Checking permissions for using Kubernetes/OpenShift components fails for regular users

[amisevsk]

Description

When verifying RBAC for Kubernetes components in a DevWorkspace, DWO checks whether the user is able to work with this object in the current namespace. To avoid multiple SAR tests per request, the webhook server checks that the user can * the relevant resource, equivalent to

oc auth can-i '*' <resource> -n <namespace>

However, even if the user has admin privileges, granting all individual verbs for the resource, the SAR request appears to check if the user explictly has * permissions, causing the check to fail.

How To Reproduce

1. Create a regular user in an OpenShift cluster and create a namespace for testing
2. (optional) Verify the user can use all verbs on pods:

   for verb in create delete deletecollection get list patch update watch; do oc auth can-i $verb pods -n $NAMESPACE; done
   

3. (optional) Verify the user cannot * pods:

   oc auth can-i '*' pods -n $NAMESPACE
   

4. Create a DevWorkspace that has a pod component

Expected behavior

Check should be improved to avoid this issue.

Additional context