Detect mismatch between host defined in config and env variable

NEXT_CHANGELOG.md

@@ -11,5 +11,6 @@
 * Added support for volumes in deployment bind/unbind commands ([#2527](https://github.com/databricks/cli/pull/2527))
 * Added support for dashboards in deployment bind/unbind commands ([#2516](https://github.com/databricks/cli/pull/2516))
 * Added support for registered models in deployment bind/unbind commands ([#2556](https://github.com/databricks/cli/pull/2556))
+* Added a mismatch check when host is defined in config and as an env variable ([#2549](https://github.com/databricks/cli/pull/2549))
 
 ### API Changes

acceptance/auth/bundle_and_env/.databrickscfg

@@ -0,0 +1,5 @@
+[DEFAULT]
+host = https://bar.com
+
+[profile_with_matching_host]
+host = $DATABRICKS_HOST

acceptance/auth/bundle_and_env/databricks.yml

@@ -0,0 +1,11 @@
+bundle:
+  name: test-auth
+
+targets:
+  match:
+    default: true
+    workspace:
+      host: $DATABRICKS_HOST
+  not_match:
+    workspace:
+      host: https://foo.com

acceptance/auth/bundle_and_env/output.txt

@@ -0,0 +1,35 @@
+
+=== Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation not OK (env-defined host doesn't match bundle host)
+>>> errcode [CLI] bundle validate -t not_match
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_HOST], but CLI configured to use https://foo.com
+
+Name: test-auth
+Target: not_match
+Workspace:
+  Host: https://foo.com
+
+Found 1 error
+
+Exit code: 1
+
+=== Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation OK (env-defined host matches bundle host)
+>>> errcode [CLI] bundle validate -t match
+Name: test-auth
+Target: match
+Workspace:
+  Host: [DATABRICKS_HOST]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-auth/match
+
+Validation OK!
+
+=== Bundle commands load bundle configuration with -p flag with DATABRICKS_HOST defined, host in profile matches bundle host but env-defined host doesn't
+>>> errcode [CLI] bundle validate -t match -p profile_with_matching_host
+Name: test-auth
+Target: match
+Workspace:
+  Host: [DATABRICKS_HOST]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-auth/match
+
+Validation OK!

acceptance/auth/bundle_and_env/script

@@ -0,0 +1,15 @@
+# Replace placeholder with an actual host URL
+envsubst < databricks.yml > out.yml && mv out.yml databricks.yml
+envsubst < .databrickscfg > out && mv out .databrickscfg
+
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+title "Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation not OK (env-defined host doesn't match bundle host)"
+trace errcode $CLI bundle validate -t not_match
+
+title "Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation OK (env-defined host matches bundle host)"
+trace errcode $CLI bundle validate -t match
+
+export DATABRICKS_HOST="https://baz.com"
+title "Bundle commands load bundle configuration with -p flag with DATABRICKS_HOST defined, host in profile matches bundle host but env-defined host doesn't"
+trace errcode $CLI bundle validate -t match -p profile_with_matching_host

acceptance/auth/bundle_and_env/test.toml

@@ -0,0 +1,5 @@
+# Some of the clouds have DATABRICKS_HOST variable setup without https:// prefix
+# In the result, output is replaced with DATABRICKS_URL variable instead of DATABRICKS_HOST
+[[Repls]]
+Old='DATABRICKS_URL'
+New='DATABRICKS_HOST'

acceptance/bundle/debug/out.stderr.txt

@@ -17,7 +17,6 @@
 10:07:59 Debug: Apply pid=12345 mutator=<func>
 10:07:59 Info: Phase: initialize pid=12345
 10:07:59 Debug: Apply pid=12345 mutator=validate:AllResourcesHaveValues
-10:07:59 Debug: Apply pid=12345 mutator=validate:interpolation_in_auth_config
 10:07:59 Debug: Apply pid=12345 mutator=RewriteSyncPaths
 10:07:59 Debug: Apply pid=12345 mutator=SyncDefaultPath
 10:07:59 Debug: Apply pid=12345 mutator=SyncInferRoot

acceptance/bundle/variables/host/output.txt

@@ -7,19 +7,14 @@ Warning: Variable interpolation is not supported for fields that configure authe
 Interpolation is not supported for the field workspace.host. Please set
 the DATABRICKS_HOST environment variable if you wish to configure this field at runtime.
 
-Error: failed during request visitor: parse "https://${var.host}": invalid character "{" in host name
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_URL], but CLI configured to use ${var.host}
 
 {
   "bundle": {
     "environment": "default",
     "name": "host",
     "target": "default"
   },
-  "sync": {
-    "paths": [
-      "."
-    ]
-  },
   "targets": null,
   "variables": {
     "host": {
@@ -41,7 +36,7 @@ Warning: Variable interpolation is not supported for fields that configure authe
 Interpolation is not supported for the field workspace.host. Please set
 the DATABRICKS_HOST environment variable if you wish to configure this field at runtime.
 
-Error: failed during request visitor: parse "https://${var.host}": invalid character "{" in host name
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_URL], but CLI configured to use ${var.host}
 
 Name: host
 Target: default

bundle/config/workspace.go

@@ -1,10 +1,12 @@
 package config
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
 	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/workspace"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/marshal"
@@ -148,9 +150,34 @@ func (w *Workspace) Client() (*databricks.WorkspaceClient, error) {
 		}
 	}
 
+	if w.Host != "" && w.Profile == "" {
+		err := validateConfigAndEnvHost(cfg)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	return databricks.NewWorkspaceClient((*databricks.Config)(cfg))
 }
 
+func validateConfigAndEnvHost(cfg *config.Config) error {
+	var hostEnvName, hostEnvVal string
+	for _, attr := range config.ConfigAttributes {
+		if attr.Name == "host" {
+			hostEnvVal, hostEnvName = attr.ReadEnv()
+			break
+		}
+	}
+	if hostEnvName == "" || hostEnvVal == "" {
+		return nil
+	}
+
+	if !workspace.MatchHost(hostEnvVal, cfg.Host) {
+		return fmt.Errorf("config host mismatch: %s is defined as %s, but CLI configured to use %s", hostEnvName, hostEnvVal, cfg.Host)
+	}
+	return nil
+}
+
 func init() {
 	arg0 := os.Args[0]
 

bundle/phases/initialize.go

@@ -27,7 +27,6 @@ func Initialize(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 
 	return bundle.ApplySeq(ctx, b,
 		validate.AllResourcesHaveValues(),
-		validate.NoInterpolationInAuthConfig(),
 
 		// Update all path fields in the sync block to be relative to the bundle root path.
 		mutator.RewriteSyncPaths(),

cmd/root/bundle.go

@@ -2,12 +2,16 @@ package root
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/env"
 	"github.com/databricks/cli/bundle/phases"
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
 	envlib "github.com/databricks/cli/libs/env"
 	"github.com/spf13/cobra"
 	"golang.org/x/exp/maps"
@@ -94,6 +98,8 @@ func configureBundle(cmd *cobra.Command, b *bundle.Bundle) (*bundle.Bundle, diag
 		return b, diags
 	}
 
+	diags = diags.Extend(checkVariablesInAuthFields(b))
+
 	// Set the auth configuration in the command context. This can be used
 	// downstream to initialize a API client.
 	//
@@ -181,3 +187,64 @@ func initEnvironmentFlag(cmd *cobra.Command) {
 	cmd.PersistentFlags().MarkDeprecated("environment", "use --target flag instead")
 	cmd.RegisterFlagCompletionFunc("environment", targetCompletion)
 }
+
+func checkVariablesInAuthFields(b *bundle.Bundle) diag.Diagnostics {
+	authFields := []string{
+		// Generic attributes.
+		"host",
+		"profile",
+		"auth_type",
+		"metadata_service_url",
+
+		// OAuth specific attributes.
+		"client_id",
+
+		// Google specific attributes.
+		"google_service_account",
+
+		// Azure specific attributes.
+		"azure_resource_id",
+		"azure_use_msi",
+		"azure_client_id",
+		"azure_tenant_id",
+		"azure_environment",
+		"azure_login_app_id",
+	}
+
+	diags := diag.Diagnostics{}
+
+	for _, fieldName := range authFields {
+		p := dyn.NewPath(dyn.Key("workspace"), dyn.Key(fieldName))
+		v, err := dyn.GetByPath(b.Config.Value(), p)
+		if dyn.IsNoSuchKeyError(err) {
+			continue
+		}
+		if err != nil {
+			return diag.FromErr(err)
+		}
+
+		vv, ok := v.AsString()
+		if !ok {
+			continue
+		}
+
+		// Check if the field contains interpolation.
+		if dynvar.ContainsVariableReference(vv) {
+			envVar, ok := auth.GetEnvFor(fieldName)
+			if !ok {
+				continue
+			}
+
+			diags = append(diags, diag.Diagnostic{
+				Severity: diag.Warning,
+				Summary:  "Variable interpolation is not supported for fields that configure authentication",
+				Detail: fmt.Sprintf(`Interpolation is not supported for the field %s. Please set
+the %s environment variable if you wish to configure this field at runtime.`, p.String(), envVar),
+				Locations: v.Locations(),
+				Paths:     []dyn.Path{p},
+			})
+		}
+	}
+
+	return diags
+}