Automatically fall back to client-side preview if server-side preview…

… fails

Server-side apply previews currently require "patch" permission to run. For cases where the user doesn't have permission to perform a "patch" operation, attempt a graceful fallback to Client-side preview. The Client-side preview may not be 100% accurate, but is preferable to failing with a permission error.

CHANGELOG.md

@@ -10,6 +10,8 @@ Breaking changes:
 
 ## Unreleased
 
+- Automatically fall back to client-side preview if server-side preview fails (https://github.com/pulumi/pulumi-kubernetes/pull/2419)
+
 ## 3.28.0 (May 19, 2023)
 
 Breaking changes:

provider/pkg/provider/provider.go

@@ -2280,7 +2280,7 @@ func (k *kubeProvider) Update(
 	// Apply update.
 	initialized, awaitErr := await.Update(config)
 	if awaitErr != nil {
-		if req.GetPreview() && k.isDryRunDisabledError(err) {
+		if req.GetPreview() && apierrors.IsForbidden(awaitErr) {
 			logger.V(9).Infof("could not preview Update(%v): %v", urn, err)
 			return &pulumirpc.UpdateResponse{Properties: req.News}, nil
 		}
@@ -2732,6 +2732,11 @@ func (k *kubeProvider) tryServerSidePatch(
 		return ssPatch, ssPatchBase, true, nil
 	}
 
+	if apierrors.IsForbidden(err) {
+		// If the user doesn't have permission to run a Server-side preview, compute the patch using inputs
+		logger.V(1).Infof("unable to compute Server-side patch: %s", err)
+		return nil, nil, false, nil
+	}
 	if k.isDryRunDisabledError(err) {
 		return nil, nil, false, err
 	}