Repository navigation
knowledge_base: add run_as_service_principal example - #176
Open
andresgarciaf wants to merge 9 commits into
Open
andresgarciaf wants to merge 9 commits into
andresgarciaf wants to merge 9 commits into
Conversation
Dev target runs as the deploying user (mode: development). Prod target uses mode: production, run_as.service_principal_name from a required variable, group-only permissions (CAN_MANAGE deployers, CAN_VIEW viewers), and an explicit workspace.root_path. A serverless whoami job (environment_version 4) prints current_user() and the SDK identity. README (STE) covers SP setup, CI deploy via OAuth M2M, identity model, and run_as edge cases verified against CLI v1.20.0. Closes #13 Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
Cut README from 309 to 59 lines: intro, Prerequisites, Usage (dev, prod, identity check, one identity table), and five Notes. Config is unchanged. Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
- Document that prod deploys only as the service principal (from CI), so root_path resolves to its home folder and one prod copy exists; a deploy by a person creates a separate copy. root_path itself is unchanged. - README: require Databricks CLI v1.20.0 or above, one action per usage step, label the expected output, qualify ownership as IS_OWNER set by the bundle, add the idempotent redeploy / destroy-scope note, and say when the permissions recommendation appears. Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
- Usage: export BUNDLE_VAR_service_principal_application_id once in CI, so prod deploy, run, and destroy all get the required variable. - Notes: one bullet for cloud support (serverless only), no secrets in the bundle, and no job schedule. Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
…undle-examples, live-test findings
- root_path: dev -> /Workspace/bundle-examples/${bundle.name}/${bundle.target}/${workspace.current_user.short_name},
prod -> /Workspace/bundle-examples/${bundle.name}/${bundle.target} (one stable prod copy).
- README Notes from a live deploy/run/destroy test: deployers need
Service Principal: User (Manager is not sufficient); a non-admin
identity cannot take over an existing prod job; output label is now
observed output. Drop the validate recommendation/warning notes.
Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: omnigent <noreply@omnigent.ai>
Remove the root_path folder guidance from databricks.yml comments. root_path values are unchanged. Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
Remove the Notes section. Move the Service Principal: User role into Prerequisites and the CI OAuth M2M and BUNDLE_VAR settings into Usage. Shorten the identity table. Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: omnigent <noreply@omnigent.ai>
Co-authored-by: omnigent <noreply@omnigent.ai>
9 tasks
Author
|
@pietern could you please review this PR? Thank you. |
Co-authored-by: omnigent <noreply@omnigent.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
run_as.CAN_MANAGEfor deployers andCAN_VIEWfor viewers.whoamijob prints the identity that ran it.Testing
databricks bundle validatedatabricks bundle deploydatabricks bundle rundatabricks bundle destroy