Skip to content

feat: implement dremio access control lists (ACL) - #1838

Open
dtext wants to merge 1 commit into
stackitcloud:mainfrom
dtext:main
Open

dtext wants to merge 1 commit into
stackitcloud:mainfrom
dtext:main

Conversation

@dtext

@dtext dtext commented Oct 19, 2026 •

Copy link
Copy Markdown

Description

  • Update dremio to allow configuring ACLs

Checklist

  • Code format was applied: make fmt
  • Examples were added / adjusted (see examples/ directory)
  • Docs are up-to-date: make generate-docs (will be checked by CI)
  • Unit tests got implemented or updated
  • Acceptance tests got implemented or updated (see e.g. here)
  • Unit tests are passing: make test (will be checked by CI)
  • No linter issues: make lint (will be checked by CI)

@dtext
dtext force-pushed the main branch 3 times, most recently from df6d413 to fb38288 Compare October 20, 2026 09:20
@dtext
dtext marked this pull request as ready for review October 20, 2026 12:27
@dtext
dtext requested a review from a team as a code owner October 20, 2026 12:27
Comment thread stackit/internal/services/dremio/instance/resource.go Outdated
Comment on lines +79 to +80
Acl: types.ListValueMust(types.StringType, []attr.Value{types.StringValue("0.0.0.0/0")}),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we claim to support ipv6, should we also add a test for that?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd argue probably not here because they're just strings as well. The only thing preventing this from being compatible with ipv6 would be if validate.CIDR() didn't pass for IPv6 CIDRs, but they're just using net.ParseCIDR() which documents IPv6 compatibility.

@Fyusel Fyusel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some feedback right now, still in progress

Comment thread stackit/internal/services/dremio/instance/datasource.go Outdated
Comment thread examples/resources/stackit_dremio_instance/resource.tf
if diags.HasError() {
return fmt.Errorf("failed to parse acl")
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about the order of the Acl list?
There are a lot of services present with this problem.
E.g. Acl in terraform config: "0.0.0.0, 1.1.1.1"

Response returns: "1.1.1.1, 0.0.0.0" -> state drift for terraform.

There is a utils function for this: utils.ReconcileStringSlices

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additionally I see a state drift right now, when removing the ACL from an existing terraform config.

  1. Create a dremio instance with acl "0.0.0.0" via terraform apply
  2. Remove the ACL completely and run terraform apply

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me know if this is correct 🙂

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants