data source azurerm_kubernetes_cluster - Bypass reading admin config when encounter 403 error

[lonegunmanb]

As @tombuildsstuff described:

the Data Source should support limited permissions, whereas the Resource requires that we have CRUD permissions (including the ability to List the Admin and User Credentials here).

This patch should solve #21183 by bypass reading cluster admin config when API response 403 error.

[slzmruepp]

Why would you do that? If the Admin config can not be read, the context user is clearly not allowed to read it so the error should be thrown. Otherwise the tf fails when trying to access the cluster anyhow because the authentication was never completed. All subsequent providers like helm, etc using the kubeconfig will fail. This is not good practice. Why don't you implement the solution suggested by @browley86? #21183 (comment) ?
Still the problem is not solved by just ignoring the error. Also the option to read the cluster user config protected by RBAC is not addressed here.

[tombuildsstuff]

hi @lonegunmanb

Unfortunately we need to take a different approach with this PR, as such whilst I'd like to thank you for this contribution, I hope you don't mind but I'm going to close this in favour of #21229 which solves this in a different manner.

Thanks!

[lonegunmanb]

Hi @tombuildsstuff I'm glad that your approach is apparently better than mine. Have a nice day!

@slzmruepp to be honest I didn't quite get @browley86's comment's point. In both resource and data source we call both listClusterUserCredential and listClusterAdminCredential, one for kube_config and one for kube_admin_config. What this deprecated pr tried to do is, set an empty value as data source's kube_admin_config output when the executing account doesn't have permission to read admin config. Since your account is lacking of such permission it won't block you from reading other properties of the cluster, you can still use kube_config if your executing account do have the permission to call listClusterUserCredential API.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.