Deploy and first scan
The last panel. It starts on entry, with no button to press, and streams every step into one log. That log is the record of what happened, including the exact command for anything that needs a manual step.
Installer, install panel, log mid-run. Several completed steps visible, one in progress, and at least one grant line showing its outcome.
What it does, in order
Render the dashboard
The “Databricks Cost Optimization” dashboard is generated for your chosen catalog and schema, so its queries point at your result tables.
Prepare the run identity
The lakemine-scan service principal is found or created, and you are given the User role
on it. That role is what lets the deploy bind the service principal as the job’s run_as
identity.
Build and upload the compiled wheel
The analysis ships as a sourceless wheel of compiled bytecode. No detection logic is readable in your workspace, and no source is synced there.
Deploy the bundle
The scan job and the dashboard are created under
/Workspace/Applications/lakemine, with run_as bound to the service principal.
Establish the grants
Every grant the run identity needs is verified first, then applied only where it is missing. Each one reports its outcome in the log.
Start the first scan
The first run writes your findings and publishes the dashboard with the service principal’s credentials embedded, which is what lets viewers open it without any grants of their own.
Register the install with the portal
The install is recorded at app.lakemine.ai , where it appears in your install list with its health and last check-in.
How grants are reported
Each grant lands in one of three states, and all three appear in the same log:
| Outcome | What it means | What you do |
|---|---|---|
| Verified | The grant was already in place. | Nothing. |
| Applied | The grant was missing and the installer applied it. | Nothing. |
| Needs a manual step | The installer lacks the authority to apply it, and prints the exact statement prefixed fix:. | Hand the statement to a metastore admin. |
The SELECT on system.* grant is metastore level. Account admin and workspace admin do
not confer it. If the person running the install is not a metastore admin, this is the
one thing that will need handing over, and until it is applied the scheduled scan cannot
read your usage data.
Everything else in the deploy still completes. The job, the dashboard, and the schema are all in place, waiting on the grant.
Installer, install panel, log showing a grant that needs a manual step, with the fix:
line and its exact GRANT statement visible.
When it finishes
The log ends with the first scan started and the install registered. Select Finish to close the installer.
The installer holds no credentials after it closes. The install credential was held for the duration of the deploy and never left your machine.
Your first findings
Open “Databricks Cost Optimization” in your hub workspace’s dashboards.
Databricks Lakeview dashboard, “Databricks Cost Optimization”, Account Overview page, populated with real scan data. Rollup tiles for spend analyzed and estimated savings, cost and savings by workspace, the ranked top-opportunities table, and cost by tag.
Account Overview gives you the rollups: spend analyzed, estimated savings, cost and savings by workspace, the top opportunities ranked by dollar impact, and cost by tag.
Workspace Detail lets you pick one workspace and drill into it.
Databricks Lakeview dashboard, “Databricks Cost Optimization”, Workspace Detail page, with a workspace selected and its findings, cost trend, and per-user cost visible.
If the scan has not finished yet, or your schedule is set to paused, trigger the
lakemine-scan job once by hand to get data immediately.
Checking the install from the portal
app.lakemine.ai shows the install itself: its health, its last check-in, and the aggregated totals the scan reported. Use it to confirm the install is alive and licensed.
It does not hold your findings. Those are in your own workspace and stay there.
Lakemine portal at app.lakemine.ai, Overview page, showing the stat tiles for spend analyzed, estimated savings, DBUs analyzed, and findings, with the usage chart beneath.
If the scan does not produce data
“No subscription key found.” The lakemine secret scope or its key was removed.
Re-run the installer, or use Reconnect to rewrite it without a full redeploy.
Detections skipped and named. A system.* schema is not granted. Apply the GRANT
statement the installer printed, then trigger the job again.
Workspace ids instead of names. system.access is not granted. This is an automatic
fallback, and nothing else is affected.
Cost-only coverage on some workspaces. Those workspaces are outside the hub’s region.
system.billing is global so spend is covered everywhere, but the finer telemetry is
regional. A second install with a hub in that region extends coverage.
The subscription check failed. The scan does not run and no findings are refreshed. Your existing dashboard is left exactly as it was. If the portal was simply unreachable, the last successful answer stands for 7 days.
Re-running the installer
Safe, and expected for upgrades. The service principal is reused, so it keeps the same access, keeps owning the same tables, and keeps answering the dashboard’s queries. Nothing re-points at the new deployer and no viewer loses access, even when a different administrator runs it.