[k8s] Can't create Projects with low-permissioned users

[fabianvf]

SUMMARY

Users can create projects using the oc new-project command, which creates a ProjectRequest object. The old Ansible module (openshift_raw) would automatically translate Project creation into ProjectRequest creation.

Even if you specify the ProjectRequest instead of Project kind, the request will still fail because the get will 403 (the user is not allowed to get a specific ProjectRequest).

ISSUE TYPE

• Bug Report

COMPONENT NAME

k8s

ANSIBLE VERSION

ansible 2.6.0
  config file = /home/fabian/tmp/reproducer/forklift/containers/ansible.cfg
  configured module search path = [u'/home/fabian/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/fabian/Envs/system/lib/python2.7/site-packages/ansible
  executable location = /home/fabian/Envs/system/bin/ansible
  python version = 2.7.15 (default, May 15 2018, 15:37:31) [GCC 7.3.1 20180303 (Red Hat 7.3.1-5)]

`##### CONFIGURATION

ANSIBLE_NOCOWS(env: ANSIBLE_NOCOWS) = True
DEFAULT_HOST_LIST(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = [u'/home/fabian/tmp/reproducer/forklift/inventories']
DEFAULT_ROLES_PATH(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = [u'/home/fabian/tmp/reproducer/forklift/containers/deploy', u'/home/fabian/tmp/reproducer/forklift/roles']
DEFAULT_STDOUT_CALLBACK(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = debug
DEFAULT_VERBOSITY(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = 1
HOST_KEY_CHECKING(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = False
RETRY_FILES_ENABLED(/home/fabian/tmp/reproducer/forklift/containers/ansible.cfg) = False

OS / ENVIRONMENT

`
fedora 27
OpenShift 3.10

STEPS TO REPRODUCE

---
- hosts: localhost
  tasks:
  - name: project foreman
    k8s:
      state: present
      definition:
        apiVersion: project.openshift.io/v1
        kind: Project
        metadata:
          name: test

EXPECTED RESULTS

Project creation success

ACTUAL RESULTS

403 failure

PLAY [localhost] *************************************************************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [project foreman] *******************************************************************************************************************************************************************************************************************************************************************
fatal: [localhost]: FAILED! => {
    "changed": false, 
    "error": 403, 
    "reason": "Forbidden", 
    "status": 403
}

MSG:

Failed to retrieve requested object: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"projects.project.openshift.io \"test\" is forbidden: User \"developer\" cannot get projects.project.openshift.io in the namespace \"test\": User \"developer\" cannot get project \"test\"","reason":"Forbidden","details":{"name":"test","group":"project.openshift.io","kind":"projects"},"code":403}



PLAY RECAP *******************************************************************************************************************************************************************************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=1   

[ansibot]

Files identified in the description:

• lib/ansible/modules/clustering/k8s/k8s.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @chouseknecht @flaper87 @maxamillion
click here for bot help

[ansibot]

cc @willthames
click here for bot help