What comes in the box
-
One CLI utility for the whole workspace
A single executable registers resource types covering Unity Catalog, clusters and policies, users, groups and service principals, secrets, SQL warehouses and workspace settings. Nothing else to install per resource.
-
Declarative and idempotent
Describe the end state, not the steps. Applying the same configuration twice changes nothing the second time, and an instance marked
_exist: falseis removed — creation and deletion in one document. -
Preview before you apply
Every resource implements what-if. Add
-wtodsc config setand you get the exact state the apply would produce, plus the list of properties that would change, without touching the workspace. -
Export what already exists
Point it at a workspace that was built by hand and get a configuration-shaped inventory back. Useful for auditing live state, and a head start on the document you actually want to keep in source control.
-
Authentication that just works
Credentials come straight from the Databricks SDK for Go: environment variables,
.databrickscfgprofiles, Microsoft Entra service principals. No bespoke auth to configure, and no secrets in your documents. -
Open Source and MIT licensed
Sources, build and releases are public. Read the code, build it yourself, vendor it, fork it — the MIT license asks only that the notice travels with it.
More than a set of commands
dsc config set -f secrets.dsc.yaml
$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
resources:
- name: platform scope
type: LibreDsc.Databricks/SecretScope
properties:
scope: platform
- name: storage key
type: LibreDsc.Databricks/Secret
dependsOn:
- "[resourceId('LibreDsc.Databricks/SecretScope','platform scope')]"
properties:
scope: platform
key: storage-account-key
string_value: s3cr3tConfiguration documents, not scripts
Declare a whole slice of the workspace in one document. The engine works out the order from dependsOn, applies each resource, and reports what changed — so the document, not a runbook, is the source of truth.
Resources compose across boundaries: a storage credential backs an external location, which backs a catalog, which holds schemas and volumes.
dsc config set -w -f catalog.dsc.yaml
metadata:
Microsoft.DSC:
executionType: whatIf
results:
- name: engineering catalog
result:
beforeState:
name: engineering
_exist: false
afterState:
name: engineering
comment: Engineering data
_exist: true
changedProperties:
- commentWhat-if, on every resource
executionType: whatIf is your proof that nothing moved. The prediction has the same shape as a real apply, so the diff you review is the diff you get.
Predictions are computed by the resource itself, not guessed from the schema: server-computed values stay empty for instances that would be created, and read-only fields carry over for instances that would be updated.
dsc resource export -r LibreDsc.Databricks/Cluster
resources:
- name: LibreDsc.Databricks/Cluster-0
type: LibreDsc.Databricks/Cluster
properties:
cluster_id: 0729-101122-abcdefgh
cluster_name: etl-nightly
spark_version: 19.x-scala2.13
state: TERMINATED
_exist: trueStart from the workspace you have
Most workspaces were not built declaratively. Export turns what is already there into resource states you can read, diff and commit — an inventory today, a configuration tomorrow.
Read-only properties are included and clearly marked, so you know what to strip before replaying a document into another workspace.
Covers the whole workspace
Governance, compute, identity and configuration are all one document away. Every resource type carries the same contract of get, set, test, delete, export and what-if, so a workspace behaves the same whichever corner of it you are managing.
Contribute
dsc-databricks is built in the open under the MIT license. Issues, resource requests and pull requests are all welcome — adding a resource is a well-trodden path, and the contributing guide walks through it.
Missing a resource you need? Open an issue.