[k8s] Special case project creation so that it is possible

[fabianvf]

SUMMARY

Automatically translates Projects to ProjectRequests if the user isn't permissioned enough to make Projects. This basically makes project creation for low-permissioned users the same as running oc new-project. This again makes it possible to create projects from Ansible with < admin permissions on the cluster.

Fixes #42116

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

k8s

ADDITIONAL INFORMATION

This should be backported to 2.6

[fabianvf]

@maxamillion

[ansibot]

The test ansible-test sanity --test pep8 [explain] failed with 1 error:

lib/ansible/module_utils/k8s/raw.py:125:29: E127 continuation line over-indented for visual indent

click here for bot help

[fabianvf]

cc @chouseknecht @flaper87

[maxamillion]

rebuild_merge

[maxamillion]

@fabianvf does this need to be backported to 2.6?

[fabianvf]

@maxamillion yeah, you can't make projects in 2.6 right now without cluster-level admin permissions

[fabianvf]

@maxamillion can you rekick the build?

[maxamillion]

rebuild_merge

[ansibot]

cc @willthames
click here for bot help

[willthames]

Does the get fail only when the project doesn't exist? Otherwise it will presumably try and recreate the project, returning changed=True even if the project already exists?

[fabianvf]

Projects in OpenShift are different than most resources, since almost no user has permission to create them. There's a fake resource called ProjectRequest that will allow a user to request a project and depending on cluster configuration a project will be provisioned for that user. A ProjectRequest isn't actually created though, so the user won't have permission to get it. The proper way to idempotently handle project creation for unpermissioned users is to check if the project exists and make a ProjectRequest if it doesn't.

[willthames]

Surely the permission error would then happen on project create, not on project get?

Your description of what the process should be sounds reasonable to me, I'm just not convinced that this change is implementing that process - I'd expect the ForbiddenError to be caught after project creation attempt

[fabianvf]

Good point, the forbidden error on get will happen if you create a ProjectRequest but maybe not if you create a Project, I'll check it out and amend the PR tomorrow if necessary.

[fabianvf]

@willthames it looks like the current behavior is correct, when I try to GET a project that I don't have access to I get a Forbidden error

[maxamillion]

rebuild_merge