auth: bound per-profile validation with a 10s timeout#5928
Merged
Conversation
`databricks auth profiles` validates each profile with a live API call (Workspaces.List or CurrentUser.Me). The SDK retries transient network failures — connection refused, connect/TLS timeout, retriable 5xx — for its default RetryTimeoutSeconds (~5 minutes), so a single unreachable workspace stalls the entire listing. (Hosts that fail DNS are not retriable and already fail fast; those never stalled.) Bound each validation with a 10s context timeout, and set the same value on HTTPTimeoutSeconds/RetryTimeoutSeconds so the host-metadata fetch in EnsureResolved is bounded too — it runs on context.Background internally, so the context.WithTimeout on the validation call cannot reach it. Adds a regression test that points a profile at a server which hangs until the client cancels and asserts Load returns bounded rather than retrying to the SDK default. profileValidationTimeout is a var so the test can shrink it. Co-authored-by: Isaac
janniklasrose
temporarily deployed
to
test-trigger-is
July 15, 2026 08:08 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
janniklasrose
temporarily deployed
to
test-trigger-is
July 15, 2026 08:08 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
janniklasrose
changed the title
janniklasrose
temporarily deployed
to
test-trigger-is
July 15, 2026 11:25 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
janniklasrose
temporarily deployed
to
test-trigger-is
July 15, 2026 11:25 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
andrewnester
approved these changes
Jul 21, 2026
janniklasrose
enabled auto-merge
July 21, 2026 10:21
Collaborator
Integration test reportCommit: d202457
10 interesting tests: 4 RECOVERED, 4 SKIP, 2 flaky
|
pietern
reviewed
Jul 21, 2026
| @@ -0,0 +1 @@ | |||
| * `databricks auth profiles` no longer stalls on an unreachable workspace. Each profile is now validated with a 10s timeout (also applied to the host-metadata fetch in `EnsureResolved`), so a host the SDK would otherwise retry — connection refused, connect/TLS timeout, or a retriable 5xx — can't block the whole listing for the SDK's default ~5-minute retry budget. | |||
Contributor
There was a problem hiding this comment.
Nit: outdated changelog with 5s change.
yansonggao-db
pushed a commit
to yansonggao-db/cli
that referenced
this pull request
Jul 21, 2026
databricks#5928 follow-up - forgot PR link - AI text too verbose
deco-sdk-tagging Bot
added a commit
that referenced
this pull request
Jul 22, 2026
## Release v1.9.0 ### CLI * `databricks auth profiles` no longer stalls on an unreachable workspace and instead fails validation after 5 seconds per host ([#5928](#5928)). * Fixed `databricks fs rm -r` failing on UC Volumes backed by GCS when a directory becomes empty during recursive deletion ([#5958](#5958)). * You can now ask questions about your data directly from the CLI with `databricks genie ask "..."`. Genie answers natural-language questions ("what were total sales last month?", "which tables are in the sales catalog?"), runs the query inside Databricks, and renders the answer in the terminal. This promotes the former `databricks experimental genie ask` command; the experimental alias still works but is deprecated and will be removed in a future release ([#6010](#6010)). ### Bundles * `bundle validate` now reports a clear error when a `sql_warehouse` is missing a `name` (including whitespace-only names), and a warning when a grant is missing a `principal` ([#5818](#5818)). * Bundle templates now scaffold an `AGENTS.md` that points coding agents at Databricks AI Tools, alongside a minimal `CLAUDE.md` that includes it via `@AGENTS.md` ([#5996](#5996)). * `bundle generate job` can now download workspace files referenced by `spark_python_task`, rewriting them to a relative path like it already does for notebooks. This is opt-in via the `--download-spark-python-files` flag ([#5799](#5799)). * Simplified the `default-minimal` bundle template and added an alias `databricks bundle init empty` ([#5899](#5899)). * Add support for the `instance_pools` resource type in Declarative Automation Bundles. Instance pools are only supported in direct deployment mode. * Do not emit "unknown field" warnings for YAML anchors grouped in a list or map, matching the existing suppression for standalone anchors ([#5975](#5975)). * Provide an actionable error message if databricks.yml is missing or DATABRICKS_BUNDLE_ROOT is invalid ([#5953](#5953)). ### Dependency Updates * Bump `github.com/databricks/databricks-sdk-go` from v0.154.0 to v0.160.0 ([#5982](#5982)). * Bump Terraform provider from v1.121.0 to v1.122.0 ([#5977](#5977)).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Bound each per-profile validation in
databricks auth profileswith a 10s timeout.auth profilesvalidates every profile with a live API call (Workspaces.Listfor account configs,CurrentUser.Mefor workspace configs). The SDK retries transient network failures — connection refused, connect/TLS timeout, retriable 5xx — for its defaultRetryTimeoutSeconds(~5 minutes). So a single unreachable-but-retriable workspace stalls the entire listing for minutes.context.WithTimeout(ctx, 10s).cfg.HTTPTimeoutSeconds/cfg.RetryTimeoutSeconds, because the host-metadata fetch inEnsureResolvedruns oncontext.Backgroundinternally and so can't be reached by the validation call's context — without these it would still retry for ~5 minutes.Hosts that fail DNS (e.g. a typo'd or reserved hostname) are not retriable and already fail fast; this only bounds the retriable cases.
Why
Users with a decommissioned, firewalled, or otherwise unresponsive workspace in
~/.databrickscfgseeauth profileshang for minutes on that one entry, blocking the whole list. Bounding each validation keeps the command responsive.Tests
TestProfileLoadTimesOutOnUnresponsiveHost(cmd/auth/profiles_test.go) — points a profile at anhttptestserver that hangs every request until the client cancels, and assertsLoadreturns bounded rather than retrying to the SDK default. The handler waits on the request context soserver.Closedoesn't block on a leaked connection.profileValidationTimeoutis avarso the test shrinks it (kept ≥1s, sinceLoadderives the SDK's integer-second budgets from it and a sub-second value floors to 0 = "use default").cmd/authpackage and./task lint-qpass.This pull request and its description were written by Isaac, an AI coding agent.