Infer Docker registry host from workspace profile

.nextchanges/cli/auth-docker-host.md

@@ -0,0 +1 @@
+* Deprecate `--region` in `databricks auth docker configure` ahead of its removal in the next release, infer the Artifact Registry region when it is omitted, and add `databricks auth docker host --profile <name>` to show the profile's registry host and credential-helper status. ([#6782](https://github.com/databricks/cli/pull/6782))

acceptance/cmd/auth/docker/configure-errors/output.txt

@@ -0,0 +1,23 @@
+
+=== Unsupported flag
+
+>>> musterr [CLI] auth docker configure docker-test --workspace-id [NUMID]
+Error: --workspace-id is not supported for auth docker configure. Select the workspace with [PROFILE] or --profile instead
+
+=== Profile argument and flag
+
+>>> musterr [CLI] auth docker configure docker-test --profile docker-test
+Error: argument "docker-test" cannot be combined with --profile. Use --profile instead
+
+=== Unsupported workspace host
+
+>>> musterr [CLI] auth docker configure unsupported-host
+Error: profile "unsupported-host" does not target a supported Databricks workspace host. Select a workspace profile, or create one with databricks auth login --host <workspace-url> --profile <name>
+
+=== Another profile already maps to the workspace
+
+>>> musterr [CLI] auth docker configure docker-test
+Error: multiple Databricks profiles match workspace ID [NUMID]: duplicate and docker-test. Remove duplicate workspace_id entries before using Docker credential helper
+
+=== Nothing changed
+Docker config not created; profiles unchanged

acceptance/cmd/auth/docker/configure-errors/script

@@ -0,0 +1,32 @@
+setup_docker_auth
+export DOCKER_CONFIG="$HOME/docker"
+
+cat >> "$HOME/.databrickscfg" <<ENDCFG
+
+[unsupported-host]
+host = https://workspace.example.test
+auth_type = databricks-cli
+
+[duplicate]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+workspace_id = 900800700600
+ENDCFG
+cp "$HOME/.databrickscfg" "$HOME/databrickscfg.before"
+
+title "Unsupported flag\n"
+trace musterr $CLI auth docker configure docker-test --workspace-id 900800700600
+
+title "Profile argument and flag\n"
+trace musterr $CLI auth docker configure docker-test --profile docker-test
+
+title "Unsupported workspace host\n"
+trace musterr $CLI auth docker configure unsupported-host
+
+title "Another profile already maps to the workspace\n"
+trace musterr $CLI auth docker configure docker-test
+
+title "Nothing changed\n"
+assert_not_exists.py "$DOCKER_CONFIG/config.json"
+cmp "$HOME/databrickscfg.before" "$HOME/.databrickscfg"
+printf 'Docker config not created; profiles unchanged\n'

acceptance/cmd/auth/docker/configure/output.txt

@@ -1,4 +1,49 @@
 
+>>> databricks auth docker host --profile docker-test
+Registry host: [NUMID].container.us-west-2.localhost
+Credential helper configured: NO
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+>>> databricks auth docker configure docker-test
+Configured Docker credential helper for [NUMID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
 === Docker config
 {
   "auths": {
@@ -7,17 +52,64 @@
     }
   },
   "credHelpers": {
-    "[NUMID].container.us-west-2.cloud.databricks.com": "databricks"
+    "[NUMID].container.us-west-2.localhost": "databricks"
   }
 }
 
-=== Installed shim
-Platform shim verified
+=== Profile with resolved workspace ID
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
 
-=== Credential from shim
+[docker-test]
+host         = [DATABRICKS_URL]
+auth_type    = databricks-cli
+workspace_id = [NUMID]
+
+>>> databricks auth docker host --profile docker-test --output json
+{
+  "host": "[NUMID].container.us-west-2.localhost",
+  "configured": true
+}
+
+>>> print_requests.py --get //api
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
 
 >>> docker-credential-databricks get
 {
   "Secret": "oauth-token",
   "Username": "oauthtoken"
 }
+
+>>> musterr docker-credential-databricks erase
+docker-credential-databricks only supports get
+
+=== Configure again
+Docker config unchanged
+
+>>> print_requests.py --get //api
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+=== Deprecated --region flag skips workspace lookups
+
+>>> databricks auth docker configure docker-test --region us-west-2
+Flag --region has been deprecated, --region will be fully removed in the next release
+Configured Docker credential helper for [NUMID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+No requests sent

acceptance/cmd/auth/docker/configure/script

@@ -1,44 +1,38 @@
 setup_docker_auth
-
-mkdir -p "$HOME/.databricks"
-cp "$TESTDIR/../token/token-cache.json" "$HOME/.databricks/token-cache.json"
-cp profile.databrickscfg "$HOME/.databrickscfg"
+install_databricks_cli
 
 export DOCKER_CONFIG="$HOME/docker"
 mkdir -p "$DOCKER_CONFIG"
 cp docker-config.json "$DOCKER_CONFIG/config.json"
 
-mkdir -p "$HOME/bin"
-if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
-    cli_path="$HOME/bin/databricks.exe"
-    cp "$(cygpath -u "$CLI")" "$cli_path"
-    helper="$HOME/bin/docker-credential-databricks.cmd"
-else
-    cli_path="$HOME/bin/databricks"
-    cp "$CLI" "$cli_path"
-    chmod +x "$cli_path"
-    helper="$HOME/bin/docker-credential-databricks"
-fi
-export PATH="$(dirname "$helper"):$PATH"
-
-"$cli_path" auth docker configure docker-test --region us-west-2 >LOG.configure 2>&1
+trace databricks auth docker host --profile docker-test
+trace print_requests.py --get //api
+
+trace databricks auth docker configure docker-test
+trace print_requests.py --get //api
 
 title "Docker config\n"
 jq -S . "$DOCKER_CONFIG/config.json"
 
-title "Installed shim\n"
-if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
-    test -f "$helper"
-else
-    test -x "$helper"
-fi
-printf 'Platform shim verified\n'
-
-title "Credential from shim\n"
-cat > "$HOME/.databrickscfg" <<ENDCFG
-[docker-test]
-host = $DATABRICKS_HOST_ORIG
-auth_type = databricks-cli
-workspace_id = 123456789
-ENDCFG
-printf '%s\n' "$TEST_DAR_REGISTRY_HOST" | trace docker-credential-databricks get | jq -S .
+title "Profile with resolved workspace ID\n"
+cat "$HOME/.databrickscfg"
+
+trace databricks auth docker host --profile docker-test --output json | tee "$HOME/host.json"
+trace print_requests.py --get //api
+
+registry_host=$(jq -r .host "$HOME/host.json")
+printf '%s\n' "$registry_host" | trace docker-credential-databricks get | jq -S .
+
+trace musterr docker-credential-databricks erase
+
+title "Configure again\n"
+cp "$DOCKER_CONFIG/config.json" "$HOME/config.before.json"
+databricks auth docker configure docker-test &>LOG.configure-again
+cmp "$HOME/config.before.json" "$DOCKER_CONFIG/config.json"
+printf 'Docker config unchanged\n'
+trace print_requests.py --get //api
+
+title "Deprecated --region flag skips workspace lookups\n"
+trace databricks auth docker configure docker-test --region us-west-2
+assert_not_exists.py "$OUT_REQUESTS"
+printf 'No requests sent\n'

acceptance/cmd/auth/docker/configure/test.toml

@@ -1,10 +1,5 @@
-Ignore = [
-    "home",
-]
-
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
-
-Timeout = "15s"
+RecordRequests = true
+IncludeRequestHeaders = ["X-Databricks-Workspace-Id"]
 
 # git-bash can't resolve/exec the installed .cmd shim on Windows; that path is
 # covered by Go unit tests in libs/dockercredentials. Run this end-to-end on Unix.

acceptance/cmd/auth/docker/help/output.txt

@@ -42,6 +42,7 @@ Usage:
 
 Available Commands:
   configure   (Experimental) Configure Docker authentication for Databricks Artifact Registry
+  host        (Experimental) Show the registry host and credential helper status for a profile
   token       (Experimental) Generate a Docker credential
 
 Flags:
@@ -57,3 +58,54 @@ Global Flags:
       --workspace-id string   Databricks Workspace ID
 
 Use "databricks auth docker [command] --help" for more information about a command.
+
+>>> [CLI] auth docker configure --help
+(Experimental) Configure Docker authentication for Databricks Artifact Registry.
+
+This command installs docker-credential-databricks and configures Docker to use
+it for the selected workspace's Artifact Registry host. If the selected profile
+does not already include a workspace_id, the command resolves and saves it so
+the Docker helper can map the registry host back to the profile. The registry
+region is inferred from the workspace's metastore. Select the workspace with
+[PROFILE] or --profile; --host, --account-id, and --workspace-id are not
+supported. The deprecated --region flag is retained for compatibility; omit it
+because it will be fully removed in the next release.
+
+Usage:
+  databricks auth docker configure [PROFILE] [flags]
+
+Flags:
+  -h, --help            help for configure
+      --region string   Artifact Registry region; we recommend omitting this flag because the region is inferred automatically (DEPRECATED: --region will be fully removed in the next release)
+
+Global Flags:
+      --account-id string     Databricks Account ID
+      --debug                 enable debug logging
+      --host string           Databricks Host
+  -o, --output type           output type: text or json (default text)
+  -p, --profile string        ~/.databrickscfg profile
+  -t, --target string         bundle target to use (if applicable)
+      --workspace-id string   Databricks Workspace ID
+
+>>> [CLI] auth docker host --help
+(Experimental) Show the Databricks Artifact Registry host and Docker credential helper status for a profile.
+
+The --profile flag is required.
+
+Usage:
+  databricks auth docker host [flags]
+
+Examples:
+  databricks auth docker host --profile DEFAULT
+
+Flags:
+  -h, --help   help for host
+
+Global Flags:
+      --account-id string     Databricks Account ID
+      --debug                 enable debug logging
+      --host string           Databricks Host
+  -o, --output type           output type: text or json (default text)
+  -p, --profile string        ~/.databrickscfg profile
+  -t, --target string         bundle target to use (if applicable)
+      --workspace-id string   Databricks Workspace ID

acceptance/cmd/auth/docker/help/script

@@ -1,2 +1,4 @@
 trace "$CLI" auth --help
 trace "$CLI" auth docker --help
+trace "$CLI" auth docker configure --help
+trace "$CLI" auth docker host --help

acceptance/cmd/auth/docker/host/docker-config.json

@@ -0,0 +1,3 @@
+{
+  "credsStore": "databricks"
+}

acceptance/cmd/auth/docker/host/output.txt

@@ -0,0 +1,32 @@
+
+=== Profile required
+
+>>> musterr [CLI] auth docker host
+Error: --profile is required for auth docker host
+
+=== Workspace profile required
+
+>>> musterr [CLI] auth docker host --profile account
+Error: profile "account" does not target a workspace. Run databricks auth login --host <workspace-url> and retry with that profile
+
+=== Unsupported workspace host
+
+>>> musterr [CLI] auth docker host --profile unsupported-host
+Error: profile "unsupported-host" does not target a supported Databricks workspace host. Select a workspace profile, or create one with databricks auth login --host <workspace-url> --profile <name>
+
+=== Credential helper not configured
+
+>>> [CLI] auth docker host --profile docker-test
+Registry host: [NUMID].container.us-west-2.localhost
+Credential helper configured: NO
+
+=== Credential helper configured as the default store
+
+>>> [CLI] auth docker host --profile docker-test --output json
+{
+  "host": "[NUMID].container.us-west-2.localhost",
+  "configured": true
+}
+
+=== Profiles unchanged
+Workspace ID not saved