[AIGTWY-4573] Use a static SP token for the managed integration job - #667
Closed
david-siqi-liu wants to merge 1 commit into
Closed
david-siqi-liu wants to merge 1 commit into
david-siqi-liu wants to merge 1 commit into
Conversation
The managed integration jobs minted a service-principal OAuth token against the managed e2e workspace from the CI runner, which the workspace RBAC-denies (403 "RBAC: access denied") even though the same credentials mint fine from a trusted network. Switch the job to pass a long-lived service-principal token as DATABRICKS_BEARER (as the existing e2e workspace already does), so no token is minted on the runner. Needs an `E2E_ADMIN_BEARER` secret; the `E2E_ADMIN_SP_CLIENT_ID` /`E2E_ADMIN_SP_CLIENT_SECRET` secrets are no longer used by CI. Also surface the token-mint failure detail (status, Server header, body) in run_integration, so any future mint failure names its cause instead of a bare "Forbidden". Co-authored-by: Isaac <no-reply@databricks.com>
david-siqi-liu
force-pushed
the
david/AIGTWY-4573-managed-mint-error
branch
from
September 16, 2026 02:41
b0f7cfb to
4d03220
Compare
david-siqi-liu
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What did you change, and why?
The managed integration jobs (
Managed config · Claude/Codex) minted a service-principal OAuthtoken against the managed e2e workspace from the CI runner. The workspace RBAC-denies that
(
403 RBAC: access denied) even though the identical credentials mint fine from a trusted network,so it is a network-conditional access policy on token issuance, not a code or IP-ACL problem.
Switch the managed job to pass a long-lived service-principal token directly as
DATABRICKS_BEARER(exactly how the existing e2e workspace's bearer already works), so nothing is minted on the runner.
.github/workflows/integration.yml: the managed job now readssecrets.E2E_ADMIN_BEARERinsteadof the client-credential secrets.
scripts/run_integration.py: also surface the mint failure detail (status,Serverheader, body)so any future mint failure names its cause instead of a bare "Forbidden". The runner-side mint path
stays for workspaces that permit it.
Requires a new
E2E_ADMIN_BEARERsecret: a long-lived SP token foreng-ml-agent-platform.staging, generated from a trusted network. TheE2E_ADMIN_SP_CLIENT_IDandE2E_ADMIN_SP_CLIENT_SECRETsecrets become unused by CI.How do you know it works?
Validated by the next
Managed configrun: with the bearer, the job skips the runner-side mint andcalls the workspace directly. If the workspace allows API calls from runners (as the us-east-1 e2e
workspace does), the managed cases run; if the same policy also blocks API calls from runners, the
run now says so clearly via the surfaced error. The managed jobs are non-blocking, so this cannot
gate merges either way.
This pull request and its description were written by Isaac.