I've been working on getting release-monitoring.org working in Openshift (on staging) and I've noticed several pain points. I'm not sure if the permissions are intentionally as restrictive as they are, but here are a few things I'd like to be able to do that I can't:

"oc debug " and "oc rsh " - without these debugging is much more difficult

If you mark yourself as "appowner", this should work.
If it doesn't, please tell me the error message you get.

Seeing the logs in the web UI - I can get the logs with "oc logs", but it never loads in the web UI. I'm guessing this is a permission issue, but I don't see any error so I don't know.

This is not permissions related, but rather problematic because that requires http/2.
We are working on that, but that's somewhat difficult due to the architecture.

Creating/editing/deleting deployment configs, build configs, etc. I can add these with the Ansible playbook, but when I'm experimenting it's painful to check something into ansible, run the playbook, revert/add a new commit, repeat. Also, it's tough to get the YAML "just right" so OpenShift likes it and I'd rather make OpenShift generate it itself.

We explicitly decided to not allow this on either staging or prod since everything there needs to be setup via ansible.

If you mark yourself as "appowner", this should work.
If it doesn't, please tell me the error message you get.

In the playbook? For release-monitoring.org I am, but I get:

$ oc debug release-monitoring-web-9-81p0v
Debugging with pod/release-monitoring-web-9-81p0v-debug, original command: /bin/sh -c python3-gunicorn --bind 0.0.0.0:8080 --access-logfile=- anitya.wsgi:application
Waiting for pod to start ...
Pod IP: 10.128.1.177
If you don't see a command prompt, try pressing enter.
Removing debug pod ...
Error from server (Forbidden): User "jcline" cannot create pods/attach in project "release-monitoring"
$ oc rsh release-monitoring-web-9-81p0v
Error from server (BadRequest): Upgrade request required

We explicitly decided to not allow this on either staging or prod since everything there needs to be setup via ansible.

What I have to do instead is roll my own OpenShift locally (making sure I have the same version), create the the project, export it, and then import to Fedora's OpenShift by way of Ansible. I feel like this is a really weird workflow. Maybe we can re-visit this decision?

We explicitly decided to not allow this on either staging or prod since everything there needs to be setup via ansible.

IMO a more practical way to do things is to allow interactive edits (particularly in stage!), just don't allow them to persist for too long. There's probably tools for this.

Any chance I can get the permission issues for debugging ("oc rsh" and "oc debug") fixed? I'm blocked on getting release-monitor.org deployed.

The debug permissions are granted on staging, just make sure to use the correct oc login os-master01.stg.phx2.fedoraproject.org --token=..... to make sure it bypasses the proxies.