Revert "limit forbidden error to details of what was forbidden"

[sambdavidson]

Reverts changes from #67617.

The main justification for the original change (#67617) was the confusing "Unknown user" authorizer response returned by the GKE authorizor when an authorize request is made with a non-Google/GCP service account identity. This was leading to confusion. However one big down side in removing the authorizer's reason is users never get constructive feedback on how to fix 403 Forbidden issues, e.g. "Required permission container.pods.get" for the GKE authorizer.

Recently the GKE "Unknown user" error has been removed which should mitigate user confusion once this PR is submitted. At this point I think returning authorizer _reason_s is valuable and should be re-enabled.

/kind design
/assign liggitt

NONE

[k8s-ci-robot]

@samdamana: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fejta]

Consider creating a test/integration/OWNERS and/or test/integration/master/OWNERS file so PRs like this are delegated correctly.

/approve
for test changes

[idealhack]

/ok-to-test
/release-note-none

[liggitt]

if we want to revert this, we should also revert the RBAC change from #65906 in the same PR

[sambdavidson]

if we want to revert this, we should also revert the RBAC change from #65906 in the same PR

#65906 just contains some tiny improvements to the reason logic that look like they could stay in. Why do you think it should get reverted as well?

[liggitt]

#65906 just contains some tiny improvements to the reason logic that look like they could stay in. Why do you think it should get reverted as well?

as pointed out in https://github.com/kubernetes/kubernetes/pull/65906/files#r210048853, always echoing "No RBAC policy matched" isn't really an improvement

[sambdavidson]

Yeah makes sense.

Alright I have also reverted #65906 within this PR. :)

[sambdavidson]

/retest

[liggitt]

/approve
/lgtm

[liggitt]

/retest

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fejta, liggitt, samdamana

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/auth/OWNERS [liggitt]
• plugin/pkg/auth/OWNERS [liggitt]
• staging/src/k8s.io/apiserver/OWNERS [liggitt]
• test/OWNERS [fejta,liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment