state struct exposing the
immutable identity (parent + <r>_id, which the server composes into the
resource name) plus the mutable comment/config body. The SDK models the
identity inputs as URL params, so the create request cannot be embedded
directly.
- bundle/direct/dresources/<r>.go: CRUD mapped 1:1 onto the SDK AiGateway
service (Create/Get/Update/Delete). The engine tracks the bare
{catalog}.{schema}.{leaf} id and re-adds the resource name prefix at
each call; DoRead reconstructs the identity from the server-returned
name so it participates in drift detection.
resources.yml classification: parent + <r>_id are provided id fields
(immutable, recreate on change); model_provider_service.config.provider_type
is immutable (recreate); output-only config fields (inference_table.*,
mcp source_connection.is_deleted) and the write-only provider secrets
(*.plaintext, never returned by GET) are suppressed to avoid phantom drift.
Wires up registration, the resource test server, the generated schema,
and the shared "all resources" coverage tests. Builds and the
dresources/config/testserver unit tests pass.
Follow-up (not in this commit): acceptance tests, invariant configs,
bind/unbind tests, and live-cloud validation (including confirming the
model_provider_service update mask is accepted over the immutable
provider_type field).
Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
marked this pull request as ready for review
August 28, 2026 11:25
Contributor
Approval status: pending
|
…e resources Test coverage for the model_services, mcp_services, and model_provider_services direct-engine bundle resources, all running offline against the libs/testserver fakes: - Acceptance tests (acceptance/bundle/resources/<r>/): a `basic` subtest (deploy -> summary -> read -> update comment in place -> plan a recreate on an immutable field -> destroy) and a `remote-delete` subtest (out-of-band delete -> plan detects drift). Pinned to the direct engine via EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] since these resources have no terraform converter (cf. genie_spaces). - Invariant configs (acceptance/bundle/invariant/configs/*.yml.tmpl) wired into the invariant matrix; excluded from the cloud run (no routing target / provider / connection is provisioned there) and from the migrate test (direct-only resources can't be terraform-seeded), matching genie_space / cluster_policy. - Bind/unbind tests (acceptance/bundle/deployment/bind/<r>/), with a [[Server]] GET stub so bind sees the remote resource. The invariant no_drift test also confirms the resources.yml output-only / secret suppression works: the model_provider_service's write-only config.custom.direct.api_key.plaintext produces no post-deploy drift. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
An authorized user can trigger integration tests manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
4 tasks
alex-khakhlyuk
added a commit
to alex-khakhlyuk/cli
that referenced
this pull request
Sep 3, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of databricks#6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 4, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 4, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
to alex-khakhlyuk/cli
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of databricks#6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
to alex-khakhlyuk/cli
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of databricks#6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 10, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of #6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. - Wired model_services into the direct-only Terraform-lifecycle ignore list and the statemgmt full-resource-coverage test suite, and fully populated the SDK struct literals so the dresources exhaustruct lint passes. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
Second of a stacked split of #6410 (databricks/cli), stacked on the model_service PR. Adds the direct-engine bundle resource for the AI Gateway MCP service securable (mcp_services): config/resource + dresources CRUD, testserver, acceptance (basic + remote-delete + bind) and an invariant config, plus registration and regenerated schema. All SDK struct literals set every field to satisfy exhaustruct; mcp_services added to the TF-lifecycle ignore list and the statemgmt full-resource-coverage fixtures. Direct engine only. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
Third and last of the stacked split of #6410 (stacked on the mcp_service PR). Direct engine only; provider_type is immutable (recreate) and write-only provider secrets + server-computed fields are suppressed to avoid phantom drift. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
…ice, model_provider_service) Follow-up to the #6410 split. Wires UC grants (the `grants` field + `.grants` sub-resource) into all three AI Gateway securables, mirroring volumes/registered_models: the `Grants` field on each resource config, the resource->securable_type mapping (model_service/mcp_service/ model_provider_service), and the direct-engine grants sub-resource registration. Stacked on the model_provider_service branch. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 11, 2026
…ice, model_provider_service) Follow-up to the #6410 split. Wires UC grants (the `grants` field + `.grants` sub-resource) into all three AI Gateway securables, mirroring volumes/registered_models: the `Grants` field on each resource config, the resource->securable_type mapping (model_service/mcp_service/ model_provider_service), and the direct-engine grants sub-resource registration. Stacked on the model_provider_service branch. Co-authored-by: Isaac <no-reply@databricks.com>
pranshupand-db
pushed a commit
to pranshupand-db/cli
that referenced
this pull request
Sep 11, 2026
…ks#6525) Adds direct-engine Databricks Asset Bundle support for the Unity Catalog AI Gateway model service securable (model_services), so it can be declared and deployed from databricks.yml. First of a stacked split of databricks#6410 (mcp_services and model_provider_services follow). Direct engine only. - bundle/config/resources/model_service.go: flat ConfigResource exposing the immutable parent + model_service_id identity plus the mutable comment/config body. - bundle/direct/dresources/model_service.go: CRUD onto the AiGateway service; DoRead reconstructs identity from the server-derived name so it participates in drift detection. - resources.yml: parent + model_service_id as immutable id fields; the server-computed output-only config fields (inference_table.table/is_deleted and routing.destinations[*]/fallback.destinations[*].is_deleted) suppressed to avoid phantom drift. - Registration, testserver implementation, regenerated schema, acceptance (basic + remote-delete + bind), and an invariant config. Scope is strictly model_service: no changes to jobs suppression or other resources. Owner is deferred (the API returns effective_owner); permissions use grants; no Catalog Explorer URL is wired up yet. ## Changes <!-- Brief summary of your changes that is easy to understand --> ## Why <!-- Why are these changes needed? Provide the context that the reviewer might be missing. For example, were there any decisions behind the change that are not reflected in the code itself? --> ## Tests <!-- How have you tested the changes? --> <!-- If your PR needs to be included in the release notes for next release, add a changelog fragment: create .nextchanges/<section>/<name>.md with a one-line description (e.g. .nextchanges/cli/quickstart.md). See .nextchanges/README.md. --> Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
Second of a stacked split of #6410 (databricks/cli), stacked on the model_service PR. Adds the direct-engine bundle resource for the AI Gateway MCP service securable (mcp_services): config/resource + dresources CRUD, testserver, acceptance (basic + remote-delete + bind) and an invariant config, plus registration and regenerated schema. All SDK struct literals set every field to satisfy exhaustruct; mcp_services added to the TF-lifecycle ignore list and the statemgmt full-resource-coverage fixtures. Direct engine only. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
Third and last of the stacked split of #6410 (stacked on the mcp_service PR). Direct engine only; provider_type is immutable (recreate) and write-only provider secrets + server-computed fields are suppressed to avoid phantom drift. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
Second of a stacked split of #6410 (databricks/cli), stacked on the model_service PR. Adds the direct-engine bundle resource for the AI Gateway MCP service securable (mcp_services): config/resource + dresources CRUD, testserver, acceptance (basic + remote-delete + bind) and an invariant config, plus registration and regenerated schema. All SDK struct literals set every field to satisfy exhaustruct; mcp_services added to the TF-lifecycle ignore list and the statemgmt full-resource-coverage fixtures. Direct engine only. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
Third and last of the stacked split of #6410 (stacked on the mcp_service PR). Direct engine only; provider_type is immutable (recreate) and write-only provider secrets + server-computed fields are suppressed to avoid phantom drift. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
…ice, model_provider_service) Follow-up to the #6410 split. Wires UC grants (the `grants` field + `.grants` sub-resource) into all three AI Gateway securables, mirroring volumes/registered_models: the `Grants` field on each resource config, the resource->securable_type mapping (model_service/mcp_service/ model_provider_service), and the direct-engine grants sub-resource registration. Stacked on the model_provider_service branch. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
Third and last of the stacked split of #6410 (stacked on the mcp_service PR). Direct engine only; provider_type is immutable (recreate) and write-only provider secrets + server-computed fields are suppressed to avoid phantom drift. Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
added a commit
that referenced
this pull request
Sep 14, 2026
…ice, model_provider_service) Follow-up to the #6410 split. Wires UC grants (the `grants` field + `.grants` sub-resource) into all three AI Gateway securables, mirroring volumes/registered_models: the `Grants` field on each resource config, the resource->securable_type mapping (model_service/mcp_service/ model_provider_service), and the direct-engine grants sub-resource registration. Stacked on the model_provider_service branch. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Databricks Asset Bundle support (direct deployment engine) for three Unity Catalog AI Gateway securables, so they can be declared and deployed from
databricks.yml:model_services— AI Gateway model servicemcp_services— AI Gateway MCP servicemodel_provider_services— AI Gateway model provider serviceWhat's included
For each resource, following the existing direct-engine pattern (cf.
volume/database_instance):bundle/config/resources/<r>.go— config/state struct implementingConfigResource(Exists,TerraformResourceName,ResourceDescription, etc.). A flat struct exposes the immutable identity (parent+<r>_id, which the server composes into the resource name) plus the mutablecomment/configbody; the SDK models the identity inputs as URL params, so the create request can't be embedded directly.bundle/direct/dresources/<r>.go— CRUD mapped 1:1 onto theAiGatewayservice indatabricks-sdk-go(Create/Get/Update/Delete). The engine tracks the bare{catalog}.{schema}.{leaf}id and re-adds the resource-name prefix at each call;DoReadreconstructs the identity from the server-returned name so it participates in drift detection.resources.ymlclassification —parent+<r>_idas immutable id fields;model_provider_service.config.provider_typeis immutable (recreate); output-only config fields (inference_table.*,source_connection.is_deleted) and the write-only provider secrets (*.plaintext, never returned by GET) are suppressed to avoid phantom drift.bundle/config/resources.go,bundle/direct/dresources/all.go), a resource test server implementation (libs/testserver/), regenerated schema, and updates to the shared "all resources" coverage tests.Owner is deferred (the API returns
effective_owner), permissions use grants rather than bundle permissions (classified inunsupportedResources), and there is no Catalog Explorer URL wired up yet.Status
Draft.
go build ./...andgo test ./bundle/direct/dresources/ ./bundle/config/... ./libs/testserver/pass (full create/read/update/delete/drift per resource).Live-cloud smoke test (direct engine,
model_provider_service, staging workspace): full CRUD verified.bundle deploycreated the resource, editing a field + redeploying updated it, andbundle destroydeleted it (confirmed gone). This also confirms the["comment","config"]update mask is accepted over the immutableprovider_type— no mask narrowing needed.model_service/mcp_serviceshare the identical direct-engine code path (not separately deployed here; they need a routing target / UC connection to create).Remaining before merge-ready (per
bundle/direct/dresources/README.md):acceptance/bundle/resources/<r>/—basic(deploy/summary/update-in-place/recreate-on-immutable) +remote-delete(drift) for all three resourcesacceptance/bundle/invariant/configs/*.yml.tmpl) and bind/unbind tests (acceptance/bundle/deployment/bind/*)model_provider_service(see above)