Entitlements are not applied to account groups #488
Assignees
Labels
migrate/groups
Corresponds to Migrate Groups Step of go/uc/upgrade
Comments
pohlposition
added
the
migrate/groups
nfx
pushed a commit
that referenced
this issue
Nov 3, 2023
Addresses the issues in #488 . **Problem Statement** - Setup: - We have a ws and acc group. - Ws group has an entitlement - Crawler: - During the inventorization, the entitlement is saved into the inventory without any issues into a Permissions object with `object_type="entitlements"` and `object_id="workspace_group_id"` - Appy to backups: - Backup group is created - Entitlements are applied to the backup group - Replace: - Simply replaces the groups - Apply to acc groups (separate task) - **Migration state** becomes lost and there is no link between the workspace group id and the acc group id anymore. - Since there is no linkage in the migration state, the `is_item_relevant` method returns `None`, therefore it won’t apply the proper group entitlements. **Design** Together with @william-conti we've decided that the `migration_state` object needs to be persisted across the `replace` and `apply_to_account` tasks to properly save the state and avoid losing the logical association between ws and acc groups. --------- Co-authored-by: William Conti <william.conti@databricks.com>
FastLee
pushed a commit
that referenced
this issue
Nov 8, 2023
Addresses the issues in #488 . **Problem Statement** - Setup: - We have a ws and acc group. - Ws group has an entitlement - Crawler: - During the inventorization, the entitlement is saved into the inventory without any issues into a Permissions object with `object_type="entitlements"` and `object_id="workspace_group_id"` - Appy to backups: - Backup group is created - Entitlements are applied to the backup group - Replace: - Simply replaces the groups - Apply to acc groups (separate task) - **Migration state** becomes lost and there is no link between the workspace group id and the acc group id anymore. - Since there is no linkage in the migration state, the `is_item_relevant` method returns `None`, therefore it won’t apply the proper group entitlements. **Design** Together with @william-conti we've decided that the `migration_state` object needs to be persisted across the `replace` and `apply_to_account` tasks to properly save the state and avoid losing the logical association between ws and acc groups. --------- Co-authored-by: William Conti <william.conti@databricks.com>
|
Fixed in v0.6.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Entitlements are correctly applied to the backup groups but not account groups.
The text was updated successfully, but these errors were encountered: