[draft] Allow resource permissions to override target defaults

.nextchanges/bundles/7291.md

@@ -0,0 +1 @@
+* Allow resource permissions to override target-wide permissions without overlap warnings for all supported resources and principal types. ([#7291](https://github.com/databricks/cli/pull/7291))

acceptance/bundle/validate/permissions_overlap/output.txt

@@ -42,3 +42,27 @@ See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more
     }
   ]
 }
+
+>>> [CLI] bundle validate --strict
+Warning: 'jobs' already has permissions set for 'overlap@example.com' user name
+
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning and 1 recommendation
+Error: 1 warning was found. Warnings are treated as errors in strict mode

acceptance/bundle/validate/permissions_overlap/script

@@ -1 +1,3 @@
 $CLI bundle validate -o json | jq '.resources.jobs | map_values(.permissions)'
+
+musterr trace $CLI bundle validate --strict

acceptance/bundle/validate/permissions_target/databricks.yml

@@ -0,0 +1,44 @@
+bundle:
+  name: permissions-target
+
+variables:
+  group:
+    default: developers
+  acl:
+    type: complex
+    default: &target_permissions
+      - {group_name: "${var.group}", level: CAN_VIEW}
+      - {user_name: reader@example.test, level: CAN_VIEW}
+      - {service_principal_name: reader-sp, level: CAN_VIEW}
+      - {group_name: inherited, level: CAN_VIEW,}
+
+resources:
+  jobs:
+    root_job: &job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/notebook
+            source: WORKSPACE
+      permissions:
+        - {group_name: "${var.group}", level: CAN_MANAGE_RUN}
+        - {user_name: reader@example.test, level: CAN_MANAGE_RUN}
+        - {service_principal_name: reader-sp, level: CAN_MANAGE_RUN}
+  pipelines:
+    root_pipeline: &pipeline
+      permissions:
+        - {group_name: "${var.group}", level: CAN_RUN}
+        - {user_name: reader@example.test, level: CAN_RUN}
+        - {service_principal_name: reader-sp, level: CAN_RUN,}
+
+targets:
+  literal:
+    permissions: *target_permissions
+    resources: &target_resources
+      jobs:
+        target_job: *job
+      pipelines:
+        target_pipeline: *pipeline
+  complex:
+    permissions: ${var.acl}
+    resources: *target_resources

acceptance/bundle/validate/permissions_target/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/validate/permissions_target/output.txt

@@ -0,0 +1,216 @@
+
+>>> [CLI] bundle validate --strict -t literal -o json
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:9:14
+
+{
+  "jobs": {
+    "root_job": [
+      {
+        "group_name": "developers",
+        "level": "CAN_MANAGE_RUN"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ],
+    "target_job": [
+      {
+        "group_name": "developers",
+        "level": "CAN_MANAGE_RUN"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  },
+  "pipelines": {
+    "root_pipeline": [
+      {
+        "group_name": "developers",
+        "level": "CAN_RUN"
+      },
+      {
+        "level": "CAN_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ],
+    "target_pipeline": [
+      {
+        "group_name": "developers",
+        "level": "CAN_RUN"
+      },
+      {
+        "level": "CAN_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle validate --strict -t complex -o json
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:43:18
+
+{
+  "jobs": {
+    "root_job": [
+      {
+        "group_name": "developers",
+        "level": "CAN_MANAGE_RUN"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ],
+    "target_job": [
+      {
+        "group_name": "developers",
+        "level": "CAN_MANAGE_RUN"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_MANAGE_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  },
+  "pipelines": {
+    "root_pipeline": [
+      {
+        "group_name": "developers",
+        "level": "CAN_RUN"
+      },
+      {
+        "level": "CAN_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ],
+    "target_pipeline": [
+      {
+        "group_name": "developers",
+        "level": "CAN_RUN"
+      },
+      {
+        "level": "CAN_RUN",
+        "user_name": "reader@example.test"
+      },
+      {
+        "level": "CAN_RUN",
+        "service_principal_name": "reader-sp"
+      },
+      {
+        "group_name": "inherited",
+        "level": "CAN_VIEW"
+      },
+      {
+        "level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/validate/permissions_target/script

@@ -0,0 +1,4 @@
+for target in literal complex; do
+    trace $CLI bundle validate --strict -t "$target" -o json > config.$target.json
+    jq '.resources | map_values(map_values(.permissions))' config.$target.json
+done

acceptance/bundle/validate/permissions_target/test.toml

@@ -0,0 +1 @@
+Ignore = ["config.literal.json", "config.complex.json"]