Select single permissions level per principal

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/databricks.yml.tmpl

@@ -0,0 +1,12 @@
+# https://github.com/databricks/cli/issues/3864
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+targets:
+  green:
+    resources:
+      jobs:
+        interim_gold_layer_job:
+          permissions:
+          - service_principal_name: $CURRENT_USER_NAME
+            level: CAN_MANAGE_RUN

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.deploy.requests.json

@@ -0,0 +1,29 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Untitled",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "service_principal_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.direct.json

@@ -0,0 +1,7 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [NUMID]
+  }
+}

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.terraform.json

@@ -0,0 +1,19 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [NUMID]
+  }
+}

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.direct.txt

@@ -0,0 +1,63 @@
+{
+  "plan": {
+    "resources.jobs.interim_gold_layer_job": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "job_id": [NUMID],
+        "run_as_user_name": "[USERNAME]",
+        "settings": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "email_notifications": {},
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Untitled",
+          "queue": {
+            "enabled": true
+          },
+          "timeout_seconds": 0,
+          "webhook_notifications": {}
+        }
+      },
+      "changes": {
+        "remote": {
+          "email_notifications": {
+            "action": "skip",
+            "reason": "server_side_default"
+          },
+          "timeout_seconds": {
+            "action": "skip",
+            "reason": "server_side_default"
+          },
+          "webhook_notifications": {
+            "action": "skip",
+            "reason": "server_side_default"
+          }
+        }
+      }
+    },
+    "resources.jobs.interim_gold_layer_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.interim_gold_layer_job",
+          "label": "${resources.jobs.interim_gold_layer_job.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/jobs/[NUMID]",
+        "permissions": [
+          {
+            "permission_level": "IS_OWNER",
+            "service_principal_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.terraform.txt

@@ -0,0 +1,7 @@
+{
+  "plan": {
+    "resources.jobs.interim_gold_layer_job": {
+      "action": "skip"
+    }
+  }
+}

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/output.txt

@@ -0,0 +1,42 @@
+
+>>> [CLI] bundle validate -t green -o json
+{
+  "jobs": {
+    "interim_gold_layer_job": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Untitled",
+      "permissions": [
+        {
+          "level": "IS_OWNER",
+          "service_principal_name": "[USERNAME]"
+        }
+      ],
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+}
+
+>>> errcode [CLI] bundle deploy -t green
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] bundle debug plan -t green
+
+>>> errcode [CLI] bundle destroy -t green --auto-approve
+The following resources will be deleted:
+  delete job interim_gold_layer_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/script

@@ -0,0 +1,11 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate -t green -o json | jq .resources
+trace errcode $CLI bundle deploy -t green
+print_requests.py //jobs &> out.deploy.requests.json
+
+# check plan to ensure there is not drift
+trace $CLI bundle debug plan -t green > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+
+trace errcode $CLI bundle destroy -t green --auto-approve
+print_requests.py //jobs &> out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json

acceptance/bundle/resources/permissions/jobs/current_can_manage_run/test.toml

@@ -0,0 +1,6 @@
+Local = true
+Cloud = true
+IsServicePrincipal = true
+
+# On GCP, service principals do not follow UUID which results them being treated as user_name, resulting in different output
+CloudEnvs.gcp = false

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/databricks.yml.tmpl

@@ -0,0 +1,12 @@
+# https://github.com/databricks/cli/issues/3864
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+targets:
+  green:
+    resources:
+      jobs:
+        interim_gold_layer_job:
+          permissions:
+          - user_name: runmanager@example.com
+            level: CAN_MANAGE_RUN

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.deploy.requests.json

@@ -0,0 +1,33 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Untitled",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE_RUN",
+        "user_name": "runmanager@example.com"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.direct.json

@@ -0,0 +1,7 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [NUMID]
+  }
+}

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.terraform.json

@@ -0,0 +1,19 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [NUMID]
+  }
+}

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/output.txt

@@ -0,0 +1,44 @@
+
+>>> [CLI] bundle validate -t green -o json
+{
+  "jobs": {
+    "interim_gold_layer_job": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Untitled",
+      "permissions": [
+        {
+          "level": "CAN_MANAGE_RUN",
+          "user_name": "runmanager@example.com"
+        },
+        {
+          "level": "IS_OWNER",
+          "user_name": "[USERNAME]"
+        }
+      ],
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+}
+
+>>> errcode [CLI] bundle deploy -t green
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> errcode [CLI] bundle destroy -t green --auto-approve
+The following resources will be deleted:
+  delete job interim_gold_layer_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/script

@@ -0,0 +1,8 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate -t green -o json | jq .resources
+trace errcode $CLI bundle deploy -t green
+print_requests.py //jobs &> out.deploy.requests.json
+
+trace errcode $CLI bundle destroy -t green --auto-approve
+print_requests.py //jobs &> out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json

acceptance/bundle/resources/permissions/jobs/other_can_manage_run/test.toml

@@ -0,0 +1 @@
+Local = true