RBAC Migration Followup #6: new-project with RBAC?

[enj]

Should project creation use RBAC instead of proxy endpoints?

[enj]

The project creation flow for a normal user is:

1. User submits a project request
2. The server internally creates a set of resources based on a template
3. The template is configurable but by default it creates:
   • A project (namespace)
   • SA role bindings
   • A role binding that gives the requesting user admin rights to the project
4. The server waits up to ~6 seconds for the auth cache to be in sync with the last binding

The creation of these bindings uses the proxied endpoints because they are defined using Origin auth resources instead of the RBAC ones. I believe we can skip the extra indirection in this case since the server should only talk to its own loopback interface (so this should not cause issues during a rolling update).

@deads2k @liggitt do you have any concerns with this?

[liggitt]

is there a reason not to keep it as-is for one release, then switch?

[enj]

is there a reason not to keep it as-is for one release, then switch?

@liggitt just trying to reduce the surface area of the legacy code as much as possible in 3.7 (any performance improvements are negligible IMO). If you feel this adds unnecessary complexity and risk for 3.7, I can move this to the 3.8 milestone.

[deads2k]

is there a reason not to keep it as-is for one release, then switch?

It just defers work we need to do. Is there a reason to keep it as-is? The default is only generated and used locally to the process. The loopback speaks back to itself.

[liggitt]

I don't feel strongly either way.

[simo5]

Sounds like converting is not a big deal here, but we'll need to emit warnings for admins to update their templates when we catch old types