asb_last_operation fails without special permissions

[jmrodri]

While trying to test sbcli using APBs in OpenShift online, we don't seem to have permissions to update the pod label. The last operation should do one of the following:

1. if it gets an error, log it but go into degraded mode and no longer update the status
2. allow a parameter to disable it that I can pass to the apbs so I can tell it never to do that

[jmrodri]

@maleck13 @shawn-hurley thoughts?

[jmrodri]

TASK [postgresql-apb : Update last operation] **********************************                                                            
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Error attempting to update pod with last operation annotation: (403)\nReason: Forbidden\nHTTP response headers: HTTPHeaderDict({'Date': 'Thu, 24 May 2018 15:09:11 GMT', 'Content-Length': '369', 'Content-Type': 'application/json', 'Cache-Control': 'no-store'})\nHTTP response body: {\n  \"kind\": \"Status\",\n  \"apiVersion\": \"v1\",\n  \"metadata\": {},\n  \"status\": \"Failure\",\n  \"message\": \"pods \\\"bundle-7b12b4e7-fca7-4fe4-94c0-ade0d0825a0b\\\" is forbidden: unable to validate against any security context constraint: []\",\n  \"reason\": \"Forbidden\",\n  \"details\": {\n    \"name\": \"bundle-7b12b4e7-fca7-4fe4-94c0-ade0d0825a0b\",\n    \"kind\": \"pods\"\n  },\n  \"code\": 403\n}\n"}
PLAY RECAP *********************************************************************                                                            

[jmrodri]

@djzager mentioned we could disable it with the in_cluster=false option
https://github.com/ansibleplaybookbundle/postgresql-apb/blob/master/tasks/main.yml#L6

[djzager]

I've seen this same thing before with travis https://travis-ci.org/ansibleplaybookbundle/hello-world-apb/jobs/365688175#L733. It's only against OpenShift 3.9, you can see the OpenShift 3.10 variant of the same test has no issues.

[maleck13]

disabling seems reasonable. Prob should log something when it called and it is disabled to give the developer information as to why he is not seeing any updates.
For OpenShift Online the scc must not allow updates to the pod? or is it the edit role has been limited

[jmrodri]

@maleck13 we're going to investigate to make sure we gave the correct permissions, we might have also missed something :)