[Fix] Suppress options.pem_private_key_expiration_epoch_sec attribute for databricks_connection

[840]

Suppress options.pem_private_key_expiration_epoch_sec attribute from API to prevent drift when creating a Snowflake connection using pem_private_key.

Resolves #4471

Changes

Add suppressPemPrivateKeyExpiration function. When options.pem_private_key_expiration_epoch_sec exists, we suppress for options.pem_private_key_expiration_epoch_sec.

Tests

Tested in my local environment.

First run:

> terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are
indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # databricks_connection.this will be created
  + resource "databricks_connection" "this" {
      + connection_type = "SNOWFLAKE"
      + id              = (known after apply)
      + metastore_id    = (known after apply)
      + name            = "<REDACTED>"
      + options         = (sensitive value)
      + owner           = (known after apply)
      + read_only       = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

databricks_connection.this: Creating...
databricks_connection.this: Creation complete after 1s [id=<REDACTED>|<REDACTED>]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Subsequent run:

> terraform apply

databricks_connection.this: Refreshing state... [id=<REDACTED>|<REDACTED>]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so
no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Changing another variable within options inside Terraform code:

> terraform apply

databricks_connection.this: Refreshing state... [id=<REDACTED>|<REDACTED>]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # databricks_connection.this will be updated in-place
  ~ resource "databricks_connection" "this" {
        id              = "<REDACTED>|<REDACTED>"
        name            = "<REDACTED>"
      ~ options         = (sensitive value)
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

databricks_connection.this: Modifying... [id=<REDACTED>|<REDACTED>]
databricks_connection.this: Modifications complete after 1s [id=<REDACTED>|<REDACTED>]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

• make test run locally
• relevant change in docs/ folder
• covered with integration tests in internal/acceptance
• using Go SDK
• using TF Plugin Framework

[nkvuong]

would it work if we set this field to optional+computed?

[840]

I've tried this initially, but it seems that because pem_private_key_expiration_epoch_sec is not defined in the Schema directly. I cannot call something like:

common.MustSchemaPath(m, "options", "pem_private_key_expiration_epoch_sec").Optional = true
common.MustSchemaPath(m, "options", "pem_private_key_expiration_epoch_sec").Computed = true

Error:

Stack trace from the terraform-provider-databricks plugin:

panic: options is not nested resource

goroutine 1 [running]:
github.com/databricks/terraform-provider-databricks/common.MustSchemaPath(...)
        /terraform-provider-databricks/common/reflect_resource.go:232
github.com/databricks/terraform-provider-databricks/catalog.ResourceConnection.func1(0x140003abce0)
        /terraform-provider-databricks/catalog/resource_connection.go:61 +0x14c
github.com/databricks/terraform-provider-databricks/common.StructToSchema({0x105685920?, 0x1400033fb80?}, 0x105720028)
        /terraform-provider-databricks/common/reflect_resource.go:257 +0x1d4
github.com/databricks/terraform-provider-databricks/catalog.ResourceConnection()
        /terraform-provider-databricks/catalog/resource_connection.go:58 +0x80
github.com/databricks/terraform-provider-databricks/internal/providers/sdkv2.DatabricksProvider({0x0, 0x0, 0x0})
        /terraform-provider-databricks/internal/providers/sdkv2/sdkv2.go:146 +0x5180
github.com/databricks/terraform-provider-databricks/internal/providers.GetProviderServer({0x105736400, 0x106239440}, {0x0, 0x0, 0x14000131ed8?})
        /terraform-provider-databricks/internal/providers/providers.go:78 +0xa4
main.main()
        /terraform-provider-databricks/main.go:41 +0x268

Need to tinker a bit more

[alexott]

do we have any environment to test it?

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/terraform

Inputs:

• PR number: 4474
• Commit SHA: 1485d4212e8ebb1041dace0870939165e191371d

Checks will be approved automatically on success.