Skip to content

[draft] Allow resource permissions to override target defaults - #7291

Open
lennartkats-db wants to merge 3 commits into
mainfrom
factory/dabs/aabd17eaae87
Open

[draft] Allow resource permissions to override target defaults#7291
lennartkats-db wants to merge 3 commits into
mainfrom
factory/dabs/aabd17eaae87

Conversation

@lennartkats-db

@lennartkats-db lennartkats-db commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

Allow explicit resource permissions to override target-wide defaults without overlap warnings for users, groups, and service principals across supported resources. Effective permissions and root-wide overlap warnings remain unchanged.

Record the permission boundary when selecting the target and retain it on Bundle, so complex-variable resolution cannot obscure the origin. Root and its typed conversion remain unchanged.

Why

Issue #7032 reports that layered permissions fail strict validation. The exception should apply consistently across resources and principals, including permissions supplied through complex variables.

Tests

  • All 12 bundle, configuration, and permission test packages pass. Coverage includes literal and complex-list references, absent/null/empty target permissions, resource-wins precedence, and failed target merges. New cases confirm existing same-section duplicates remain warning-free and normalize to the highest level.
  • The full bundle-validation acceptance group passes, including strict success for target defaults and strict failure for root/resource overlap.
  • Bundle and configuration lint passes with zero issues.

@lennartkats-db lennartkats-db added DABs DABs related issues software-factory PR produced by the software factories task labels Nov 2, 2026
@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

✅ Integration test report

Commit: 7cff8d1

Run: 42231969590

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 271 17 3:56
✅​ aws-windows-latest-4core-16gb 273 15 2:43
✅​ azure linux-2core-8gb 270 17 4:09
✅​ azure-windows-latest-4core-16gb 272 15 3:16
✅​ gcp linux-2core-8gb 271 17 4:00
✅​ gcp-windows-latest-4core-16gb 273 15 3:21
Top 3 slowest tests (at least 2 minutes):
duration env testname
3:16 gcp-windows-latest-4core-16gb TestAccept
3:11 azure-windows-latest-4core-16gb TestAccept
2:32 aws-windows-latest-4core-16gb TestAccept

@lennartkats-db lennartkats-db added software-factory PR produced by the software factories task and removed software-factory PR produced by the software factories task labels Nov 3, 2026
@lennartkats-db lennartkats-db changed the title [draft] Fix bundle/config/mutator/resourcemutator/apply_bundle_permissions.go [draft] Allow job permissions to override target group permissions without warnings Nov 4, 2026
@lennartkats-db
lennartkats-db marked this pull request as ready for review November 4, 2026 19:21
@lennartkats-db
lennartkats-db requested review from a team as code owners November 4, 2026 19:21
@lennartkats-db
lennartkats-db marked this pull request as draft November 4, 2026 19:21
@lennartkats-db
lennartkats-db marked this pull request as ready for review November 4, 2026 21:59
@lennartkats-db lennartkats-db changed the title [draft] Allow job permissions to override target group permissions without warnings [draft] Allow resource permissions to override target defaults Nov 6, 2026
@github-actions

github-actions Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Commit: 7cff8d114 | Workflow run

Regression test report

Selected 2 changed tests (limit=20, 0 not selected)

4 tests: regression=2 unreleased=0 coverage=2 failing=0
test branch main (663e1f7) latest (v1.24.0)
TestAccept/bundle/validate/permissions_overlap/DMS= ✅ ✅ ✅
TestAccept/bundle/validate/permissions_overlap/DMS=true ✅ ✅ ✅
TestAccept/bundle/validate/permissions_target/DMS= ✅ ❌ ❌
TestAccept/bundle/validate/permissions_target/DMS=true ✅ ❌ ❌
TestAccept/bundle/validate/permissions_target/DMS=: branch ✅ | main (663e1f7) ❌ | latest (v1.24.0) ❌

main (663e1f7):

acceptance_test.go:1345: Diff:
        --- bundle/validate/permissions_target/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_targetDMS=3762294346/002/output.txt
        @@ -1,113 +1,29 @@
         
         >>> [CLI] bundle validate --strict -t literal -o json
        -Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
        -If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -Consider using a adding a top-level permissions section such as the following:
        +Warning: 'jobs' already has permissions set for 'reader@example.test' user name
         
        -  permissions:
        -    - user_name: [USERNAME]
        -      level: CAN_MANAGE
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
         
        -See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:9:14
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  }
        -}
        +Warning: 'jobs' already has permissions set for 'reader@example.test' user name
         
        ->>> [CLI] bundle validate --strict -t complex -o json
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for 'reader@example.test' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for 'reader@example.test' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -118,99 +29,8 @@
               level: CAN_MANAGE
         
         See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:43:18
        +  in databricks.yml:9:14
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
... (43 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.24.0): same output as main (663e1f7)

TestAccept/bundle/validate/permissions_target/DMS=true: branch ✅ | main (663e1f7) ❌ | latest (v1.24.0) ❌

main (663e1f7):

acceptance_test.go:1345: Diff:
        --- bundle/validate/permissions_target/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_targetDMS=true1953782408/002/output.txt
        @@ -1,113 +1,29 @@
         
         >>> [CLI] bundle validate --strict -t literal -o json
        -Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
        -If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -Consider using a adding a top-level permissions section such as the following:
        +Warning: 'jobs' already has permissions set for 'reader@example.test' user name
         
        -  permissions:
        -    - user_name: [USERNAME]
        -      level: CAN_MANAGE
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
         
        -See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:9:14
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  }
        -}
        +Warning: 'jobs' already has permissions set for 'reader@example.test' user name
         
        ->>> [CLI] bundle validate --strict -t complex -o json
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for 'reader@example.test' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for 'reader@example.test' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -118,99 +29,8 @@
               level: CAN_MANAGE
         
         See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:43:18
        +  in databricks.yml:9:14
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "reader@example.test"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "reader@example.test"
        -      },
... (44 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.24.0): same output as main (663e1f7)

@lennartkats-db lennartkats-db changed the title [draft] Allow resource permissions to override target defaults Allow resource permissions to override target defaults Nov 6, 2026
@lennartkats-db lennartkats-db changed the title Allow resource permissions to override target defaults [draft] Allow resource permissions to override target defaults Nov 6, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renaudhartert-db renaudhartert-db Awaiting requested review from renaudhartert-db renaudhartert-db is a code owner automatically assigned from databricks/eng-deco-cli
@Sankalp-Mittal Sankalp-Mittal Awaiting requested review from Sankalp-Mittal Sankalp-Mittal is a code owner automatically assigned from databricks/eng-deco-dabs

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

DABs DABs related issues software-factory PR produced by the software factories task

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lennartkats-db @eng-dev-ecosystem-bot