From 7e14c589319118d52c4a6cdc7384203335a18db7 Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Tue, 11 Mar 2025 14:12:33 -0700
Subject: [PATCH] improvement: clarify databricks native integration behavior
 and suggest desingated scope for sync/native integration

---
 docs/integrations/cloud/databricks.mdx                   | 6 ++++++
 docs/integrations/secret-syncs/databricks.mdx            | 2 ++
 docs/mint.json                                           | 3 +--
 .../SecretSyncDestinationFields/DatabricksSyncFields.tsx | 2 ++
 .../DatabricksConfigurePage/DatabricksConfigurePage.tsx  | 9 +++++++--
 5 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/docs/integrations/cloud/databricks.mdx b/docs/integrations/cloud/databricks.mdx
index 7fee3acd3..1971190de 100644
--- a/docs/integrations/cloud/databricks.mdx
+++ b/docs/integrations/cloud/databricks.mdx
@@ -7,6 +7,12 @@ Prerequisites:
 
 - Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
 
+<Note>
+    When integrating with Databricks, Infisical is intended to be the source of truth for the secrets in the configured Databricks scope.
+
+    Any secrets not present in Infisical will be removed from the specified scope. To prevent removal of secrets not managed by Infisical, Infisical recommends creating a designated secret scope for your integration.
+</Note>
+
 <Steps>
   <Step title="Authorize Infisical for Databricks">
     Obtain a Personal Access Token in **User Settings** > **Developer** > **Access Tokens**.
diff --git a/docs/integrations/secret-syncs/databricks.mdx b/docs/integrations/secret-syncs/databricks.mdx
index 8f305ecd6..148542708 100644
--- a/docs/integrations/secret-syncs/databricks.mdx
+++ b/docs/integrations/secret-syncs/databricks.mdx
@@ -34,6 +34,8 @@ description: "Learn how to configure a Databricks Sync for Infisical."
 
             <Note>
                 You must create a secret scope in your Databricks workspace prior to configuration. Ensure your service principal has [Write permissions](https://docs.databricks.com/en/security/auth/access-control/index.html#secret-acls) for the specified secret scope.
+
+                Infisical recommends creating a designated Databricks secret scope for your sync to prevent removal of secrets not managed by Infisical.
             </Note>
 
         5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
diff --git a/docs/mint.json b/docs/mint.json
index f604ff310..bf40a9778 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -644,8 +644,7 @@
             "api-reference/endpoints/oidc-auth/attach",
             "api-reference/endpoints/oidc-auth/retrieve",
             "api-reference/endpoints/oidc-auth/update",
-            "api-reference/endpoints/oidc-auth/revoke",
-            "integrations/frameworks/terraform-cloud"
+            "api-reference/endpoints/oidc-auth/revoke"
           ]
         },
         {
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/DatabricksSyncFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/DatabricksSyncFields.tsx
index c6cfff0e5..533d0d2cf 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/DatabricksSyncFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/DatabricksSyncFields.tsx
@@ -40,6 +40,8 @@ export const DatabricksSyncFields = () => {
             isError={Boolean(error)}
             errorText={error?.message}
             label="Secret Scope"
+            tooltipClassName="max-w-md"
+            tooltipText="Infisical recommends creating a designated Databricks secret scope for your sync to prevent removal of secrets not managed by Infisical."
             helperText={
               <Tooltip
                 className="max-w-md"
diff --git a/frontend/src/pages/secret-manager/integrations/DatabricksConfigurePage/DatabricksConfigurePage.tsx b/frontend/src/pages/secret-manager/integrations/DatabricksConfigurePage/DatabricksConfigurePage.tsx
index 69538a318..79a49725d 100644
--- a/frontend/src/pages/secret-manager/integrations/DatabricksConfigurePage/DatabricksConfigurePage.tsx
+++ b/frontend/src/pages/secret-manager/integrations/DatabricksConfigurePage/DatabricksConfigurePage.tsx
@@ -206,8 +206,13 @@ export const DatabricksConfigurePage = () => {
           <span className="text-md ml-3 text-mineshaft-100">Pro Tip</span>
         </div>
         <span className="mt-4 text-sm text-mineshaft-300">
-          After creating an integration, your secrets will start syncing immediately. This might
-          cause an unexpected override of current secrets in Databricks with secrets from Infisical.
+          When integrating with Databricks, Infisical is intended to be the source of truth for the
+          secrets in the configured Databricks scope.
+        </span>
+        <span className="mt-4 text-sm text-mineshaft-300">
+          Any secrets not present in Infisical will be removed from the specified scope. To prevent
+          removal of secrets not managed by Infisical, Infisical recommends creating a designated
+          secret scope for your integration.
         </span>
       </div>
     </div>