Add direct-mode bundle support for AI Gateway securables - #6410
Open
alex-khakhlyuk wants to merge 3 commits into
Open
Add direct-mode bundle support for AI Gateway securables#6410alex-khakhlyuk wants to merge 3 commits into
alex-khakhlyuk wants to merge 3 commits into
Conversation
Add three Unity Catalog AI Gateway securables as Databricks Asset Bundle
resources on the direct deployment engine: model_service, mcp_service,
and model_provider_service.
Each resource follows the existing direct-engine pattern (cf. volume /
database_instance):
- bundle/config/resources/<r>.go: a flat state struct exposing the
immutable identity (parent + <r>_id, which the server composes into the
resource name) plus the mutable comment/config body. The SDK models the
identity inputs as URL params, so the create request cannot be embedded
directly.
- bundle/direct/dresources/<r>.go: CRUD mapped 1:1 onto the SDK AiGateway
service (Create/Get/Update/Delete). The engine tracks the bare
{catalog}.{schema}.{leaf} id and re-adds the resource name prefix at
each call; DoRead reconstructs the identity from the server-returned
name so it participates in drift detection.
resources.yml classification: parent + <r>_id are provided id fields
(immutable, recreate on change); model_provider_service.config.provider_type
is immutable (recreate); output-only config fields (inference_table.*,
mcp source_connection.is_deleted) and the write-only provider secrets
(*.plaintext, never returned by GET) are suppressed to avoid phantom drift.
Wires up registration, the resource test server, the generated schema,
and the shared "all resources" coverage tests. Builds and the
dresources/config/testserver unit tests pass.
Follow-up (not in this commit): acceptance tests, invariant configs,
bind/unbind tests, and live-cloud validation (including confirming the
model_provider_service update mask is accepted over the immutable
provider_type field).
Co-authored-by: Isaac <no-reply@databricks.com>
alex-khakhlyuk
marked this pull request as ready for review
August 28, 2026 11:25
Contributor
Approval status: pending
|
…e resources Test coverage for the model_services, mcp_services, and model_provider_services direct-engine bundle resources, all running offline against the libs/testserver fakes: - Acceptance tests (acceptance/bundle/resources/<r>/): a `basic` subtest (deploy -> summary -> read -> update comment in place -> plan a recreate on an immutable field -> destroy) and a `remote-delete` subtest (out-of-band delete -> plan detects drift). Pinned to the direct engine via EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] since these resources have no terraform converter (cf. genie_spaces). - Invariant configs (acceptance/bundle/invariant/configs/*.yml.tmpl) wired into the invariant matrix; excluded from the cloud run (no routing target / provider / connection is provisioned there) and from the migrate test (direct-only resources can't be terraform-seeded), matching genie_space / cluster_policy. - Bind/unbind tests (acceptance/bundle/deployment/bind/<r>/), with a [[Server]] GET stub so bind sees the remote resource. The invariant no_drift test also confirms the resources.yml output-only / secret suppression works: the model_provider_service's write-only config.custom.direct.api_key.plaintext produces no post-deploy drift. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
An authorized user can trigger integration tests manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Databricks Asset Bundle support (direct deployment engine) for three Unity Catalog AI Gateway securables, so they can be declared and deployed from
databricks.yml:model_services— AI Gateway model servicemcp_services— AI Gateway MCP servicemodel_provider_services— AI Gateway model provider serviceWhat's included
For each resource, following the existing direct-engine pattern (cf.
volume/database_instance):bundle/config/resources/<r>.go— config/state struct implementingConfigResource(Exists,TerraformResourceName,ResourceDescription, etc.). A flat struct exposes the immutable identity (parent+<r>_id, which the server composes into the resource name) plus the mutablecomment/configbody; the SDK models the identity inputs as URL params, so the create request can't be embedded directly.bundle/direct/dresources/<r>.go— CRUD mapped 1:1 onto theAiGatewayservice indatabricks-sdk-go(Create/Get/Update/Delete). The engine tracks the bare{catalog}.{schema}.{leaf}id and re-adds the resource-name prefix at each call;DoReadreconstructs the identity from the server-returned name so it participates in drift detection.resources.ymlclassification —parent+<r>_idas immutable id fields;model_provider_service.config.provider_typeis immutable (recreate); output-only config fields (inference_table.*,source_connection.is_deleted) and the write-only provider secrets (*.plaintext, never returned by GET) are suppressed to avoid phantom drift.bundle/config/resources.go,bundle/direct/dresources/all.go), a resource test server implementation (libs/testserver/), regenerated schema, and updates to the shared "all resources" coverage tests.Owner is deferred (the API returns
effective_owner), permissions use grants rather than bundle permissions (classified inunsupportedResources), and there is no Catalog Explorer URL wired up yet.Status
Draft.
go build ./...andgo test ./bundle/direct/dresources/ ./bundle/config/... ./libs/testserver/pass (full create/read/update/delete/drift per resource).Live-cloud smoke test (direct engine,
model_provider_service, staging workspace): full CRUD verified.bundle deploycreated the resource, editing a field + redeploying updated it, andbundle destroydeleted it (confirmed gone). This also confirms the["comment","config"]update mask is accepted over the immutableprovider_type— no mask narrowing needed.model_service/mcp_serviceshare the identical direct-engine code path (not separately deployed here; they need a routing target / UC connection to create).Remaining before merge-ready (per
bundle/direct/dresources/README.md):acceptance/bundle/resources/<r>/—basic(deploy/summary/update-in-place/recreate-on-immutable) +remote-delete(drift) for all three resourcesacceptance/bundle/invariant/configs/*.yml.tmpl) and bind/unbind tests (acceptance/bundle/deployment/bind/*)model_provider_service(see above)